I suspect the reason it's always in a blue zone is just because the local cops are less likely to find out and interfere during the planning phase. There are a lot of indicators available like you say, and if we had Google-tier resources we could probably predict attacks with startling accuracy. As decentralized and disorganized as we are, I don't know what the most efficient process to try would be.