On 7 June 2019, the Kenyan authorities announced that they had arrested two individuals suspected of being affiliated with the Somali al-Shabaab terrorist organisation and of having planned an attack on the Hilton hotel in the Central District Business (CDB) of Nairobi. The suspects were arrested on 4 June 2019 after the hotel staff had caught them taking pictures of the hotel with a mobile phone. Pictures of al-Shabaab militants inside training camps were found on the phone of one of the suspects. At the time of the arrest, the suspects were not armed. Investigations are still ongoing.
On 1 June 2019, three men were indicted for allegedly planning an attack on the Narok Stadium (Narok County) on the occasion of the Madaraka Day celebrations. The three men were arrested at different times; the authorities believe that one of them has ties to al-Shabaab and lived in Somalia for two years.
If the two suspects arrested in Nairobi were confirmed to be affiliated with al-Shabaab, this would be indicative of a high risk of terrorist operations still affecting the capital. Nairobi is a coveted target for the Somali al-Shabaab terrorist organisation, due to both significant international personnel presence and its symbolic value (as the capital of a country directly involved in the AMISOM mission in Somalia). In January 2019, the group carried out a successful attack on the Dusit D2 facility in the Westlands area, causing 21 fatalities.
The recent arrest and the successful operations claimed by al-Shabaab in Nairobi (including the 2013 attack on the Westgate Mall shopping centre, about 70 dead) are also a sign of the real risk that accommodation facilities, hotels and business complexes frequented by foreigners may constitute specific targets for attacks.
Tactically, based on information about the Dusit D2 attack, as well as on al-Shabaab’s typical method of operation in Somalia, the most likely modes of attacks involve small groups armed with explosives and small arms. Generally speaking, we can identify two main attack phases: an initial one in which attackers burst into the target perimeter with explosives (by means of a vehicle loaded with explosives or a suicide attack), and a second phase in which the group penetrates the target facility killing as many people as possible. In some cases, the initial explosion could be aimed at causing panic and leading victims to gather at access/exit points. Plenty of evidence shows how al-Shabaab’s operations are preceded by detailed preparation, which consists in examining the target facility and its security system gaps. In this phase, the attackers could intentionally get noticed by the security personnel at the target facility in order to get them used to their presence, make security personnel less focused on them and, therefore, make penetration easier on the day of attack (according to some sources, in the days before the attack on the Dusit D2, one of the militants repeatedly visited the site to speak to some of the guards, offering them tips to have his vehicle checked). The highest-risk time for possible attacks is the afternoon, as a potential operation would probably last through the night, making security force intervention more complicated and media coverage of the event greater.
Since May 2019, and for the first time since 2017, al-Shabaab’s official media channel, al-Kataib, has also resumed online publication of a series of propaganda videos in Swahili language with Kenyan militant Ahmad Iman Ali, leader of the Jaysh Aiman unit (mostly composed of foreign fighters from different East African countries). In March 2019, some media outlets released the news that Iman, also known as Abu Zinara, had been killed in Bu’aale, in the Middle Juba region of Somalia, but recent developments suggest that he is likely to be still alive (he has been presumed dead five times since 2012). Iman’s videos are explicitly aimed at radicalising the Kenyan Muslim minority (mostly Swahili native speakers), and the dissemination of new videos (May, June 2019) is indicative of the organisation’s renewed commitment to recruiting new militants. The videos basically feature doctrinal content and accurate references to concepts typical of a Salafi-based Koranic interpretation.
In the short/medium term, there is a real risk of terrorist attacks in the main urban centres of the country (including Nairobi), along the border with Somalia and in tourist areas frequented by foreign nationals. The recent arrests in Narok are also indicative of a general risk of attacks on large crowds during celebrations and events of various kinds. In the short term, the government will possibly try to minimise media coverage of any anti-terrorism operations, in order not to discourage foreign investors in the country. Based on the information available, personnel travelling to Kenya must stay in accommodation facilities with effective security measures and procedures to mitigate the impact of complex security events and the effects that such events would have on business activities.