Washington (CNN) -- To understand how the suspect in the botched terror attack was able to board a plane, you have to understand how the counterterrorism system that President Obama says failed is supposed to work.
The president says the clues were there, and that a fuller, clearer picture of 23-year-old Umar Farouk AbdulMutallab would have emerged if all the bits and pieces had been shared and put together.
"The warning signs would have triggered red flags, and the suspect would have never been allowed to board that plane for America," Obama said.
The president has ordered a top-to-bottom investigation of the failed terrorist attack on Christmas Day. The preliminary report is expected Thursday.
One of the key questions is why wasn't the suspect's visa revoked.
The suspect, a Nigerian national, was supposedly on the terrorist watch list. Six weeks ago, his father warned the U.S. Embassy in Nigeria that his son was becoming radicalized and had gone to Yemen.
The father provided the embassy with his son's name, birth date and passport number. That information was sent in a routine, unclassified cable known as a visa VIPER to the National Counterterrorism Center in Washington.
The details in the cable were "insufficient for this interagency review process to make a determination that this individual's visa should be revoked," State department spokesman Ian Kelly said.
In the aftermath of the attempted attack, the State department is directing embassies to include information on whether a person has a U.S. visa when it sends the visa VIPER cables to Washington, a state department official said.
The change was prompted by the preliminary reviews Obama ordered due to him Thursday.
The information the father provided the embassy with was just one of hundreds of reports, and often vague tips, coming in each day. Analysts from the CIA, FBI, Justice Department and other agencies are supposed to evaluate such tips side by side, running them through databases, comparing them with other clues agencies have gathered, and those still coming in. The purpose is to make sure the even seemingly insignificant dots get connected.
The U.S. also had intelligence that between August and October of this year, extremists in Yemen were talking about operations. Someone known as "the Nigerian" was mentioned, and they had a partial name -- Umar Farouk.
"At any point along that chain, people have the responsibility for making sure that they are accurately and fully reporting what they've learned. And then there are going to be some judgments that have to be made about whether and what action ought to be taken, based on the information," said Michael Chertoff, former Homeland Security Secretary under President Bush.
But in this case, with no urgency attached, the father's warning was treated more as a missing-person report. With nothing else alarming coming up, the analysts put the suspect on the Terrorist Identities Datamart Environment (TIDE) list, along with 550,000 other suspicious people.
And that's where the warnings stopped.
To go on to the next step and put someone on a no-fly list or subject them to a secondary screening, there has to be a "reasonable suspicion" of a link to terrorism.
The threshold for taking action is being looked at in the review ordered by the president. The threshold could be made less restrictive to allow a quicker trigger for action such as revoking a visa, according to a source briefed on the review.
There was "not a lack of information collected, but a lack of understanding of what to do with that information," the source said.
Chertoff said that during his time in the job, there was a "very good information-sharing system."
"I think what the current administration is going to be looking at is, was there human failure, either in the initial reporting or in the initial decision about what would be sent up the chain of communication, or in the ultimate determination by the intelligence community about whether this was significant enough to warrant preventing this person from getting on an airplane," he said.
CNN's Jeanne Meserve contributed to this report.