Washington ( CNN ) -- To understand how the suspect in the botched terror attack was able to board a plane , you have to understand how the counterterrorism system that President Obama says failed is supposed to work . The president says the clues were there , and that a fuller , clearer picture of 23-year-old Umar Farouk AbdulMutallab would have emerged if all the bits and pieces had been shared and put together . `` The warning signs would have triggered red flags , and the suspect would have never been allowed to board that plane for America , '' Obama said . The president has ordered a top-to-bottom investigation of the failed terrorist attack on Christmas Day . The preliminary report is expected Thursday . One of the key questions is why was n't the suspect 's visa revoked . The suspect , a Nigerian national , was supposedly on the terrorist watch list . Six weeks ago , his father warned the U.S. Embassy in Nigeria that his son was becoming radicalized and had gone to Yemen . The father provided the embassy with his son 's name , birth date and passport number . That information was sent in a routine , unclassified cable known as a visa VIPER to the National Counterterrorism Center in Washington . The details in the cable were `` insufficient for this interagency review process to make a determination that this individual 's visa should be revoked , '' State department spokesman Ian Kelly said . In the aftermath of the attempted attack , the State department is directing embassies to include information on whether a person has a U.S. visa when it sends the visa VIPER cables to Washington , a state department official said . The change was prompted by the preliminary reviews Obama ordered due to him Thursday . The information the father provided the embassy with was just one of hundreds of reports , and often vague tips , coming in each day . Analysts from the CIA , FBI , Justice Department and other agencies are supposed to evaluate such tips side by side , running them through databases , comparing them with other clues agencies have gathered , and those still coming in . The purpose is to make sure the even seemingly insignificant dots get connected . The U.S. also had intelligence that between August and October of this year , extremists in Yemen were talking about operations . Someone known as `` the Nigerian '' was mentioned , and they had a partial name -- Umar Farouk . `` At any point along that chain , people have the responsibility for making sure that they are accurately and fully reporting what they 've learned . And then there are going to be some judgments that have to be made about whether and what action ought to be taken , based on the information , '' said Michael Chertoff , former Homeland Security Secretary under President Bush . But in this case , with no urgency attached , the father 's warning was treated more as a missing-person report . With nothing else alarming coming up , the analysts put the suspect on the Terrorist Identities Datamart Environment ( TIDE ) list , along with 550,000 other suspicious people . And that 's where the warnings stopped . To go on to the next step and put someone on a no-fly list or subject them to a secondary screening , there has to be a `` reasonable suspicion '' of a link to terrorism . Under the NCTC rules , the evidence against the bombing suspect was n't there . No recommendation was made to the State Department to revoke AbdulMutallab 's visa . The threshold for taking action is being looked at in the review ordered by the president . The threshold could be made less restrictive to allow a quicker trigger for action such as revoking a visa , according to a source briefed on the review . There was `` not a lack of information collected , but a lack of understanding of what to do with that information , '' the source said . Chertoff said that during his time in the job , there was a `` very good information-sharing system . '' `` I think what the current administration is going to be looking at is , was there human failure , either in the initial reporting or in the initial decision about what would be sent up the chain of communication , or in the ultimate determination by the intelligence community about whether this was significant enough to warrant preventing this person from getting on an airplane , '' he said . CNN 's Jeanne Meserve contributed to this report .
Despite warnings , suspect 's visa was not renewed . Tip from suspect 's passport went to National Intelligence Center . Was put on TIDE list , along with several other possibly suspicious people . To take matters further , there has to be a ` ` reasonable suspicion '' of a link to terrorism .