Lydia Baccino, Gabriel Helupka, Dan Flanagan, Nicholas Novak, Christine Saddy, AFRICOM and Extremism Team
Evan Beachler, Senior Editor
August 29, 2023
Kenya’s Capital of Nairobi, Highlighted by the Red Dashed Line[1]
The Counterterrorism Group (CTG) is issuing a FLASH ALERT to all citizens, Kenyan and Somali security services, Western troops, and diplomats based in Kenya and Somalia following the publication of an unverified Kenyan National Police Service poster from the office of the Directorate of Criminal Investigations (DCI). The viral poster details Al-Shabaab's intention to conduct terror attacks in the capital of Nairobi before the end of August and September 2023. Attack targets allegedly comprise military bases housing Western troops along with hotels and other social spaces frequented by Western diplomats. Knowledge of the group’s previous tactics suggests plans are to detonate suicide vests accompanied by random shooting attacks in public spaces or areas with significant foot traffic.[2] Kenya's National Counter Terrorism Centre (NCTC) has reposted the tweet that first published this poster with the post’s comment, “... notice or not, real or fabricated, we always have to be ready and prepared. Learn what to do in the case of an attack…”[3] There are heightened concerns regarding this threat as the 10th anniversary of the September 21 Westgate Mall shooting approaches. Al-Shabaab controlled the mall for four days, resulting in 67 deaths and approximately 200 injured.[4] The heightened tensions arising from the Somalian counterterrorism operations targeting Al-Shabaab have resulted in various attacks towards Somali troops, with the latest occurring over the weekend.[5]
CTG is on HIGH alert for the safety of Kenyan and Somali citizens following an unverified DCI poster circulating that warns Al-Shabaab plans to conduct attacks within Nairobi before the end of August and September. Al-Shabaab has VERY LIKELY selected this time to attack for its proximity to the 10-year anniversary of the Westgate Mall shooting. Al-Shabaab will VERY LIKELY seek to replicate this attack on a broader scale and capitalize on the poster’s virality. The poster is VERY LIKELY a response to recent large-scale Somali counterterrorism operations against al-Shabaab, with the group LIKELY attempting to project its ability to sustain cross-border attack capabilities.
On August 26, an unverified DCI poster warned of possible Al-Shabaab attacks in Nairobi, Kenya, at the end of August through to September. The document states that Al-Shabaab plans to “detonate suicide vests reinforced with sporadic shooting in crowded places and/or targeted areas.”[6] Assumed targets include “hotels frequented by foreigners, embassies, international schools, vital government installations, and social places such as malls remain vulnerable.”[7] Concerns about possible attacks are due to the upcoming 10th anniversary of the September 21 Westgate Mall shooting which appeared to be retaliation of Operation Linda Nchi, a coordinated military operation with Kenyan and Somali forces based in southern Somalia. Weeks leading up to the 2013 attack Al-Shabaab posted many threats with Kenyan police disrupting attack plans one week before the incident.[8] In January 2019, an Al-Shabaab attack on Nairobi's DusitD2 hotel complex killed 21 and injured 28. The group claimed it was in retaliation for the US embassy's relocation to Jerusalem and experts say it was a likely response to recent Kenyan operations against Al-Shabaab.[9] Kenya has been deploying troops to Somalia to combat the Islamist insurgency, participating as part of an African Union force. Al-Shabaab, in response, has been directing its attention toward Kenya, likely to prompt the withdrawal of its troops and urging them to focus on its internal affairs. Somalia and Kenya have reopened their border, which has been closed since 2011, and the African Union Transition Mission in Somalia (ATMIS) is withdrawing troops from Somalia, increasing the risk of Al-Shabaab violence.[10] A counter-insurgency campaign in Somalia has pushed militants to neighboring countries and increased the frequency of Al-Shabaab attacks in Kenya.[11] Their main tactic is to utilize Improvised Explosive Devices (IEDs) against civilian and military targets.
On August 24, the Somali government announced a ban on Telegram and TikTok in conjunction with ongoing large-scale military offensives against Al-Shabaab, believing the group uses these platforms for proof of attacks and recruitment purposes.[12] On August 27, the U.S. Africa Command (AFRICOM) stated that following the request from the Somali government a “collective self-defense airstrike" was carried out against al Shabaab near Seiera, about 45 km (28 miles) northwest of Kismayo.[13] This airstrike is part of the year-long collaborative operation between the US and Somalia in an effort to remove Al-Shabaab out of Somalia.[14] On August 28, Al-Shabaab asserted its capture of a military base in Cowsweyne, prompting government troops to withdraw from towns and villages previously liberated from the group in recent months, Al-Shabaab claimed it killed 178 troops.[15] Following the attack, Somali President Hassan Sheikh Mohamud stated that operations against Al-Shabaab will persist until they attain victory, insisting the group is weaker after the operations. Mohamud also contested the number of troops Al-Shabaab claimed to have killed.[16]
Al-Shabaab will likely use a successful attack to counter future Kenyan operations, very likely attempting to dissuade public favor of internal military counterterrorism operations. Attacks will very likely boost morale for Al-Shabaab, very likely using them as a tool to replenish numbers from recent counterterrorism operations. The group will very likely use this morale to sustain future counter-attacks along the Somalia-Kenya border, likely attempting to establish concealed hideouts and operational bases in northern Kenya for future retaliatory domestic attacks. Al-Shabaab will likely carry out limited border attacks against Kenyan forces, very likely testing response times without sacrificing essential resources. Border attack response will very likely factor into an attack on Nairobi, very likely using response time as an indicator for urban attacks.
Al-Shabaab’s attack threats will very likely extend to populous Somali cities and citizens, likely retaliating for increased operations and arrests against the group. The group will very likely use recent US bombing campaigns as an example, very likely attempting to increase anti-Western sentiment. Al-Shabaab will likely use these sentiments to undermine Somalia’s counterterrorism campaign, likely attempting to turn public opinion against the large-scale operations. There is a roughly even chance Al-Shabaab's tactics will influence public opinion, as Somali citizens very likely view the group as a domestic threat. Concerns of civilians caught in the crossfire of counterterrorism operations and retaliatory Al-Shabaab attacks will very likely grow as the group will likely increase retaliatory efforts against Western and civilian targets.
Western allies of Kenya will almost certainly increase intelligence-gathering operations against Al-Shabaab, almost certainly continuing a coordinated bombing campaign against the group. There is a roughly even chance that sustained bombing campaigns will dissuade Al-Shabaab’s plans, very likely showing their resolve and resiliency to carry out attacks in Kenya. The threat of Al-Shabaab IED or suicide attacks will very likely strain law enforcement's physical resources, likely creating challenges to sustainably securing vulnerable public venues long-term. Al-Shabaab will very likely launch smaller attacks to distract law enforcement and the military, very likely launching a larger coordinated attack while physical resources are spread thin.
Al-Shabaab will very likely use social media accounts, including X (Twitter) and Telegram, to broadcast threats, very likely to demoralize Kenyan citizens, military, and law enforcement agencies. The group will very likely broadcast attacks on social media platforms, likely using them to show their effectiveness at striking deep into adversarial territory. Al-Shabaab will likely use the poster to demonstrate their ability to threaten violence and disseminate proof of attacks despite recent Telegram and TikTok bans in Somalia, likely attempting to disprove the basis of the Somali government’s ban. They will very likely use social media to attract recruits from major urban populations, likely using Nairobi and other populous Kenyan cities to recruit local populations for insider attacks.
CTG recommends that the Kenyan National Police Service and Nairobi law enforcement enhance security measures in public areas, including increased personnel presence and heightened scrutiny of suspicious individuals near hotels and popular public venues. Transportation hubs, malls, hotels, bars, and other social venues should increase vigilance, review active shooter protocols, and coordinate with local enforcement. CTG recommends enhanced surveillance and security protocols in areas surrounding the 2019 and 2013 attack sites, particularly the DusitD2 complex and the Westgate mall that were the focus of the respective Al-Shabaab attacks. These venues should maintain awareness of the threat and take it seriously despite its unverified status. CTG advises Western diplomats and tourists to minimize visits to crowded areas and, when unavoidable, maintain vigilant situational awareness while promptly reporting suspicious activity to local authorities. CTG recommends that Nairobi establishments and civilians familiarize themselves with the ADD (Avoid-Deny-Defend) active shooter civilian response to prepare for potential incidents. CTG recommends that the Kenyan Border Police Unit (BPU) increase patrols and surveillance along the Somali border for potential Al-Shabaab infiltrators. CTG recommends that the Kenyan government assign military units to assist the BPU in their operations. CTG also recommends that Western citizens maintain an active state of awareness while in Nairobi and contact their local embassy officials for travel and departure advice. CTG advises if citizens cannot contact their embassies or reach a safe destination, they shelter in place. CTG’s AFRICOM, Extremism, and OSINT teams will continue to monitor for any further developments on intel given about the Al-Shabaab movement or attack plan. The Kenyan government should treat this threat with utmost seriousness, advising the public to exercise caution and promoting a "see something, say something" approach to foster increased vigilance.
CTG assesses that the current threat climate is HIGH given the recent increase in Al-Shabaab attacks, the upcoming 10th anniversary of the Westgate mall shooting, and the unverified threat. Increased Al-Shabaab recruitment and activity makes the threat of attack very likely in Nairobi and populous Kenyan cities. These attack threats will very likely extend to Mogadishu or other populous Somali cities. Western civilians and diplomats are at the highest risk within crowded public venues like hotels, malls, and social spaces. Recent arrests of Al-Shabaab members in Kenya, Somalia, and the US very likely increase the likelihood of retaliatory attacks. Previous Al-Shabaab attacks almost certainly indicate a preference for targeting military troops and populated public venues where diplomats and Western civilians frequent. Kenyan law enforcement agencies, citizens within major urban areas, and venue operators should maintain a HIGH alert status for potential Al-Shabaab attacks.
Analysis indicates a HIGH PROBABILITY of credible Al-Shabaab attack threats, with these threats against Western troops and diplomats in Nairobi LIKELY increasing throughout September. As counterterrorism operations against Al-Shabaab and counter-attacks from the group persist, there is a HIGH PROBABILITY that Al-Shabaab will use successful attacks for propaganda. They will VERY LIKELY use this propaganda to increase recruitment for sustainable threats of attack in major Kenyan and Somali urban areas.
[2] Lemayian Leiyan, from X, via CyberHUMINT
[3] NCTC Kenya, from X, via CyberHUMINT
[4] Westgate attack: Two jailed over Kenyan shopping mall attack, BBC, October 2020, https://www.bbc.co.uk/news/world-africa-54748341
[5] Al Shabaab counter-attack inflicts losses on Somali troops, Reuters, August 2023, https://www.reuters.com/world/africa/al-shabaab-counter-attack-inflicts-losses-somali-troops-2023-08-28/
[6] Lemayian Leiyan, from X, via CyberHUMINT
[7] Ibid
[8] Kenya Starts Probe in Wake of Mall Siege, The Wall Street Journal, September 2013, https://www.wsj.com/articles/SB10001424052702304526204579096713497161006
[9] Kenya attack: 21 confirmed dead in DusitD2 hotel siege, BBC, January 2019, https://www.bbc.co.uk/news/world-africa-46888682
[10] Kenya: Al-Shabaab Attacks Surge Ahead of Somalia-Kenya Border Reopening, ACLED, July 2023, https://acleddata.com/2023/07/07/kenya-situation-update-july-2023-al-shabaab-attacks-surge-ahead-of-somalia-kenya-border-reopening/
[11] Ibid
[12] LIBYA'S PRIME MINISTER WARNS ABOUT CIVILIAN DEATHS AND SOMALIA BANS SOCIAL MEDIA AFTER TERRORIST USE, by Jennifer Radlinsky, Megan Khalife, Gabriel Helupka
[13] US air strike said to kill 13 al Shabaab militants in Somalia, Reuters, August 2023, https://www.reuters.com/world/africa/us-air-strike-said-kill-13-al-shabaab-militants-somalia-2023-08-27/
[14] Ibid
[15] Somalia Military Offensive Suffers Setback as Troops Retreat, Voice of America, August 2023, https://www.voanews.com/a/7245333.html
[16] Somali President Says Military Operations Against Al-Shabab Will Continue Until 'Final Victory', Voice of America, August 2023, https://www.voanews.com/a/somali-president-says-military-operations-against-al-shabab-will-continue-until-final-victory-/7246454.html