Westgate: How police used call data trail to arrest terrorists

A senior crime analyst has told a trial court in Nairobi that the suspects held over the September 21, 2013 Westgate terrorist attack communicated on mobile phones with the four attackers killed at the mall.

They communicated throughout the planning and execution of the attack, the analyst who said he sifted through “mountains” of call data records to come to his findings, told the court.

Paul Maingo’s testimony builds up a clear picture of how the Al Shabaab interacted with accomplices throughout the Westgate Mall terror attack.

Arising from the analysis include evidence of a phone used by a man among the terrorists who did not enter the mall, one used earlier by one of the terrorists killed in a counter strike and which was later recovered from one of the suspects in Nairobi’s Eastleigh estate prior to the attack.

“I established that the four suspects who died in the mall had links with accused persons in court,” the senior police officer said.

Call data records


Car bomb kills at least 13 in Somali capital: police, medics

He said Call Data Records (CDR) obtained from mobile phone service providers,” and the geographical locations” helped establish there was an association with the terrorists. “At one time, they were in Eastleigh…one of the accused persons cellphones was found in that area…”the witness said.

The officer explained that the fourth accused, Hussein Mustafa, was in communication with one of the terrorists, Abdinur, who also used the handset at one stage and they had exchanged 40 calls and sent two text messages between August 27 2013 and September 18 2013

Abdinur used the handset to send money to Mogadishu, Somalia, the trial court heard. “Accused persons had direct association with cell phones used by the attackers…” the witness said.

He said a meticulous analysis of piles of call data records “revealed the linkage of attackers with the suspects arrested, the connection of the terrorists with the crime scene and the link of the terrorists with the car they purchased, paid and used in planning the execution of the attack .”

“At one time, a hand set was shared… the hand set was recovered from accused number two…,” the expert witness said. He explained in court how he exploited the phones IMEI number and found a SIM card which was recovered at the scene used by Abdinur had been slotted in it at one stage.

He said the registration had been done under fake identities but six numbers in the IMEI find revealed the gunman Abdinur received calls from accused number 4, 1, 2.

“The number of accused number 4 was slotted into the equipment…” the detective added. Five numbers were used in the day of the attack, the witness said. He clarified that only four gunmen stormed the mall while a fifth remained outside.


Brother of most wanted terrorist charged in Milimani court

Day they came to Kenya

He said the suspects on trial were in communication with the attackers from the day they came to Kenya through Uganda.”They were the first to be contacted,” he said.

The witness denied there was manipulation of the data profiles to fix the suspects as the state had “to have some take the blame.” “I did not manufacture or manipulate data used for this analysis,”the witness said. The telephonic links presented in court show the presence of Hassan Ahmed Dhuhulow, Yahya Ahmed Osman and Ahmed Hassan Abukar at the mall on September 9, 14 and 15. They attacked the mall September 21. The attack left at least 67 people dead. More than 170 were injured.

It is believed they were on surveillance mission. The men received calls from the suspected accomplices – Mohammed Ahmed Abdi, Adan Adikadir Adan alias Adan Dheq, Liban Abdulle Omar and Hussein Mustafa, according to the call data.

Abdi was arrested on September 30 2013 in Kitale. He holds a Kenyan identity card and comes from Ijara, Garissa County. Omar was arrested on October 6 2013. He is a refugee registered in Kakuma.

The suspects face charges of giving support to a terrorist group, obtaining registration by false pretences, committing a terrorist act and provision of property and services for the commission of a terrorist act contrary to the Prevention of Terrorism Act 2012. Hearing continues.


Senior civil servants take home billions

Facebook page where criminals are put on notice