Revealed: Secrets of Dusit D2 terror attack

Kenya's investigators burnt the midnight oil to crack the Dusit D2 terror attack, identifying the planners, facilitators and executors of the heinous attack where 25 lives were lost and dozens injured.

The investigators drawn from the Anti-Terror Police Unit combed through Facebook, at least 177 SIM cards collected from Muchatha, M-Pesa transactions, calls and texts to unravel the faces, movements and communications behind the attack.

So meticulous were the detectives that they managed to link Dusit D2 attack planners and facilitators with a foiled attempt to bomb the Kenyatta International Convention Center (KICC) in 2018.

They went to the extent of tracing where the attackers were born, their families, and what they did on the day before and during the attack.

Police Constable Titus Lang'at was the man who put the pieces and bits together, which led to the arrest of Mire Abdullahi, Hussein Mohammed, and Mohamed Ali.

He was a witness testifying on Tuesday in a case where Abdullahi, Hussein and Ali are accused of committing acts of terrorism, aiding and abetting terrorism acts, and conspiracy to commit terrorist acts.

In his testimony, Mr Lang'at told High Court judge Diana Mochache that at least 177 SIM cards were collected from Muchatha in Kiambu County, and a mobile phone from Ali Salim Gichunge aided investigators to trace the attack from Jilib, Somalia.

Jilib, the court heard, is the operations base for al-Shabab. "If we can stop this menace then we need to also look at facilitators and the financiers," said Lang'at.

Lang'at first identified the attackers. He said Gichunge, who was commandeering the rest, had rented a house at Muchatha and lived with his wife, Violete Kemunto.

The court heard that Mahir Khaled Riziki or Gabriel Simba was the suicide bomber. The others were Osman Gedi, Adan Mohamed Noor, and Siad Omar Abdi.

Lang'at played a video in court showing the five eating breakfast one day before the attack. They had a loaf of bread, pancakes, apples and cups of tea.

There was a video of Osama bin Laden playing and an AK-47 rifle below the television. On the recording, Gedi speaks partly in Kiswahili and is overwhelmed by emotions. He weeps.

A year later, an al-Shabab sympathiser news channel Al-Kataib Media Foundation, posted their faces and details. The officer said this was a way of celebrating the attackers who had been killed.

According to the officer, Al-Kataib posted a similar video following the Manda Bay attack. "They reveal faces of those who have died in an attack and blur those who have not died," testified Lang'at.

Gichunge, the court heard, was born in 1990. He was raised in a military camp where his father was a Kenya Defence Forces (KDF) officer.

The court heard that there were videos of Kemunto and Gichunge getting married.

While revealing Riziki's dark past, the officer said that he was part of a criminal gang associated with the Musa and Sakina mosques. According to him, Riziki hailed from Tononoka and was born in 1993.

The court heard that he escaped to Tanzania then joined al-Shabab.

Omar was a refugee from Dagahaley, He was born in Somalia in 1992, while Gedi was born the same year in Mandera East.

Meanwhile, Noor was an unknown person. His identity was revealed from a mobile phone retrieved from Gichunge.

The investigator said that Gichunge received a total of Sh806,900 through M-Pesa.

According to Lang'at, the last amount wired, allegedly from Ali, happened a day before the attack. It was in two tranches of Sh70,000 and Sh69,500.

The investigator, however, was hard pressed to explain the link between Ali and Gichunge.

Quizzed by Ali's lawyer Chacha Mwita whether Ali communicated with Gichunge, the officer stated that there were no calls or texts. Only the money transfer linked the two.

"It was only him who sent the money to Gichunge," Lang'at testified.

According to Mwita, Ali was in the money exchange business and he has sent the money to Gichunge on behalf of one Yussuf Ali Noor.

But Lang'at asserted that there was evidence to connect Ali to the attack financing for three months from November 2018 to January 2019 when the attack happened.

The court heard that one of the mobile phone number used to wire the money was registered in the name of Ali's dead brother, Isaack Abdi.

Lang'at testified that Gichunge had used a doctor's lost identification card to register for M-Pesa. He also used the ID from Dr Eric Kinyanjui to register Kemunto's line.

Kemunto was last traced at Mandera and is believed to have crossed into Somalia after the attack.

The court heard that a Facebook account was created on January 14, 2019 and the purpose was to transmit live videos by the attackers.

Another account that had been created on April 4, 2018 was traced to one Adam Chege who was in Jilib. Chege was central to the attack.

It was alleged that the same Facebook account was used to communicate in the KICC plot where Victor Odede was charged with attempting to blow up the building.

Hussein, the second accused, was said to have possessed pictures of fake student IDs that aided two terrorists to escape a refugee camp for Muchatha.

The court heard that Hussein communicated through Facebook with Adam Chege but he did not communicate about any intended terrorist attack.

Lang'at testified that the ID images were sent by Chege who had instructed Hussein on what to look for.

According to the officer, Chege also communicated through the same Facebook account with one Simple Wes who was to ferry a parcel from Mandera to Nairobi. The parcel was to be collected by one Abdulahi Ali.

The officer alleged that the same mobile phone number that was printed on the parcel was the same one that was found with Mohammed.

"Was there communication between the three accused persons?" Chacha asked.

"No, your honour," Lang'at replied.

Meanwhile, the court heard that Mahir travelled from Elwak to Nairobi, then Muchatha. Elwak is a town in Kenya, on the border with Somalia.

Gedi, on the other hand, lived in Nairobi. His last location before going to Muchatha was traced at Mirema Drive in Roysambu.

Omar, the other attacker, was said to have travelled from Dagahaley camp on January 3, 2019 and arrived in Nairobi 10 days later. He also ended up being hosted by Gichunge in Muchatha.

Another terrorist was also said to have travelled from Dagahaley to Eastleigh before joining Gichunge.

Gichunge, Omar, Gedi and Noor also travelled together in the same car to Dusit D2 on the day of the attack.