For example, Australia's Lindt Cafe siege - the guy was already under "24 hour surveillance" by ASIO (Australian Security Intelligence) - which did nothing to prevent the attack. Despite this, AFAIK there was not much blame placed on ASIO. I'm sure there are many other examples. I'm not saying it's an easy problem to solve, just that more surveillance is probably not the answer.
Sure, the attacker is the real culprit, but adding more laws and surveillance will not prevent crazies from doing crazy stuff.