Russia’s intelligence chief on Tuesday directly blamed Ukraine for orchestrating the assault on the Crocus City Hall concert venue with Western help, alleging without evidence that Kyiv “trained militants in the Middle East.”

The accusation by Alexander Bortnikov, the head of Russia’s Federal Security Service, or FSB, seemed intended to deflect attention from his agency’s failure to prevent the attack, in which at least 139 people were killed, and to fan anti-Ukrainian rhetoric even as officials presented an increasingly convoluted narrative of what transpired Friday night.

“We think the act was prepared by the radical Islamists, but of course, the Western special services have aided,” Bortnikov told state media reporters, singling out the United States and Britain. “And the special services of Ukraine have a direct relation to this.”

Ukraine has strongly denied having any involvement in the attack. On March 7, the United States issued a warning of a potential terrorist attack in Russia, urging Americans there to avoid mass gatherings, based in part on intelligence reporting about the possible activity inside Russia of the Islamic State-Khorasan (ISIS-K), the Afghanistan and Pakistan arm of the militant group. Russian President Vladimir Putin, speaking to the FSB board a week ago, dismissed that warning as an attempt by the West to “destabilize Russia.”

The Islamic State has claimed responsibility for the attack, and Russia has charged four suspects, all citizens of Tajikistan, with carrying out the rampage. Bortnikov on Tuesday confirmed that the United States had passed on information about a potential attack but said it was “of general nature.”

“We responded to this information and took appropriate measures to prevent such things,” Bortnikov said. “Unfortunately, the actions we carried out in relation to specific groups and specific individuals - this information was not confirmed at that time,” he added. He did not provide any details about what groups the FSB targeted.

According to Bortnikov, the FSB received reports that preparations were underway for an attack in early March, before Russia’s presidential election, which was held March 15 to 17, but “unfortunately, what happened later was already the next stage,” he said.

The FSB previously had ISIS-K on its radar.

In October, Bortnikov warned a meeting of the heads of security services in Commonwealth of Independent States (CIS) nations, a group of 10 former Soviet republics, that ISIS-K had more than 6,500 members and could initiate attacks outside Afghanistan “in the near future.”

On Tuesday, however, Bortnikov accused the CIA and Britain’s MI6 intelligence agency of interfering in Afghanistan with the goal of creating instability on the southern border of CIS countries, including Tajikistan. “The CIA and MI6 are restoring their intelligence presence in a number of key Afghan provinces,” Bortnikov said.

“The main efforts are focused on forming a belt of instability along the CIS’s southern borders. To this end, fighters keep being recruited from international terrorist organizations operating in Iraq, Syria, and some other Asian and African countries and transferred to northern Afghanistan,” he said.

After Russia’s military intervened in Syria beginning in 2015 to support Bashar al-Assad against Islamist and opposition militias, including the Islamic State, the FSB focused on the threat Islamist extremists posed to Russia.

But in recent years, especially since Russia’s February 2022 invasion of Ukraine, the FSB’s main effort has shifted to countering Ukrainian sabotage against Russian railways, pipelines and other infrastructure, as well as arresting liberal, pro-democracy and antiwar activists.

As Bortnikov pointed fingers at Kyiv, Washington and London, a timeline of Friday’s attack presented to Putin by Alexander Bastrykin, the head of the Investigative Committee, Russia’s main law enforcement body, raised new questions about the law enforcement response as the assault unfolded.

Bastrykin, in the presentation to Putin on Monday evening, said the attack lasted 13 minutes. But Russian news outlets reported that specialized police units did not arrive until more than an hour after the shooting started, and then waited more than 30 minutes before entering the building. At that point, the attackers had long escaped.

The attackers “arrived at the concert hall at 6:45 p.m.,” Bastrykin said. “They waited for the spectators to gather. At 7:58 p.m. they opened fire on visitors on the street and entered the Crocus City Hall building.”

He continued: “They shot at everyone they saw, regardless of gender and age. Using gasoline they brought with them in plastic bottles, they set the room on fire. At 8:11 p.m., they left the building.”

SOBR and OMON, Russia’s special police response units, were alerted at 8:33 p.m. and arrived at 9:06 p.m., according to the Tass state news agency. A journalist with another outlet, Ostorozhno Novosti, who was at the scene reported that officers began entering the building at 9:39 p.m.

The nearest police department is located about one and a half miles from Crocus City Hall. A spokeswoman for Russia’s Internal Affairs Ministry, Irina Volk, later dismissed complaints that police arrived too late, asserting that the first group of officers was at the scene “five minutes after reports of shooting were received.”

Volk also urged the media to “only trust official statements.”

The description of the suspects’ getaway car - a 2007 white Renault - quickly appeared on Telegram channels with links to law enforcement. The four alleged attackers were caught several hours later, some 250 miles from Moscow in the Bryansk region near the border with Ukraine and Belarus.

The suspects were able to drive roughly five hours despite Moscow being one of the most heavily surveilled cities in the world with 221,000 closed-circuit cameras installed, many of which are equipped with facial recognition technology.

Such cameras have been used widely to track down protesters opposing the invasion of Ukraine, for example, or mourners of the late opposition leader Alexei Navalny.

Russian media geolocated videos showing law enforcement arresting the suspects near the village of Khatsun. At that location, the highway forks, with one road to Ukraine and another to Belarus. Putin on Saturday said the suspects were heading to Ukraine.

On Tuesday, Belarusian President Alexander Lukashenko, a Putin ally, injected more confusion into Moscow’s version of events by saying that the perpetrators initially planned to cross into Belarus. Lukashenko’s remarks contradicted Putin’s assertion that Ukraine “had prepared an escape window” at the border.

“They understood that they couldn’t enter Belarus,” Lukashenko said. “Therefore, they turned away and went to the Ukrainian-Russian section of the border.”

At a press briefing Tuesday, Putin’s spokesman, Dmitry Peskov, was asked to explain the Kremlin’s version of events - that radical Islamists had done the bidding of Ukrainian President Volodymyr Zelensky, who is Jewish. Peskov said the entire matter was under investigation but replied that Zelensky “is a peculiar Jew” who “in many ways shows sympathy to the nationalist spirit that permeated the leadership of the Kyiv regime.”

Russian officials have also placed blame on the private security company that was protecting Crocus City Hall, saying guards were unarmed even though the company had an arsenal of weapons.

“This entire arsenal is stored in the building next door to Crocus, but the guards on duty did not carry,” said Alexander Khinshtein, a member of parliament. “Their emergency response group is also based there; however, they did not go to the site after the terrorist attack.”

In addition to the four alleged shooters, Russia has charged three men with assisting the attackers by providing transportation. Iam Islomov, the brother of Dilovar Islomov, one of the men, told Russian outlet Verstka that his sibling “knows nothing about the attack” and had sold his car to a client who claimed it would be used as a taxi.

According to vehicle registration records reviewed by The Washington Post, the car was sold earlier this year and repainted white from dark gray.

On Tuesday, Russia arraigned an eighth suspect, a citizen of Kyrgyzstan who rented an apartment to one of the gunmen. The suspect, Alisher Kasymov, said that he posted an online ad and denied having any knowledge that his tenant had links to radical Islamist groups.

Two of the alleged gunmen, Shamsidin Fariduni and Saidakram Rajabalizoda, briefly traveled to Turkey in late February and returned to Russia on March 2 on the same flight, according to a senior Turkish security official who spoke on the condition of anonymity to discuss sensitive matters. The official said he believed that “both individuals became radicalized in Russia given the short amount of time they spent” in Turkey.

According to brutal interrogation videos leaked on various pro-Kremlin Telegram channels, Fariduni said he was contacted on Telegram by “an assistant of an imam” about a month before the attack and offered the equivalent of about $5,000 to “kill people.”

Baza and 112, both Telegram channels linked to Russian law enforcement, published a photograph of Fariduni allegedly inside Crocus City Hall on March 7. The 112 channel alleged that he was scouting the location.

Kareem Fahim in Istanbul contributed to this report.