A Norwegian commission has criticised police authorities for failing to take actions that could have prevented or interrupted the bomb and gun attacks by a far-right militant that killed 77 people last year.
It said intelligence services could have learned about Anders Behring Breivik's plans months before the attacks.
The government building he bombed should have been better protected and he should have been stopped before he gunned down dozens of victims on an island as police struggled to find a working helicopter and a suitable boat.
The commission said: "All in all, July 22 revealed serious shortfalls in society's emergency preparedness and ability to avert threats.
"The challenges turned out to be ascribable to leadership and communication to a far greater extent than to the lack of response personnel."
Mr Breivik first detonated a fertiliser car bomb outside government headquarters in Oslo, killing eight people, then travelled to the ruling Labour Party's summer camp on Utoeya island where he gunned down 69 victims unimpeded.
Authorities had become aware of his suspicious activities months before when he purchased items that could be used to make bombs, but intelligence service failures meant he was not put on a watch list, the commission said in the 482-page report.
The government building should have been much better protected as it had been identified as a security risk years before.
But government squabbling over minor details of the security measures needed meant little was done.
Once the bombing took place, a witness's description of Mr Breivik, which was phoned into police, was not passed on to officers in the field for 20 minutes.
Police should have automatically activated drills meant to guard against multiple attacks but weak leadership and disorganisation led to delays, the report said.
The military was not immediately informed, police could not find the helicopter, and its boat, intended to transport special forces to the island, could not carry the necessary load.
"The authorities' ability to protect the people on Utoeya island failed. A more rapid police operation was a realistic possibility. The perpetrator could have been stopped earlier on 22 July," the commission said.
Mr Breivik admits the attacks but denies criminal guilt, claiming to be a political activist who attacked the ruling party for its support of Muslim immigration, which he says has adulterated pure Norwegian blood.
His ten-week trial ended in June and a court is expected to deliver its verdict on 24 August, with prosecutors asking the five judges to declare him insane.
If deemed insane, he faces indefinite mental care in a facility inside a maximum security prison, while if ruled sane, he faces a 21-year prison sentence with the possibility of indefinite extensions.
The commission's findings are a major embarrassment for security forces but the justice minister and security chief at the time have both resigned since the attack, while many of the senior police personnel involved have also been replaced.
Prime Minister Jens Stoltenberg said he took ultimate responsibility for the intelligence and police failures, after the publication of the report.
"It took too long to apprehend the perpetrator and the police should have been on Utoeya earlier. This is something I regret," he said.