The following document was obtained from the website of the National Domestic Preparedness Coalition, Inc.

Attack on Nairobi Mall Highlights Continued Threat from Al-Shabaab

• 7 pages
• For Official Use Only
• September 22, 2013

(U//FOUO) This Joint Intelligence Bulletin (JIB) provides information on the 21 September 2013 attack in Nairobi, Kenya likely conducted by al-Shabaab—an al-Qai‘da linked militant group based in Somalia. This JIB examines the ongoing incident and provides background on the threat from al-Shabaab. This JIB also highlights protective measures that can assist in mitigating threats in the United States using similar tactics and is provided to support the activities of FBI and DHS and to assist federal, state, local, tribal, and territorial government counterterrorism and law enforcement officials, as well as first responders and private sector security officials to deter, prevent, preempt, or respond to terrorist attacks in the United States or overseas targeting US interests.

(U//FOUO) Group Attacks Westgate Mall; at Least 59 Confirmed Dead

(U//FOUO) On 21 September 2013, 10 to 15 terrorists attacked a Nairobi shopping mall wearing black tactical clothing and ski masks. According to witnesses, the terrorists used explosive devices, likely grenades, and began shooting civilians. FBI and DHS have no specific, credible threats indicating al-Shabaab will attempt any additional near-term, follow-on attacks in the Horn of Africa region. FBI and DHS also have no specific, credible information indicating al-Shabaab may be planning a similar attack in the Homeland.

— (U//FOUO) While the situation remains fluid and ongoing, as of 12 p.m. on 22 September, there are at least 59 confirmed deaths and approximately 175 wounded.

(U//FOUO) Al-Shabaab Claims Credit for Attack, Likely in Retaliation for Kenyan Presence in Somalia

(U//FOUO) Al-Shabaab claimed responsibility for the attack and vowed not to negotiate with Kenyan authorities. The attack appeared designed to cause mass casualties and to gain media coverage by targeting a commercial facility frequented by Westerners as well as Kenyans. Al-Shabaab has publically threatened to retaliate against Kenya since its incursion into Somalia in 2011.

— (U//FOUO) An al-Shabaab associated-user on a social media site claimed ―For long we have waged war against the Kenyans in our land, now it’s time to shift the battleground and take the war to their land.

— (U//FOUO) There are about 4,000 Kenyan troops in southern Somalia, where they have been fighting the militants since 2011.

(U//FOUO) Regional Threat of Al-Shabaab Remains a Concern, Despite Lack of Specifics in Threat Reporting

(U//FOUO) This is the second high-profile al-Shabaab attack against soft targets frequented by foreigners in East African countries contributing to the African Union Mission in Somalia (AMISOM). The FBI and DHS assess al-Shabaab could conduct an attack in the region with little warning due to the threat environment and the desire to conduct attacks against Kenyan and Western interests.

— (U//FOUO) Despite the disruption of al-Shabaab plots in December 2011 and August 2012 in Mombasa and Nairobi, respectively, the group has conducted numerous attacks in Kenya against public areas in Nairobi and police posts since the incursion. The attacks are generally conducted using small arms, grenades, and improvised explosive devices (IEDs). East Africa-based violent extremists could also seek to target churches, night clubs, restaurants, and hotels based on previous attacks.

— (U) Al-Shabaab also was responsible for the July 2010 suicide bombings against public venues in Kampala, Uganda that killed more than 70 people, including one US citizen. Uganda has contributed troops to AMISOM since 2007.
— (U) On 24 August 2010, at least two members of al-Shabaab stormed the Muna Hotel in Mogadishu disguised as police officers, killing at least 33 people.

(U//FOUO) Terrorist Use of Small-Unit Tactics Overseas Continues

(U//FOUO) The recent events in Nairobi highlight terrorist and violent insurgent groups overseas—in some cases operating in nations battling violent civil unrest—continue to utilize small-unit assault tactics in attacks. These attacks involve using operatives to storm a target using small-arms to defeat security. The frequency of these attacks is likely attributable to perceptions of their effectiveness, the prevalence of small-arms instructions at terrorist and militant training camps, and the widespread availability of assault weapons in conflict regions.

(U//FOUO) FBI and DHS continue to assess the scale and complexity of any attack of this type is dependent on a variety of factors, to include the sophistication and training of the attackers, parameters of their targets, and the local security environment.

— (U) On 28 June 2011, nine terrorists—several wearing suicide vests and carrying small arms—infiltrated the Intercontinental Hotel in Kabul, Afghanistan. One suicide bomber reportedly detonated his vest at a guarded entrance, allowing other insurgents to enter the hotel kitchen and disperse throughout the building.
— (U) From 26 to 29 November 2008, 10 operatives working in smaller teams used small arms, hand grenades, and IEDs to attack multiple lightly secured facilities in Mumbai, India, including hotels and a rail station, ultimately killing 166 people. The operatives, who received specialized training from Pakistan-based terrorist organization Lashkar-e Tayyiba, infiltrated India by boat. The teams that stormed the Taj Mahal and Oberoi Trident hotels took hostages, leading to a multi-day standoff with police.

(U) Indicators of Pre-Operational Surveillance and Preparations for an Attack

(U//FOUO) The following activities may suggest surveillance of facilities. Some of these behavioral indicators may be constitutionally protected activities and should be supported by additional facts to justify increased suspicions. No single behavioral indicator should be the sole basis for law enforcement action. The totality of behavioral indicators and other relevant circumstances should be evaluated when considering any law enforcement response or action. Independently, each indicator may represent legitimate recreational or commercial activities; however, multiple indicators could suggest a heightened threat:

— (U//FOUO) Suspicious observation of or unusual questions about security procedures, or engaging in overtly suspicious actions to provoke and observe responses by security or law enforcement officers;
— (U//FOUO) Overly interested in entry points, peak days and hours of operation, security personnel, surveillance assets (including cameras), and access controls such as alarms, barriers, doors, gates, or locks;
— (U//FOUO) Suspicious observation of security reaction drills or procedures; multiple false alarms or fictitious emergency calls to same locations or similar venues;
— (U//FOUO) Loitering, parking, or standing in the same area over multiple days with no reasonable explanation;
— (U//FOUO) Having an unusual interest in speaking with building maintenance personnel or security guards;
— (U//FOUO) Attention to or avoidance of surveillance cameras;
— (U//FOUO) Attempts to disguise appearance from visit to visit (change in hair color, style of dress);
— (U//FOUO) Interest without justification in obtaining site plans, ingress and egress routes, and information on employees or the public;
— (U//FOUO) Garments not appropriate for weather/seasons;
— (U//FOUO) Unusual behavior, such as staring at or quickly looking away from personnel or vehicles entering or leaving facilities or parking areas;
— (U//FOUO) An increase in anonymous telephone or e-mail threats in conjunction with suspected surveillance incidents, indicating possible surveillance of threat reaction procedures;
— (U//FOUO) Discreet use of still cameras and video recorders or note taking or use of sketching materials that would raise suspicion in a reasonable person.
— (U//FOUO) Suspicious purchases of unusual quantities of items that could be used to construct an explosive device, including hydrogen peroxide, acetone, gasoline, propane, or fertilizer;
— (U//FOUO) Suspicious activities that a reasonable person would suspect indicate a storage facility or other area is being used to construct an explosive device; and
— (U//FOUO) Attempted or unauthorized access to rooftops or other potentially
sensitive areas.

(U//FOUO) Law enforcement agencies, security personnel, and administrators should be aware of and remain alert to indicators of surveillance activities. Officials are encouraged to review and update their evacuation plans and security and emergency policies.

(U) Suggested Protective and Crisis Response Measures

(U//FOUO) The following protective and crisis response measures may assist or augment existing safety, security, and counterterrorism efforts at commercial and public facilities. Facilities should review and update existing emergency and crisis management procedures using these measures. Officials should consider the following measures for everyday security:

— (U//FOUO) Review, update, and validate all emergency and crisis management plans;
— (U//FOUO) Coordinate response plans across functional disciplines (e.g. police, fire, EMS, hospitals, school districts, and private sector) and regions to maximize response in a large incident;
— (U//FOUO) Conduct exercises of emergency and crisis management plans;
— (U//FOUO) Raise awareness among employees by conducting ―all hazards‖ awareness training;
— (U//FOUO) Raise community awareness of potential threats and vulnerabilities;
— (U//FOUO) Ensure the staff is aware of their roles and responsibilities during a crisis and exercise these responsibilities;
— (U//FOUO) Ensure that emergency communications equipment is present and operable. Practice emergency communications plans and systems; and
— (U//FOUO) Report suspicious activity to proper authorities, to include missing or stolen weapons.

(U) Long-Term Protective Measures

(U//FOUO) Protective measures in the long term should emphasize physical safeguards, including building enhancements that present a more robust deterrent and provide a more survivable environment. Officials should consider the following measures:

— (U//FOUO) Install secure locks and protection on all external and internal doors and windows with quick-release capability from within for emergency and fire escape;
— (U//FOUO) Train security personnel to watch for suspicious or unattended vehicles on or near facilities; watch for repeated visitors or outsiders who have no apparent business in non-public areas of the mall; watch for abandoned parcels, suitcases, backpacks, and packages and any unusual activities;
— (U//FOUO) Consider establishing safe areas within the facility for assembly and refuge during crises;
— (U//FOUO) Consider establishing/implementing an emergency communications system such as phone trees or text messages for personnel; and
— (U//FOUO) Consider installing closed-circuit television (CCTV) systems, intruder detection systems, and lighting to cover key areas.

Share this: