[buro9]

This is just part of signals intelligence.

Once you have a known event, then you can use the information that you know about that to start asking more questions.

Proximity is an obvious one, who was near or in contact with the alleged terrorist in the hours, days, weeks beforehand. Were there recurrences of close proximity amongst those individuals previously not considered persons of interest.

This methodology is precisely the same as how fraud and money laundering risk is mitigated. Once you work back from a KE (known event) to build up the pattern of related activities you can use this as a signature on observed future behaviour to try and identify future activity that you'd like to investigate more closely or act on.