As in this case, terrorist threat levels often seem to change after an attack has happened. This sometimes seems a bit like shutting the door after the horse has bolted. But in fact, as the Canada incident illustrates, terrorist attacks really do come in clumps. Canada's terrorist attacks are so infrequent that there is an average of about 230 days between them, since 1970. A purely random process with this kind of interval would mean that only 3% of terrorist attacks would occur within the same week. In Canada's case, though, nearly one in five terrorist attacks occurs within a week of the last one. In other words, the rate of terrorist attacks rises by a factor of about six immediately following an attack. A terrorist attack is therefore a relatively good indicator of another imminent attack - even disregarding any intelligence received - and the authorities almost certainly did the right thing in raising the threat level.
The effect is also clear in countries with relatively high levels of terrorism. The chart below shows the observed frequency of intervals (in days) between attacks in Northern Ireland since 1970 (in blue) and the frequency that would be observed if attacks came purely randomly (in red).