About 9.15pm, Bharat Tamore stepped out from his small apartment to walk to the Taj Mahal Palace Hotel where his night shift as a junior manager was due to start at 10pm. Diverting to the waterfront to enjoy the sea breeze, he noticed something unusual.

"It was a small inflatable raft, not usually seen in our parts where fishermen ply only small boats," Tamore told The Times of India . "In the darkness, I saw eight young men stepping out of the raft, two at a time. They jumped into the waters, and picked up a haversack. They bent down again, and came up carrying two more haversacks, one in each hand."

Tamore approached the men, who looked in their 20s and were wearing jeans and jackets, and asked them what they were doing. "We're students," one said. Tamore accepted the explanation. Six of the young men went off, carrying the haversacks that seemed to be very heavy. Two got back in the dinghy, started the outboard, and shot off into the darkness.

The hotel staffer walked to the back entrance of the Taj, the luxury century-old stone pile facing the harbour near the triumphal Gateway of India built for King George V's tour of his empire's jewel, and started changing into his uniform. Soon after he heard gunshots coming from the fashionable Shamiana restaurant, where Mumbai's business and financial wizards mix with wealthy tourists and Bollywood film figures for late suppers. It began a night of terror that ended when Tamore was guided from his hiding place by police at 4am.

For the attackers, Wednesday night was the culmination of careful preparation that must have begun months earlier, possibly in neighbouring Pakistan. It now appears that some time in the 12 days before the attack, up to 20 young fanatics had overwhelmed the crew of a 14-metre trawler called the Kuber after it sailed on November 14 from the Gujarat port of Porbandar for a 10-day fishing trip.

Capable of only seven or eight nautical miles an hour, the trawler chugged down the coast towards Mumbai, mingling with the hundreds of fishing and trading boats plying the generally calm seas. Several kilometres off the brightly lit "Maximum City", as dubbed by the writer Suketu Mehta, the little vessel stopped, and two inflatables were launched. The attackers sped into the metropolis of 15 million inhabitants, leaving a dead captain on the bobbing trawler and no sign of the four other crew. Carrying their rucksacks of metal ammunition clips, grenades and concealed Kalashnikov automatic rifles, the men were dropped at jetties around the peninsula, close to their targets.

A bit after 9.30, two gunmen went to the Leopold Cafe. Once a haunt of minor underworld figures, Somali traders and wizened Western hippies and made famous in the Australian jail escapee Gregory David Roberts's novel Shantaram , the cafe is now a self-consciously "low-life" locale for backpackers, professionals and aircrews. It even sells its own T-shirt.

From the pavement outside, where vendors were closing up their stalls and laying down mats to sleep, the gunmen opened up with their automatic rifles through the open sides, before tossing in grenades. Two young Australians were among the many injured, lying with about eight dead customers and waiters.

The two then fled down the side street, which leads to the Taj, and joined others to enter via a door normally kept locked but open that night because of weddings and corporate functions. They walked into the lobby, a wide expanse of marble and fountains, and opened fire. Some headed into the Shamiana, spraying gunfire, and trying to single out American and British citizens as captives.

Then they headed up to the residential suite of the hotel general manager, Karambir Kang, showing a familiarity with the detailed layout and passageways of the old building. Kang's wife and two children have been reported killed during the seige and fire that then started.

Among the dead left by the mayhem was the Greek millionaire Andreas Liveras, the owner of a luxury yacht charter business who had come to scout for opportunities. The French nuclear scientist Georges Vendryes, known as the father of the fast-breeder reactor, managed to escape with his wife, as did the Australian cricket lawyer Dean Kino who had come to help prepare the Champions League T20 competition, now postponed.

Another group stormed the lobby of the Oberoi Trident, another luxury hotel on the other side of the peninsula, where guests included a 25-member NSW trade delegation. The gunmen sprayed the lobby with gunfire and tossed grenades as staff and guests fled through the kitchens, before holing up on the 19th floor with foreign and local hostages.

Midway up the peninsula, four gunmen walked into the concourse of the Chhatrapati Shivaji Terminus, the vast neo-Saracenic railway station once named after Queen Victoria. Pulling out their guns, they opened fire at random among commuters getting late trains home, killed about 10 people and left the polished floors awash with gore. The attackers ran off towards the nearby Cama Hospital.

Hemant Karkare, the head of Maharashtra state's anti-terrorism squad, had been summoned from his official flat. A veteran of the elite national police service, he'd taken up the key Mumbai-based position after seven years in Vienna working under diplomatic cover for the Indian external intelligence service, the Research and Analysis Wing or RAW. Already he'd shown a fearless disregard for political pressure, arresting a Hindu holy man and a serving army lieutenant-colonel for a recent bombing in the inland city of Malegaon which had been portrayed initially as an Islamist plot.

Arriving at the railway station, Karkare put on a bullet-proof vest and helmet, and set off in pursuit of the attackers. But he removed them some time before he got to the Cama Hospital and, in a close-quarter clash, died with three bullets in the chest, while two other senior police died alongside him.

The night of slaughter went on, with attackers killing two security guards at the hospital, some seizing a police vehicle and driving through the city shooting at random, and others trying to keep police bailed up inside their headquarters and shooting up the popular Regal cinema. A separate attack caught a rabbi, his family and several Jewish worshippers at the small Chabad Lubavitch centre, back down the peninsula. As Thursday dawned, police were reinforced with truckloads of army and navy commandos from nearby barracks, and elite special forces from the National Security Guard.

As operations proceeded to isolate and overwhelm gunmen and save hotel guests, police and intelligence officials began interrogating three of the captured attackers. Indian press reports quoted Major-General R. K. Hooda, the leader of the operations, as saying the attackers had pretended to come from Hyderabad, an ancient city with a big Muslim population in central India, but they had captured one man who spoke with a Punjabi accent and appeared to be from Pakistan. Some reports named the man as Ajmal Amir Kamal, a resident of Multan in Pakistan.

Even before this information, the precision and planning of the concerted attacks pointed to an expertise beyond the scope of India's domestic extremists. As Jane's Information Group in Britain reported in its Country Risk Daily Report : "From a tactical perspective, most terrorist attacks in India have been carried out through the use of improvised explosive devices planted on bicycles, motorcycles and cars, and triggered by timers or mobile telephones."

To Yogesh Pratap Singh, a former senior policeman now a Mumbai barrister, the sea approach to bring a large number of men and weapons, around the normal surveillance screening, pointed to a link with Pakistan-based organisations. "It seems to be a highly trained operation," he says. "They kept it very secret, they don't allow any information to come out, and they're ready to die: such a wide, comprehensive and immaculate modus operandi is that of al-Qaeda."

The assessment by Jane's Information Group also emphasised that the apparent focus on killing or capturing foreign businesspeople, specifically US and British nationals, had not occurred previously and suggested "a wider global anti-Western agenda" in contrast to national issues that appeared to motivate recent Indian incidents.

A leading Indian intelligence and terrorism expert, the former senior RAW official B. Raman, says sheer expense points to assistance from Pakistan, either its intelligence service, exiled Mumbai mafia figures such as the gang boss Dawood Ibrahim, or al-Qaeda and its Pakistani affiliates. "Indian boys who had taken to terrorism in the name of Indian Mujahideen, they do not have that kind of money at their disposal," Raman says. "I personally feel this has the clear stamp of al-Qaeda."

The Indian Prime Minister, Manmohan Singh, also pointed the finger after an emergency cabinet meeting on Thursday.

"The well-planned and well-orchestrated attacks, probably with external linkages, were intended to create a sense of panic, by choosing high-profile targets and indiscriminately killing foreigners," Singh said in a national TV address.

"It is evident that the group which carried out these attacks, based outside the country, had come with single-minded determination to create havoc in the commercial capital of the country … We will take up strongly with our neighbours that the use of their territory for launching attacks on us will not be tolerated, and that there would be a cost if suitable measures are not taken by them."

This would point to terrorist groups based in Pakistan, such as the Lashkar-e-Toiba, which transferred their attention and deadly expertise from the anti-Soviet war in Afghanistan to undermining Indian rule in its part of Kashmir during the 1990s, with active assistance from Pakistan's Inter-Services Intelligence, at least up until September 11, 2001. These groups have a record of suicide attacks, in Kashmir and more widely in India, including the December 2001 assault on the Indian parliament.

Yet the only early claimant to responsibility for Wednesday's attack was a hitherto-unknown group, the "Deccan Mujahideen", which emailed claims to Indian media via a Russian server. Deccan, the plateau of central India in which Hyderabad is located, seemed to link to the attackers' cover story, while Mujahideen linked to a new terrorist group, the Indian Mujahideen, which had emerged after serial blasts in three northern Indian cities last November. It later claimed to have carried out the July 2006 train bombings in Mumbai, as well as bombings this year in Jaipur, Ahmedabad, and New Delhi.

But the Indian Mujahideen is in many ways even more of a danger for India than groups such as Lashkar-e-Toiba.

It appears to draw on alienated elements among India's vast population of Muslims, numbering 140 million. Its recruits include some young people whose family members suffered in the vicious anti-Muslim pogroms that swept Mumbai and some other centres at the end of 1992, after the destruction of the disputed Ayodhya mosque by Hindu zealots, and in Gujarat in 2002. A wider pool is the Students Islamic Movement of India, a banned organisation of religious purists.

They include many well-educated and well-travelled people, able to find their way around the upper echelons of the global economy and India. Among suspected members arrested in Mumbai not long before this attack were three IT professionals, including one with a senior position in yahoo.com, who had visited the United States.

This would suggest that as well as a sharpened counter-terrorist intelligence performance, India has a huge task of rebuilding faith in its secular politics.

This faith has been eroded by the desultory efforts to sheet home blame for the 1992 Mumbai pogrom against complicit police and politicians, and by the impunity of Gujarat's chief minister, Narendra Modi, and his police for their role in whipping up that state's horrific violence in 2002.

As national elections approach in the first half of next year, Singh's Congress Party Government is struggling to find balance between a Hindu-nationalist opposition, the Bharatiya Janata Party, baying for a crackdown on terrorism and its duty to protect Muslims from oppressive surveillance. Violence between Hindu extremists and Christian converts in eastern states, the growing Maoist insurgency in central regions, and the delicate Kashmir situation add to the precarious security mix.

Yet so far the Indian Mujahideen may just be local cover for outside groups. The attackers, who have been in limited contact with the Indian media, seem motivated by concerns dealing with Kashmir and India's strategic position. "Are you aware how many people have been killed in Kashmir?" asked one attacker naming himself as Imran, who called a TV station from the Jewish centre seige. "Are you aware how your army has killed Muslims?"

In May the Lashkar-e-Toiba head, Abdul Subhan Qureshi, threatened to attack tourist sites unless the Government withdrew its support for the United States, and it has claimed responsibility for the recent bombings in Bangalore, Ahmedabad and Delhi.

This suggests that by striking at India's investment and inflows, the attackers want India to pay a heavy price for its backing of the Karzai Government in Kabul and its detente with Pakistan over Kashmir. Although fragile, the reduction in tension between the two countries allows the Pakistan army to divert forces to fighting the Taliban along the North-West Frontier.

If one result is also a boost to the Hindu nationalists in India's politics and harsher monitoring of India's Muslims, that is not just collateral damage but another wedge into the secular structures that have kept India together for more than 60 years.

Hamish McDonald is the Herald 's Asia-Pacific editor