Germany's security services are under intense scrutiny because of the way Anis Amri, the Tunisian jihadist who killed 12 people in Berlin, evaded their surveillance and crossed European borders undetected.
As after the Paris and Brussels attacks in 2015-2016, critics say it is too easy for terrorists to travel in the EU's passport-free Schengen zone.
There are fears that so-called Islamic State (IS) - under heavy military pressure in the Middle East - will launch more attacks in the EU.
Why didn't German police stop Amri?
The investigation into the Berlin Christmas market attack of 19 December has exposed several errors or shortcomings:
- He was a known follower of an Islamist hate preacher, Abu Walaa, but the authorities say they lacked the legal grounds to detain him
- Germany rejected Amri's asylum request in June, 11 months after he had arrived from Italy; but Tunisia refused to take him back, initially refusing to accept he was Tunisian citizen
- Amri was initially registered in Kleve, North Rhine-Westphalia, and legally he was supposed to remain there, but he moved to Berlin
- He used 14 different identities in Germany and was suspected of making multiple fraudulent welfare claims
- Immediately after Amri's lorry attack police followed a false lead, questioning an innocent Pakistani man as a suspect
- Only on 3 January did police detain a Tunisian suspect, Bilel A, who had had dinner with Amri on the eve of the attack.
Amri's atrocity highlighted the fragmentation of Germany's security and counter-terrorism services. Each of Germany's 16 states has its own police and intelligence service, on top of the federal agencies.
It is acknowledged that sometimes important intelligence is not passed on between services. That weakness was blamed in the case of a neo-Nazi cell - part of the National Socialist Underground (NSU) - accused of 10 murders across a decade, in different German cities. The truth finally came out in 2011.
Federal Interior Minister Thomas de Maiziere has now called for a broadening of the federal police's security remit and a centralisation of intelligence-gathering. But he faces political resistance - from Bavaria, for example.
Why wasn't he spotted crossing a border?
Investigators say that after the lorry attack Amri caught several trains which took him from the Netherlands to Italy, via Belgium and France.
Those countries are in Schengen - the zone covering most of Europe where passport controls are minimal or non-existent.
After the 2015 Paris attacks by jihadists, in which 147 people were killed, France, Germany and some other Schengen countries reinstated passport checks at some of the EU's internal borders.
France plans to maintain passport checks on all its borders until 15 July, and Germany is also extending its checks on the Austrian border indefinitely. Austria demanded such checks to help curb the huge influx of migrants last year.
But the Berlin attack, and the jihadist bombings in Brussels last March, suggest that the new controls are far from systematic, and that tighter border surveillance may be needed.
It was only by chance that Italian police stopped Amri at a Milan station and killed him after he had opened fire.
Amri was caught by CCTV cameras at train stations in Nijmegen (Netherlands), Brussels (Belgium), Turin and Milan (Italy). But he was able to buy train tickets without revealing his real identity.
The Dutch government is reportedly in talks with Belgium and France about increasing security checks on buses, trains and boats. One idea is to require passengers to show ID when buying a ticket.
There are demands in Germany now to boost CCTV surveillance - something that was resisted for decades, in part due to Germany's grim memories of state surveillance.
What is the EU doing to improve border controls?
The priority last year was to reduce the numbers of refugees and migrants heading for northern Europe from Greece and Italy.
In 2015 Germany took in a record 890,000 asylum seekers - many of them refugees from the wars in Syria, Iraq and Afghanistan.
After the Paris attacks it emerged that some of the jihadists had slipped into the EU among crowds of migrants. Belgian citizen Abdelhamid Abaaoud, allegedly the organiser, had boasted about going to war-torn Syria and returning to Belgium.
Now the EU recognises the need to link police databases so that potential terrorists are spotted.
Tove Ernst, EU Commission spokesperson for migration and home affairs, told the BBC that the EU "needs to do more and do better when it comes to exchanging information".
The Schengen Information System (SIS) is the most widely used database for intelligence-sharing in the EU.
But the UK - not part of Schengen - uses the SIS in a limited way. And the amount of data provided varies greatly from country to country - gaps which the EU is urgently trying to plug.
A Commission report in December urged EU states to put all alerts about migrant entry bans or deportation decisions into the SIS.
A key problem is that of "home-grown" jihadists, such as those responsible for the carnage in Paris. The checks on EU citizens are generally not as systematic as those on migrants from outside the EU.
The EU has decided that in future the identities of all travellers - including EU citizens - will be checked against databases at the Schengen zone's borders.
Is Schengen the weak link?
The terrorist atrocities exposed some weaknesses in national policing - so just blaming Schengen is no solution.
The Commission found that national forces' use of the SIS database was uneven - it needed to be systematic.
EU countries can act quickly when a European Arrest Warrant (EAW) is issued. But there was a delay in the case of Amri, as police initially pursued a false lead. In 2005 an EAW enabled the UK to quickly extradite from Italy a fugitive bomber, Hussain Osman, over a terror plot in London.
A senior EU official in law enforcement told the BBC that "the willingness to share terrorism data has improved a lot".
The official said France and Belgium, since the 2015-2016 terror attacks, had "started to share terabytes of information" with Europol, the EU police agency.
According to Ms Ernst, efficient use of counter-terrorism tools "requires a culture change" among national forces - "the habit of systematic co-operation and information-sharing".
Schengen enshrines the EU's cherished principle of free movement. And while the system allows for temporary border controls under special circumstances, the member states are reluctant to reinstate barriers.
The Commission estimates that restoring full border controls in Schengen would impose annual costs of €5bn-€18bn (£4bn-£15bn) on the members, through border delays, lost tourism and trade blockages.
A note on terminology: The BBC uses the term migrant to refer to all people on the move who have yet to complete the legal process of claiming asylum. This group includes people fleeing war-torn countries such as Syria, who are likely to be granted refugee status, as well as people who are seeking jobs and better lives, who governments are likely to rule are economic migrants.