About the background of the attackers:
What we should be certain of, though, is that the Mumbai attackers were combat trained. You do not sustain a military assault for three days, taking only combat naps, unless you know what you are doing. You have to have been shot at before. You cannot be intimidated by flash-bang grenades, or commandos fast-roping down the side of a building. And it is almost certain that the planners of the attack understood that the only way to get into India with the amount of weapons and explosives used in the attacks was by sea — the risk of smuggling them in over land was too great.
About lessons learnt from the attack:
There are two lessons we should be taking away from Mumbai. The first is that all large cities are vulnerable to attack. Even if it doubled the size of its police force, there is no way New York City could could ever protect its hotels, schools or other public buildings from attacks of this type, short of turning them into fortresses. There is no way for the NYPD to prevent a car bombing on Wall Street, sending the stock market into an even worse plunge, or a single suicide bomber from blowing himself up in the subway. Plans are available on the Internet for making bombs like these with ingredients available in hardware stores.
The second reminder we should take from Mumbai is that the longer the wars go on in Iraq and Afghanistan, the more combat-experienced men there will be available to planners of terror attacks. And we should count on the veterans of Iraq and Afghanistan going global — there is no reason they could not blend into the waves of immigrants crossing the Mediterranean from Northern Africa to Europe every day.