By Gordon Corera
BBC security correspondent
Four days after Thursday's bomb attacks in London, what progress are the police making in identifying who was behind them?
It is not clear whether the No 30 bus was a pre-planned target
Police are being careful not to rule anything out at this stage.
The indications are that they have not yet identified any specific individuals or groups behind the attack.
The fact that London's bombings came out of the blue indicates the challenge involved in identifying those behind the attacks.
Painstaking detective work is required to make sure no crucial detail is missed.
There has been intense speculation over whether the attackers were a "home grown" cell or came from abroad.
Investigators have still not ruled out either possibility - nor that there was some combination of the two, with a UK group being supplied with bomb-making expertise or equipment from a wider European network, or even one that stretched to Iraq or beyond.
All options are still open.
The fact that the group operated under the radar of the security and police services also indicates a degree of professionalism.
Existing suspects and groups in the UK and overseas are carefully watched and monitored, and if the cell had made any contact with them then it would likely have been picked up.
It is also clearer from the close timing of the three underground blasts that the attacks were relatively professional.
The bus blast remains a mystery, with question marks over whether the bus was indeed the intended target, and why the blast came an hour later than the Tube explosions.
That makes it possible that it was a follow-on attack, perhaps even aimed at emergency services at the original blast site, or designed to ensure more media coverage.
Appeal for images
Forensics are still working to try to find out exactly what kind of bomb-making material or detonators and timers were used, as this could provide important clues as to where the cell came from.
The CCTV footage is also likely to be important in trying to identify suspects.
More evidence is also being sought by police, who appealed for any images or video from camera phones at the time of the incident.
Officials say there has been a large flow of information coming into the system - whether from the police and security service's agents and informers, from GCHQ's monitoring of communications or from foreign intelligence and security services.
All of this has to first be carefully assessed for its credibility, before they look at whether the information helps build a picture of what might have happened in London.
At MI5 headquarters in Thames House, staff have been pulled in from other departments to work on the investigation and search for the bombers, working in three shifts across the day.
The close similarities with the Madrid blasts are also being investigated - the blasts are not identical but close enough to warrant careful examination.
In the case of Madrid, it took about three weeks to close in on some of those involved in an apartment in Leganes. They had more explosives and were preparing for further attacks.
The UK's threat level is at its highest level - a sign of the real concern here over follow-on attacks. The cell could well be at large and may want to show they can strike again.
The Birmingham alert on Saturday night came after credible intelligence came into West Midlands police which was separate from the London investigation - raising fears of another group possibly being at work.
Whether that is the case or not, until the manhunt for the London attackers is complete, more alerts, alarms and evacuations are likely to take place, in addition to the 100 or so there have been already.