"I don’t know how true it is, but [our Nairobi office] got a message from al-Shabab with more details on those responsible for the attack," said Botha. "I was amazed by the number of foreigners involved: two Somalis, a Kenyan, a Swede, one from Finland, one from the UK, 6 from the US, one from Russia and two from Syria.

"If that’s verifiable information, then it’s not only the attack (which has an international flavor) but those behind the attack. With that come other questions: if we think al-Shabab cleaned house and went after foreigners, having such a large number of people involved that are foreigners is quite interesting. It’s still early days…But if it’s true, we have to do a very different analysis."

Observers say part of the effort to end al-Shabab is to dry up funding, which comes from a variety of sources. They include the Somali Diaspora, al-Qaeda, and revenues earned by the group from smuggling, taxes and revenues on the sales of dates, bananas and small livestock from the time it held the Somali port of Kismayu.

But analysts say there’s more, including a network of cultural and religious institutions in Kenya. They include a Kenya-based affiliate from Nairobi’s Majengo neighborhood called al-Hijra, which also has experience fighting in Somalia.

"All of these groups understand which buttons to push, and when," said Botha.

"If I look at Kenya, there is a growing sense of the split between Nairobi and the coast. There is the Mombasa Republican Council that wants to secede because they feel they’ve been treated as second class citizens; the same in Tanzania – with Zanzibar and Pemba that want to separate from the mainland. The root of all of this is effective nation building has not succeeded."