Data Loading...
2013 Nairobi Mall Shooting Flipbook PDF
On September 21, 2013, terrorists affiliated with the terrorist group al-Shabaab attacked Westgate Mall in Nairobi, Keny
128 Views
1 Downloads
FLIP PDF 1.8MB
CASE STUDY Terrorist Attack on Westgate Shopping Mall, Nairobi, Kenya, September 21-24, 2013 “More than ever this is a time for vigilance, not complacency.” Raymond Kelly, New York City Police Commissioner December 10, 2013
Abstract On September 21, 2013, terrorists affiliated with the terrorist group al-Shabaab attacked Westgate Mall in Nairobi, Kenya. The ensuing engagement between terrorists and government forces continued for four days, resulting in over 70 deaths and over 200 injured. The exceptional nature of the terrorists’ methods used in the attack warrants the attention of Army commanders and leaders. Moreover, the complexity of four attackers operating in synchronized fashion guided by a central command and control arguably represents the most dangerous scenario should a similar attack occur in the United States. This case study highlights the events that occurred on the days of the engagement and synthesizes studies and reporting of elements discovered after the event. Through trenchant observations and practical lessons learned, it posits that a prepared populace and trained response force could prevent an attack or substantially reduce its virulence. Continued study of the event could yet encourage more creative and effective preparations and response. The overall effect will strengthen the U.S. Army Antiterrorism Program and support more resilient protective procedures.
Introduction The terrorist attack on the Westgate Mall in Nairobi, Kenya, in September 2013 echoes the reminder that terrorism remains as a threat to Americans throughout the world. Perhaps more significantly, it represents an evolving terrorist tactic, often referred to as a “swarm attack,” that presents more complex challenges than the single assailant often presumed. Although the Westgate Mall attack was a long way from the U.S. homeland, the methods on display during that attack provide lessons that can guide preparatory efforts and information collection to help prevent or respond to a similar event involving the Army community worldwide. The need to address the swarm attack concept is expressed in the Army Antiterrorism Strategic Plan, “Burnishing the Steel.” It emphasizes the unique characteristics of a swarm attack and, at the same time, juxtaposes the swarm tactic with the more common terrorist approach associated with active shooters. It is the aim of this case study to analyze the Westgate attack and develop lessons learned that guide practical efforts to address the swarm phenomenon.
1
Swarm attacks are high-risk, coordinated assaults sometimes directed against multiple targets or building complexes, using mobile groups to circumvent security measures, allowing attackers to inflict casualties, garner news coverage and, in recent years, to inflict considerable damage prior to neutralization of the assailants. Cerwyn Moore, “The Threat from Swarm Attacks: Case studies from the North Caucasus,” Combating Terrorism Center at West Point, May 22, 20121
Objective 2K. Develop procedures to prevent or respond to attacks using swarm tactics. The 2008 terrorist attack on Mumbai indicated a possible model for future terrorists. Considering the devastation and uncertain response at the time, we must consider the possibility of swarm tactics in AT planning. Attacks similar to that in Mumbai required extensive preparations and communication among multiple organizations. Despite the surprise nature of the Mumbai attack, it is plausible to believe that the attackers’ plan would have been vulnerable to a public with proper awareness training and understanding of AT principles. This suggests that future attacks could be mitigated or prevented with proper education and training.
The Challenge of Malls as Gathering Areas The concept of a mall or shopping center is not new. Some might argue that Trajan’s Market in Rome around A.D. 100 was one of the earliest malls. The physical structure has changed since Trajan’s day, but the concept remains the same, a concentration of stores that attract a large number of people. Most have shopped in a local mall many times, and navigating a mall is common sense to most Americans. These shopping meccas characteristically occupy at least one floor and sometimes multiple stories that sprawl over many acres. They allow open access and include retail vendors varying from small kiosks to large department stores, along with restaurants, food courts, banks, theaters, play areas, grocery stores, and, frequently, accompanying multilevel parking garages. Mall populations differ depending on the time of day and seasonal attractions. Because of the type of stores or a contiguous neighborhood, malls sometimes cater to a particular type of shopper. All of this is common knowledge to the typical American, who has no trouble locating and maneuvering in a mall. Less well known to Americans, 1
http://www.ctc.usma.edu/posts/the-threat-from-swarm-attacks-case-studies-from-the-north-caucasus.
2
however, iis that mallss offer a particularly vulnerable v t target for prospective terrorists. M More importantlly, many Americans do d not know w how to react when multiple m terrrorists assaault that fam miliar environmeent in a welll-planned and a brutally y executed attack. The very concept thatt attracts mall m shopperrs can work k toward th he benefit off terrorist aambitions. T The chaos and panic creatted by an atttack make it difficult for security y forces to operate, o an nd mall environmeents allow for f high cassualties, big g news head dlines, and possibly ho ostage situaations. The mall could offerr cover for attackers a an nd traps forr victims. From F a terro orist perspeective, as att Westgate, the presence o of foreignerss could offeer an excusee for the atttack. Conveersely, the maze m of a tyypical malll layout doees provide some s protecction in thee form of hiding placess that could d be an advvantage for prepared p personnel.
This enviro onment wa as the area of o operation ns for a terrrorist attack k at the Wesstgate Malll in Nairobii. Considerin ng the possibility of a similar s occu urrence in the t United States or neear a U.S. fa facility overrseas, it warrants cclose study. The lesson ns learned in n preparing g for the prrospect of sw warm attaccks on malls will apply almo ost equally to other po otential terrrorist targetts. Why terrorrists chose a mall and particularly y the Westg gate Mall, why w they atttacked as tthey did, an nd what their objectives were repreesent reason nable questiions. What were peop ple’s reactioons, and how w did law enforccement and medical ag gencies resp pond? Thesse are more than simplle curiositiees. What was significantt about the attack a on Westgate W Ma all, and how w can we prepare p for a similar occcurrence? The answers to o the questions and a subsequent s review of the t attack sequence s ca an guide a w way ahead for antiterrorissm plannin ng.
Why Weestgate…and how w does it apply to the U.S. Army co ommunitty? In common n security parlance p Weestgate Mall was a “so oft target” similar s to trransportatioon systemss and other public gathering locations. That is, th hey represen nt a potentiial target fo or terrorist aattack that does not have a defined security perim ugh terroriists meter and often o no deedicated seccurity preseence. Althou aspire to atttack DoD facilities f they frequenttly assess th he level of difficulty d an nd risk as ttoo high. Th his factor help ps drive terrrorists to fo ocus on high h-capacity public p venu ues which are a perceiveed as soft taargets. Reports alsso suggest that t terrorists consisteently select targets asso ociated witth the terrorrist grievan nce. In
3
the past this has included restaurants frequented by DoD or Army personnel and other popular hangouts.
Why was the attack on Westgate different than other terrorist attacks…and why should we study it? The assault on Westgate Mall included at least four attackers simultaneously. A review of headlines in the past few years indicates that Westgate Mall was not the first instance of a swarm attack, the most notorious being the attack in Mumbai, India, in November 2008. In Mumbai the terrorists attacked people at the railroad station, religious centers, and restaurants, finally linking up in two hotels. It ended in a shootout with police and the practical destruction of at least one hotel. The swarm attack on Westgate featured two teams of two (or more) assailants who attacked from two different points and then linked in the mall supermarket. The Intelligence Community assesses that Mumbai and Westgate demonstrate the effectiveness of swarming soft targets, which is becoming an increasingly popular tactic.
Terrorist Planning for the Westgate Attack Background General Situation
Terrorism in Africa has become a frequent occurrence. In 2013 terrorist attacks were spurred by the Kenyan Army’s active participation in the African Union Mission in Somalia, supporting the extant government of Somalia. Al-Shabaab, an Islamic terrorist group based in Somalia, opposes both the current Somali government and external sources, such as Kenya, that support that government. In recent years, al-Shabaab has used improvised explosive devices, kidnapping, assassinations, and other terror tactics in attempts to coerce the Kenyan government to withdraw forces from Somalia. The attack on Westgate Mall was a continuation of this strategy. Threat
Al-Shabaab is one of several armed groups in Somalia. Its aim is to replace the current government of Somalia. In February 2012 it announced its affiliation with al-Qaida, which may have encouraged an increase in attacks outside Somalia, including multiple attacks in Kenya during 2012. The targets of Al-Shabaab attacks vary, most frequently including private citizens, military, government, police, businesses, diplomatic entities, and journalists and media. The group’s most lethal attacks are often characterized by assaults on military targets leading to extended clashes, or mass-casualty bombings like that in 2010 that killed scores of civilians gathered to watch a World Cup soccer game in Kampala, Uganda. Thirty of Al-Shabaab’s 548 attacks between 2007 and 2012 were carried out by suicide bombers. These attacks killed 331 people, including the attackers.2
“Al-Shabaab Attack on Westgate Mall in Kenya,” Background Report, National Consortium for the Study of Terrorism and Responses to Terrorism, September 2013, page 1.
2
4
A recovered document from a leading al-Qaida operative in East Africa suggested attacks “similar to the tactics used by our brothers in Mumbai.”3 The link with al-Qaida in 2012 and the demonstrated and expressed intent to attack in Kenya implied the possibility of an attack in the commercial sector. It is difficult to determine the precise planning and decision-making sequence that drove the attack at Westgate. However, some indicators suggest that these attackers followed the basic terrorist planning cycle.
Broad-based target selection. A Word document found on a terrorist killed in Mogadishu in 20114 suggested that terrorists in the region were anxious to replicate the Mumbai attack. At this stage the Al-Shabaab leadership may have decided to use swarm tactics in the Westgate attack. They appeared to emphasize a focus on hotels, shopping malls, and other soft targets that could represent a high-profile attack. Coupled with Al-Shabaab’s express desire to attack Kenya for its participation in antiterrorism operations in Somalia, this implies that in the broad target selection process the Westgate Mall stood out as a strong possibility.
Intelligence and surveillance. Target selection, in turn, drives intelligence collection and surveillance. This refines the specific target and emphasizes gaps in information that must be filled before executing an attack. As indicated in a captured Word document, “Reconnaissance will cover how to gather suitable information on the target for example where are the nearest police stations, what times is the area most crowded, when are best times to attack, are there any armed guards, are they prepared for an attack, best way to enter building …”5 It is possible that other targets were reviewed as prospects for attack, but the large presence of foreigners and weak security likely made the Westgate Mall stand out as an ideal target supporting al-Shabaab operational objectives.
Specific Target Selection. The general information gathered during the previous step identified Westgate as a possibility. Weighing the characteristics and vulnerabilities led to the selection of Westgate over others. To be sure specific target selection was based upon the requirements, risks, and message of al-Shabaab. In this case the field of possibilities probably had narrowed to a soft target. In Nairobi that might eliminate embassies and military targets. The hope for a media extravaganza may Paul Cruickshank, Tim Lister, and Nic Robertson, CNN, “Evidence Suggests that Al-Shabaab Is Shifting Focus to ‘Soft’ Targets,” September 26, 2013. 4 Paul Cruickshank, Tim Lister, and Nic Robertson, “Evidence Suggests that Al-Shabaab Is Shifting Focus to ‘Soft’ Targets.” 5 Paul Cruickshank, Tim Lister, and Nic Robertson, “Evidence Suggests that Al-Shabaab Is Shifting Focus to ‘Soft’ Targets.” 3
5
have emphasized large gathering areas rather than assassination or kidnapping. The appeal of a Mall frequented by foreigners could have been a significant factor in the specific target selection as well. Concerns about inflaming the public could be reduced by emphasizing attacks on foreigners and individuals of another religion.
Pre-attack surveillance and planning. Actions of the terrorists during the attack indicate detailed prior reconnaissance. Linkup points of the terrorists after the initial assault and awareness and even adjustment of the closed-circuit television (CCTV) emphasize substantial pre-attack planning. The obvious familiarity of terrorists with the mall argues convincingly that the prospective terrorists had an excellent working knowledge of the mall layout and likely visited the site many times prior to the attack.
Rehearsals. Most studies of both successful and aborted terrorist attacks suggest that rehearsals form a fundamental element of preparation. For example, the disrupted attack plans against Fort Dix in 2007 included rehearsals at a paintball range with the intent to recreate actions on the objective. In the case of Westgate Mall, at least one report mentions the possibility that the terrorists spent time training “in a popular gym in the busy district, known as ‘Little Mogadishu’, as they prepared for the September 21 operation.”6 At Westgate, as in the preparations for attacking Fort Dix, the rehearsals occurred at what the prospective terrorists considered a safe area. The CCTV video of the attacks indicates that the attackers not only practiced with weapons used during the attack but very likely studied the mall layout carefully to select movement routes, linkup points, and possibly escape routes. It is possible that the prospective terrorists even developed a mockup of the mall to conduct tabletop rehearsals. Some reports suggest that a vehicle to support terrorist media efforts was located on the mall premises or nearby before the initial attack. This vehicle may have operated as a command and control site, communicating with attackers and perhaps even releasing Twitter messages during the attack. “Intelligence intercepts suggested that some of the Twitter updates posted by Al-Shabaab’s HSM (Harakat al-Shabab al-Mujahidin) Press account were sent from there.”7
Actions on the Objective Timeline of Events Video coverage serves as a pinpoint record of some events and actions at the mall during the attack. It reveals much about terrorists’ routes and their awareness of the surroundings, objectives, weapons, and communications. It also suggests how civilians might respond in the emergency. Reporting during and after the attack and post-attack investigations fill in many gaps that video does not. The following timeline was developed from a collection of video coverage,8 investigations, scholarly papers, and a variety of news reports. This collection includes reports from New York City investigators and the Kansas Intelligence Fusion Center, along with notes from the company contracted to provide security
Peter Martell, Agence France-Presse, “Westgate Attackers Spent Four Months Planning in Nairobi,” November 19, 2013. Christopher Anzalone, “The Nairobi Attack and Al-Shabab’s Media Strategy,” Combating Terrorism Center at West Point, October 24, 2013. 8 Video coverage in this case study is from CCTV in the mall. It is referenced in the frequent news and investigative studies. Much is still available on the web. For example the url https://www.youtube.com/watch?v=j55ReTHTe-Y shows the terrorists in the mall moving, shooting, and linking up in the Nakumatt storeroom after their initial assault. 6 7
6
for the mall. In some cases the reports actually disagree with the location and actions initially reported by the Kenyan government on the response forces. This case study is somewhat hampered by conflicting information of the several investigations, but it offers conclusions from a basis of facts and assumptions. International media covered the event in detail and, in second and third reports, with accuracy as to what occurred in Nairobi. In fact, some of the lessons learned related to information collection, management, and distribution by news agencies during the event. Undoubtedly more detail will evolve with further examination. But it is unlikely that any future study will suggest major changes to the concepts that make this case study important to Army preparations for a similar incident. Moreover, it may be prudent to distribute the information as soon as reasonably possible to aid preparations to counter a potential swarm attack. The floor plan diagram shows the shopping mall layout. It allows for some tracking and movement of terrorists and response forces during the operation. The movements offer some insights into possible terrorist targeting, movement, and firing. At Westgate, as with the swarm attack in Mumbai, terrorists eventually linked. In Mumbai it was at two hotels. At Westgate the linkup was in the Nakumatt Department Store.9 Based on al-Shabaab Twitter messages, their objective included the goal of evoking a large media response. During the event, the media reporting was almost all inaccurate in the details but, in the media fervor to cover the event, probably supported the fondest hopes of Al-Shabaab.
The Nakumatt department store is variously referred to in documents as the “market,” “super market,” and “store.” In fact, the Nakumatt store is more like an American department store in format—like Kmart, Target, and others. It is referenced in this case study according to the report referenced.
9
7
Day 1, Saturday, September 21, 2013 Approximately 12:30 hours (CCTV) Four terrorists exit their vehicle, and “they throw three hand grenades: one onto the outdoor dining patio of the Art Cafe just to the left of the main entrance, and two at the security booth located outside of the parking garage.”10 12:30 hours (CCTV) “After firing shots at bystanders outside the mall’s main pedestrian entrance, the first two terrorists, operating as a pair, enter in to the mall”11 through the main entrance. One of the terrorists briefly enters “the Urban and Gourmet Burgers shop located just to the left of the main pedestrian entrance to shoot innocent victims.” A second terrorist probably engages shoppers in the immediate vicinity of the mall entrance. “After the terrorist shoots victims in the Urban and Gourmet Burger shop both terrorists appear to put fresh magazines in their AK-47s. Once reloaded, the two terrorists made a left hand turn from the main entrance and proceed walking slowly towards the Art Cafe.”12 12:32 hours “CCTV Camera footage shows the two other terrorists making their way up the ramp to the rooftop parking garage in the rear of the mall. Once on the rooftop garage they open fire on the adults and children participating in a cooking competition, before entering the mall through the rear exit.”13 Initial Response—Mall Security 12:38 hours An employee of the security company providing security at the mall and his wife hear explosions and gunfire. 12:41 hours Security guard #1 received a text: “Terrorist attack underway.” He subsequently informed security guard #2 and the Kenya Country Manager.14 “In accordance with the facility’s established security practices and standing orders, the Security Guard attempted to close the roll down metal security gates before the attackers entered the building. A terrorist reportedly shot this guard.”15 Uniformed Kenya Police Service Personnel
The police initially responded to a report of “shots being fired and a robbery in progress at the mall.”16 The typical Uniformed Kenyan Police Officer is not as well equipped as their western counterparts, typically only carrying a long gun, most commonly an AK-47 style rifle with a 10 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, information current as of November 1, 2013, p. 14. 11 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 15. 12 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 15. 13 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 16. 14 “Nairobi Westgate Mall Siege; 21/09/13,” slide show by Schlumberger, EAR Geo Security Advisor, c. November 2013. 15 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 17. 16 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 17.
8
folding stock, loaded with a single 30 round magazine. They do not carry handguns, wear body armor, gun belts or have portable radios to communicate.17 Plainclothes Law Enforcement First Responders There were multiple plainclothes law enforcement first responders conducting tactical and rescue operations during the first day of the attack. Very few … of the plainclothes law enforcement first responders displayed any visible law enforcement identification such as a badge, arm band, ID card or a raid jacket, making identification as “friend or foe” extremely difficult for other armed first responders.18 Private Armed Citizens and Security Personnel First Responders A number of armed private citizens and security company personnel played a significant role in the early stages of the attack. Reportedly these personnel formed “ad hoc” tactical teams with plainclothes police personnel and assisted in evacuating people and attempting to engage the terrorists early on during the attack.19 12:45 hours (CCTV) “In the first few minutes of the attack, Terrorist # 1, who had entered the main pedestrian entrance with Terrorist # 2, apparently exchanges gunfire with an unidentified first responder and receives a wound to his left leg.”20 13:00 hours (CCTV) “Responding police officers outside the mall are attempting to establish a perimeter, deal with the hundreds of people fleeing the location and assess what is going on inside the mall.”21 13:30 hours (CCTV) “Four terrorists joined up inside the Nakumatt Super Market store. While inside the store they locate and shoot numerous people who are attempting to hide.”22 13:50 hours The “Kenyan Police Service’s Inspector General (Commissioner) arrives at scene.”23 14:15 hours “The Kenyan Police Service’s General Service Unit … Company (GSU-RC) has assembled at the scene. The GSU-RC is a highly trained paramilitary unit and functions as the Kenya Police Service’s elite” tactical team.24 15:00 hours “The GSU-RC Tactical Team composed of ten officers enters the mall and begins to conduct clearing and rescue operations. CCTV footage shows that at some point during the tactical operations” police throw “tear
“Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 17. “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 18. 19 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 19. 20 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 20. 21 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 20. 22 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 20. 23 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 20. 24 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 20. 17 18
9
gas grenades … in front of the Nakumatt Super Market forcing one of the terrorists away from the entrance.”25 16:00 hours Kenyan government officials decided to transfer the handling of this incident from the police to the military. A squad of Kenya Defense Forces KDF soldiers enters the mall and shortly afterwards, in a case of mistaken identity, the troops fired on the GSU-RC Tactical Team. They kill one police officer and [wound] the tactical team commander. In the ensuing confusion both the police and military personnel pull out of the mall to tend to the casualties and re-group.26 Government forces cited a lack of night vision gear as another reason to withdraw into perimeter positions.27 19:00 hours (CCTV) All four terrorists previously viewed on CCTV link up in a storeroom located in the rear of the first floor of the Nakumatt market. (CCTV) “During the several hours the terrorists spend in the store room they appear extremely relaxed. They treat the wound that Terrorist # 1 had sustained to his left lower leg. They also eat and pray. At one point, three of the terrorist[s] put down their weapons and only one terrorist has a weapon in his hands.”28 (CCTV) “At an unknown time, Terrorist # 1 is observed on the CCTV footage leaving the storage room in the direction of the exit to the Nakumatt’s loading dock. Authorities believe that he was possibly checking for a means of escape. Terrorist # 1 does not re-appear for the remainder of any of the CCTV footage.”29 21:00 hours Al-Shabaab Twitter commentary: “The Mujahideen entered #Westgate Mall today at around noon and are still inside the mall, fighting the #Kenyan Kuffar [infidels] inside their own turf.”30 Sunday, September 22, 2013 00:54 hours (CCTV) “One of the three remaining terrorists tilt[s] the CCTV camera so it no longer covers the inside of the storeroom. This is the last CCTV footage of the terrorists and it is believed that they attempted to escape by an unknown route sometime after tilting the CCTV camera.”31 One opinion suggested that the terrorists escaped through an underground sewage pipe.32
“Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 20. “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 21. 27 “Lessons Learned: Westgate Mall Attack,” Kansas Fusion Center, October 25, 2013, p. 10. 28 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 22. 29 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 22. 30 “Nairobi Westgate Mall Attack,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, September 23, 2013. 31 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 22. 32 Russell Myers, “Video: The Escape Route Tunnel Used by Terrorists after Shopping Centre Massacre,” London Daily Mirror, September 28, 2013, 1658 hours. 25 26
10
05:45 hours “U.S. Embassy Nairobi issues a security message informing citizens that violent extremists continue to occupy Westgate Mall and security services are there in full force. The security message urges U.S. citizens to remain close to their residences, shelter in place, and to avoid the area of the mall and large gatherings.”33 08:00 hours “An additional security message is issued by the Embassy informing citizens that due to ongoing security operations in Nairobi following the attack at Westgate Mall and subsequent demands on Embassy resources, the Embassy has suspended all travel to post by U.S. government temporary duty personnel until further notice.”34 10:00 hours “The Kenyan Interior Secretary Ole Lenku holds … a press conference announcing that 10 to 15 terrorist[s] attacked the Mall and that the terrorists are holding hostages.”35 Under command of the police chief, joint Army and police make a first attempt to enter and take control of the ground floor of Nakumatt. They come under fire from a sniper on one of the upper floors and are forced to withdraw after at least two of their men are shot, one of them fatally.36 Government response forces in helicopters land on the roof in an attempt to assault from the top down. 13:15 hours The U.S. Department of State reports a series of explosions followed by gunfire and a large fire “possibly started by the gunmen that sends large clouds of smoke from the building.”37 Al-Shabaab commentary (the initial Twitter feed was shut down by Twitter on Sunday morning, but a new account began within hours), making the following Tweets:38 “#Westgate: a 14-hour standoff relayed in 1400 rounds of bullets and 140 characters of vengeance and still ongoing. Good morning Kenya!” “It’s slowly approaching the 24-hour mark – the darkest 24 hours in Nairobi – highlighting the sheer fragility of the Kenyan nation.” “The Mujahideen are still firmly in control of the situation inside Westgate Mall. Negotiation is out of the question!” 20:00 hours “Kenya Defense Forces broadcast a Twitter Message that 4 soldiers have been injured and are being evacuated to the hospital.”39 They also claim that most of the “hostages” have been rescued and the mall secured. “Terror at Westgate: Lessons Learned,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, November 18, 2013. 34 “Terror at Westgate: Lessons Learned,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, November 18, 2013. 35 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 22. 36 “Lessons Learned: Westgate Mall Attack,” p. 11. 37 “Nairobi Westgate Mall Attack,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, September 23, 2013. 38 Harriet Alexander, “Tweeting Terrorism: How al Shabaab Live Blogged the Nairobi Attacks,” London Telegraph, September 22, 2013. 39 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 23. 33
11
Monday, September 23, 2013 06:45 hours “A large explosion is heard inside the mall,”40 source unknown. 11:00 hours “The electrical power and CCTV feed from the mall [are] cut.”41 12:45 hours “Gunshots and explosions are heard coming from the mall throughout the day. Dark clouds of smoke appear at the rear of the mall.”42 13:25 hours “Four more large explosions occur at the mall.”43 19:00 hours “Kenya officials say that the smoke is from the terrorists setting mattresses on fire.”44 “It is reported that at some point during the day the Kenya Defense Forces decided to fire a high explosive anti-tank rocket (possibly a[n] RPG-7 or an 84 mm Recoilless Rifle [projectile]) as part of their operation to neutralize the terrorists in the Nakumatt Super Market.”45 “The end result of this operation was a large fire and the partial collapse of the rear rooftop parking lot and two floors within the Nakumatt Super Market into the basement parking garage.”46 Tuesday, September 24, 2013 15:10 hours “The Kenya Defense Forces broadcast a Twitter Message that three of the 11 wounded soldiers who were previously removed to the hospital have died.” 22:00 hours “The President of Kenya, Uhuru Kenyatta in a live televised press conference declares the Westgate Mall secure.”47 He states that 61 civilians and six security officers died and that 240 people were injured in the attack.
“Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 23. “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 23. 42 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 23. 43 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 23. 44 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 23. 45 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 24. 46 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 24. 47 “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 25. 40 41
12
Escape and exploitation. As mentioned earlier in this case study, some have speculated that some of the terrorists escaped.48 Using a little-known water and sewage access tunnel that led to the Nairobi River, they may have fled, possibly leaving some of the hardcore terrorists behind.49 The report indicates that the government investigators may not have known of the escape route until at least 72 hours after the attack began. This report, although speculative, suggests the possibility that terrorists in a circumstance such as at Westgate might actually include an escape plan. Time will confirm Al-Shabaab’s exploitation of the Westgate Mall attack. The success of the attack could provide a recruiting advertisement that would bolster strength and encourage additional attacks. As one author put it, “… al-Shabaab is sure to capitalize on its ‘success’ and continue to orchestrate attacks both in Somalia and the region.”50
Conclusion Terrorists attacked Westgate Mall with intent. Part of the scheme included murdering as many people as possible and provoking a massive media response. It featured a heavily armed assault with coordinated cell phone communications. The attackers used hand grenades and AK-47 rifles and fired in semiautomatic mode. In the first phase of their plan, video coverage suggests, they shied from armed response but probably operated on a formal plan. The terrorists linked up in the Nakumatt store on Saturday. This may have been a critical aspect of their plan to launch the second phase of their operation. Unlike at Mumbai, where the terrorists used the linkup at the hotels to begin their final suicide stand, the terrorists link up at Westgate may have initiated their escape plan. Gunfire and explosions continued after Saturday evening, but there were no documented reports of actual sightings of the terrorists. In either case, the terrorist linkup represents a critical phase for response forces, the final outcome of the event and its effect on public opinion. Some media coverage of the terrorist attack on Westgate Mall portrays it as a successful attack for alShabaab. Assuming the al-Shabaab goal was widespread media coverage, sowing seeds of insecurity in the Kenyan government policy in Somalia, and raising the perception of a cohesive, powerful threat, they may well have succeeded. This prospect reinforces the requirement to develop procedures necessary to prevent and respond effectively should the U.S. Army face a similar threat.
Observations 1. After the initial assault, terrorists appeared to look for sites where victims had hidden; then the terrorists executed groups.
When hiding, ensure the safe site is as secure as possible. Barricade your position with whatever is available.
2. Many potential victims in the initial phases continued to walk generally away from the sounds. When terrorists arrived, those who had not evacuated were executed.
48
“Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, p. 22.
49
Russell Myers, “Video: The Escape Route Tunnel Used by Terrorists after Shopping Centre Massacre,” London Daily Mirror, September 28, 2013, http://www.mirror.co.uk/news/world-news/nairobi-attack-escape-route-tunnel-2314873.
50
Solomon Dersso, “The Fight Against al-Shabaab,” Al Jazeera, last modified 8 October 2013, http://www.aljazeera.com/indepth/opinion/2013/10/fight-against-al-shabab-201310282112677589.html.
13
Be decisive at the first sign of a terrorist attack. Do not panic, but move with purpose away from the action.
3. Some potential victims acknowledge that they did not know their way around the mall to find an exit.
Know where the exits are when in a public gathering place. If you do not know where the exits are when the attack starts, ask people in the vicinity and make a plan for exit or concealment.
4. Large numbers of people gathered just outside the mall hampered movement of security forces and identification of people exiting the mall. The obstacle slowed actual entry into the objective area. 5. Private armed, unidentified civilians and mall security guards provided the first armed response.
Expect ad hoc response and consider plans for controlling and managing friendly armed individuals. Establish identification procedures immediately to help prevent friendly-fire incidents.
6. Multiple security organizations eventually participated in the response and confrontation with the terrorists. Confusion between police and Army response forces and mistaken identity of a police tactical team and Kenya Defense Force soldiers resulted in mistaken identify and death of one police officer and wounding of another. 7. The first response to the attack was an ad hoc one of local police, armed security guards, armed local citizens, and off-duty members of the police and military who had been inside the mall when the attack occurred. Although it was unorganized, most credit this group with saving many lives by providing a way to escape. 8. Al-Shabaab used a constant Twitter commentary as the attack was going on. This caused confusion with conflicting government response. Attempts to shut down the Twitter feed failed. 9. Initial public reports released by official government agencies were conflicting and mostly inaccurate. Some official reports did provide accurate reporting and may have contributed to the hysteria. 10. It is possible the terrorists escaped. This could have occurred through an unknown access point or by blending with the local populace. 11. The actions of mall patrons at Westgate suggested a general confusion and inability of many individuals to make decisions. Video shows some stopping in alarm, walking uncertainly, and others hiding in places that offered no protection. 12. The terrorists constantly used cell phones. It is possible that they were providing updates and receiving instruction from a command and control site mentioned above. 13. The terrorists’ linkup point at Westgate, as at Mumbai, signaled the final phase of their operation. At Westgate they may have initiated escape plans.
Commanders’ considerations to prepare for a Westgate-style swarm attack 1. Immediate response is critical to success and reduction in lives lost and destruction. 2. Anticipate potential linkup points for active terrorist groups after an attack is initiated. Protect and prepare before attackers can link up. 3. Control the area immediately surrounding the attack(s) as soon as possible. 4. Train and resource potential responders to act immediately and report effectively.
14
5. Conduct rehearsals and exercises to train for response and track improvements. 6. Conduct war-gaming with external agencies to test communications and identification procedures and techniques. 7. Prepare for mass-casualty medical response by coordination with external medical elements and their inclusion in exercises and rehearsals. 8. Control the area around the attack site(s) and identify all personnel. 9. Plan for possible ad hoc armed response by friendly sources before formal law enforcement arrives on scene. Ensure clear understanding of rules on the use of force or rules of engagement. 10. Coordinate with local law enforcement to search where prospective terrorists might hide and/or rehearse. Add the information requirement to collection efforts to discover possible terrorist planning and rehearsal sites. 11. Prepare for the possibility of limited-visibility operations with night vision devices. 12. Define and control the perimeter for the attack site to facilitate rapid maneuver of security elements. 13. Check the surrounding area for a command and control vehicle or a site that supports terrorists’ communications. 14. Prepare for medical response. Control space for immediate triage and evacuation. 15. Prepare for public affairs response. Control information for consistency and accuracy. Replace inaccurate information as soon as possible. Prepare for terrorist public information releases touting their particular concept or goal. Prepare a response for terrorist Twitter (and other forms of) information release that exaggerates or falsely reports. 16. Ensure positive identification of all access points to the site, including underground water and sewage. 17. A swarm attack will most likely entail a significant law enforcement response, often much more so than any typical assault addressed by local law enforcement.
Plan for leadership assignment and management of the possibilities for multiple law enforcement, military, medical, and public affairs.
Ensure compatible communication.
Identify the leader of the response force early.
Ensure clear identification procedures and rules on the use of force and rules of engagement.
Use active shooter training as a basis for creating community awareness of effective response to swarm attacks.51
Summary of the Outcome of Events at Westgate Mall, September 2013 From September 21 to 24, terrorists conducted a swarm attack that caused confusion, highlighted a chaotic government response, resulted in over 60 deaths and many more wounded, and increased the Active shooter training slides, “Coping with an Active Shooter,” and handouts are available on the web at the Army Antiterrorism Enterprise Portal, url: https://west.esps.disa.mil/army/sites/APP/OPMG/OPS/antiterror/ATEP/default.aspx. 51
15
profile of the terrorist group, al-Shabaab. Some media coverage of the terrorist attack on Westgate Mall portrays it as a successful attack for Al-Shabaab. Assuming the terrorists’ goal was increased media coverage, sowing seeds of insecurity in the Kenyan government about its policy in Somalia, and raising the perception of a cohesive, powerful threat, al-Shabaab may well have succeeded. That prospect reinforces the requirement to develop procedures and create awareness necessary to prevent and respond effectively should U.S. Army personnel become involved with a similar threat.
References 1. “Terror at Westgate: Lessons Learned,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, November 18, 2013 2. “Lessons Learned: Westgate Mall Attack,” Kansas Fusion Center, October 25, 2013 3. “Nairobi Westgate Mall Attack,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, September 23, 2013 4. “Security Message for US Citizens: Nairobi (Kenya), Westgate Attack—Latest Update,” Overseas Security Advisory Council, U.S. Department of State, Bureau of Diplomatic Security, September 25, 2013 5. Peter Martell, Agence France-Presse, “Westgate Attackers Spent Four Months Planning in Nairobi,” November 19, 2013, http://www.google.com/hostednews/afp/article/ALeqM5gnA1HAgkJfAsEIsgaIqJRKdZaQPw?docId=317ef06b-9b14-4d5ca52d-11f82bebf298 6. “Al-Shabaab Attack on Westgate Mall in Kenya,” Background Report, National Consortium for the Study of Terrorism and Responses to Terrorism, September 2013, http://www.start.umd.edu/start/publications/br/STARTBackgroundReport_alShabaabKenya_Sept2013.pdf 7. Carlos Mureithi, “Shopping Mall Is Premier Complex That’s Home to International Brands,” Nairobi Daily Nation, September 21, 2013, http://mobile.nation.co.ke/News/Shopping-mall-is-premier-complex/-/1950946/2002378//format/xhtml/-/p0leo1z/-/index.html 8. Mark Duell and Simon Tomlinson, “Kenya Mall Terrorists ‘Burnt Victims’ Faces and Cut Off Their Hands to Prevent Identification’ as Reports Emerge of Woman Hostage Being Sexually Abused at Gunpoint,” London Daily Mail, September 23, 2013, http://www.dailymail.co.uk/news/article-2430152/Kenya-mall-attack-Terrorists-burnt-victims-faces-cut-handsprevent-identification.html 9. Paul Cruickshank, Tim Lister, and Nic Robertson, CNN, “Evidence Suggests that Al-Shabaab Is Shifting Focus to ‘Soft’ Targets,” September 26, 2013, http://www.cnn.com/2013/09/26/world/london-bombing-plot-qaeda/ 10. “Analysis of Al-Shabaab’s Attack at the Westgate Mall in Nairobi, Kenya,” New York City Police Department report, information current as of November 1, 2013, http://www.scribd.com/doc/190795929/NYPD-Westgate-Report 11. “Nairobi Westgate Mall Siege; 21/09/13,” slide show by Schlumberger, EAR Geo Security Advisor, c. November 2013 12. Cerwyn Moore, “The Threat from Swarm Attacks: Case studies from the North Caucasus,” Combating Terrorism Center at West Point, May 22, 2012 13. John Arquilla and David Ronfeldt, “Swarming and the Future of Conflict,” Rand, National Defense Research Institute, December 19, 2000, http://www.analytictech.com/mb021/swarming%20DB311.pdf 14. Harriet Alexander, “Tweeting Terrorism: How al Shabaab Live Blogged the Nairobi Attacks,” London Telegraph, September 22, 2013, http://www.telegraph.co.uk/news/worldnews/africaandindianocean/kenya/10326863/Tweetingterrorism-How-al-Shabaab-live-blogged-the-Nairobi-attacks.html 15. Christopher Anzalone, “The Nairobi Attack and Al-Shabab’s Media Strategy,” Combating Terrorism Center at West Point, October 24, 2013, http://www.ctc.usma.edu/posts/the-nairobi-attack-and-al-shababs-media-strategy 16. Russell Myers, “Video: The Escape Route Tunnel Used by Terrorists after Shopping Centre Massacre,” London Daily Mirror, September 28, 2013, http://www.mirror.co.uk/news/world-news/nairobi-attack-escape-route-tunnel-2314873 17. Solomon Derso, “The Fight Against al-Shabaab,” Al Jazeera, last modified 8 October 2013, http://www.aljazeera.com/indepth/opinion/2013/10/fight-against-al-shabab-201310282112677589.html
16