The terrorists who planned and executed the Westgate Shopping Mall attack in 2013 exploited the lax procedures in obtaining mobile phone lines in Kenya.
Local and international investigators have established the al-Shabaab's tradecraft in preparation for the Westgate attack led to the issuance of eight mobile numbers and a network of potentially Somalia-linked numbers.
These numbers were either assessed to be associated with the 'infantry attackers' (who were inside the Westgate Mall from 21-24 September 2013) or part of the support/facilitation tier used in preparation for the attack.
A report by the UN Security Council Monitoring Group says that from the eight Kenyan-issued numbers identified, seven were found to be geo-located at the Westgate scene on either 21 September or through to 23 September 2013.
Five of the numbers were apparently all activated and switched on within the deployment/attack' phase between 17 and 21 September 2013 in Eastleigh in Nairobi.
This is in addition to six of the same numbers all being registered under indigenous names ("Kiswahili names").
At least six of the numbers were all registered with the Mpesa money transfer service but with either actual or operational names ("Somali names").
“This is also suggestive of possible collusion of mobile phone vendors,” the report says.
In addition, information collected indicates that some of the al-Shabaab operatives had adopted the tradecraft of borrowing mobile handsets as part of their preparation for the attack.
The operation, conceived in Somalia, planned from a United Nations refugee camp and executed from Eastleigh in Nairobi, signalled the widely anticipated operational shift.
It marked a departure from “soft targets” to “complex and spectacular” large-scale attacks beyond Somalia, drawing on, where practical, a combination of Al-Hijra resources (in Kenya) at the peripheral level and the operational discipline of Al-Shabaab core
On 21 September 2013, four masked gunmen attacked the Westgate shopping mall, an upscale mall in Nairobi, Kenya and killed about 70 people.
“Badru Nairobi Operation” was commonly known as the Westgate shopping mall attack of September 2013 by the terror group.
And since then, the war on terrorism changed.
Investigations show some of these Nairobi-based associates were targets of electronic surveillance by one regional intelligence service and possibly at least two foreign intelligence services operationally active in the Horn of Africa.
According to investigations, the facilitation cell drawn from al-Shabaab's 'safe haven' in Kakuma UNHCR refugee camp and included Mohamed Abdi Noor, Siyad Salat Ahmed, and Liban Abdulle Omar.
The infantry cell included Mohamed llauaa Dbubulow, Khatab Al Kelle, Umar Al Mogadisb and Omar Nabhan.
According to the report, by the end of 2013, al-Shabaab’s regional strategy had become apparent, which is a resurgent extremist group sufficiently assertive to fully align itself with and pursue strategies adapted to transnational Al-Qaeda operations.
On 30 March 2012, at about 8:00 pm, a known senior Al-Shabaab commander "Ibrahim" called a 'Nairobi associate' asking for a security assessment of Nairobi. "Ibrahim" called again days later to request specific operational information on Westlands such as its size, population and level of security.
The Monitoring Group says another potential indicator and warning in relation to possible useable intelligence pointing to the Westgate Mall attack was the suspicious but equally circumstantial activity of "M", a known al-Shabaab-linked female logistician.
This gave an indication the terror group had identified the mall as a potential target.
Officials say the intelligence about the communication among the associates of the terror group was shared with Kenyan security agencies but they failed to act on the same.
The female logistician frequently visited Westgate for surveillance and kept communicating with the planners in Somalia.
The report was filed to the International Court of Justice in the Indian Ocean boundary dispute case with Somalia to show terrorism is serious and that the porous border had abetted terrorism at large.
Even though officials thought the visits by the female logistician were circumstantial, her activities were suspicious.
The report says “M” played a peripheral and liaison role in a conspiracy to transport explosives from Tanzania to Kenya in 2013 aimed at disrupting the Kenya elections on March 4, 2013.
"In addition, since 2012, the Monitoring Group closely monitored "M"'s regular and suspicious routine visits to Westgate Mall, which have included weekend visits," the report says.
The report says the gang used Facebook to communicate their operations.
For instance, on September 21, 2013, at 3:16 pm during the Westgate siege, a close associate of Ábu Zinnirah, the Barawe-based Amir of Al-Hijra, and a Facebook associate to "M", sent a message to "M" saying "Sis, u ok? Plz tell me no coffee 2day."
On the second day of the siege, at 9:12 am, "M" responded saying "Walkm slm, Alhamdulillah, had just left Westgate with my coffee and the shooting started. Alhamdulillah."
That afternoon of September 21, a group of armed attackers pulled up at the main entrance of the Westgate Mall, driving a Mitsubishi Lancer with the registration plate KAS 575X.
They immediately began throwing grenades and shooting at bystanders.
Then they stormed into the main mall to indiscriminately target shoppers marking the start of the siege.
While in the mall, the gang kept communicating with their associates in Somalia.
According to the report, before the attack, the security agencies had demonstrated their capability both analytically and operationally in containing many of the terror group’s complex and spectacular plots.
"However, based on the Monitoring Group's own investigations over the course of successive mandates, it has become aware of plots by Al-Shabaab, many of which have been disrupted by the Kenyan security agencies but equally served as potential intelligence indicators and warnings pointing to the Badru Nairobi Operation.”
The report says “Operation Linda Mpaka”, which was a Kenya Defence Forces covert operation in Somalia had rattled the terror group.
This was before the publicly declared "Operation Linda Nchi" in October 2011 when President Mwai Kibaki announced that Kenyan troops were moving into the war-torn nation to pursue the militants.
The terrorists had made declarations indicating their attacks in Kenya.
For instance, a series of public declarations by the group’s leaders and a senior Kenyan 'Amir', the Amir of Al-Hijra in Somalia on January 7, 2012, gave the indications.
In a video warning from Somalia, he said: "But if they seek your help in religion, it is your duty to help them" and categorically declared that Kenya was a "war zone".
And to underscore the warnings, Ahmad Iman, using the nom de guerre 'Abu Usama', three months later in the al-Shabaab Kiswahili magazine Gaidi Mtaani published an article titled "Levelling the scales".
In it he warned: "... look at how vulnerable Kenya is... we have tourists, shopping malls, bars etc... just imagine how we can compromise your economy, kill one 'mzungu (white person) and they all run away... just imagine."
The report noted that while often Al-Shabaab's public declarations amounted to propaganda, and offered little or no intelligence warning value this suggested al-Shabaab's determination to conduct a major attack in Kenya.
The report concluded that one of the reasons for selecting Westgate as a target was the high number of Westerners frequenting it daily.
The gang also planned another deadly attack in Mombasa, Kenya the following year.
In March 2014, Isaak Noor Ibrahim and Abdiaziz Abdulahi Abdi, two al-Shabaab operatives, went to pick up a vehicle (Toyota Surf registration number KAN 410 E) parked at the Baragwo parking yard in Mombasa.
The vehicle according to multiple credible sources, was destined for an unknown al-Shabaab operation possibly in Mombasa as part of an advanced stage plot.
Arriving at the parking yard, the two operatives were immediately apprehended by Kenyan security agents.
Inside the vehicle were two cylinders filled with TNT explosives connected to a triggering system in the forrn of a Noika mebile phone, and a cache of arms, including AK-47 rifles, 270 rounds of ammunition, six grenades, five magazines, and four detonators.
A month after the attack in Nairobi, al-Shabaab attempted to target Addis Ababa, Ethiopia.
"Al-Shabaab's meticulous and incremental planning to carry out violent attacks involved the reassigning of Amniyat-like operatives from Kenya, Somalia, Somaliland and possibly Yemen to Addis Ababa in the form of the 'Bole Rwanda cell," says the report.
This included an al-Shabaab operative assuming the identity of a United Nations worker and another using his membership of the Puntland security forces and patronage from the Puntland authorities to conspire against Ethiopia.
The plot, if executed as planned, would almost certainly have resulted in al-Shabaab breaking its long operational deadlock inside Addis Ababa.
Suspects sentenced
In 2020, a court sentenced two men to 18 and 33 years in jail after they were convicted of helping Islamist militants attack a shopping mall in 2013.
The state said the four militants who carried out the attack were found dead in the shopping centre's rubble.
The militants occupied the mall for four days, in one of the deadliest jihadi attacks in Kenya.
These are the only convictions relating to the Westgate attack.
A third man who was found not guilty on all counts of conspiracy to commit a terrorist act has been missing since the day after the verdict was announced.
Mohammed Ahmed Abdi, who received a 33-year prison sentence, and Hussein Hassan Mustafa, who was jailed for 18 years, were charged with planning and committing acts of terror, as well as supporting and helping a terrorist group.
The third suspect, Liban Abdullahi, was found not guilty. The Somali refugee was also acquitted of the charge of being in Kenya illegally and possessing identification documents by false presence.
Witnesses said that the day after he was found not guilty, gunmen stopped his taxi and abducted him. He has not been seen since.
On a Saturday afternoon in September 2013, gunmen entered the mall and opened fire on shoppers, leading to a four-day siege.
The rivalry between police and military forces has previously been pointed out as a factor that hindered the response.
Since the attack, there have been better coordination, correspondents say.
This helped in the response to the nearby DusitD2 hotel and office complex attack in January 2019, where 21 people died.
Police and military counter-terror units, foreign security personnel, ambulance and fire brigade personnel co-ordinated to end the assault.