At 2:50 p.m. ET Monday, two explosions blasted the crowd near the finish line of the Boston Marathon. The bombings killed three people and injured at least 176 others -- revealing what marathon organizers around the world have feared but hoped they would never have to admit: Their events are among the most vulnerable in sports to terrorist attack.
By 2:51 p.m., emergency response was underway, tracking down and re-routing all remaining runners, moving the wounded to triage, cordoning off spectators, briefly locking down the city and turning the marathon's end into an eerily quiet crime scene. The reaction -- by marathon officials, volunteers, medical professionals and front-line public servants at all levels of government -- revealed something too: a sports world far more sophisticated in dealing with disasters than a decade ago but still struggling with the limits of how much preparedness can accomplish.
Since the terrorist attacks of Sept. 11, 2001, many sports events and venue operators have amped up their attempts to fight terror, to the point where cities, teams and schools spend about $2 billion a year on sports security, though efforts remain scattershot. But the most common measures at arenas -- extra security guards, bag checks and metal detectors -- don't work particularly well among open, massive, 26.2-mile-long marathon crowds. How can you secure a major road race?
"You can't," said Julia Emmons, former director of the Peachtree Road Race, the largest 10K in the world, and director of marathons and road races at the 1996 Summer Olympics, which staged the women's marathon one day after Eric Rudolph used a pipe bomb in an attack on Centennial Olympic Park in Atlanta. "You can secure it against little old ladies who wander on the course, but to secure it safely the way we secure the president of the United States would mean a total lockdown of the event to the point that nobody could afford it or would want to take part in it."
A longtime official at a major marathon told ESPN.com that Boston "was always the worry, that something like this could happen."
"The challenge for us is we don't have a stadium [where] you can have airport-like security," the official said. "Â… In New York, they screen the media. They screen the runners. They screen the volunteers. They screen anybody that has a credential. But the one place that you can't screen are those spectators."
Organizers of open-air sports events have developed some tactics for preventing attacks. Before a marathon, big cities typically subject the route to close inspection, temporarily remove potential bomb drops like mailboxes and garbage cans from the path of the race and seal nearby manhole covers to limit explosions. During events, police set up long-range cameras as well as snipers on rooftops and in helicopters, and sometimes even in armored counterterrorism vehicles, to monitor or neutralize suspicious behavior.
More important, to an extent Monday's attackers might not have appreciated, in recent years, the Boston Marathon has become a training ground for state and local officials to develop their response to a large-scale catastrophe, whether man-made (like terrorism) or natural (like an extreme heat wave). In 2008, Richard Serino, then the head of the Boston Emergency Medical Service, told counterterrorism expert Arnold Bogis that his agency treated the marathon as a "planned disaster" -- a relatively controlled environment where terror fighters would have the "opportunity to test some things you would never want to test in a real disaster." At that time, Boston and Massachusetts emergency management and public health officials already were using the marathon to coordinate disaster plans with the Boston Athletic Association, which organizes the race, and to try out new technologies, such as a barcode scanner to help locate injured runners.
Indeed, the marathon turned into something of an anti-cataclysm laboratory as local agencies cooperated with tech companies and research facilities, bringing an impressive array of hardware to defend the event from disaster. At the 2009 marathon, the City of Boston first used an "enhanced situational awareness" system developed by Raytheon, the $23 billion defense electronics giant headquartered in Waltham, Mass. The project, called Athena, integrated video, mapping and tracking software across the city's police, fire and port security departments into one set of information that any public safety official could access.
In 2012, the marathon deployed the Next-Generation Incident Command System, a sort of real-time virtual whiteboard developed by the Lincoln Laboratory, a federally funded research center at MIT. NICS not only displays the marathon route and the location of water and aid stations and plots the movements of the vehicles that lead and trail the race, it also shows packs of runners, who now wear microtransmitters. Any first responder can mark the map to report an incident, call for help or warn emergency vehicles about traffic.
All of this coordination and technology wasn't enough to stop the explosions Monday, and it's not clear if improving some aspect of security at the marathon could have stopped the attacks. But the combined effort -- helped by the fact that medical personnel and volunteers were already in place near the finish line, close to where the bombings took place -- helped Boston accomplish something that emergency responders say is just as important: a quick, efficient reaction that aided victims while assisting investigators.
Counterterrorism officials talk relentlessly about the "disaster management cycle," where managers must try not only to prevent calamity and prepare for it but also to respond and recover once a horrible event occurs. Boston has been working the back end of that cycle vigorously.
Soon after the explosions, BAA officials, working with local police, diverted runners who were still on the course to a different route and ultimately to a community meeting area on the Boston Common. In person and through social media, they told concerned family members and friends there would be no easy way to find competitors and to reunite with the runners back at homes and hotels. At the same time, they evacuated fans from the finish line. And they converted the marathon's medical tent into a MASH unit for the wounded.
"Even though a stadium might be even better prepared, hotels and hospitals in Boston plan for the marathon all year round," said Bogis, formerly a fellow at Harvard's Belfer Center for Science and International Affairs. "The site was filled with volunteer doctors and nurses when those two bombs went off."
Despite relentless images of chaos broadcast on television, the area around the finish line was quiet within an hour after the explosions, paving the way for police to start gathering evidence.
"How quickly a sports scene has become a crime scene," tweeted Juliette Kayyem, lecturer at Harvard's Kennedy School of Government and former Massachusetts Undersecretary for Homeland Security. "No runners. Just badges Â… Moving from response to investigation."
Few people at the Boston Marathon will want to hear that things could have gone worse, particularly after reports about how the pressure cooker devices, packed with shrapnel, maimed so many victims. But with more panic, and without such an organized medical response, the toll of injury and death could have been much greater.
"Marathons are soft targets," said Stacey Hall, associate director of the National Center for Spectator Sports Safety and Security at the University of Southern Mississippi. "There's just not enough physical structure or access control to be 100 percent risk-free. That means you must prepare for response and recovery. You have to control ingress and egress and sweep the area once something happens. There's no doubt Boston did that."
As police and federal investigators scour the marathon scene for evidence, gather eyewitness testimony and collect local videos, will sports events heed the lessons of this attack? Over the past few years, many of the world's biggest venues and richest professional teams have stepped up their security planning. Organizers of the six major world marathons -- Boston, London, Berlin, New York, Chicago and Tokyo -- have studied one another's events and shared best practices.
But a number of arenas and staging areas remain "soft." Counterterrorism experts point to two particular problem areas, and they extend far beyond marathons. For one thing, sports events often focus on prevention, especially the deployment of showy technology like armed guards or scanners, while neglecting response and recovery. For instance, while 65 percent of U.S. schools with Division I football programs have assessed their vulnerability to security threats, only 41 percent actually have an emergency response plan for disasters, according to a 2010 study by NCS4.
At some sports events, potential attackers may easily infiltrate operations. Other NCS4 studies have found that 62 percent of personnel running security for Division I football schools have no formal education or training in event security management and that 60 percent of universities outsource their game-day security. Meanwhile, just 10 percent of colleges run background checks on everyone who works at their athletic facilities.
Marathons have been zooming in popularity, in the U.S. and worldwide. More than 500,000 Americans finished 26.2-mile races in 2011, up 47 percent since 2000, and this weekend, locales from Roanoke, Va., to London to Nagano, Japan, will stage marathons in the shadow of the Boston bombings. As the number of races and competitors on local and international circuits keeps climbing, organizers and municipalities must ask themselves: Are personnel thoroughly screened? And are they planning coordinated response to and recovery from potential terror strikes?
And there's a deeper question, specific to this sport: Can marathons continue to exist in their traditional form? The marathon is unique because it is so public and so communal, a ritual Kayyem has called "a spectator event with no doors." But what if the characteristics that make the marathon so engaging turn its participants into sitting ducks?
"Maybe there should be some distance between the road and the spectators," Hall said. "Maybe it will turn out that spectators can't go anywhere except certain staging areas. The key is how to control that space, where you go to and from the race."
That space houses the soul of the marathon, but even the best police and technology can keep it under only limited surveillance. Athletes, fans and organizers must determine again in a modern world how much ground can be relinquished while preserving the essence of the race. And when the next one starts, we will all wonder if we chose correctly, or if the next finish line is the next target.
After Monday, the marathon will be a whole new kind of endurance test.
ESPN.com investigative reporter Mike Fish contributed to this report.