Forensic analysis: How Westgate Mall attack was planned


Get real time updates directly on you device, subscribe now.

A grenade at the scene of crime where many were killed after gunmen stormed the Westgate Mall in Nairobi September 21, 2013. National security will be the main agenda in Nation Leadership Forum to be held on April 8, 2019 at the University of Nairobi. PHOTO | FILE | NATION MEDIA GROUP

As from last week, the High Court started listening to the defence of three suspects facing charges over Westgate Mall attack in Nairobi.

Mr Mohammed Ahmed Abdi, Mr Liban Abdullahi Omar, unknown alias Adan Mohammed alias Adan Abdikadir alias Aden Dheq, and Mr Hussein Hassan Mustafa were arrested on diverse dates after the September 21, 2013 attack.


The suspects were first brought to court on November 4, 2013 and later on pleaded not guilty to all the 12 charges that they faced.

All the suspects were jointly charged with two counts— commission of a terrorist act and Conspiracy to commit a terrorist act.

On charge three, all the suspects were accused of giving support to a terrorist group.

They were charged with supporting Mr Mohammed Abdinur Said, Mr Hassan Mohamed Dhullow and others in committing a terrorist act.

A month ago, in a ruling delivered on January 14, Judge Francis Andayi ruled that no prima facie case was made out against the accused on Count 1, commission of a terrorist act contrary to section 4(2) of the Prevention of Terrorist Act.

However, the judge concluded that they had a case to answer on various charges.

The third suspect, Adan, was acquitted on all charges for lack of evidence with the court stating that it will give reasons for the acquittal during judgment.

The suspects were arrested after circumstantial evidence built on telephonic communication between them and the Westgate mall attackers.

All the attackers were killed in the shopping mall.


“It is the prosecution’s submission that a prima face case has been established against all the accused person to warrant them to be placed on their defense to answer to the charges that have been laid against them,” a report written by James  Warui, a senior Assistant Director of Public Prosecutions, reads.

The report dated September 21, 2018 forms a key part in the ongoing prosecution.

The investigations at the mall started on September 26, 2013 with teams drawn from the Directorate of Criminal Investigations, the Government Chemists, government pathologists, engineers and fire investigators.

The investigations also involved detectives and forensic experts from the US, Germany, Britain and Israel.

The investigators came across a cache of data from the Ugandan airport pisces system and from mobile service operator, Safaricom.

The shredded documents indicated that the attackers had transacted cash through the Express Forex Bureau in Eastleigh.

On the day of the start of investigations, detectives discovered a motor vehicle, a Mitsubishi Lancer KAS 575X, at the entrance of the mall

The attackers used the car to access the area.


Detectives retrieved SIM card holders and shredded papers from inside the car, which could form an important part of the investigations.

Out of the five SIM card holders, four of them connected the suspects to the attackers.

“The exploitation of the four numbers led up the pace of the investigations in terms of identifying the perpetrators. There is confirmation that these numbers were activated between 17th and 21st September 2013 hours before the attack and they were located within the general area of Eastleigh,” the investigation report reads.

The report adds,” Exploitation of these numbers led to the arrest of several people who were interrogated. After interrogation some were released while the four accused persons before the court were charged with 12 counts relating to the attack as per the charge sheet.”

Upon conducting investigations at the mall, in his report, Sergeant Ezekiel Lulei stated that various exhibits— including body parts, a FH Hestal rifle, two empty G3 rifle magazines, one AK47, three G3 rifles, eleven magazines for G3 rifles and two burnt A4 47 rifles.

  • How they were arrested

The first accused, Mohamed Abdi, who hails from Ijara, Garissa County, was arrested on September 30, 2013 in Kitale.

According to the investigators, immediately after the terror attack, he left Nairobi for Kakuma refugee camp but was arrested on his way to Kitale.

During his arrest, a laptop was recovered and forensic analysis on the laptop, done by Sergeant Joseph Kolum, found that Abdi had jihadist videos and frequently visited jihadists websites.


A forensic analysis of mobile phone communications revealed that Abdi was in communication with the attackers 321 times between June 19, 2013 and August 26, 2013, weeks before the terror attack.

The second accused, Liban Abdulle Omar, a refugee registered in Kakuma was arrested on October 6, 2013.

Ana analysis of his mobile phone communication established that he was in contact with mall attacker Ahmed Hassan Abubakar 91 times between August 26, 2013 and September 20, 2013.

During interrogation, Omar claimed that the mobile handset he was using belonged to his brother Ahmed Hassan Abukar, whose phone number was used to procure insurance for the car used during the attack.

National security will be the main agenda in Nation Leadership Forum to be held on April 8, 2019 at the University of Nairobi. PHOTO | FILE | NATION MEDIA GROUP

During the court proceedings, one witness also claimed that Omar identified two houses where some of the mall attackers lived in Eastleigh.

The third accused, Adan Abdikadir Adan, shared a cell phone handset with Abdikadir Haret Mohamed, one of the individuals who purchased the car used by the attackers.

He was arrested at Saxon Saxo Plaza in Eastleigh.

Adan, who was acquitted by the courts of all charges he faced, employed Haret Mohamed as a madrassa teacher.

The fourth accused, Hussein Hassan Mustafa, left for north eastern Kenya immediately after the attack. He was arrested on his way to Wajir.

  • What phone numbers unearthed

The four suspects were taken to court after investigations.

An investigation team, led by Mr Charles Ogeto, identified the mall attackers as Mohamed Abdinur Said, Ahmed Hassan Abukar, Yahye Osman Ahmed and Hassan Mohamed Dhuhulow.

Police analyst Paul Maingo, who conducted an analysis on the cell phones used by the planners, coordinators and executors of the attack, established that the attackers entered Kenya through Uganda as from June 2013.

One of them using a chartered flight from Mogadishu to Entebbe.

From the mobile phone analysis, call data records revealed regular contact among the accused persons Abdi and Mustafa and the first mall attacker, Abdinur.

Photos obtained from the Uganda Pisces system, a digital identification system installed at points of entry and exit in airports, and from passport records, indicate that Abdinur was born in 1993, and was only 20 years old when he helped lead the mass murder at Westgate Mall.

According to the investigations, Abdinur departed Somalia for Uganda on June 17, 2013 arriving at Entebbe in the evening.

While in Uganda, he made frequent calls to Abubakar, the second mall attacker.


He was also in contact with the first accused, Abdi.

Two days later, on June 19, 2013, Abdinur left Uganda for Somalia on a flight via Nairobi and Wajir.

“The timings of these calls, the proximity to Abdinur’s trip to Uganda and his return to Somalia, suggests that Abdinur spoke with close members of the conspiracy to plan for the mall attack,” the investigation report reads.

On June 24, 2013, Abdinur reappeared on the radar once again when he travelled from Somalia to Uganda where upon landing he made his first call to Abdi and then speaks to Dhuhulow, the fourth attacker.

Two days later, on June 26, 2013, Abdinur travels to Kenya from Uganda by road.

On this particular day, he only speaks to Abubakar, the second attacker and Dhuhulow.

Between July 6, 2013 and July 10, 2013, Abdinur makes several phone calls with Somali telephone numbers and Abdi.

The second attacker, Hassan Mohamed Dhullow, who was just 25 years by the time of the attack, arrived in Uganda through a chartered flight from Mogadishu.

On the evening of July 26, 2013, Yahya Osman, the third attacker arrives at Entebbe airport from Somalia.

For the next couple of days, Osman communicates frequently on phone with both Abdinur and Abdi.


Investigators say that Osman arrived in Kenya at the end of July.

On August 1, 2013, Osman made a phone call to Hared, the suspect who purchased the car that the terrorists used during the attack.

The other attacker, Ahmed Hassan Abubakar, entered Uganda via a commercial flight.

Both Abubakar and Abdinur were refugees at the Kakuma Refugee camp.

As from August 25, 2013, the attackers started looking for a house.

They settled for an apartment located at Eastleigh’s 4th Street, which they occupied on September 1, 2013.

During this period, they communicated frequently with Abdi and Mustafa, the fourth accused.

About a week later on September 1, 2013, Abubakar moves to purchase a motor vehicle which they pay through a Barclays Bank transaction.

CCTV cameras from the bank captured Hared, Abubakar and Mustafa making the transaction.

  • Pre-surveillance of mall

On September 8, 9, 14 and 15, 2013, the attackers are captured carrying out pre-operational reconnaissance of the Westgate Mall, about two weeks before the terror attack.

Investigators say that the attackers made the final preparations of the attack on September 18, 2013.

On this day, Abdinur makes phone calls to all the attackers and some of the suspects.

Source Daily Nation

Get real time updates directly on you device, subscribe now.

Comment on the article

This site uses Akismet to reduce spam. Learn how your comment data is processed.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More