The man held on suspicion of killing three people at a park in Reading was known to MI5, security sources say.
Khairi Saadallah, 25, from the town, was arrested at the scene on Saturday and police say they are not looking for anyone else over the terror incident.
Sources told the BBC he is originally from Libya and came to the attention of MI5 in 2019.
One victim has been named as teacher James Furlong – described by his school as “talented and inspirational”.
PM Boris Johnson said he was “appalled and sickened” by the attack in Forbury Gardens on Saturday evening.
Security sources told the BBC the suspect came to the attention of the security services after they received information he had aspirations to travel to Syria – potentially for terrorism.
- Live updates: Reading attack declared ‘terrorist incident’
- Tributes paid to teacher killed in Reading stabbing
- What we know so far
- ‘Reading weeps’ as town mourns stab deaths
It is understood the information was further investigated, and no genuine threat or immediate risk was identified.
No case file was opened which would have made him a target for further investigation.
The Holt School in Wokingham paid tribute to Mr Furlong, its head of history and government and politics, in a letter to parents, saying he was a “kind and gentle man” with a “real sense of duty”.
“He truly inspired everyone he taught through his passion for his subject and his dedication,” the secondary school for girls wrote, in a letter signed by co-head teachers Anne Kennedy and Katie Pearce.
“He was determined that our students would develop a critical awareness of global issues and in doing so, become active citizens and have a voice.”
Image copyright Reuters
Mr Johnson has promised action following the incident “if there are lessons that we need to learn”.
Metropolitan Police Assistant Commissioner Neil Basu, head of counter-terrorism policing, described it as an “atrocity” and said his “deepest sympathies go to the families who will be mourning loved ones after this horrific act”.
Mr Basu said investigators are not looking for anyone else in connection with the attack.
Saturday’s horrifying killings may be another example of what security chiefs call “lone actor” attack where a single individual turns extremist beliefs into murderous actions.
In November last year, the UK’s official threat level from terrorism was reduced from “severe” to “substantial” – meaning it remained likely – but there was no intelligence of an immediate risk to life.
Since then, there have already been three major incidents in which two people have died. Two of those attacks were carried out by lone individuals.
Today, detectives will be interviewing their suspect – and a huge operation will have swung into operation.
Electronic analysts will delve into any social media accounts linked to the suspect; they’ll trawl every call and text message going back years, looking for contacts with extremists.
Intelligence officers at MI5 will review both their open and closed case files on so-called “subjects of interest”.
A picture will emerge of the suspect’s movements. What led to the attack may be very difficult to identify.
A witness told the BBC he saw a man moving between groups of people in the park in Reading town centre, trying to stab them.
Three other people were injured in the attack, which took place at about 19:00 BST on Saturday.
Two of the injured people have been discharged and one remains in hospital, although the injuries are not thought to be life-threatening.
Labour leader Sir Keir Starmer has said that “people are united in their grief” following the attack, and that he wants to speak to the prime minister to discuss how to “learn from this.”
“This is not a time for party politics,” he said.
“It’s incumbent on all of us to pull together in response to this on a cross party basis.”
Thames Valley Police said on Sunday morning the attack was now being treated as terrorism and that Counter Terrorism Policing South East would be taking over the investigation.
The force’s chief constable, John Campbell, told reporters later that a man was arrested within five minutes of the first emergency call made to police – at 18:56 BST on Saturday.
He said lives had been “devastated”, but added that there was not believed to be a wider risk to the public and there was nothing to suggest anyone else was involved.
“I would like to reassure you that at this time we do not believe there to be a wider risk to the public,” he said.
He added: “I am sure we would all want to recognise the bravery of those police officers responding, but also that a number of members of the public were helping my officer’s and the victims at what was a very distressing scene.”
The prime minister has held a meeting with security officials, police and senior ministers over the incident.
Speaking in Downing Street, Mr Johnson said: “If there are lessons that we need to learn about how we handle such cases, how we handle the events leading up to such cases then we will learn those lessons and we will not hesitate to take action when necessary.”
He said that included changes to the law, as they had done over the automatic early release of terrorist offenders.
Of the three injured people, one was seen at the John Radcliffe Hospital in Oxford, where they were discharged without being admitted to hospital.
Two were admitted to the Royal Berkshire Hospital in Reading. One has been discharged, while another remains in a stable condition under observation.
Mr Basu said police were working with the coroner to formally identify those who had died and he praised the actions of Thames Valley Police officers – “unarmed and incredibly brave” – who detained the suspect.
He also said the public should not be alarmed about visiting busy places as a result of this attack.
“Let me be clear, there is no specific intelligence to suggest anyone attending crowded places is at risk, but I would ask the public: please continue with your daily lives, but be alert, not alarmed, when you are out in public,” he said.
The UK’s terrorism threat level of “substantial” is the third of five ratings at which the threat level can stand.
