A phone call as the dusitD2 complex terror attack unfolded helped security forces to crack a terrorist network behind the raid in which 21 people were killed.
A man who saw the registration number of a car whose image was broadcast last Tuesday as the one that ferried the terrorists to the scene of the attack at 14 Riverside Drive called police and told them he had seen the car leave Guango estate in Kiambu County on several occasions.
The Standard is aware of the man - and police have corroborated this account - but we cannot reveal it for his own safety.
Administration policemen on the ground were alerted and went to the estate. They barricaded it at about 8pm on Tuesday, hours after the gunmen had stormed the complex and started to kill people.
A dozen detectives from the Anti-Terrorism Police Unit and other groups joined the team at the estate and cordoned off the suspected residence for 16 hours. The house has been established to have belonged to the commander of the attack, Ali Salim Gichunge alias Farouk and his companion, Violet Kemunto Omwoyo.
Detectives at various security command centres later established that calls were made from the estate to dusitD2.
“That single call by a man who said he knew the car helped to crack the issue. We got much information that is now helping to unveil the entire network and we commend the public for this,” said an official who asked not to be named.
Police have said the Toyota Ractis registration number KCE 340E was fraudulently registered.
And in another pointer of the vigilance of the public, attendants at a courier service provider in Mandera town called police after they received luggage containing clothes that Kemunto had sent from Nairobi last week and which she was to collect on Wednesday (see separate story).
The car had been abandoned a few metres from the entrance of the complex after police confronted the terrorists and deflated its tyres. Security sources said it was believed tha the brief shootout between guards at a nearby embassy and the four attackers outside the upscale complex disoriented the terrorists and partly helped alert would-be victims.
In the car, detectives found a laptop and two mobile phones, one of which had a SIM card. The laptop had been extensively damaged.
The SIM card led to the first person of interest named in court papers only as Erik.
It is from Erik’s national identity card, which investigators say had registered 11 other SIM cards, that officers arrested two taxi operators, an M-Pesa agent and a Canadian.
In the meantime, the team in Ruaka was in charge of the house where the terrorists had been hours earlier. They arrested at least three people found in the house, including a man.
Investigators obtained Gichunge’s ID number and this led them to three mobile phone numbers.
From Kemunto’s ID number they got six mobile phone numbers.
Investigators say Gichunge’s and Kemunto’s mobile phone numbers were used to communicate to several phone numbers traced to Somalia.
This was the beginning of the cracking open of the network believed to have been behind the attack.
Several police teams were involved in the operation. A command centre was set up at one of the police installations in the city and ground teams from Nairobi, Meru, Mombasa, Isiolo, Nyeri and Mandera were mobilised with orders not to reveal who they had detained and where.
The people arrested from Gichunge’s house are said to have provided crucial information.
It was established that the suicide bomber, 25-year-old Al Shabaab operative Mahir Khalid Riziki, had been to the house and probably spent time at dusitD2 hotel before the attack.
In early 2015, Riziki reportedly told his family in Mombasa that he had relocated to Somalia, where he was being trained by Al Shabaab.
It is also emerging that in November and December 2018, while undertaking his final training in Somalia, Mahir regularly contacted his, wife Suhaila Mwalim Bakari, to find out about her status and that of his family members. Ms Bakari did not reported her husband to police. She has been arrested.
On January 13, Riziki sneaked into Kenya through Elwak in Mandera County, then travelled to Takaba and boarded a Moyale Raha bus in Marsabit town to Nairobi.
He went to Muchatha to link up with the cell leader, Gichunge, to receive instructions on his role in the planned attack.
On the day of the attack, Riziki reportedly arrived at the scene earlier and was constantly communicating with Gichunge.
Police are going through the hotel manifest to establish if the bomber may have been booked there as a guest, giving him ample time to plan and execute the mission.
After the officers had got the crucial leads, they started arresting and interrogating dozens of people who were in touch with the terrorists. At least 20 people have been questioned. They include a sheikh who is said to have inspired the terrorists.
Six of those arrested have been presented in court and detained for 30 days as investigations continue.
Police said they believed the cell behind the attack is linked to another one in Isiolo, which they thought had been eliminated. The most puzzling revelation is that one of the attackers from Mandera had used fake documents to obtain Kenyan identification cards.
His cousin was one of the four attackers who stormed Garissa University in 2015 and killed 147 people, most of them students.
“It shows the cell becomes active even among some distant family members,” argued an officer.
Multi-agency teams have been burning the midnight oil since Tuesday night in efforts to dismantle the gang.
It is also puzzling that a car whose registration number resembled the one of the car used in the ducitD2 attack was not in use. “We suspect the terrorists knew the car was parked in Kitengela for long and was not in use. The owner of the genuine car is away,” added another official. It is unclear how the terrorists knew about a car and that was not used regularly.
The terrorists' car was removed from the scene. Police said there were indications were using drugs before they launched the attack.
