Nairobi, Kenya - Since its invasion of Somalia in 2011, the al-Qaeda-linked group al-Shabab has vowed to leave Kenya's capital looking like Mogadishu, its streets running with "rivers of blood".
Last month's Westgate attack leaving at least 67 dead and 175 wounded has prompted most Nairobians to take these threats seriously. For four days the front lines of the war between al-Shabab and Kenyan forces played out on Kenyan soil and cut right through the centre of the capital's premier shopping venue. The mall itself looked like a war zone.
The entrance to its biggest store, the Nakumatt supermarket, is now a gaping charcoal-black hole into which most hostages ran. All that's recognisable on the scorched first floor is the distinctive green logo of Safaricom, a telecommunications shop.
Beyond a once-lively carousel, a shaft of light illuminates the pale arm of a mannequin. Though the stench of decaying bodies and rotting meat at markets and restaurants is cleared, a sense of death still persists.
|Mall footage depicts Nairobi siege terror
One month since the attack, the fog of war has yet to clear. Only a fraction of the total CCTV footage has been released, the most telling procured by local media, showing how the insurgents commandeered the mall.
Alleged attackers Abu Baara al-Sudani and Omar Nabhan blasted their way into the main entrance of the mall, while Khattab al-Kene and Umayr al Mogadishu sauntered up the ramp to its upper parking lot and began lobbing grenades and spraying bullets into a crowd at a cooking competition.
The footage seems to conclude that only four gunmen had caused what survivors and the Minister of Interior Joseph Ole Lenku had originally reported might have been up to 15 shooters.
How many attackers entered the mall and how many were killed makes direct implications for the pressing question of whether the assailants escaped and, if so, how many?
But security analysts insist that large numbers of attackers are not needed to explain the carnage.
Farley Mesko, an analyst and chief operating officer at C4ADS, a Washington DC-based security research organisation, references the 2008 Mumbai assault, when two-man teams carried attacks around the city, killing dozens in each location.
Footage also revealed the ineptitude on part of the Kenyan Defence Forces (KDF) while taking over the operation from police, who on some accounts had the gunmen cornered. Instead of engaging with the enemy, however, the police and soldiers were allegedly exchanging gunfire with each other. Perhaps most embarrassingly, CCTV caught soldiers leaving the supermarket carrying bags filled with unidentified items, possibly allowing the attackers to escape, regroup or continue killing innocent civilians.
It also remains unclear why KDF decided to collapse part of the building using anti-tank weapons to contain the attackers. The action has complicated forensic issues of how many attackers were involved, who they were, and what organisations were behind them.
Almost all witnesses say the gunmen were shooting "indiscriminately", suggesting the violence was politically and not religiously motivated. With the exception of rare moments of mercy allowing some hostages to leave, the assailants' aim was to kill as many people as possible.
Of the reported 67 who died that day, 20 were Muslim, members of Nairobi's Asian community told Al Jazeera.
'Too slick' for al-Shabab?
Some commentators say the attack, whatever the number of perpetrators, was too organised to be the work of al-Shabab alone.
Al-Shabab is entirely capable of undertaking complex attacks with or without al-Qaeda's assistance.
"While there's some debate over where one organisation ends and the other begins, [the Westgate] operation seems way too slick for Shabab," said Mesko.
"This [attack] has the sophistication and a high-visibility target, full of Westerners and Kenyan elites, that looks like more the work of al-Qaeda in East Africa than al-Shabab alone. Al-Shabab is fighting an insurgency and uses a different calculus in its target selection. Al-Qaeda only has to prove it exists every once in a while."
Matt Bryden, former coordinator of the UN Somalia Monitoring Group, however, told Al Jazeera he disagrees. "Al-Shabab is entirely capable of undertaking complex attacks with or without al-Qaeda's assistance."
He adds the attack "demonstrates, for the first time, that al-Hijra [Kenya's recruitment arm of al-Shabab] has acquired battle-hardened, dedicated fighters prepared to directly confront security forces and, if necessary, to die in the attempt."
Regardless of whom the perpetrators actually were, the attack shows how easy it is to pull of an act of "political violence" in a region the world considered relatively secure and democratic. A similar false sense of security was made evident by how easy it was for Somalis to penetrate the border to snatch tourists on Kenyan's northern coast. The spate of kidnappings, which included aid workers, prompted Kenya to invade Somalia in the fall of 2011.
Compounding a lack of confidence in Kenya's preparedness and response to the attack were revelations that the National Intelligence Service (NIS) had warned Kenya's top brass and Western intelligence of an impending Mumbai-style terrorist attack.
One situation report - dated September 21, 2012, exactly a year before the mall was hit - warned that al-Shabab was planning an attack on the Israeli-owned Westgate specifically, during the Jewish holidays, along with other Israeli interests in Nairobi.
According to the leaked NIS report dated the same week, "suspected terrorists of Somali origin entered South Sudan through Djibouti, Eritrea and Sudan and are suspected to be currently in Uganda waiting to cross into Kenya".
US and other Western embassies have issued security warnings about the strong possibility of politically motivated assaults in Uganda, where Islamists claimed an attack in Kampala in 2010 that killed 74; the African Union troops now occupying Somalia are comprised largely of Ugandans.
|Somalia faces uphill struggle with al-Shabab fighters
"East African countries will always remain targets of al-Shabab as long as Somalis are not willing to behave," a senior Kenyan intelligence officer told Al Jazeera, speaking on the condition of anonymity for security reasons.
Al-Shabab recently claimed responsibility for a suicide attack reportedly killing up to 20 people at a Mogadishu restaurant popular with Ethiopians. The African Union army also includes Ethiopian soldiers.
Asked for comment on whether Kenya should remove its troops from Somalia to avert another attack, an Israeli manager of a popular business in Nairobi said, "I don't want to say anything political," and held his hands up in the air. "My responsibility is to protect my family, my home and my business."
Ndung'u Gethenji, chairman of the committee investigating the attack, told reporters the two scorched bodies pulled from the rubble inside the shopping centre were "highly likely" to be the attackers, because AK-47s - weapons Kenyan security forces do not use - were found nearby.
One of the suspected gunmen, Hassan Abdi Dhuhulow, has been identified as a Norwegian national of Somali origin, trained in southern Somalia and is believed to be linked to al-Shabab commander Mohamed Abdikadir Mohamed, the target of a US Navy Seals raid near the town of Barawe in Somalia on October 5.
Yet Dhuhulow is not among the original four attackers shown and identified from in CCTV footage, raising the possibility about a fifth attacker.
Regardless of how many assailants there were or whether al-Qaeda was involved, Robert Young Pelton, of Somalia Report and Danger Magazine, puts it succinctly: "With all things African it [the truth] remains confusing, opaque and inexact. What's important [about Westgate] is that Kenya is a much more media-friendly place to wage jihad than Somalia."
Follow Margot Kiser on Twitter: @MargotKiser