You can also listen to William Saletan read this piece.

Every once in a while, a terrorist sets off a fatal bomb in the United States. In 1993, it was the World Trade Center. In 1995, it was Oklahoma City. In 1996, it was the Atlanta Olympics. Now it’s Boston. Each time it happens, we’re shocked.

But the attacks we see or hear about on TV are just the surface. The FBI is constantly tracking bomb plots. If you look at the bureau’s most recent cases—the ones in which it has announced investigations, arrests, indictments, convictions, or sentences since the beginning of 2012—you’ll discover that during this time frame, Boston is the 21^st case involving explosives. And when you study these cases, you realize how lucky we’ve been. The next Boston may not be far behind.

Here are some of the patterns in the FBI case list:

1. Diverse targets. We expect attacks on big, iconic buildings, such as the Pentagon and the World Trade Center. Some of the recent plots fit that pattern: The perpetrators reportedly targeted or considered targeting  the U.S. Capitol, the New York Stock Exchange, Grand Central Terminal, Times Square, the New York Federal Reserve Bank, a federal courthouse, and George W. Bush’s home. But others picked softer targets: electrical plants, bridges, synagogues, restaurants, bars, night clubs, malls, and a Christmas tree-lighting ceremony. Good luck protecting those places.

2. Bomb size. Three of the 20 previous cases involved car bombs. All were inoperative, thanks to prior infiltration by law enforcement. One plotter thought he was detonating a 1,000-pound bomb. Another thought he was detonating an 1,800-pound bomb. Another tested his device at a quarry and said he wanted a bigger blast. The carnage in Boston could have been worse. Much worse.

3. Everyday ingredients. Two plotters connected to al-Qaida used high explosives. But many cases involved common household items (clocks, phones, Christmas lights, auto wire, fishing weights, soda bottles) or chemicals that weren’t inherently suspicious (acetone, hydrogen peroxide, rat poison). Even the gun powder used in one explosive device was extracted from common shotgun shells. One case involved pressure cookers, a component that may have been repeated in Boston. Four cases involved pipe bombs. Three included nails. In one of these cases, nails were blasted “over a block away and at least six stories into the air.” Another nail bomb, in a reconstructed test, riddled a metal filing cabinet with holes.

4. Backpacks. If they were used to deliver the Boston bombs, that shouldn’t surprise us. Three other plotters on the 2012–13 list used them, too. One left her pack at the front doors of a courthouse. Another placed his pack along a parade route, positioned to explode into the marchers.

5. Ingenuity. Among the 20 cases, the cleverest device—too clever, apparently—was the chemical underwear bomb in Detroit, with its syringe detonator. Another perpetrator wounded a man by hiding his device in a gift basket. A third researched ways to conceal explosives in a doll or a baby carriage.

6. Luck. In three of the 20 cases, the plotters had prior contacts with al-Qaida or other known terrorist groups outside the U.S. In five other cases, the plotters reached out to fellow jihadists or jihadist wannabes, either online or through other unspecified channels. This seems to be how we infiltrated and disarmed those plots, except for the underwear bomber. We’re plugged in to the jihadist network.

Of the 12 remaining cases, one was an AWOL soldier, which presumably made him a hunted man. Another was a bush-league pipe-bomb maker, apparently for hire. Another was a bunch of anarchists who discussed their scheme with one person too many. We were in on those plots, too.

That leaves nine cases. In two of them, the defendants had explosives but no known targets. How did we discover the explosives? Dumb luck. One guy alarmed his neighbors by shooting at bottles from his back door. When the cops showed up, they found chemicals and devices they recognized, according to an indictment, as bomb components. Another woman shot at two utility workers who ventured onto her property to turn off her water for nonpayment. A search of her home turned up 122 improvised explosive devices.

In a third case, a former chemical engineering student who was assembling explosives for a violent jihad campaign needed one final chemical, phenol, to complete his recipe. The supplier shipped it, but the freight company felt uneasy about delivering it to a home address, so they alerted police. In a fourth case—the one involving the backpack and the parade—a former Army artilleryman managed to place his bomb along the parade route. He was foiled, according to the FBI, only because “alert city workers discovered the suspicious backpack before the march started.”

In the remaining five cases, we were at the bombers’ mercy. Two of them, it turned out, were just using the bombs to extort or intimidate. They gave warnings, and their devices were intercepted or (according to an FBI statement of arrest) disarmed via controlled detonation. The other three bombs went off. One caused an unspecified “permanent bodily injury.” Another blew out the doors of a courthouse, but nobody was around to receive the shrapnel. Two other bombs, loaded with acid, blew up in the car of the intended victim, but through freakishly good timing, one went off before she arrived, and the other failed to explode until she had fled.

Together, the 20 cases tell us several sobering things. First, the Boston Marathon is just the beginning of an expanded target list. Bombers have already aimed at restaurants, bars, and malls. We can expect more plots against gathering places where security is difficult, if not impossible, to guarantee.

Second, some of the components implicated in Boston—the backpack disguise, the household shrapnel—are common practice. They make it difficult for law enforcement agencies to detect plots and recognize explosive devices before the bombs go off.

Third, bombers are constantly innovating. They want better disguises and bigger blasts. If the devices used in Boston were Iraq-style pedestrian IEDs, the next device could be an Iraq-style car bomb.

Fourth, when you look at the 20 cases, you realize that Boston is just the tip of the iceberg. What’s surprising isn’t that the marathon bombing succeeded, but that so many other plots failed. In most of these cases, the culprits didn’t tap the jihadist networks we’ve infiltrated. Some of them did stupid things that caught our attention. Others, apparently unserious, tipped us off. Others botched their work.

It’s been more than a decade since this country endured a major bombing. We’ve been lucky. In Boston, our luck ran out. Don’t be surprised if it happens again.

William Saletan's latest short takes on the news, via Twitter: