The attackers of the dusitD2 complex in Nairobi planned to livestream the drama there as part of efforts to show their might.
But the plan flopped after they failed to get airtime and bundles for the mission on time and got there late.
The gang was at the same time scouting for an alternative target up to the last day of the attack.
A report filed by the government before the International Court of Justice (ICJ) says a delay between the detonation of the suicide bomber and the arrival of the four gunmen was due to the latter’s purchase of credit for their mobile phones, likely to enable them to stream footage and contact others in the likely event of a prolonged siege once security forces arrived.
The attack came in the wake of an earlier attack planned on key government installations in Nairobi using a vehicle-borne improvised explosive device (VBIED), containing approximately 100kg of explosives.
In 2018, police had disrupted a similar attempt when they intercepted a VBIED destined for Nairobi near Merti, Isiolo county.
“The operation had likely been originally been planned to coincide with the second anniversary of the El Adde attack,” says the report.
Investigations revealed links between the organisation of the two operations, including a common financier based in Mandera and the identical origin of a Type 56-2 assault rifle used by one of the dusitD2 gunmen.
The report says it is likely al Shabaab learned lessons from the failure of the Merti plot and adapted their tactics to carry out the successful dusitD2 operation.
THE ATTACK
On January 15, 2019, al Shabaab militants attacked the commercial business complex in Nairobi containing the dusitD2 Hotel.
The attack began at 3:28pm with the detonation of a suicide bomber, Mahir Riziki. Four gunmen — Ali Salim Gichunge, Osman Ibrahim Gedi, Siyat Omar Abdi, and an unknown individual — then proceeded to attack the compound using AK-pattern rifles and grenades, targeting people within the dusitD2 hotel and surrounding shops.
The terrorists’ images emerged last year in December, when al Shabaab released a seven-minute clip showing them preparing to attack the complex.
The attack resulted in 21 civilian deaths as well as the four gunmen.
According to investigations, al Shabaab dubbed the operation Al-Qudsu Lan Tuhawwad (“Jerusalem will never be Judaised”) and stated that it had targeted “western and Zionist interests worldwide and in support of our Muslim families in Palestine”.
This rhetoric was atypical for al Shabaab, which typically justifies its attacks based on the presence of foreign troops in Somalia.
The DusitD2 attack was the most significant operation carried out by al Shabaab in a regional Member State since the Garissa University College massacre of April 2015.
Officials say the DusitD2 attack was carried out on a significant date, coinciding with the third anniversary of al Shabaab’s overrunning of a Kenya Defence Forces (KDF) base in El Adde, Gedo region.
Investigations have shown the plan to launch the attack was mooted in 2015, when the cell leader Gichunge travelled to Somalia.
THEIR TRAVELLING
In March 2018, facilitators in Jilib, Somalia, organised a fake ID for Siyat Omar Abdi and a month later in April 2018, Gichunge and his wife Violet Wanjiru established a safe house at Guango Estate, Muchatha, Kiambu county.
On December 15, 2018, an unknown attacker travelled to Eastleigh, Nairobi, from Dadaab refugee camp.
On January 2, 2019, Osman Gedi Ibrahim travelled to Roysambu, Nairobi, from Danaba, Northeastern.
On January 5, 2019, Siyat Omar Abdi travelled to Eastleigh from Dadaab refugee camp.
On January 10, 2019, Osman Gedi Ibrahim moved to the safe house on the outskirts of Nairobi.
On January 11, 2019 suicide bomber Mahir Khalid Riziki travelled to the Nairobi safe house from Somalia through El Wak. Riziki crossed the border from Somalia to Kenya through El Wak on January 11, 2019.
He activated a Kenyan phone registered in the name of “Hibo Ahmed” that same morning, immediately placing a call to Somalia.
At 18:21, Riziki placed his first call to Gichunge, arriving at the safe house in the outskirts of Nairobi later in the evening. Except for his Somali contact and Gichunge, Riziki placed calls to only one other number from the time he entered Kenya until his death four days later, thereby limiting his exposure to police.
On January 13, 2019, Siyat Omar Abdi and the unknown attacker moved to the safe house.
On January 14, 2019, the entire cell assembled at the safe house on the day prior to the attack.
On the day of the attack, the suicide bomber arrived at the complex at 3:14pm, and between that time and 3:25pm, he exchanged six calls with Gichunge, averaging 30 seconds each.
On the day of the attack, Riziki departed the safe house via taxi at approximately 2:15pm.
At about 3:21pm, the four suicide gunmen, Gichunge, Omar, Ibrahim and the unidentified Somali attacker, arrived in a Toyota Ractis, registration KCN340E.
They changed into black outfits.
At 3:28pm, Riziki detonated himself outside Secret Garden restaurant, and four minutes later, the four gunmen walked into the dusit complex and begun throwing grenades and firing indiscriminately.
In three minutes, security forces arrived at the scene.
On January 16 at 8am, the four gunmen were cornered and killed.
Officials believe it was Riziki’s first and only visit to dusitD2, likely indicating he required specific instructions from Gichunge regarding the layout of the complex.
Gichunge and his wife Violet Wanjiru established the safe house about nine months prior to the attack.
Other members of the cell stayed at the bungalow sporadically in the lead-up to the attack, with all the attackers coming together at the house the night prior.
Police recovered phones, a laptop, flash disks, SIM cards and an Internet router from the safe house.
Investigations revealed communications between Gichunge and a cell coordinator based at the al Shabaab ‘capital’ of Jilib, in Middle Juba region.
The coordinator in Jilib had arranged for the manufacture of a falsified secondary school identity card for one of the non-Kenyan attackers, Dadaab refugee camp resident Siyat Omar Abdi.
The falsified document identified Siyat Omar Abdi as a student at Arabia Boys Secondary School, located in Mandera.
The school was attacked by Al-Shabaab in October 2018, resulting in the deaths of two non-Muslim teachers.
THE MERTI RECOVERY LINK
On February 15, 2018, Kenyan police on a routine patrol in Merti division, Isiolo county, spotted a vehicle stopped by the side of the road before a fire exchange happened, killing Mbarak Abdi Huka, alias Sa’ad.
Four individuals attempted to flee the scene and two were arrested, Abdimajit Hasan Adan and Mohammed Osman Nanne.
The vehicle, a 2003 Mitsubishi Airtrek, had been converted into a vehicle-borne improvised explosive device (VBIED) containing approximately 100 kg of explosives.
Also discovered in the vehicle were 5 Type 56-2 AK-pattern assault rifles, 36 magazines of ammunition, 36 unprimed F1 grenades and their firing pins, three knives and an al Shabaab flag.
The operation appeared to have been patterned after the modus operandi of al Shabaab complex attacks in Somalia, whereby a VBIED would have been used to breach the perimeter of an unknown target, followed by a wave of ‘suicide gunmen’.
In this case, the number of rifles recovered from the vehicle most likely point to the possibility of five suicide gunmen.
According to police, the Merti plot was orchestrated by an al Shabaab operative based in Jilib, known only as “Dere” (tall), who personally conveyed instructions to Abdimajit Hasan Adan and Mohammed Osman Nanne. Dere also either personally provided cash to the two operatives or arranged for large installments of up to $9,000 to be sent to them from Somalia via hawala transfer.
The Merti attack had likely been intended to take place in Nairobi on January 15, 2018, to coincide with the second anniversary of al Shabaab's killing of 150 soldiers at a KDF base in El Adde, Gedo region.
However, al Shabaab operatives experienced a number of delays in the execution of the plot, including a mechanical failure that forced them to abandon an initial VBIED and construct a second device.
According to the report, there are two indications that the Merti and dusitD2 plots involved a crossover in al Shabaab planning networks.
First, a financier of the dusitD2 plot based in Mandera had previously transferred funds to Abdimajit Hasan Adan and, in addition, a Type 56-2 assault rifle used by one of the dusitD2 gunmen originated in the same arms consignment delivered to the FGS in 2013 as four rifles recovered from the Merti plotters.
LESSONS LEARNED
It is likely the dusitD2 cell adapted their behaviour in response to the shortcomings of the Merti operation.
First, rather than constructing a VBIED, the dusitD2 attackers employed a person-borne improvised explosive device (PBIED).
The PBIED was easier to conceal and did not risk the mechanical risks inherent with a vehicle loaded with explosives undertaking the 800km journey from the Kenya-Somalia border to Nairobi.
Instead of using the same route as the Merti VBIED, the dusitD2 attackers altered their route from northern Kenya to Nairobi, bypassing the area where the Merti VBIED had been intercepted by security agencies.
Al Shabaab leaders in Somalia also used a financial intermediary based in Mandera to transfer funds to the operations cell in Nairobi.
The transfers were completed through cash and M-Pesa mobile money.
Gichunge was given wide autonomy with respect to the target and the plan of attack, and unlike the cell leader of the Merti plot, Gichunge did not communicate directly with individuals based in Somalia, reducing the likelihood of detection.
Up to one day prior to the dusitD2 attack, the al Shabaab cell was continuing to scout possible alternative targets.
Additionally, due to the possibility of his presence compromising the operation, Gichunge used a dedicated mobile phone line to contact Riziki, who was already known to the Kenyan security services.
