President Trump stepped before the cameras at a White House news conference less than a month after his inaugural and declared that he was already taking bold steps to keep “radical Islamic terrorists” out of the United States.

“Our citizens will be very happy when they see the result,” Mr. Trump said, foreshadowing orders he would issue requiring tougher screening of visa applicants. “Extreme vetting will be put in place.”

But that “extreme vetting” did not stop precisely the sort of person Mr. Trump’s policy was supposed to root out: Second Lt. Mohammed Alshamrani of Saudi Arabia, a 21-year-old Qaeda loyalist who was part of a prestigious training program at the naval air station in Pensacola, Fla. This past December, Lieutenant Alshamrani opened fire in a classroom building at the base, killing three sailors and wounding eight other people before being fatally shot by sheriff’s deputies.

The episode, one in an alarming series of insider attacks on U.S. military bases, forced American officials to acknowledge serious problems in their vetting systems and pledge reforms.

But a New York Times review reveals lapses far more extensive than previously known in how international military students are selected, screened and monitored once in the United States. Even the sophisticated antiterrorism systems developed after the Sept. 11, 2001, attacks failed to identify the future gunman.

Breakdowns in vetting systems in the United States and Saudi Arabia occurred at virtually every step of the way. The Times examination, including a review of government records and interviews with more than two dozen current and former American officials and friends and relatives of Lieutenant Alshamrani, found that:

• Saudi security services failed to detect early clues from Lieutenant Alshamrani’s online life that might have disqualified him from joining the military and prevented him from receiving clearance to apply for the American training program.

• The American vetting system operated by the State Department and the Pentagon, with access to vast U.S. intelligence and law enforcement data, failed to spot a pattern of troubling social media activity that connected him with extremist ideology.

• An insider threat program developed by the Pentagon after the shootings at Fort Hood in Texas in 2009 and the Washington Navy Yard in 2013 did not monitor his movements and actions once the lieutenant arrived in the United States — because officials had not extended it to cover military trainees from foreign countries.

• Lieutenant Alshamrani was in contact with Al Qaeda beginning two years before coming to the United States for training, and remained so up until the night before the shooting.

“The ball was dropped,” said Martin Reardon, a retired F.B.I. counterterrorism specialist who was assigned to the embassy in Riyadh in the early 2000s, adding that the failure pointed to a need to commit more resources to screening foreign trainees. “It’s something that I think the Department of Defense and all of the U.S. agency sections that are involved in this training are going to have to do.”

One reason Lieutenant Alshamrani proved so difficult to detect, American defense and intelligence officials said, was that he represented a new kind of terrorist. He was not directed start to finish by Al Qaeda, nor was he simply inspired by online jihadist ideology. Instead he more closely resembled a self-directed contractor who was strongly enabled by Al Qaeda’s Yemeni branch.

“A self-directed contractor could now become the most popular approach, because it allows tactical flexibility on the part of the attacker, which could result in a higher level of success,” said Colin P. Clarke, a senior fellow at the Soufan Center, a New York-based research organization.

The First Vetting Failure

Lieutenant Alshamrani’s dream was to learn to fly, family members said.

Born in a small farming town in southern Saudi Arabia, he grew up in Al Ahsa, not far from the sprawling Saudi Aramco compound in the eastern part of the country. His father had moved there to work in the local airport, eventually rising to be a security official.

As a young man, Lieutenant Alshamrani seemed more serious than his peers, friends recalled. The Alshamranis were observant Muslims who prayed, but their practice of Islam was not considered especially strict, Galat bin Mitshoosh, a retired detective in a prosecutor’s office in southern Saudi Arabia who knows the family, said in an interview with The Times in December.

Lieutenant Alshamrani became active on Twitter in 2012, when he was 14, according to an internal Saudi government report compiled shortly after the shooting. At that time, he mainly focused on poetry and the Quran.

But a little more than three years later, according to the Saudi report, Lieutenant Alshamrani began following some religious figures the Saudi government has characterized as hard-liners — Abdulaziz al-Tarifi and Ibrahim al-Sakran, both Saudis, who were jailed in 2016, and some Kuwaiti and Jordanian clerics. Lieutenant Alshamrani’s views became radical, the Saudi report said.

In 2015, the lieutenant had his initial contacts with operatives from Al Qaeda in the Arabian Peninsula, the same Yemen-based group that had trained, directed and deployed the so-called underwear bomber, Umar Farouk Abdulmutallab, a decade earlier. It is unclear exactly how Lieutenant Alshamrani’s relationship with the Qaeda branch came about, or who contacted whom.

(American investigators learned of his contacts with Al Qaeda only months after the shooting, and only after the F.B.I. bypassed the security features on at least one of Lieutenant Alshamrani’s two iPhones to discover the contacts.)

Lieutenant Alshamrani moved toward his longtime goal to fly when he was accepted by the Saudi Air Force, long considered the most elite branch of the Saudi military, to train at its King Faisal Air Academy in Riyadh. “Since he was a kid, he’d dreamed of being a pilot, and he worked so hard for it,” his brother, Abdullah Alshamrani, told The Times.

Lieutenant Alshamrani’s online life might have disqualified him from joining the Saudi military, but no red flags went up. He went on to excel at the academy and by 2017 was one of two students picked from his class of several hundred for an even bigger dream: a training program in the United States.

“He was amazed by America’s military force, just really impressed by the military,” his brother said.

In the Saudi military, candidates for foreign training programs are typically nominated by their squadron commanders, who send the nominations up the chain of command in the kingdom’s Defense Ministry. As a prospective trainee in the American flight program, Lieutenant Alshamrani was supposed to have been thoroughly screened by Saudi security forces before his name was even put forward.

Saudi authorities had no access to the lieutenant’s cellphone data, unlike the F.B.I. after the shooting occurred, but at this point they should have been aware that the lieutenant’s public Twitter account was following online figures whom the Saudis considered dangerous extremists, said Mr. Clarke of the Soufan Center, who wrote an analysis of the case for West Point’s Combating Terrorism Center.

“The account did have his first and last name in Arabic and was tied to several posts which, at least after the fact, made it clear Alshamrani was responsible for operating the account and its content,” Mr. Clarke said in an interview.

The fact that the Saudis missed him points to serious gaps in their vetting process, and implications far beyond one attack by a Saudi officer in the United States, said Bruce Riedel, a former C.I.A. officer now with the Brookings Institution.

“All the vetting in the world isn’t going to work if the Saudi ministry responsible for internal security is asleep at the switch,” Mr. Riedel said. “Al Qaeda has infiltrated the Saudi military and the Ministry of Interior was unaware of that.”

The Saudi Embassy in Washington did not respond to multiple requests for comment.

Vetting Fails Again and Again

After passing through the hands of Saudi authorities, Lieutenant Alshamrani’s application for a visa to the United States landed in the consular section of the American Embassy in Riyadh in the summer of 2017.

The lieutenant’s information was first fed into a database kept by a special Department of Homeland Security vetting unit that has operated in Saudi Arabia after the Sept. 11 attacks. A consular officer used his passport and photograph to run still more checks — including facial recognition searches — on powerful databases fed by the American government’s central repository of information about terrorist identities.

It is not uncommon for the searches to turn up information that prevents military trainees from obtaining visas. But American Embassy officials, who are largely restricted from knocking on doors and taking other steps associated with deep background investigations, did not check the lieutenant’s social media history because such checks were not required at the time. Lieutenant Alshamrani’s application raised no suspicions.

One problem was that he was applying for a diplomatic visa as part of the elite training programs that are often important components of multibillion-dollar arms sales. In the last five years alone, Saudi Arabia has bought more than $45 billion in American weapons and training.

Although the State Department had cabled all embassies at Mr. Trump’s orders earlier in 2017 to step up screening of visas, the extra scrutiny was applied to immigrant visas and not to diplomatic applications, a senior American Embassy official in Riyadh said.

Embassy workers affixed an A-2 diplomatic visa to Lieutenant Alshamrani’s passport that would allow him to come and go freely between the United States and Saudi Arabia.

Pentagon officials, who received his application only about two weeks before he was to arrive in the United States, found no problems in a final cursory check.

In August 2017, Lieutenant Alshamrani landed at Lackland Air Force Base in San Antonio, Texas, where he began language training.

Two months later, an American government oversight authority, the Special Inspector General for Afghan Reconstruction, warned in a report sent to the heads of the State Department, the Pentagon and the Department of Homeland Security that the relatively hands-off screening process for foreign military trainees created “potential national security vulnerabilities.”

But nothing changed. By then, Lieutenant Alshamrani had achieved for himself one of the rarest and most useful positions an aspiring jihadist could hope to secure. He was a U.S. military insider with ties to a foreign terrorist group.

More Lapses in the U.S.

Lieutenant Alshamrani continued to slip through the cracks throughout his time in the United States. The Pentagon system to monitor insider threats — created after the fatal shootings at Fort Hood and the Washington Navy Yard — was focused only on American service members, not on the 5,000 international military students who were training in the United States, including some 850 Saudis.

And though Lieutenant Alshamrani used an American cellphone connected to American networks to remain in contact with leaders of Al Qaeda in the Arabian Peninsula while he was living in the United States, his communications remained undetected by American authorities — raising questions about gaps in the far-reaching digital surveillance system that is supposed to sound an alarm about impending attacks.

His diplomatic visa was in the meantime allowing him to travel freely. He returned to Saudi Arabia during a school break and then traveled back to the United States in February 2019, ready to resume his studies in Pensacola.

That July, Florida records show that the lieutenant obtained a state hunting license, which the authorities said he used to buy a Glock 45 9-millimeter pistol and an extended magazine, exploiting a loophole in federal law intended to prevent gunmen from being able to fire a larger number of bullets without reloading.

On Sept. 11, 2019, Lieutenant Alshamrani posted a cryptic message on social media, saying that “the countdown has begun.” The same month, he wrote out a will purporting to explain himself, saved it using the Notes app on his iPhone and sent a copy to Al Qaeda’s Yemeni branch. Over Thanksgiving, he visited the Sept. 11 memorial in New York City.

He remained in regular touch with Al Qaeda as he finalized meticulous plans for the attack. For the site of the shooting, he chose Building 633, where generations of pilots had gone through aviation preflight indoctrination classes, a rite of passage on the way to becoming an aviator.

“He continued to confer with his AQAP associates right up until the end, the very night before he started shooting,” Christopher A. Wray, the F.B.I. director, said in January.

On Dec. 5, 2019, the lieutenant screened videos of mass shootings during dinner with fellow Saudi trainees. The next morning, before 7, he wrote out a final screed on Twitter, calling the United States a “nation of evil.” Then he took up his pistol and some extra magazines, walked into the training building and started firing.

Lieutenant Alshamrani fatally shot Ensign Joshua Kaleb Watson, 23, of Coffee, Ala., who was the officer manning the building’s front desk. He also shot and killed Airman Apprentice Cameron Scott Walters, 21, of Richmond Hill, Ga., who was standing watch, and Airman Mohammed Sameh Haitham, 19, of St. Petersburg, Fla.

He moved down a hallway and fired through the door of the office where paperwork is processed for international students, wounding three more sailors. Then he exchanged fire with two base police officers, hitting one in the thigh, according to Escambia County sheriff’s records.

Moving to a stairwell, he traded more fire with a pair of sheriff’s deputies, wounding both. A third deputy caught him as he came down another flight of stairs, getting off a shot that struck the lieutenant in the chest before his pistol jammed. The deputy fell back as three more deputies, armed with long guns and a pistol, confronted Lieutenant Alshamrani, shooting and killing him.

The entire attack lasted about 15 minutes.

Plugging the Vetting Gaps

Days after the shooting, Defense Secretary Mark T. Esper suspended operational training for the 852 Saudi military students in the United States, limiting them to classroom instruction. He ordered an immediate review of policies for vetting foreign students and granting access to American military bases.

The suspension of operational training for hundreds of Saudi military students was an extraordinary rebuke by the Pentagon, especially at a time when Mr. Trump had tamped down suggestions that the Saudi government must be held to account on an array of recent issues.

Even before the shooting, the White House had been fighting efforts in Congress to cut military aid to the Saudis, a reflection of anger over the continuing war in Yemen, with tolls of civilian casualties growing, and the brutal killing in Istanbul of Jamal Khashoggi, a Saudi dissident and journalist who had been granted legal residence in the United States.

In mid-January, Attorney General William P. Barr announced that Lieutenant Alshamrani had most likely acted alone. Still, 21 other Saudi military students were expelled from the United States after investigators found that many had links to extremist organizations.

About a week later, Mr. Esper said he had ordered “far more comprehensive” vetting for foreign military students, including a more thorough examination of their social media accounts and interactions, as well as “continuous monitoring” during their stay in the United States.

Under the new rules, Pentagon officials would receive the names of international military students further in advance to allow more thorough vetting before students arrived in the United States. The Pentagon ordered increased supervision of Saudi students in the United States by supervisors holding at least the rank of colonel. New restrictions were also put in place on foreign military students possessing or using firearms.

Weeks later, tensions between Pentagon and State Department officials over the lapses were still palpable. “The Department of Defense has been overly reliant on the vetting conducted by the Department of State,” Garry Reid, the Pentagon’s director for defense intelligence, told a Senate panel in March while explaining the revamped procedures.

Some lawmakers and counterterrorism experts voice skepticism that these changes are sufficient to prevent another terrorist from infiltrating the foreign student ranks. Pentagon aides acknowledge that the new vetting and monitoring are a work in progress.

“This was a significant and unacceptable failure by the Trump administration and the State Department in particular,” said Senator Jack Reed of Rhode Island, the ranking Democrat on the Armed Services Committee. “We owe it to those we lost in this terrorist attack to fix the vetting system by using all tools at our disposal.”

After the shooting, other jihadist organizations held up Lieutenant Alshamrani as an example to follow. In February, the Qaeda-affiliated Somali group the Shabab issued a statement calling him a “Muslim hero” and exhorting followers to carry out similar attacks.

Katie Benner, Adam Goldman and Vivian Yee contributed reporting.