How Kenya Security Intelligence Agencies Preempted 2nd Mall Terror Attack by Al-Shabaab

Thika Road Mall along the ultra-modern super-highway provides a unique geography, for it is both difficult to secure, and for emergency services to access upon eruption of a humanitarian crisis.

There are 2 roundabouts within meters of the mall. They are always jammed in the event of a minor traffic disruption. Densely populated estates some high-class, middle class, and low-class surround the mall and are along the high-way.

There is only one access route to the mall, a one-way- all-weather tarmac service road which passes past a 5-star hotel frequented by top government officials, company heads, and politicians.

Traffic would jam all access routes to the mall in-fact, security and humanitarian assistance can only be airlifted to the zone of conflict.

Al-Qaeda -Al-Shabaab had planned to attack the mall on 24th of December 2014 and 2 terrorists tasked with the terror attack operation were arrested outside the mall shortly after they surveyed it on the 1st Sunday of October 2014. Nobody noticed the arrest let alone security officers in the mall.

Most notable during the debriefing was their frantic calls to a man of Somali origin who was arrested the evening before upon arrival from Busia using forged papers.

OSINT at Kenyan Government Security Intelligence agencies obtained WhatsApp messages from a suspect where he discussed heavy traffic jam during the evening hours after seizing his phone upon arrest. The other suspect said 24th was a great day citing significantly bad traffic and thousands of shoppers in the mall.

The terrorists communication was disrupted during the final stages of planning. Kenya traced communication between transnational terrorists on the global terror watch in Yemen, Netherlands, and Somalia.

These jihadists made calls to each other. The matrix of the calls was analyzed by intelligence analysis and production officers to procure biases. The matrix showed the jihadists called local terror cells in Mombasa, Dadaab refugee camp, and Nairobi.

The arrest of the Somali with forged papers in Nairobi upon arrival in Nairobi via Simba Coach through Busia disrupted the operation. The person had called the cell in Dadaab refugee camp several times in September.

The cell in Dadaab had received Sat-phone calls from Netherlands and Somalia. The cell had called a number in Mombasa. The Mombasa cell was also called by the same Sat-phone number from Somalia.

The terror attack was quietly preempted though security agencies remained on high alert throughout the festive season.