How phone calls helped catch two Westgate mall terror suspects

Just like Abdi, detectives helped track down Mustafa using his phone number, managing to arrest him in Wajir as he plotted to flee the country.

“…There was a terror act,” Chief Magistrate Francis Andayi ruled as he convicted the two for acts of terror, which led to the loss of 68 lives.

It was a rare victory in the courts against terror, with the Office of the Director of Public Prosecutions announcing that “the judgment marks an end to seven years’ wait for justice.”

However, the two, who were convicted for the offences of conspiracy to commit a terrorism act and being in possession of material promoting terrorism, were just helpers in the terrorist act and not directly involved in that attack.

Mustafa was the individual captured alongside the attackers by bank CCTV cameras as they made a transaction for the purchase of the motor vehicle used to ferry the attackers to the mall.

Lack of evidence

The judge released Liban Abdulle Omar alias Liban Abdullahi Omar, alias Adan Mohammed alias Adan Abdikadir alias Aden Dheq, a refugee, who was found not to have played an active role in the attacks, becoming the second suspect to be released for lack of evidence out of the four charged in connection with the terror act.

Police identified the mall attackers as Mohamed Abdinur Said, Ahmed Hassan Abubakar, Yahye Osman Ahmed and Hassan Mohamed Dhuhulow.

The last call to be made to the four al-Shabaab terrorists who were killed at Westgate in Westlands, Nairobi, was at 12.30pm on September 21, 2013.

The call data produced in court by cybercrime detectives shows that the attackers were in constant communication with the two men who were convicted in the judgment delivered yesterday.

The magistrate ruled that telephone gadgets and sim cards got from the vehicle that was used by the terrorists to drive to Westgate were used by police in identifying the accused.

“Telephone communication trail of the terrorists from Eastleigh to the Westgate mall placed Mohammed Ahmed Abdi and Hussein Hassan Mustafa at the centre of the attack,” ruled chief magistrate Andayi.

Communication with terrorists

Mr Andayi said police established that telephone numbers registered in the names of the accused were used in communicating with the four terrorists.

Mr Andayi said Abdi made 226 telephone calls, including on the day of the attack, to Ahmed Hasan Abubakar who was killed in the mall attack ruling that the prosecution had proved beyond reasonable doubt that the accused conspired with the terrorists to execute the mall attack. “The accused and the terrorists were in constant telephone communication until they blew up their target,” Mr Andayi said when he analysed the evidence tendered by 46 witnesses.

The magistrate reserved his sentence until October 22, 2020 to await a victims impact report sought by the DPP’s office.

“I urge this court to call for the victims’ impact report as their views need to be incorporated and considered by the court before sentence is handed down,” said Mr Edwin Okello, the lead state prosecutor.

Besides the victim reports, the convicts lawyers Victoria Kariuki and Chacha Mwita for Mustafa also called for a pre-sentencing report from the accused and their relatives.

The trial started on Wednesday, January 15, 2014, with the courthearing from various witnesses.

The magistrate said witnesses to the terror attack said the attackers were in full combat gear.

“They shot at people indiscriminately until police came to our rescue,” Mr Andayi quoted a hair dresser identified as Thomas Ndung’u.

However, despite the conclusion of the case, the trial ended without bringing to justice key perpetrators who financed and commandeered the attack from outside the mall.

Whereas the big men were not brought to book, investigators managed to present to court four suspects, among them a tailor and a small-time businessman in Eastleigh who ran a madrassa and was acquitted by the courts in January 2019.

Guns and ammunition

Individuals who bought the guns and ammunition used during the attack also remain a mystery to date.

After the attack, detectives discovered a FH Hestal rifle, two empty G3 rifle magazines, one AK47, three G3 rifles, 11 loaded magazines for G3 rifles and two burnt AK 47 rifles at the mall.

Abdi, who hails from Ijara, Garissa County, was arrested on September 30, 2013 in Kitale on his way to the Kakuma Refugee Camp.

A forensics analysis on a laptop found on him, done by Sergeant Joseph Kolum, uncovered jihadist videos and a search history revealed he frequently visited jihadist websites.

A forensics analysis of mobile phone communications revealed that Abdi was in communication with the attackers 321 times between June 19, 2013 and August 26, 2013, weeks before the terror attack.

Mustafa was arrested on his way to Wajir, with investigators claiming that his intention was to run away from Kenya.

Regular contact

Following mobile phone analysis, call data records revealed regular contact among the convicts and the terrorist who entered the mall first, Mohamed Abdinur Said.

Photos obtained from the Uganda Pisces system, a digital identification system installed at points of entry and exit in airports, and from passport records indicate that Abdinur was born in 1993, and was only 20 years old when he helped lead the mass murder at Westgate.

According to the documents filed in court, Abdinur left Somalia for Uganda on June 17, 2013, arriving at Entebbe in the evening. While in Uganda, he made frequent calls to Abubakar, the second mall attacker. He was also in contact with Abdi.

Two days later, on June 19, 2013, Abdinur left Uganda for Somalia on a flight via Nairobi and Wajir.

From Uganda

On June 24, 2013, Abdinur reappeared on the radar once again when he travelled from Somalia to Uganda where upon landing he made his first call to Abdi and then spoke to Dhuhulow, the fourth attacker.

Two days later, on June 26, 2013, Abdinur travelled to Kenya from Uganda by road. On this particular day, he only spoke to Abubakar, the second attacker and Dhuhulow.

Between July 6, 2013 and July 10, 2013, Abdinur made several phone calls with Somali telephone numbers and the convict Abdi.

A report on the investigations signed November 20, 2015 — two years and two months after the attack — did not mention names of other conspirators, perpetrators and financiers of the attack.

Instead, the “Westgate Terrorist Attack: Investigations and Analysis Report,” prepared by Sergeant Paul Maingi of the Directorate of Criminal Investigations, a surveillance and analysis expert, said the attack was carried out by four attackers assisted by the four accused persons and “others not in court”.

The reported hinted at the involvement of other individuals in a terrorist network spread in Kenya, Somalia, Norway, Saudi Arabia, Uganda, USA and South Sudan.

According to the investigators, as the attack progressed, Dhuhulow was in communication with a Norwegian mobile phone number, which he had also called four days before the attack.

According to documents filed in court, the mobile phone number was roaming in Egypt.

The investigators did not unearth the identity of the individual with the Norwegian phone line.

Dhuhulow also communicated several times with various phone numbers in Somalia during the attack until 11:13am on September 23, 2013 when he made the last call. One of the numbers he is believed to have called was that of Abdukadir Mohammed Abdukadir alias Ikrima, a Kenyan-born Somali who is an al-Shabaab commander.

Kenyan intelligence reports also linked Ikrima to Samantha Lewthwaite, the British widow of Germaine Lindsey, who was one of four suicide bombers who attacked the London transport system on July 7, 2005, and who was suspected to have played a hand in the Westgate mall attacks. Her whereabouts remain unknown.

Investigators in their report did not indicate if Ms Lewthwaite was involved in the Westgate attack.

Detectives pointed out at a fifth suspect, whose mobile phone number was registered during the purchase of the motor vehicle used during the attack.