Sydney siege: Watch list questions over Monis

It took less than 24 hours for the finger pointing to begin.

A 16-hour siege in a cafe in the heart of Sydney had ended in the early hours of Tuesday with the death of a lone gunman and two of his hostages.

Tabloid newspapers and politicians immediately demanded to know why the gunman - now identified as Iranian-born Man Haron Monis - hadn't come under closer scrutiny by security agencies.

At the time of the siege Monis, who received political asylum in 1996, was on bail facing serious criminal charges including accessory to murder and sexual assault.

He had also been convicted of sending offensive letters to the families of Australian soldiers who died serving in Afghanistan.

His website, now closed down, had hosted a series of videos supporting terrorism and blaming rape victims for their attacks.

Australian Prime Minister Tony Abbott says Monis was being monitored by domestic spy agency Asio in 2008 because of the letters but then dropped off watch lists.

"How can someone who has had such a long and chequered history not be on the appropriate watch lists, and how can someone like that be entirely at large in the community?" he asked.

But security analysts say it is too easy to blame security agencies, the police and the courts for the actions of a "lone wolf", seemingly frustrated by his dealings with the courts and his personal problems.

Monis had claimed his siege was part of an Islamic State (IS) attack and he forced his captives to hold up what appeared to be a black Islamic banner in the café window.

But exactly what he hoped he would achieve remains unclear and experts say his profile and his actions do not fit the usual criteria applied to terrorists.

Monis simply didn't have the standard hallmarks of a terrorist, says James Brown, Military Fellow at the Lowy Institute for International Policy.

"I just think he was a mentally disturbed individual who reached out for a cause closest to him," he said.

He was a late convert to the IS cause but there is no evidence he had been in contact with them or any other terrorist group.

With investigations still under way, security experts point to four key questions: Should Monis have been on a terror watch list? Should he have been granted bail? How did he get access to a gun? And should he have been given asylum?

'Unplanned and unfocussed'

Australia's former spy chief David Irvine has raised the alarm about Muslim Australians travelling to Syria and Iraq to fight with IS.

"Lone wolf" terrorists and suicide bombers returning to Australia were a great threat to security, he said in September.

But Monis, 50, appears to have little in common with young, radicalised Muslim Australians - some of them known gang members - who have left to fight overseas.

His chief concern appeared to be his long-running fight with the courts over the abusive letters. Last Friday, he lost an appeal against those convictions.

While not underplaying the fear Monis' captives would have experienced, Mr Brown says Monis could have made things much more terrifying.

With a terrorist attack, "you plan to kill as many people as you can to create havoc and fear and you plan for a clear outcome, and to use the hostages for leverage for what you want," he says - all of which stand in contrast to what appeared to be an unplanned and unfocussed attack by Monis.

"The reason people are reaching out to talk about it as an act of terrorism is because IS has put out a call for individuals to carry out such acts."

Mr Brown does say, however, that questions need to be asked about how Monis got what appeared to be a pump-action shotgun.

Under Australian law, pump-action or self-loading shotguns holding five or fewer rounds are strongly restricted. Only farmers, occupational shooters, collectors and some clay target shooters can own them.

'Doesn't fit criteria'

Monash University Professor and member of The Global Terrorism Research Centre in Victoria Greg Barton is also not surprised Monis was not on a terrorism watch list.

"He was regarded as someone who was mad and bad but not someone who was a terrorist."

"Poorly-resourced security agencies such as Asio have to concentrate on monitoring people they believe are part of a terrorist network or who are actively plotting some kind of terrorist act," says Prof Barton.

"When the prime minister says 'Why was Monis not on a watch list?', it overlooks the basic way Asio and the AFP (Australian Federal Police) work."

"They are resource-constrained and have to work out priorities," he says, adding that round-the-clock surveillance of high-risk groups or individuals is "massively, massively expensive".

"Whichever way you slice and dice it, [Monis] does not meet the criteria."

Security agencies want to stop a terror act before it happens but they also need to be able to prosecute alleged terrorists, he says "and for that they need to be able to gather evidence".

"If you cannot prosecute them, you cannot detain them and stop them doing something else."

'Weak case'

A court decision granting Monis bail after he was charged with being an accessory to the murder of his ex-wife has also been criticised.

His wife was stabbed and set alight in an apartment stairwell on 21 April 2013. Monis's then partner, Amirah Droudis, was charged with her murder.

Bail laws in New South Wales have long been a battle ground for those for and against tougher sanctions against alleged and convicted criminals.

But according to media reports at the time, the magistrate granted bail after a hearing lasting more than three hours.

"It is a weak case," he said, noting that both of the accused had an alibi. He granted them conditional bail which included them surrendering their passports.

The final question that some people want answered is why Monis was allowed into the country.

He sought asylum from Iran, citing political persecution by the Iranian government.

It is something Mr Abbott says a joint federal and state government review will examine, along with his successful applications for permanent residency and citizenship.