STOCKHOLM — Swedes questioned their country’s welcoming immigration policies with pride and pain Sunday after learning that an asylum-seeker from Uzbekistan was allegedly behind the truck rampage that killed four people, Stockholm’s deadliest extremist attack in years.

The Swedish capital was slowly, but resolutely, regaining its normal rhythm as details about the 39-year-old suspect in the attack emerged. Police said he had been ordered to leave Sweden in December because his request for a residence permit was rejected six months earlier.

Instead, he allegedly went underground, eluding authorities’ attempts to track down and deport him until a hijacked beer truck raced down a pedestrian street and rammed into an upscale department store Friday.

“It makes me frustrated,” Swedish Prime Minister Stefan Lofven told Swedish news agency TT on Sunday.

The suspect, who has been detained on suspicion of terrorist offenses, was known for having “been sympathetic to extremist organizations,” Jonas Hysing of Sweden’s national police said.

A second person was arrested on the same potential charge Sunday, and four others were being held by police. None of them have been identified.

Security officials in neighboring Norway, where a 17-year-old asylum-seeker from Russia was detained early Sunday in connection with an explosive device found near a busy subway station, spoke of the alarming potential for a copycat effect.

Norwegian’s security agency said it wasn’t clear if the teenager planned to carry out an attack with the primitive homemade device police defused without any injuries. Agency head Benedicte Bjornland said it was likely the youth had been inspired by recent attacks in Stockholm, France, Germany, Britain and Russia.

“The attacks demonstrate how easy such attacks can be carried out, and prove to others that it is possible to make something similar,” Bjornland said.

Sweden has long been known for its open-door policy toward migrants and refugees. But after the Scandinavian country of 10 million took in a record 163,000 refugees in 2015 – the highest per-capita rate in Europe – the government has tried to be more selective about which newcomers it allows to stay.

Swedish police said Sunday they had received roughly 12,500 referrals from the Swedish Migration Board of people who, like the suspect in the truck attack, had overstayed their welcome.

The suspect eluded authorities by giving police a wrong address after his residency request was rejected in June 2016, said Hysing, the operative head of the attack investigation.

“The efforts to locate (these people) is both time-consuming and resource-intensive,” he said.

National Coordinator Against Violent Extremism Anna Carlstedt, who used to lead the Red Cross in Sweden, said Friday’s attack and the background of the suspect posed “difficult questions.”

“Do we somehow need a more repressive policy?” Carlstedt said. “I think it is very important now not to rush into something, to see how we can safeguard this open society and still be able to protect ourselves.”

The range of mixed emotions also surfaced at memorial services and rallies held in Stockholm on Sunday to honor the attack victims.

Lars Holm, a 73-year-old Stockholm resident, was visibly upset after attending a service at Stockholm Cathedral.

“If people who are here seeking asylum and treat us like this, it is not good,” Holm said. “So now we have to have more security in our society, but still we don’t like to live in bunkers.”

Addressing tens of thousands of people rallying in bright sunshine on the downtown Sergelstorg square, organizer Rickard Sjoberg noted that many in the crowd probably were from out of town.

“But today, we’re all Stockholmers,” he said to huge applause.

The four victims killed included a British man, a Belgian woman and two Swedes, authorities in those countries said. Their identities were not released by Swedish officials.

The British government named the Briton as Chris Bevington, an executive at Swedish music-streaming service Spotify. In Brussels, the Belga news agency said the Belgian woman had been reported missing before she was identified by her identity papers and later by DNA testing.

As of Sunday, 10 of the 15 people injured remained hospitalized, including one child.