As five al Shabaab fighters raided and occupied the Dusit hotel and office compound in Nairobi, Kenya, on 15 January 2019, a slew of civilians, some armed and some unarmed, immediately descended on the scene as first responders. Serge Medic was one of them. Here is his riveting and highly informative story.

Bio:  Serge Medic, age 56, Tambuka Holdings LTD, Swiss national currently based in Nairobi. Serge has over 28 years of experience in management of international projects and programs, security, investigations, audits, administration, and facilities. Most of his career was in the telecommunications sector.

Muir Analytics: What were you doing at the time of the initiation of the attack, what drove you to descend upon the Dusit compound?

Medic: At approximately 15:35, I was in a taxi (Uber, so I have the receipt which provides the time of the trip) on Waiyaki Way 200 meters from the Dusit in straight line but still over one kilometer by car. At 15:39 (timestamp on a photo I took), I saw wounded people being carried away on Waiyaki Way, I thought it was a car accident. I checked social media, and it turned out there was an ongoing attack. I could hear the gunfire. I asked the taxi driver to change direction. By the time we got to Riverside Drive, the road was completely empty, and some people at the crossroad were turning vehicles away. So, I exited the taxi at 15:42 (according to the receipt) and ran on Riverside Drive road (15:45) toward the sound of gunfire. I passed Australian High Commission which is on that road, and it was under complete shutdown.

What drove me? I was in Nairobi in 2013 during the Westgate attack. In fact, I was at a shooting competition at the RECCE barracks in Ruiru [the base for the REECE Squad, police commandos]. Just after lunchtime, messages started pouring in about an attack in Westgate. I informed all my colleagues, staff, and friends, and went home. I was later in the afternoon amazed to see on social media some of the civilians that were with me at the competition who were now present in Westgate shopping centre, and they were saving people. I then understood that one can just walk into a building under siege, and I said to myself that, should it happen again, I would go in to rescue people. In fact, I was always ready with my medical kit on me, including ear protection, gloves, etc. (as can be seen on some photos).

Muir Analytics: What did you see upon arrival, what was your assessment of the situation, and what did you do?

Medic: In the driveway off Riverside Drive, leading to 14 Riverside compound, I saw two to three vehicles stopped on the left side of the road with two to three “civilians” getting some weapons out of their car boots. One was dressed in a red shirt and had body armor on. (I was later told he was from the Police “Flying Squad”, an elite unit). He was armed with an HK 9mm submachine gun with two taped magazines. The other guy, whose name I got later, is a civil servant at the State House, and he was loading his 12-gauge shotgun (a type that looks a bit like an AK-47 because it has a magazine etc.). The three of us later walked all the way right into Dusit hotel where we got shot at. There might have been a fourth person with us, but I do not remember him. If he was there, he must have been behind us. There were also two guys filming the scene, but they did not have any usual journalistic filming equipment. I had the impression they were filming with a phone or a small camera (I did not pay attention to this at the time).

In the distance, approximately 120 meters toward the compound, I could see three burning vehicles with a large fire and a lot of smoke. Sporadically, one could hear subdued explosions, more like thuds. I assume these were exploding tires, tanks, etc. And throughout this time, I heard gunfire coming from the general direction of the compound.

I spoke briefly with the guys with guns, asked them if we are going in, but they did not give a positive answer. I cannot remember at this time what exactly they answered, but it was not positive – they wanted to wait for something. So, I just proceeded on my own, and this is what you see on the video [that showed Medic advancing into the compound, armed and alone]. Vehicles were parked on the right side of the road, and I passed them on the left side seeking at least a bit of concealment and cover from the gunfire. I was going slowly because although the gunfire was heard in the distance, I was also checking between each vehicle to see if any bad guys were hiding.

There was a security booth. I checked it, and there were no bodies, or anyone injured. I came to the level of the burning cars, and the heat was quite unbearable as I was still proceeding in the middle of the road, seeking cover behind parked vehicles on the opposite side from where the gunshots could be heard. I came to the main entrance of the compound, checked the offices there, and now I had to make a choice whether to go left, straight across the park, or right towards the multi-story car park. I saw the other guys catching up to me, and I waited, hoping they had some kind of information about the attackers by now. But they did not. Nobody was there at this time to give us any info.

We saw damage on the building where I&M bank has offices (it is called the Hanover building). What we did not know is that 20 meters to the right was the place where one assailant blew himself up on the other side of that same building. Just before you get to the bank, there was an entrance to that building completely blown up (glass piled up), and an unexploded hand grenade sat there in front of the elevators. The I&M bank shop windows were riddled with bullets. The windows seemed thick (as you look through bullet holes). Later I learnt that two dead bodies were recovered from the upper floors of that building.

So, now we knew they had rifles and hand grenades.

We came to the corner of Hanover building, where I&M offices end, still the three of us. Another building (Arlington building) was now right in front of us and the road curves to the right towards D2 hotel, approximately 50 meters away. We could still hear gun fire coming from the general direction of the hotel, but also from other directions. These were echoes.

This building in front of us, Arlington, was worrying me: many windows were overlooking us, and many were open. Some windows were riddled with bullets, and it could have been the good guys shooting at the bad guys who might have still been inside, I thought. So, I suggested we move on. Halfway to the D2 Hotel, approximately 25-30 meters from the corner of Hanover building, there was an arm severed from the shoulder. There wasn’t a body around, so I assumed they lobbed a grenade on the terrace of the D2 restaurant, and it must have belonged to one of the patrons. But later, I learnt about the assailant who exploded himself (about 50 meters further away), and this was his arm.

Muir Analytics: Can you say what you were armed with?

Medic: I was armed with a 9mm pistol and had spare magazines with me.

Muir Analytics: At the hotel, what kind of damage or casualties did you see, if any?

Medic: After seeing the severed arm, we continued toward the Dusit hotel, another 20-25 meters. We noted that the shooting had stopped by now. There is a big canopy at the entrance of the hotel. There is a part of the road where guests are dropped off, just before they proceed for a security check. The hotel had a nice white Porsche Cayenne for dropping off guests at the airport, etc. It was parked at the entrance, and it was completely riddled with bullets, which obviously came from the inside of the hotel. So now we knew the gunmen were at some point inside the hotel, or they might still have been inside at that time.

Now we passed the entrance area where the security checks were usually performed.

Let me tell you about the Dusit hotel before the incident. I lived nearby for a couple of years, and I would visit often for lunch and dinner. The security was top notch, similar to security check one can find at an airport. The luggage was scanned, and they also have a portal (scanner) through which everyone enters the building. In many places in Nairobi, security does not detect your firearm. But here, they found it every time. But despite such efficient security measures, can unarmed security agents stop determined armed assailants?

So, now we passed the security area at the entrance of the hotel. Just after this area, there used to be a huge glass entrance area. All the glass was blown out and lay on the floor in big greenish piles of glass. Now, I only remember two of us going inside over that rubble. I think the glass made some noise as we walked over it, it might have alerted the gunmen that we were entering (there was still no further gunfire at this time). We entered the reception area. Here, there was a huge open space on the left (restaurant area) and on the right (bars and drinks area).

The reception was intact. In fact, other than the exploded entrance, there was no other damage that could be seen. Nobody in sight. We stood there for about 30 seconds, trying to hear or see something that would indicate to us which way to go. Then, suddenly, very loud gunfire started (we are now inside, gunfire is louder). I could not see where it was coming from. I never saw the gunmen. One cannot take cover not knowing where exactly the fire is coming from or without seeing the assailants. So, we moved out of the hotel, but now we were surrounded by other buildings. I assumed the gunmen had split up and could be aiming at as from any direction (later we learnt they did not do that and that they were all inside the hotel). I could now see some soldiers at the corner of Hanover building from which we started our walk to the hotel. I asked them to cover us. We retreated and fired suppression shots as we did that.

Note that from entry into the compound to this point, we had not seen anyone: no hostages, no gunmen. I assumed that people had already escaped. I was amazed to find later on that many people were still hidden in the offices.

Muir Analytics: It appears as if al Shabaab fighters were inside the venue you made entry into, and then it seems either they fired at you from cover, or they threw a grenade. Can you confirm this and then expand on what happened here?

Medic: They did not throw a grenade at us, but they fired at us with automatic weapons. However, I was informed that much later at night, approximately at the same spot where we entered the hotel, the gunmen threw a “cooked” grenade at two men from the Kenyan disciplined forces [police commando team, the RECCE Squad]. A grenade normally explodes roughly five seconds after the “spoon” is ejected. When you remove the pin, eject the spoon, and wait for two to three seconds, and then throw the grenade, it either explodes in mid-air or lands near the intended victim and explodes immediately without giving that target the chance to take cover. I knew about this method, however the term “cooked” was unknown to me.

Muir Analytics: After this incident, can you explain what happened during the rest of the melee?

Medic: When we returned to the corner of Hanover building, I briefed the half-dozen soldiers that had now arrived about what we saw. I also told them I felt exposed to the building which was right in front of us (Arlington), and that we should clear it. A few minutes later, some GSU [police] arrived. Also, someone received a call saying that two to three hostages were stuck in Arlington building. An officer assigned a half dozen of these GSU officers, and we started clearing the building. A news photographer was also with us. We started with 1st floor, we were basically looking for gunmen but instead found many people hidden all over that building.

Muir Analytics: The government said the attack began at 3:00 pm, but some on the scene say more toward 3:30. What’s your take?

Medic: I think it started after 15:00 and before 15:30. Probably 15:15. Remember, I saw injured people being carried away on Waiyaki Way at 15:39. Some of them were being carried by four other people. I think it would take them more than 10-15 minutes to get to that point from the compound.

Muir Analytics: It seems the attackers arrived in the little gray hatchback car but abandoned it halfway up the drive. Video of the car shows a flat tire and what might be bullet holes in the rear right passenger side door. Can you expand on any of this?

Medic: I do not remember this vehicle but later saw the video. Someone was taking a “Camelbak” hydration pack (camo-colored) from the vehicle and showing it to the camera. The video showed the vehicle riddled with bullets and if the assailants were inside the vehicle while it was being shot at, I wonder how they escaped uninjured. But I do not know anything else about this vehicle.

Muir Analytics: So, from the people interviewed, it seems the attackers went from building to building, floor by floor, and knocked on doors and barged into rooms, shooting people. This is from people who were inside the hotel and the office buildings such as the Grosvenor. Is this your take as well?

Medic: Yes. They did that in the Hanover building where I&M bank is located. Two bodies were found upstairs in that building. I understand also in the I&M bank there were some victims. I understand that they did this in Hanover building and in the D2 Hotel, where they regrouped and remained inside.

Muir Analytics: It looks like there were a few grenades that the attackers threw, but they did not explode. Care to comment?

Medic: I only saw one unexploded grenade. BUT, I saw two exploded building entrances so I assume they used the hand grenades for that. Also, at some point I was with a news reporter on the phone. Heavy gunfire was still heard, so from time to time, we would stop talking. Then also there was a big explosion and a couple of seconds later, a “swoosh” sound as glass fell to the ground. This was obviously another grenade. I do not believe there were other unexploded grenades, but there might have been more grenades that exploded.

Muir Analytics: So, from the people interviewed, some of the office complex doors were very thick, and access control entry was robust (either card swipe, or electronic key pad entry, or mechanical key pad entry, etc.). These physical security measures seem to have prevented the attackers from making wider entry throughout the buildings. It seems to have helped save lives. Can you comment? Was this the case in the hotel?

Medic: I was [in the past] in charge of security of facilities for a big company in Nairobi. We had these glass doors in offices, locked “magnetically” and opened with swiped cards. I knew very well from experience that if you give these doors a vigorous push, they just open. So, as we were clearing the building I mentioned, we would find these doors. Some soldiers kicked down a few by breaking the glass, and I explained the trick to them, and from then on, we did not need to break any doors down. So, I tend to disagree, these kinds of doors are NOT good protection. You can do this test any time. And the doors were also not thick. The only door we could not open was the one on the 5th floor. It was not a glass door and it was opening to the outside: when I pulled the door knob, it remained in my hand so we could not open that door. I sent for a sledge hammer but in the end, the Managing Director of the company on that floor opened that door from the inside.

Muir Analytics: Anything to add regarding hostage rescue?

Medic: Shortly after the forces appeared, also an armored vehicle came and they started going back and forth, from the “corner” of Hanover building to the D2 Hotel, picking any hostages from surrounding buildings and bringing them back to safety

Muir Analytics: Anything to add?

Medic: I think I read in your report that the assailant who exploded himself was on the phone, “probably telling off accomplices for being late” or something like that. Personally, I do not think the assailant was on the phone with anyone. I have viewed many CCTV footages of criminals and often the accomplices pretend to be on the phone while they are stalking their prey. In essence, when you see someone on the phone, you tend to think they are busy with something else and not focusing on you. So, in my mind the assailant was just pretending to be on the phone so as not to arouse suspicion of the people sitting on the terrace. Some reports say that he was saying repeatedly “uko wapi?” in Swahili, meaning “where are you?”.

END QUESTIONS

Copyright © Muir Analytics 2019