A nervous public as well as the increasingly overstretched police and security services are urgently seeking the answers to these questions, but at the moment it is a struggle even to measure the size and nature of the problem. If London had been less fortunate, it would now be mourning the second round of devastating suicide bombings in a fortnight. No one can guarantee that further attempts at mass murder will not be made.
Not the least disquieting factor about Thursday's incidents is that the authorities admit that none of the four men whose pictures have been released was known to them. The nails packed into the failed bombs also testify that the would-be attackers sought to adapt and learn from those who went before them. Most worryingly, there is now compelling evidence that an al-Qa'ida-linked terror cell network has been operating undetected in Britain for some time.
As one analyst has pointed out, common sense indicates that the two assaults on London's transport system were linked. The alternative explanation, a copycat attack, would require a group to form at short notice, obtain detonators and make explosives from scratch, in two weeks. If forensic analysis shows the failed bombs were made from the same batch of explosive used by the suicide bombers of two weeks earlier, the connection will have been established.
If, however, Thursday's bombs turn out to have been made separately, but to a similar formula, the implication is even more troubling. MI5 now believes that one of the 7 July bombers - possibly the oldest, Mohammed Sidique Khan - made the explosives that killed them and 52 innocent travellers. If another batch was used for last week's attempt, it would mean that the network has enough members with bomb-making expertise to consider them expendable. "If the batch of explosives is different from the 7/7 bombs, that is worse news than if it's the same," said a security source. "If each cell makes its own explosives, then that will obviously make it more difficult to go after the logistics of the operation."
The nature of the explosive has been the main indication that the threat Britain is facing is largely home-grown. After initial speculation that the 7 July bombers had obtained military-grade explosives from abroad - it is readily available in parts of eastern Europe - police conceded that it was made here. It is almost certainly TATP, mixed from easily available chemicals to formulas published on the internet.
"My suspicion is that these groups were provided with detonators and TPUs [timer power units], but were told to get hold of their own chemicals and directed to a website which showed how to mix them," said Nigel Wylde, a former bomb disposal expert in Northern Ireland who later worked in military intelligence. "Detonators are small, and can easily be smuggled in a car or luggage. In theory the chemicals can be traced, and that's another reason why you get the bombers to buy them, rather than identify a bomb master. This way you keep the intelligent and skilled operative alive.
"What you probably have is a pre-2001 al-Qa'ida person who is in contact with groups. He provides the detonator [and other] equipment and tells the local group, who will be post-2001 people, probably fired up over Iraq, how to make the explosive.
"He tells them how to construct a rucksack bomb - he might even do it for them. The Leeds group did it properly. The latest bunch didn't.
"There is someone recruiting these people for death from all over the country. It may not be centralised."
Another security expert, who did not want to be named, agreed that "some people are clearly coming in and offering their expertise" to groups who were often "amateurs, foot soldiers". But however decentralised these groups were, they had a common cause.
"They see themselves not as terrorists but as insurgents in a war connected with Iraq, Afghanistan and Gaza. The main weapon in Iraq is not the RPG, but the camera. Fighters there video everything they do, and there is a whole class of young men here who watch them on the internet. It fires them up to do things like the London bombings."
The public was beginning to get the message that local groups were taking the initiative, the expert added. That, however, makes it infinitely more difficult for the security services to gauge the size of an extremely loose network.
MI5 used to boast that it had identified and dealt with all al-Qa'ida operatives in Britain before the attacks of 2001, and that it knew who needed watching among the 600-800 Britons trained in camps run by al-Qa'ida in Afghanistan. Resources are concentrated on the 200 or so people in the UK deemed the greatest threat to national security. At any one time at least 10 round-the-clock surveillance operations are under way.
In the wake of the London attacks, however, criticism of MI5's intelligence gathering is mounting. Most of their suspects belong to a new generation too young to have fought or trained in Afghanistan. It now appears that some al-Qa'ida agents have been able to come and go in Britain and that some al-Qa'ida sympathisers travelled from the UK without attracting the attention of the authorities. This has enabled a new generation of al-Qa'ida soldiers to develop in our midst, guided by experienced terrorists overseas - "an entire network unnoticed by MI5", as one intelligence insider puts it.
Asked after 7/7 whether there had been a failure of security, one Whitehall source retorted that before the bombings the four men had done little to attract security service attention: "MI5 does not target Muslims. It targets threats to national security." A senior Scotland Yard counter-terrorism officer said recently of the difficulty in profiling possible terrorists in ethnic communities, "You can't stigmatise the whole population."
In any case, one of the four suicide bombers was of Caribbean, not Asian origin, and the four CCTV images released on Friday appear to reflect an even wider ethnic spread. The new al-Qa'ida, said BBC terrorism expert Peter Taylor last week, "don't walk round with the Koran under their arms, don't wear Islamic dress, don't have beards".
But the more we learn about the 7 July bombers, the less it appears that they were "clean skins", as first claimed. There is increasing evidence that they were linked not only to failed plots in this country, but to attacks abroad.
Senior FBI officers have already questioned the abilities of their UK counterparts by revealing Germaine Lindsay, 19, had been "on the radar" when he visited his mother in Ohio, probably in 2004, but then disappeared from MI5's view. The most detailed evidence, however, concerns the 30-year-old Khan, whom many believe to have been the leader of the cell.
Not only did Khan have phone contact with a suspect in Operation Crevice, the wave of terror arrests across southern England last year, The Independent on Sunday has learnt that he knew the British suicide attacker Omar Sharif. Sharif's co-conspirator, Asif Hanif, killed three people in an explosion in a Tel Aviv bar in April 2003. His own bomb did not go off. He fled and was later found dead in the sea.
Although both men lived in Derby, Sharif grew up in Leeds, like Khan and two of the other London bombers. Khan, who used his British passport to visit Israel for one day in February 2003, is suspected of conducting a reconnaissance mission to plan the Tel Aviv bombing.
A terror suspect held in the US, Mohammed Junaid Babar, 29, picked out Khan after being shown photographs of the four suicide bombers. There is an uncorroborated report that a tracking device had been placed on the hire car Khan left at Luton railway station before embarking on his final journey to London. Clearly some of the bombers had appeared, albeit temporarily, as blips on the security service's radar, but they failed to follow through.
As a result, a number of previous explosives cases involving Islamist extremists in Britain are being urgently reviewed. Evidence, seemingly unimportant at the time, could now provide vital clues.
In particular the security service is focusing on the case of Moinul Abedin, a Bangladeshi-born waiter arrested in November 2000 in Sparkbrook, Birmingham. Police found handbooks on bomb-making, and raw ingredients for a home-made explosive were found at premises rented by Abedin. At the time police said there was nothing to link him to al-Qa'ida but the trial in Paris of an al-Qa'ida recruiting sergeant, David Courtailler, heard that a fake British driving licence in his name was found in Abedin's home. Courtailler shared a flat in Brixton, south London, with Zacarias Moussaoui, the only man charged in the US in connection with the September 2001 attacks, and is linked to Jamal Zougam, a suspect in the Madrid bombings.
Abedin's efforts at bombmaking were crude, and the 27-year-old was under MI5 surveillance for some time before his arrest. Five years later, however, his successors showed they had learnt from his mistakes, and the authorities are racing to catch up.
President Pervez Musharraf struck a chord last week when he complained that Britain should deal with its own militants rather than making accusations against Pakistan. But it is true that Khan and his fellow suicide bomber, Shahzad Tanweer, visited Pakistan together on an extended trip last year and on an earlier trip Tanweer met a Pakistani militant who has since been jailed. Pakistani intelligence believe he visited at least two madrassas linked with banned militant groups.
British authorities refuse to confirm that they are seeking to interview Zeeshan Siddiqi, a 25-year-old British Muslim arrested by Pakistani intelligence in May. He is believed to be a member of the militant group Hizb-ut Tahrir, and is suspected of al-Qa'ida links. There are also unconfirmed reports that Pakistani intelligence has questioned in connection with the London bombings Omar Saeed Sheikh, the jailed British Muslim who kidnapped the American reporter Daniel Pearl.
But the most dramatic reports from Pakistan last week turned out to be untrue. Claims that a key suspect, Haroon Rashid Aswad, a British Muslim, was arrested there were unfounded. The British High Commissioner to Pakistan, Mark Lyall Grant, said no one had been held in Pakistan in connection with the London bombings; according to diplomatic sources, Aswad is not even believed to be in the country.
Claims by the Pakistani authorities that the third Leeds-based bomber, Hasib Hussain, visited the country on a separate trip also turned out to be mistaken. And a crackdown on madrassas by the authorities, including the arrest of more than 100 imams, is said to have been planned before the bombings. The crackdown has far more to do with Pakistan's own internal problems and sectarian strife between Muslim sects.
Tanweer's relatives in Pakistan say that the young Briton, only 22 when his bomb exploded, was already radicalised when he arrived there. Osama bin Laden "was his hero, and everything he did was right", said his cousin, Asfaq Ahmed. "He believed that America had made Muslims suffer all over the world." This is the face of the "new al-Qa'ida" - young and in your neighbourhood, ready to be recruited by shadowy older figures who have links to the wider world of extremism.
"The only thing that has spared us is the incompetence often shown by such recruits," said the security expert. "It amazes me that the 7 July bombers did not 'dry-clean' their identities before they went on their operation. Nor did they do certain things which could have made their attack much more lethal. Suspects are persistently tracked down using the same techniques, such as fingerprints and mobile phone records."
This will be of little comfort to the authorities, however. IRA terrorists often showed similar ineptitude, but despite blowing themselves up, failing to detonate their devices or planting them in the wrong place, they caused hundreds of casualties over many years, in the face of a massive military and intelligence effort. The security services are in the same position as they were at the beginning of that campaign, dealing with an amorphous and unquantifiable threat.
"The good news is that if the cells are all linked in some way, it should be possible, with hard detection work, to bring them all in eventually," said the security expert. "The bad news is that it could take years.
"After the first attack MI5 would have been looking for maybe 12 people. After last week's attempt that probably trebled to at least 36. Any information they develop could lead to more than 100 people. Very quickly they will reach the limit of their resources, if they are not already there."
MI5 has been given the green light to increase its staff to 3,000, but has not reached that figure yet, and is pressing for a big increase in funds in the wake of the attacks. "But you cannot simply hire more people," the expert added. "It takes easily 10 years to train a good agent handler."
We are at the beginning of a long-term struggle, one that could well see further atrocities. Peter Mercer, the Conservative spokesman on homeland security, warned last week that anyone who thinks the bombing is over will be "bitterly and brutally disappointed". Mr Mercer, a former army colonel, added: "For anyone who thinks this was the wake-up call, we had our wake up-call in 2001."
Additional reporting by Justin Huggler in Islamabad