The suspected leader of the 7 July London bombings had come to security officials' attention several times before the blasts, the BBC has learned.
Mohammad Sidique Khan visited Pakistan while on sick leave
Mohammed Sidique Khan had been "flagged up" and monitored but was thought to be "peripheral" and not investigated further, security sources told the BBC.
They also believe the bombers received "preparational guidance" in Pakistan.
Khan and three other men killed 52 people and themselves by detonating bombs on three Tube trains and a bus.
His accomplices were Hasib Hussain, 18, Shehzad Tanweer, 22, and Germaine Lindsay, 19.
BBC Home Affairs correspondent Margaret Gilmore said that by re-examining old intelligence, analysts found that Khan had come across their "radar" more often than at first thought, in situations they were not aware of before.
But he was thought to be "peripheral" and was not investigated further.
"They didn't see him as an immediate threat and point out it takes between 50 and 60 officers to put someone under surveillance because they have to do it in shifts and monitor them from base," our correspondent said.
The security sources also revealed that the threat level in the UK had reached "an unprecedented level".
They now believe half of all suspected plotters being monitored by the intelligence agencies in the UK are Britons, our correspondent said.
The government has already said there will be no inquiry into the London bombings instead ministers will publish a definitive account of what happened in a written narrative.
It was recently made public that Khan had visited Pakistan while on sick leave from his job at a Leeds primary school.
Khan was pictured at Karachi airport in November 2004 after taking sick leave as a learning mentor at Hillside Primary School in Beeston.
He was off work from 20 September to 30 November, before resigning in December.
Information about Khan's employment record has been released by Education Leeds following a request under the Freedom of Information Act.