Kenyan mall attack demonstrates terrorism risks; further high-casualty attacks unlikely in three-month outlook

Around noon local time on 21 September, assailants armed with grenades and rifles launched an attack on one of Kenya's largest and most frequented malls, the upmarket Westgate in the affluent Westlands area of the capital Nairobi. At least 68 people have been killed and over 175 injured, although this number is likely to rise as a number of hostages are reportedly still being held within the mall. IHS sources have corroborated media reports that attackers specifically targeted non-Muslims, initially making hostages recite the shahada in order to identify any Muslims. Kenyan authorities have placed the number of assailants at 10–15, while IHS sources reported that there could have been more than 20 involved in the attack.

Kenyan forces have reportedly set up a 1 kilometre security perimeter around the mall and have conducted sweeps inside, supported by Israeli special forces, freeing most of the hostages. Deployed security and intelligence forces are reportedly concerned that attackers have planted remote-controlled improvised explosive devices (IEDs) throughout the building, in addition to possibly wearing suicide vests. As the siege is ongoing, it remains unclear how long the area will be closed, including the nearby Ukay Centre. Traffic and business disruptions are likely in the coming days, with a number of businesses likely to remain closed for a mourning period.

Shabab's involvement

Somali jihadist group the Shabab has claimed responsibility for the attack on its Twitter account (which also discusses actions by affiliated groups), stating that it was a response to Kenyan military involvement in Somalia. In an interview with BBC Africa, an alleged Shabab commander in southern Somalia, Abu Omar, claimed that although the attackers were not members of his group, a Shabab command centre has been in touch with gunmen throughout the siege, providing direction. Corroborating Abu Omar's claims, an IHS source who was at the mall reported that after attacking the supermarket chain Nakumatt, those involved had unfettered access to mobile phones and SIM cards, showing that there was probably some external co-ordination. However, known members of the Shabab's leadership have not claimed direct responsibility for the attack, suggesting that the group's local affiliates could be the perpetrators; no claim has been made by any local affiliates. The attack demonstrated a greater degree of co-ordination and capability than has previously been seen in Kenya, suggesting that the assailants had undergone training, most likely outside Kenya.

Since Kenya's deployment to the African Union Mission in Somalia (AMISOM) and its successful eviction of the Shabab from the group's key financial hub – Kismayo – in October 2012, the Shabab has repeatedly threatened large-scale attacks in Nairobi. The media had previously blamed the group for an explosion at a shopping complex on Moi Avenue in May 2012, which injured over 30 people, although the attack was never claimed by the Shabab.

However, following the killing of senior leaders involved in the July 2010 Kampala twin bombings, the group's foreign strategy has shifted from direct attacks to the development of local affiliates in regional countries, such as Kenyan militant group al-Hijra (formerly known as the Muslim Youth Centre: MYC). MYC largely recruits youth from the ethnic Somali Kenyan community, as well as the coastal Muslim community, which has increasingly complained of marginalisation by the government and harassment by security forces. MYC attacks to date have been restricted to low-level grenade and rifle attacks against Kenyan security forces, as well as softer targets like transports hubs, bars, and nightclubs frequented by locals in Nairobi and coastal tourist hub Mombasa. In March 2012, suspected MYC followers staged grenade attacks against a church and restaurant; this was followed by the multiple grenade attack in June targeting Euro 2012 spectators at the Jericho bar. These attacks were never directly claimed by the MYC, despite comments implying that it could have been them.

If confirmed, the involvement of the Shabab – at the very least in the co-ordination of the attack – would probably be an attempt to reassert the group's influence following its military and territorial losses, as well as to revive the credibility of its threats to destabilise countries contributing troops to the AMISOM force (Burundi, Kenya, Sierra Leone, and Uganda, supported by Ethiopian troops). The attack will place regional jihadist groups at the top of the agenda during the UN General Assembly, which starts today (23 September).

Outlook and implications

Since the Shabab's eviction from major cities from southern Somalia, the group has restructured, with a downsized force more effective for its strategy of guerrilla warfare. However, the group has still maintained technical and some material support to local affiliates in Kenya, specifically al-Hijra, and to a lesser extent the Tanzanian group Jumuiya ya Taasisi za Kiislam (Community of Muslim Organisations), led by radical cleric Sheikh Ponda Issa, which has ties to Zanzibar-based radical groups. Jumuiya ya Taasisi za Kiislam has been accused of stoking sectarian unrest in October 2012 and also of staging the May 2013 grenade attack against a Catholic church in Arusha; the group has neither confirmed nor denied its involvement in these instances.

Kenyan security forces have shown their increased capacity to detect plots, and a likely crackdown on al-Hijra adherents is likely to mitigate the risk of another high-casualty attack in the coming three months. However, further attacks are likely on softer targets frequented by expatriates, including hotels and office buildings in the Westlands and Gigiri areas of Nairobi. Popular leisure and tourist venues also face a high risk, such as The Village market in Gigiri, Carnivore restaurant in Nairobi's Langata suburb, and the Nakumatt Junction and Yaya Centre shopping malls, as well as bars and beachside tourist resorts in Mombasa are also likely to be targeted. Attacks within Uganda and Tanzania are likely to be limited to localised grenade and rifle attacks targeting security forces and congested public spaces, particularly those frequented by Western nationals and affiliated to Christian groups.

A likely security force crackdown against key Muslim communities will probably incite unrest in the predominately Somali neighbourhood of Eastleigh, as well as larger coastal cities like Mombasa and Malindi. Police harassment risks radicalised marginalised Muslim youth further, supporting recruitment drives by al-Hijra and Shabab sympathisers. In August 2012, members of the Muslim community in Mombasa staged two days of riots, including street fights with security forces, following the death of Islamic cleric Sheikh Aboud Rogo. Rogo was killed by unknown gunmen. However, at the time the police were blamed due to previous alleged human rights violations against the coastal Muslim community during counter-terrorism operations; these allegations were denied at the time and have not since been proved.

Economically, the attack is likely to put further pressure on strained public finances, affecting capital-intensive infrastructure programmes. The attack is likely to negatively affect the tourism sector, the country's largest foreign-currency earner, which has only recently rebounded from the slump following the 2007–08 widespread post-election violence. Additionally, it could also delay the upcoming debut of Kenya's USD1.5 billion, the largest ever debut sovereign bond in sub-Saharan Africa, which is earmarked to finance big-ticket projects like the USD22 billion Lamu Port and South Sudan Ethiopia Transport corridor. However, the relatively peaceful presidential election in March, natural resource development, and the recently published International Monetary Fund report commending the government's economic policy and reforms are still likely to encourage investment. A USD5-billion Chinese loan, once disbursed, is also likely to moderate the negative impact to FDI flows.

Before the March 2013 election, Western stakeholders expressed concern about maintaining close relations with the country if International Criminal Court (ICC)-indicted president Uhuru Kenyatta and deputy president William Ruto were elected. However, this attack has highlighted Kenya's strategic role in regional counter-terrorism operations, including its deployment to AMISOM, which mitigates the risk of the country's isolation. The has today ICC agreed to an adjournment of Deputy President Ruto's trial related to post-election violence in 2007, in light of the attack. This increases the likelihood of delays to the ICC trials against both Ruto and President Kenyatta, whose trial is scheduled to start in November.

Over the coming hours and days, we will be watching for the Kenyan security force's response, specifically how targeted any operations are, to refine our assessments of the likelihood of further attacks and the likely levels of civil unrest. Additionally, we will try to gain further information on the attackers in order to better understand the Shabab's capabilities in the region. We will also be monitoring the security forces' reactions in Uganda and Tanzania.