Vital clues in car that was to burn outside Westgate Mall

When the Anti-Terrorism Police Unit (Atpu) officers found the car, it was still intact, with the attackers’ trash in place.

Terrorism scholars call the investigative technique employed by Kenyan detectives “trash cover”, for it involves analysing discarded material.

That morning, the four attackers had sprinkled petrol inside the car. They also carried a matchbox. Either, detectives later speculated, the last terrorist out of the car made the mistake of closing the doors — thus extinguishing the fire — or failed to light the matchbox, which was found on the floor of the car.

Perhaps still, they may have misplaced the matchbox. A jerrycan with fuel was in the car.

As William Dyson, in his book “Terrorism: An Investigator’s Handbook”, says: “Trash cover can provide intelligence upon which other investigative techniques can be employed. Trash cover can also produce evidence that will confirm the results of other investigative techniques.”

For Westgate, it did, and Chief Magistrate Francis Andayi accepted it as circumstantial evidence and convicted the terrorists’ conspirators. 

“This car was the turning point in our investigations,” admits Mr John Gachomo, the current head of the Atpu, within the Directorate of Criminal Investigations (DCI) — and which spearheaded the “trash cover” investigations.

When the attackers struck, Newton Mwiti, then the Atpu deputy officer in charge of Nairobi, was upcountry. He drove back and was assigned to Team 3, which was to collect evidence on the third floor of the mall once the threat had been eliminated.

But with the military operation to flush out the terrorists taking two days — with the siege ending on September 25 — Mr Mwiti had started to look at all the cars parked or abandoned around the mall for any clues.

Earlier, Sergeant Ezekiel Luseli, Mr Mwiti’s colleague in Team 3, had peeped into an abandoned car and was intrigued: there was a grenade safety pin on the back seat. He beckoned Mr Mwiti over. 

In terror attacks, parked and abandoned cars can turn deadly. Of late, and especially in Somalia, vehicle-borne improvised explosive devices (VBIEDs) have been used to cause either primary or secondary damage.

When officers from the DCI’s Bomb Disposal Unit (BDU) were called, their first task was to secure the car and preserve the evidence within.

“We first did an X-ray of the vehicle and analysed the images to check whether there were any devices attached. After making sure there were no explosives, the vehicle was then remotely opened,” said an officer involved in the delicate operation to open the car.

The bomb unit, established in 2002, detonates or defuses bombs and carries out post-blast investigations, which aids the Atpu in tracking down suspects. 

Armed with digital X-ray scanners and mobile bomb-detecting robots that had been donated by the US, Westgate was one of the major assignments carried out by the Kenyan officers. 

Once the robot opened the car boot, it retrieved suitcases. Inside were tyre tubes that had been used to conceal arms and ammunition.

Mr Luseli and Mr Mwiti – both dressed in plastic suits so as not to contaminate the evidence – were given the task of opening the vehicle when it was cleared by the BDU.

Sim card holders

They were astounded by the smell of petrol, or perhaps a flammable substance, sprinkled on the seats. There was also a matchbox on the floor of the car.

They also discovered two black wallets with five sim card holders but no sim cards. These would later be used to reconstruct the Westgate mall attack puzzle.

“When we analysed these cards in our systems, each serial number produced the related mobile number,” said detective Paul Mumo, who led the analysis. “The data also revealed the owners of the cell phone lines and their ID numbers.”

Chief Magistrate Andayi in his ruling said: “Communication with the attackers (by Hussein Mustafa, a tailor who made the attackers’ vests to carry ammunition and grenades, and Mohammed Abdi, who got them accommodation in Eastleigh) was giving them support in their endeavours … they were acting in concert with active attackers.”

The chief magistrate identified Mohamed Abdinur as the attacker who “encrypted them into the conspiracy”.

On the day of the attack, the terrorists discarded all the numbers they had used in Kenya and East Africa.

Also on the floor of the car was a yellow-fever vaccination certificate, cut into small pieces using scissors. Also shredded were money transfer receipts using the Xawaal (Hawala), a popular and informal value transfer system loved by al-Qaeda-affiliated terrorists – and NGOs – since it doesn’t involve movement of cash.

For five days, in a room at the DCI headquarters, two detectives painstakingly put back together all these pieces, and finally, they were able to trace the numbers used to transfer the money through Amal Express, an Eastleigh-based Hawala, one of the biggest in Kenya. It also revealed the sender to be Mohamed Abdinur of Eastleigh, Nairobi.

There were also two exercise books with some names and telephone numbers of various contacts. On the back seat were two grenade safety pins and a box with a single bullet of calibre 7.67mm normally used in AK-47 rifles. 

Some 200 empty bullet boxes (packets) were on the floor, an indicator of how much ammunition the attackers had. With each box carrying 100 bullets, according to detectives, it means that the attackers had 20,000 bullets. But whether they had all been used in Westgate was not known.

It was after the terrorists were all eliminated that the full picture started to emerge. 

Mr Lawrence Nthiwa, a firearms examiner at the Firearm Laboratories at the DCI headquarters, examined the damaged rifles – the result of the blast that killed the attackers – to ascertain what they were: two Belgian FN rifles, two Chinese AK-47, two Romanian AK-47 and two G3 rifles.

Also retrieved from Westgate, among other items, were 16 rifle magazines, 927 exploded cartridges and 131 assorted live ammunitions.

Another piece of evidence was the car insurance sticker that was still displayed on the windscreen – providing detectives with primary evidence. Whoever had paid for this policy must have had connections with the terrorists, reasoned the detectives.

Evidence adduced in court indicated that the car had been bought by Abdikadir Hared, a madrasa teacher at Tul-Salma-al-Faris in Eastleigh. 

While ATPU officers never caught Hared, they managed to build a profile of the man. They also had his photo. What they gathered was that while Hared had bought the car, the insurance was taken by a man known as Sugow Subow, who was, also, never found.

Detectives found that the number listed as the contact for Subow had also been used by one of the attackers – Abukar – referred to in court papers as Attacker Number 3. 

On September 6, 2013, some two weeks to the date of the attack, Mr Samuel Sila, a mechanic at the Njomakin Garage in Buruburu was, at around 3pm, approached by two Somali men who wanted to buy a car.

Wanted vehicle urgently

They introduced themselves as Mohamed and Abdi Mohamed. After negotiation, they agreed on a price of Sh340,000 immediately. While they wanted to pay cash, the car owner, Mr Elvis Wenllow asked them to deposit the money into an account at Barclays Bank’s Queensway Branch in Nairobi. 

“They did not give any reason why they wanted the vehicle urgently,” the car owner would later tell the court.

Queensway Branch operates until 8pm and Ms Grace Wamuru was one of the tellers when Mr Wenllow arrived with $4,000. She rejected one of the 100 dollar bill and the customer deposited $3,900.

CCTV images show the two terror suspects entering the bank. After depositing the money — and briefly arguing over the exchange rate — Mohammed and Abdi went to the parking lot where they inspected the car they had bought.

They also signed a sale agreement that gave details of the buyer as Hussein Abdi. The witness was Mohammed Hussein who gave his number as 0722446991. But that number was registered to Abdikadir Hared, born in Mandera and still at large.

DCI detectives traced Hared’s wife Zulekha, but found that they were divorced. The man who witnessed the divorce was Adan Abdikadir, alias Adan Dheq – the man who was in contact with Attacker Number 1, Abdinur, after he arrived in Nairobi. 

Abdikadir said he was employed by Hared at his madrasa on Mayuyu Avenue, Eastleigh, and had also signed his divorce papers. He denied harbouring the terrorists.

When ATPU officers finally knocked on his door at Saxanxa plaza in Muyule Lane, Eastleigh, he was with his wife and daughter. The officers searched the house, took his sim cards and phone and left with him. He was the third accused. 

Chief Magistrate Andayi ruled that communication between Abdikadir and Hared could not be used as circumstantial evidence. “It could be within an innocent employer-employee relationship.” 

The court also set free a brother of one of the attackers on account that they could have been discussing family matters.

It also found procedural irregularities in the issuance of his identity card – which he said cannot be blamed on him. 

But Mr Andayi found Mustafa and Abdi guilty thanks to the evidence that had been left in the abandoned car. Had the car been torched successfully, most of that evidence would have disappeared.

On the eve of the attack, Hared communicated with Adan Mohammed Ibrahim and vanished – never to be seen again.

Tomorrow: How the terrorists left Eastleigh for Westgate Mall