One regional and at least two foreign intelligence services had picked up communication in 2012 that suggested Al-Shabaab was planning a major attack in Nairobi and surveillance on one woman terrorist specifically identified Westgate as a possible target.
Classified UN Security Council documents reveal that as far back as 2011, Al-Shabaab appears to have identified the Westgate Mall as a potential target, and intelligence about communication among associates of the terror group was shared with the Anti-Terrorism Police Unit (ATPU) in 2012 warning about an impending attack.
But it would appear security services failed to act on the intelligence and Al-Shabaab terrorists continued planning the “Badru Nairobi Operation”, which would later unfold as the Westgate attack on September 21, 2013, in which 67 people were killed following a four-day siege on the upscale shopping centre in Westlands.
Nation.Africa can today, on the eighth anniversary of the attack, reveal a series of leads that intelligence services ignored and which, if they had been acted upon, could have averted the deadly attack.
Specifically, one such clue was an intercepted communication in which a senior Al-Shabaab operative in 2012 asked associates in Nairobi for information about a security assessment of Nairobi and specifically operational information on Westlands, including the level of security.
And frequent visits to Westgate by a woman Al-Shabaab operative, including on the day of the attack, gave away the mall as a possible target, but none of this information was pursued to try to disrupt the evil plot.
Mr Abdul Haji, a licensed gun holder, beckons Portia Walton, 5, to flee from danger at the Westgate Mall on September 21, 2013, after she was separated from her mother and siblings during the attack.
Failure to act on the warnings is largely blamed on the mistaken belief in Kenya, “which appeared to be borne out of a series of failed aspirational plots by affiliates such as Al-Hijra, that ‘complex and spectacular’ attacks were impossible”.
This information is contained in a pile of documents that Kenya submitted to the International Court of Justice (ICJ) in the Indian Ocean boundary dispute case with Somalia, to back its position that the porous borders had abetted terrorism.
One of the documents, a report dated October 13, 2014 of the Monitoring Group on Somalia and Eritrea pursuant to Security Council resolution 2111 (2013), S/2014/726, details the telltale signs of an imminent attack that security services ignored since 2011.
The documents cite "Operation Linda Mpaka", a Kenya Defence Force (KDF) covert operation inside Somalia that had rattled the terrorist group.
Police take cover at Westgate mall during the terror attack on September 21, 2013.
This was before the publicly declared "Operation Linda Nchi" in October 2011 when President Kibaki announced Kenyan troops were moving into the war-torn nation to pursue the militants who had rocked Kenya’s tourism sector with attacks on foreigners on the Coast.
A series of public declarations by Al-Shabaab core leaders and a senior Kenyan 'Amir', the Amir of Al-Hijra in Somalia, all provided strong indications of the group's attack inside Kenya comparable to the Badru Operation.
An example of such a credible warning was on January 7, 2012 by the Al-Hijra Amir, 'Abu Zinnirah'.
In a video warning from Somalia, he ranted: "But if they seek your help in religion, it is your duty to help them” and categorically declared that Kenya was a “war zone”.
The significance of Shabaab’s Westgate attack lies partly in how it seemed to signal a change of tactics for the terror group.
Probably, in an attempt to underscore the warnings, the Monitoring Group believes that Ahmad Iman, using the nom de guerre ‘Abu Usama’, three months later in the Al-Shabaab Kiswahili magazine Gaidi Mtaani published an article titled “Levelling the scales”.
In it he warned: “…look at how vulnerable Kenya is…we have tourists, shopping malls, bars etc…just imagine how we can compromise your economy, kill one ‘mzungu (white person) and they all run away…just imagine.”
The report noted that while often Al-Shabaab’s public declarations amounted to propaganda, and offered little or no intelligence warning value, information acquired by the Monitoring Group and routinely shared with two branches of the Kenya security apparatus, including the Anti-Terrorism Police Unit (ATPU) in 2012, suggested Al-Shabaab's determination to conduct a major attack in Kenya.
“Credible information from this period confirms that senior Al-Shabaab commanders through Al-Hijra commanders were in regular contact with associates in Nairobi concerning potential plots/attacks,” the report states.
This was based on corroborated information provided to the Monitoring Group by a source directly in contact with Al-Shabaab commanders in 2012.
“The Monitoring Group can also confirm that some of these Nairobi-based associates were targets of electronic surveillance by one regional intelligence service and possibly at least two foreign intelligence services operationally active in the Horn of Africa,” discloses the report.
On March 30, 2012, at about 8:00pm, a known senior Al-Shabaab commander named "Ibrahim" called a ‘Nairobi associate’ asking for a security assessment of Nairobi.
"Ibrahim" called again days later to request specific operational information on Westlands such as its size, population and level of security.
According to the report, in April 2012, corroborating information by a government official in relation to phone calls from Somalia to an Al-Shabaab 'Nairobi associate' was provided to the Monitoring Group.
“The Monitoring Group is also aware of another potential indicator and warning in relation to possible useable intelligence pointing to the Westgate Mall attack,” the court papers went on.
This was the suspicious but equally circumstantial activity of "M", a known Al-Shabaab/Al-Hijra-linked female logistician.
In 2013, "M" played a peripheral and liaison role in a conspiracy to transport explosives from Tanzania into Kenya aimed at disrupting the Kenya elections on March 4, 2013.
“In addition, since 2012, the Monitoring Group closely monitored “M”’s regular and suspicious routine visits to Westgate Mall, which have included weekend visits,” the documents reveal.
On September 21, 2013, at 3:16pm during the Westgate siege, a close associate of Ábu Zinnirah, the Barawe-based Amir of Al-Hijra, and a Facebook associate to “M”, sent the following message to “M”: “Sis, u ok? Plz tell me no coffee 2day.”
On the second day of the siege, at 9:12am, “M” responds: “Walkm slm, Alhamdulillah, had just left Westgate with my coffee and the shooting started. Alhamdulillah.”
That afternoon of September 21, a group of armed attackers (and most likely an unarmed support cell) pulled up at the main entrance of the Westgate Mall, driving a Mitsubishi Lancer with the registration plate KAS 575X.
They immediately began throwing grenades and shooting at bystanders. Then they stormed into the main mall to indiscriminately target shoppers.
The four armed terrorists were Mohamed Hassan Dhuhulow, Khatab Al Kene, Umar Al Mogadish and Omar Nabhan. They laid siege on the mall for four days.
Hours into the attack, Al-Shabaab claimed responsibility via its official Twitter handle.
The report by the Monitoring Group stated the terror operation, conceived in Somalia, planned from a United Nations refugee camp and executed from Eastleigh in Nairobi, signalled the widely anticipated operational shift of the Somalia-based terrorist group.
It marked a departure from “soft targets” to “complex and spectacular” large-scale attacks beyond Somalia, drawing on, where practical, a combination of Al-Hijra resources (in Kenya) at the peripheral level and the operational discipline of Al-Shabaab core Amniyat-like operatives on the other.
Two operational planners in Somalia, Abdukadir Mohamed Íkrima’ and Sultan Mohame Sandhre Úkash, have been linked to the attack.
The Monitoring Group concluded that one of the reasons for selecting Westgate as a target was the high number of Westerners frequenting it daily.
Crucial to Al-Shabaab's tradecraft in preparation for the Westgate attack was its exploitation of the lax procedures in obtaining mobile phone lines in Kenya in 2013.
To date, the Monitoring Group has been able to identify at least eight Kenya-issued mobile numbers and a network of potentially Somalia-linked numbers.
These numbers are either assessed to be associated with the 'infantry attackers' (who were inside the Westgate Mall from 21-24 September 2013) or part of the support/facilitation tier attack.
A month after the attack in Nairobi, Al-Shabaab attempted to target Addis Ababa, Ethiopia.
“Al-Shabaab’s meticulous and incremental planning to carry out violent attacks involved the reassigning of Amniyat-like operatives from Kenya, Somalia, Somaliland and possibly Yemen to Addis Ababa in the form of the ‘Bole Rwanda cell,” says the report.
This included an Al-Shabaab operative assuming the identity of a United Nations worker and another using his membership of the Puntland security forces and patronage from the Puntland authorities to conspire against Ethiopia.
The plot, if executed as planned, would almost certainly have resulted in Al-Shabaab breaking its long operational deadlock inside Addis Ababa.
“Owing to enhanced security, however, in the final hours leading up to an attack that would have caused mass casualties, Al-Shabaab was compelled to abort a ‘complex and spectacular’ attack on 13 October 2013, less than a month after the Westgate shopping mall attack,” the report discloses.
Before the Westgate attack, Kenya’s National Intelligence Service (NIS) and the Directorate of Military Intelligence (DMI) had demonstrated their capacity, both analytically and operationally, in containing a majority of Al Shabaab’s “complex and spectacular plots,” according to the documents.
“However, based on the Monitoring Group’s own investigations over the course of successive mandates, it has become aware of plots by Al-Shabaab, many of which have been disrupted by the Kenyan security agencies but equally served as potential intelligence indicators and warnings pointing to the Badru Nairobi Operation.’
