If it’s true that the bombs were inside 6-liter pressure cookers and placed in black duffel bags, that seems both good and bad. It’s good because I don’t think you can walk around with a heavy black duffel bag without being caught on camera. But it’s bad because it is a pretty significant failure of security to not question someone who is carrying heavy awkward black duffel bags into a crowd and leaving them unattended.
Who knows if this report is accurate, but it is being carried by the Associated Press. I saw somewhere that the bomb squad had done a sweep in the early morning and then again an hour before the race started. So, my thinking was that the bombs had been smuggled in shortly before the explosions and dropped in mailboxes or trash cans. But it appears they were brought in in duffel bags and placed on the ground on the sidewalk.
One thing I would look at is the possibility that the bombs were stored in one of the buildings nearby the second explosion. It would be easier to store the duffel bags there in advance, then to quickly drop the first bag near the door and continue on with only one bag toward the finish line. If they were set on a timer, the timers could be set inside. If using a cell phone, he could have walked away and called them in sequence, explaining the brief delay between the explosions.
I’d focus on the people with access to the buildings, and I’d want footage of everyone going in and out of those buildings in the days before the crowds showed up.
There is no way that those duffel bags were there for long. So, we should be able to find images of the suspect, and hopefully they can be matched to earlier footage. If they knew what they were doing, however, they would be strongly disguised.