The investigation: Security agents grope for clues and ask - was this work of the gang with no name?

The attack was predicted, the chances of stopping it all but impossible, but still the bombings are a bitter blow for the intelligence services. Now they must pick up the pieces. Raymond Whitaker, Paul Lashmar, Severin Carrell and Sophie Goodchild report

It was an attack everyone had warned was inevitable, a matter of time. That did not make the moment any less dreadful, however, or the task of catching the perpetrators any easier. By general consent the response of the emergency services to the wave of bombings that shattered London's Thursday morning rush hour could scarcely have been better. For Britain's security services, however, it was a bitter blow. Having stopped no fewer than five major al-Qa'ida plots in Britain, they had, in the language of the professionals, finally "let in a goal".

And all the time the police and security apparatus has to bear in mind the possibility that the bombers escaped and have the resources to strike again. When they were run to earth, the group which carried out the deadly wave of bombings in Madrid last year was found to have detailed plans for further attacks. In Istanbul the previous year, terrorists affiliated to al-Qa'ida bombed two Jewish targets, then struck again within days, staging simultaneous attacks against British interests.

There are also fears that any future attack could involve attempts to detonate a "dirty" bomb - one contaminated with nuclear waste, which might not cause widespread casualties but could shut off a large area of London, disrupting the life of the city far more than Thursday's atrocity. In the wake of the attack, evidence emerged that would-be terrorists had made determined efforts to acquire medical-grade radiological isotopes from hospitals and medical suppliers.

The Home Secretary, Charles Clarke, admitted that the London bombings had come "out of the blue". The Joint Terrorist Analysis Centre, indeed, had lowered its estimate of the threat from "severe general" - the third highest level - to "substantial", despite the impending G8 summit in Gleneagles. In the wake of the attack it was immediately lifted to "severe general" again.

Whitehall sources say the security establishment had no warning or suspicion of the attack. Senior staff at MI5 headquarters by the Thames heard an apparent power surge had caused fires and problems on the Tube. Then they were told about the first explosion, followed by a call from the police to say that it looked like a terrorist attack. "MI5 found out only a few minutes before the public and media," said a Whitehall source.

Information which has come out since indicates that a group of terrorists, possibly no more than one for each of the four explosions, could have arrived at King's Cross Underground station and planted bombs on three trains heading away from the station. The police are not ruling out the possibility of a suicide mission, but their latest evidence is that in each case the device was placed on the floor of the train. That heightens the possibility that the bombers simply stepped off as the doors closed, and may have been back on the street when the bombs exploded within 50 seconds of each other.

The principal mystery surrounds the fourth explosion, which killed 13 people on a bus in Tavistock Square. Some reports spoke of a man acting suspiciously, constantly rummaging in the bag he was carrying, adding to speculation that he was carrying a bomb which went off prematurely. But with all the other carnage having taken place out of sight, the images that went round the world were of a London bus peeled open like a sardine can, surrounded by devastation and suffering.

In the absence of any intelligence, the police and security services are having to rely on forensic evidence. Every scrap of debris from the crime scenes, no matter how small, is being collected in an effort to determine the origin of the explosive and how it was set off.

"That particular trail is one of the most important. And it likely to be clue rich," said Crispin Black, a security expert. "Bombs are like paintings - they leave a distinct signature that can identify who committed this outrage."

Hours of CCTV footage from Tube stations is being scrutinised, and efforts are being made to recover images from the CCTV camera which is thought to be buried in the wreckage of the double-decker bus. But unless some piece of hard information is turned up, Britain's intelligence services will be working in the dark.

"Everyone you speak to in the security services has a different opinion," said one authoritative source. "There seem to be a lot of contradictory theories, but the impression I'm getting is that they think it's simply a group they've missed. It's not a group they know anything about."

The only consolation for chagrined security officials is that it could have been a great deal worse. If the two explosions on the relatively shallow Circle line had been in deep tunnels instead, the death toll would probably have been considerably higher. Police have confirmed that the bus bomb exploded upstairs; according to witnesses, it was at the back of the top deck. If it had gone off on the lower deck, everyone on the bus - including the driver, who escaped alive - might have been killed.

The bombs themselves were smaller and fewer than the devices which killed 191 people on commuter trains in Madrid in March last year. Police say they contained about 10lb of high-quality explosive, which is just under half the weight of the bombs in the Spanish capital and compact enough to fit in a briefcase or small package. The shortness of the intervals between explosions makes it more likely that timers were used.

"It was a pretty straightforward operation," said one expert. "It was small, simple and didn't require a lot of people, which would have helped to keep it below the radar of the security services. I don't think we are dealing with the same people who carried out the Madrid or Istanbul bombings."

Because of its experience with the IRA, Britain keeps tight control of explosives. In Spain the explosive was found to have been stolen from a quarry. One theory being pursued is that the material for the bombs was brought in from outside. There were reports last night that Mustafa Setmariam Nasar, a Syrian accused of masterminding the Madrid bombings, had been the subject of a warning to Britain from Spanish intelligence.

Nasar, 47, now believed to be in Iraq, was said to have set up a "sleeper" cell in London. Coded instructions believed to come from him and naming Britain as a potential target were found in a flat used by the Madrid bombers, but the Spanish thought any attack would be timed to coincide with the election in May rather than last week's G8 summit.

Spanish police who have arrived in Britain to help with the hunt for the bombers added that Nasar, a dual Spanish and Syrian national, has lived in Britain, and has claimed to be British.

Early speculation in the wake of the blasts was of a North African connection. MI5 was confident in September 2001 that it had already rounded up all al-Qa'ida members in Britain, but was known to be concerned that it did not have full knowledge of all the activities of North African exiles here. Several have since been convicted of terrorist-related offences, mainly raising funds through credit card fraud and other illegal means.

In the past year or so MI5 evidence has emerged that al-Qa'ida operatives have managed to get into Britain, despite strenuous efforts to prevent members of the network, especially those from Saudi Arabia, other Middle Eastern countries, Afghanistan and Pakistan moving freely around the world. In at least one case some months ago, however, a senior al-Qa'ida member was arrested here when an attack was nipped in the bud.

The security services keep very close tabs on a number of people in the UK they suspect are potential terrorists, known as the "jihadists". The closeness of the surveillance depends on how dangerous the suspect is estimated to be. Some are watched almost day and night by teams of highly trained surveillance officers. According to security sources none of the "usual suspects" had been out of sight or behaved unusually. All the same, within a few hours of the bombings though, MI5 officers were contacting their agents and sources to see whether "the word on the street" indicated who might have committed these atrocities. "It only requires a well-known face to have gone missing to provide a clue," said a source. Intelligence analysts at the eavesdropping centre, GCHQ, have also been trawling through thousands of emails, faxes and intercepted phone calls to make certain they do not contain retrospective leads.

The worst fear of the security services is that the bombers might be "clean skins" - newly recruited or British-born extremists with no police or intelligence records, perhaps trained, equipped and directed by a much more experienced terrorist. If they were not Muslims, they would be even harder to detect.

"A spate of individual fanatics, each committing an act of horrendous terrorism, is what senior MI5 officers lie in bed sweating about at night," said one former intelligence officer.

The major line of investigation is that the bombings were carried out by an alliance of terrorists formed specifically for this operation, perhaps using the name Secret Organisation Group of al-Qa'ida of Jihad Organisation in Europe, the first to claim responsibility.

Intelligence sources point out that a series of previously unknown "Islamist" terror groups have sprung up in the past to commit attacks and then, just as suddenly, disappeared. It is thought very possible the members of the cell or cells responsible are unaligned, free-floating terrorists not directly involved with the better-known terror groups. Their temporary existence has made it extremely hard for the intelligence agencies to track them, and build up hard data about their membership and whereabouts.

Because this attack caught the police and intelligence agencies by surprise, few lines of inquiry are being ruled out. "Until there is some kind of breakthrough, there would be a danger that the counter-terrorism effort is being directed at the wrong target," said one expert.

It is even being suggested that groups yet more extreme and potentially violent than al-Qa'ida may be involved. One such is Al-Takfir wa al-Hijra - otherwise known as "Excommunication and Exile" - which was implicated in the Madrid train bombings. Analysts at Jane's Intelligence Review reported earlier this year that the group had recently been posing a more significant threat after building in Europe from a loose grouping of militants and radical clerics, and has been detected in France, Germany, Italy and the UK. It allegedly once attempted to murder Osama bin Laden,

But if the attack on London was a shock, it cannot have been a surprise. Since the invasion of Iraq in March 2003, Osama bin Laden and other groups have threatened to attack Britain in retaliation for its support of the US. Last April, bin Laden demanded that Britain and other American allies pull out of Iraq by 15 July, 2004. The deadline passed without incident, but the opening of the G8 summit in Britain furnished another symbolic moment for an attack.

Last November, Newsweek magazine claimed that FBI officers based in London had stopped using the Tube because of its vulnerability to terrorist attack. But Control Risks, the London-based consultancy, said it had not raised its "medium" assessment of the security risk in London in the wake of the bombings.

"I take no pleasure in this, but we did actually say that such problems on public transport were a distinct possibility in London," said Jake Stratton, the company's research director.

But he added: "We believe the level of risk is the same as it was a week ago or a year ago ... We would say it's safe to travel in London. It's safe to use the Tube. Confidence in security will have taken a blow from yesterday's events, but as far as we're concerned, it makes no sense to stop people travelling to these places or in these places on the basis of what has already happened. On that basis, huge areas of the world would be off limits."

Jonathan Stevenson, senior fellow for counter-terrorism research at the International Institute for Strategic Studies in London, agreed. "Britain was always considered a juicy target, given that it has such a close relationship with the US, both in the war on terror and in Iraq," he said.

But it is one thing to issue a stream of warnings of the inevitable, and another for the warnings to come true. Now that London has been hit once, it will be that little bit harder to ignore the fear that it could happen again.