UPDATED: Attack on the Dusit Hotel Complex in Riverside, Nairobi: What Happened?
Date of Incident: Tuesday 15th January 2019
Introduction
The attack on the Dusit Hotel comes at a time when Al Shabaab has sustained heavy losses in recent months and are losing control of territory in strategic areas of Somalia to the SNA and AMISOM. U.S. airstrikes in Somalia have also intensified since President Donald Trump took office. Furthermore, the multi-agency Operation Linda Boni which began in 2015 has recorded some major successes and has impacted on Al Shabaab’s ability to use the Boni forest as a safe haven, though operational challenges remain and Al Shabaab still retain the ability to set up camps in the forest and cross the porous border.
Attacks regularly occur along the Kenya-Somalia border, though there has been a drop in attacks in some areas in eastern Kenya such as the Lamu-Garsen road. Kenyan counter-terrorism, intelligence gathering and emergency response measures have also improved since the Westgate attack in 2013. The response to the attack on the Dusit hotel complex demonstrates an improvement in multi-agency emergency response related to such incidents.
Security operations, arrests, attacks and threats linked to Al Shabaab between 2018 and 2019.
In a statement, Al Shabaab claimed the attack at the Dusit complex takes place as the country commemorates the El Adde attack.
Warnings of Attacks
Western officials claim to have warned Kenyan authorities several times in recent months of planned attacks by Al Shabaab. They expressed frustration with their Kenyan counterparts at the lack of response to the warnings. Conversely, Kenyan authorities claim information passed on to them was vague, that the country has been on high alert since November 2018 and that the group confused security officials by changing target locations. Anti-Terror Police Unit (ATPU) officer Mawira Mungania, said the attackers planned to attack a conference at the hotel attended by American nationals. When they failed to gain access to the hotel, they stormed an adjacent building.
Sources claim the attackers knew the conference was to be held in Riverside and that the attackers assumed it was to be held at the Dusit hotel. It is claimed that about 180 U.S. nationals planned to attend the conference in Gem Suites. Officials at the U.S. embassy denied the conference was to be held in Dusit Hotel. After the attack, Ayman Al Zawahiri announced the attack was carried out in response to the declaration of Jerusalem as the capital of Israel. In a statement, Al Shabaab claimed the attack at the Dusit complex takes place as the country commemorates the El Adde attack.
Security at the Complex
Popular shopping centres and complexes such as Two Rivers, West Gate and Village Market have security measures in the form of rising arm barriers, armed guards, sniffer dogs, under vehicle inspection mirrors and body scanners. It is unclear if armed guards were present at the location of the attack. Pictures circulating social media suggest under vehicle inspection mirrors were being used and rising arm barriers were in place. It has been reported that in the morning of the attack, security guards failed to subject those accessing buildings in the area to a rigorous scanning procedure which includes walking through a metal detector.
Chronology of the Attack:
1430hrs:
Security sources claim the five attackers arrived outside 14 Riverside Drive and parked outside the entrance for 30 minutes (the vehicle was tinted). A second-hand clothes dealer at the Chiromo Road and 14 Riverside Drive junction said he noticed the vehicle used several times. One of the attackers would leave the car and buy coffee from a restaurant. Two days before the attack, one of the attackers bought coffee from the same restaurant.
1500hrs:
Inspector General Joseph Boinnet said the attack began at approximately 1500hrs. Five gunmen arrived at the Dusit complex in a silver 5-seater vehicle. The first armed officers to respond to the attack were officers from the Australian embassy. They deflated the attackers’ vehicles about 40 metres away from the main security barrier of the hotel and injured the suicide bomber. Initially, officers believed it was a bank robbery. The gunmen then throw an explosive device at security guards and shoot their way past to a second barrier where they hurl more grenades at vehicles, setting three of them alight. They attempt unsuccessfully to gain entry into the offices of the I&M Bank.
A suicide bomber detonated his vest outside the Secret Garden Restaurant at 1503hrs (Other reports claim the detonation occurred at 1528hrs, but the timestamp on CCTV footage reads 1503hrs) killing himself and five others. “Why are you killing our brothers and sisters in Somalia?” one of the attackers is alleged to have asked before shooting. After the blast, civilians run toward the towards the gate of the complex. The gunmen, having taken up elevated positions with the Dusit hotel, open fire on people on the ground, forcing many to seek cover.
1517hrs-1600hrs:
At least four attackers are seen walking inside the compound of the complex. A news reporter reported seeing six gunmen. However, Inspector General of National Police Service Joseph Boinnet confirmed there were five attackers — all of them neutralised.
1530hrs-1600hrs:
GSU units (including three Recce Squad teams), special forces from the KDF and GSU, APS (including reservists), Anti Terrorism Police Unit (ATPU), the Bomb and Hazardous Disposal Unit and the Police Flying Squad arrive at the scene along with the Kenyan Red Cross, John’s Ambulance and armed civilians. Vehicles with diplomatic licence plates (U.S., China, Australia, UK) are seen arriving at the scene. The U.S. marines aided the security operation along with an SAS soldier. Teams from foreign embassies provided important logistical support. The operation is coordinated under a single command led by the GSU Commandant Douglas Kirocho Kanja. The Bomb and Hazardous Disposal Unit carry out a controlled detonation on a car used by the attackers to arrive at the complex. They find three live grenades at the entrance of the hotel where at least five bodies lay. Security forces used snigger dogs and began clearing rooms. During the Westgate attacks, it is believed some attackers disguised themselves as civilians and fled the scene. However, during the evacuation of the Dusit complex, police are said to have taken down the details of those rescued.
1600hrs-1800hrs:
Evacuation of the complex begins and those residing in nearby areas are ordered to evacuate the premises. More than 700 civilians, including injured persons, are evacuated from the complex during the course of the entire operation, according to the Kenyan Red Cross, who later reported that 94 missing persons have been accounted for. Emergency services such as the Kenyan Red Cross and St John’s Ambulance and armed civilians assist with evacuation. Heavy traffic around Nairobi hinders the transportation of victims to hospitals.
1625hrs:
The GSU Recce squad advance into the hotel. Steel doors, password locked doors, bulletproof windows slow the advance within the building but also disrupt the attackers’ mobility and save many of those trapped inside. Four police and military helicopters are seen flying over the area. Along with armoured vehicles and armed police officers, they took up strategic positions to ensure the perimeter is secure.
2000hrs:
Inspector General of National Police Service Joseph Boinnet claims six out of seven floors have been secured. Reports later noted that by 2000hrs, teams clearing rooms had arrived on the fourth floor. At 2300hrs, Interior CS Fred Matiangi says security officers are in the final stages of the combing operation and that all affected buildings are secured. However, reports after the attack, suggested they were in control of six floors by 0300hrs.
The 14 commandos (Special Forces from the Recce Squad and the army were involved in the operation), in two teams of seven, used remote-controlled surveillance equipment to map out the floors and determined that the attackers were on the seventh floor. During the entire operation, the power supply to the building is disabled. The second team of commandos rappel down the side of the building and access the seventh floor through a window. The attackers are cornered on the sixth floor. It is said that some of the terrorists were communicating with people in Kiambu and Somalia. It is believed their commander was talking with Al Shabaab militants across the border and had talked to someone in Ruaka during the early stages of the attack. He sent images of victims of the attack to unidentified people in Somalia.
Commanders leading the assault earlier rejected the idea of jamming communication, fearing it would cause those trapped to panic.
0400hrs:
Reporters state that at least 50 people have been rescued and escorted out of the building. A police source said they rescued 174 people. After freeing those trapped, a decision is made to storm the sixth floor. One team approaches from the seventh floor and the other from the fifth floor. Those in front hold bullet proof shields while their colleagues fire high-calibre rounds.
0600hrs:
Sporadic gunfire is heard in the Dusit Hotel. A Recce Squad officer sustains injuries.
0700hrs — 0900hrs:
One person is rescued from the building. Reports claim that two attackers have been killed at about 0700hrs. Their weapons with about 200 bullets each are recovered along with about eight grenades.
1000hrs:
President Uhuru Kenyatta confirms all attackers have been killed and the siege is over. Among the 21 dead are a GSU officer, 15 Kenyan citizens, an American national, a British national and three others of unknown African descent. 21 others are wounded. At least 174 people were rescued in the attack.
The Attackers
Among those arrested so far are the mother and father (a KDF sergeant) of Ali Salim Gichunge. Ali Salim Gichunge, said to be the main planner or leader of the cell, was killed during the assault. His vehicle was found at the hotel complex. Investigators say the key suspected attackers registered nine mobile phones numbers — Ali Salim Gichunge registered three and his wife Violet Kemunto Omwoyo registered six. Gichunge, who converted to Islam as a 20-year-old, is from Isiolo. He rented a house in Guango Estate, Kiambu County, near Ruaka that was raided by police soon after the siege was over. Gichunge was also known as Farouk Juma and Idriss in Nyeri. Police are investigating reports that he visited the Majengo slums in Nyeri where he met Somalia-trained youths. In 2016, Gichunge lost contact with his family. He later told his mother he had landed a scholarship to study Islam in Uganda and Tanzania. In 2017, he informed his sister he was in Lamu and on his way out of the country. His sister said she believed he travelled to Somalia. As for his wife, Violet Kemunto Omwoyo, police believe she crossed the border into Somalia hours before the Dusit attack. A male suspect who allegedly facilitated her escape has been arrested.
Another attacker, whose name is unknown, used to work as a motor vehicle mechanic in Bulla Medina area of Wajir town. He is said to be an ethnic Marehan with roots in Mandera County.
The suicide bomber, Mahir Khalid Riziki, was born and brought up in Mombasa. Police had him on their most wanted list. They say that in 2014, he was part of an Al Shabaab cell tasked with assassinating security personnel at the coast. The ATPU say Mahir was previously involved in attacks that mainly targeted security forces and has travelled to Somalia on other occasions. Police believe he was radicalised by an Al-Shabaab militant known as Ramadhan Hamisi, now said to be in Somalia. Mahir re-entered Kenya on 13 January 2019 through Elwak from Somalia, where he had been undergoing training since 2015. Upon returning, he travelled to Takaba and then boarded a bus to Nairobi. He immediately met with Ali Salim Gichunge, alias Farouk, in Muchatha, in Kiambu County. His wife and father were arrested in Bakarani and Majengo, Mombasa. After the Dusit attack, police found that while some of the grenades and rounds of ammunition were on the floor, many more were found in different drawers wrapped up in hotel laundry bags. They believe the weapons and grenades have been brought into the hotel earlier and that Mahir arrived at the complex earlier and stayed at a hotel room and that when the attack began, he joined his fellow attackers. Their strategy was for him to detonate his suicide vest and kill people at the Secret Garden restaurant and for the four gunmen to open fire on the fleeing crowd. Police are trying to determine if Mahir was part of an Al Shabaab suicide bomber planning to carry out attacks in Kenya or if it is an isolated case.
Investigators are also searching for a woman, named by one source as Miriam Abdi, believed to have conveyed weapons from Kiunga through the port city of Mombasa to Nairobi. Preliminary examination of three out of the five firearms used in the attack showed their serial numbers, though partially erased, were marked SO, usually used by the Somali National Army (SNA).
Five others arrested include Joel Ng’ang’a Wainaina (near MP Shah Hospital), Oliver Kanyango Muthee (a taxi driver), Gladys Kaari Justus (a mobile-money transfer agent arrested in Maua, Meru County), Guleid Abdihakim (Canadian national) and Osman Ibrahim (arrested at Two Rivers Mall) — all of them believed to have facilitated the attack. A sixth suspect, Hussein Muhamed (arrested in Mandera), was arraigned separately. Investigators said he had been communicating with known terrorists in Kenya. They are waiting to receive his identification documents from Uganda.
Do you require this kind of detail as soon as it happens? Intelligence Fusion provides timely, accurate and actionable threat intelligence to help you protect your people, assets and reputation across the globe.
Find out how we’ve increased the quality, volume and accuracy of intelligence for some of the biggest names in the security industry, book your free demo today.
