HARRISBURG, Pa. (AP) — The arsonist who broke into the Pennsylvania governor’s residence while Gov. Josh Shapiro and his extended family slept upstairs on the first night of Passover encountered little resistance as he scaled a security fence, smashed windows with a hammer, ignited two Molotov cocktails and crawled inside before slipping off into the night minutes later.

That suggests multiple security failures, according to a former FBI agent who wondered why burglar alarms, motion detectors and other devices did not thwart the intruder sooner.

“He never should have gotten over the fence. He never should have gotten across the yard and to the house. He never should have broken the window. He never should have gotten inside,” said retired FBI Special Agent J.J. Klaver, now a security consultant.

The arson early Sunday occurred just hours after Shapiro hosted a Seder for his family and members of the Jewish community. No one was injured, but the fire caused, by one official’s estimate, millions of dollars in damage.

“I’d be lying if I said it wasn’t jarring, scary to see that in the light of day, to see the areas where we’d either make memories privately up in the residence with our kids — hanging out, laughing, enjoying ourselves — or in the more public spaces where we’ve been able to welcome so many people to our home,” Shapiro said Thursday. “But we’re going to rebuild from that. We’re going to be stronger.”

White House, queen have faced intruders

Experts said it can be difficult to maintain security at official residences, like the one in Harrisburg, that also open their doors to the public for tours and events.

Intruders over the years have managed to breach both the White House and the queen’s bedroom at Buckingham Palace. Meanwhile, Paul Pelosi, the husband of former House Speaker Nancy Pelosi, was violently attacked inside their private home in California in 2022.

The Pennsylvania suspect, an unemployed mechanic from Harrisburg, told police he felt hatred toward Shapiro, and referenced Palestinians in a 911 call that day, according to court documents.

Still, Cody Balmer’s specific motive remains unclear, and both his family and lawyers have said he has struggled with serious mental health issues. Balmer, 38, remains in custody without bail while his lawyers seek a competency evaluation.

Police say the attack took just minutes

State police, who provide the governor’s security detail, pledged to hire an outside expert to review the breach and to assess the need for added security. They said the intruder came and went in a matter of minutes early Sunday as troopers on duty spotted the threat on security cameras and searched the grounds while he was still there.

“It was a very quick event,” Lt. Col. George Bivens said.

Shapiro, a high-profile Democrat on the national stage who was awakened about 2 a.m. Sunday by his state police detail, has expressed confidence in the agency while confirming that security measures would be bolstered.

Klaver, who is based near Philadelphia, has planned site visits involving the governor and said Shapiro typically has several members of his security team in tow. In addition to staff, an array of high-tech systems can help police keep up with ever-evolving threats, another expert said.

“As people and groups get more creative, that’s obviously where you need to adjust and learn. You’re always looking to do things better,” said John Geffre, general manager of Unlimited Technology, an Exton, Pa.-based security systems integrator.

Yet Balmer told police he relied on a rudimentary method to make the explosives — gasoline from his lawn mower and a few beer bottles. And he said he planned to hit Shapiro with the small sledgehammer if he encountered him.

Expert: He shouldn’t have gotten that close

Mohsin Siddiqui, 40, who manages a Sunoco station across the street, said he doesn’t often notice security outside the residence, but he never thought they would need it. The events of last weekend took him by surprise. The residence is about a mile north of the Capitol complex, in a mixed-use neighborhood beside the Susquehanna River.

“It’s a peaceful area,” Siddiqui said Thursday. “We had no idea this could even happen.”

Shapiro splits his time between the mansion that has housed governors since it was built in the 1960s and a home in Abington, a Philadelphia suburb.

The security review, Klaver said, should focus on “potential threats or vulnerabilities for any given location, and protecting the people in that location.”

Every state has a centralized emergency office open round-the-clock that could monitor security system feeds, he said.

“There should have been electronic security that would have detected all of that before he got close enough,” he said of the attacker, “so that as soon as he broke the perimeter of the property, the state trooper there should have been alerted, should have been there, and should have taken him into custody.”

___ Dale reported from Philadelphia. Associated Press reporter Bruce Shipkowski contributed to this report from Toms River, New Jersey.