Note: This sequence of events is hotel-centric. Details on the office buildings that were attacked are redacted in order to focus on what happened at the dusitD2 hotel. This is not to minimize the tragedy and sacrifice of those who perished and showed valor at the businesses that came under attack. Statements by the Kenyan government and the actions of the terrorists clearly indicate the hotel was the focal point of the attack. The terrorists applied a great deal of violence against the hotel, its staff, and guests, and a hotel room is where the terrorists made their final stand.

This briefing is based on open sources such as news articles, photographs, and video of the event. As the final report on the attack has not been issued by the Kenyan government or international agencies, there are multiple information gaps, and several issues need confirmation. Because reporting and video of the attack was so extensive, however, a relatively accurate picture of the attack can be deduced. As more data becomes available, Muir Analytics will update this brief and associated analyses.

 

Phase 1, Pre-attack Activities

There was no intelligence warning for the dusitD2 hotel

The Star reported that dusitD2 hotel manager, Michael Metaxas, said he had not received any intelligence warnings regarding potential attacks.

The Guardian reported, however, that foreign intelligence services told Kenyan government officials during the recent holiday season that attacks on tourist targets, including hotels, were a possibility. It is not clear how specific these warnings were, or if they were just for the holidays, or for the post-holiday season as well.

The terrorists might have checked into the hotel and/or had inside help prepping for the assault

The Star said police suppose at least one of the Dusit attackers might have stayed in the hotel before the attack, and/or that some hotel employees might have helped them with attack preparations. Authorities said this because the terrorists not only had grenades and ammunition scattered all over the hotel room they occupied, they also had a multitude of grenades and ammunition stored in drawers and “wrapped up in hotel laundry bags” throughout the room. So, it looks as if the terrorists had prepositioned some of their ordinance in their hotel room before the attack.

Additionally, Muir Analytics’ analysis of video and photos of the attackers infiltrating the Dusit compound show the gunmen carrying nothing more than individual combat loads (AK-47 magazines and grenades) in their chest rigs – in other words, only what they could carry on their bodies and still nimbly carry out the attack. They did not appear to be carrying the extra ammunition and grenades that police later saw in their hotel room. This lends more credence to the suspicion that some terrorist weaponry was stored in the hotel beforehand. These issues, coupled with the fact that the terrorists had reconnoitered the hotel complex several times prior to the attack, caused the police to say, “We suspect an inside job considering these people had been frequenting the place as they schemed the attack.”

The terrorists reconnoitered the dusitD2 hotel and office complex

The terrorists definitely carried out at least a casual reconnaissance of the dusitD2 hotel and business complex. A hawker just outside the Dusit interviewed by Daily Active Kenya saw one of the attackers twice before, each time going to the hotel’s coffee shop. And each time, he paid the hawker to watch his car parked on the street.

Reuben Kimani, a barista at the hotel coffee shop, told the press he had served coffee to one of the terrorists days before the attack. “I knew one of them because he had a big scar on one of his hands.” Mr. Kimani saw this terrorist during the attack as well.

Terrorist numbers and their weaponry/kit

Press reporting, video evidence, and the Kenyan government said there were five attackers in all, at least one of whom was a confirmed suicide bomber. The others appear to have been gunmen. Some (and possibly all) of the men recruited for this attack were Kenyan citizens and recruited on Kenyan soil, which, said the Kenyan government, was different from major al Shabaab attacks in the past where the attackers were Somalian citizens.

Video, pictures in Kenyans, and written reporting demonstrate the terrorists attacked the Dusit compound with AK-47s and hand grenades. One AK-47 had an under folding stock, and another was a latter model with a side folding stock with red plastic furniture, which is common among Chinese made AK-47s. The government did not release close-up photos of the AK-47s the other attackers carried.

The hand grenades appeared to be Russian F-1s (or copies) and possibly a mix of other types. Muir Analytics’ analysis of an AP photograph of a grenade at the Dusit that did not explode – curiously, the pin is still in and looks to have broken off when pulled – shows what appears to be the fuse of a Mecar M-72 grenade (Belgian made or a Chinese copy) in the body of a Russian F-1 grenade. M-72 grenade bodies are smooth with a few slight ridges, and F-1 grenades have long, pen-looking fuses and chunky, “pineapple-like” bodies.

Images of the attackers showed them clad in black combat utilities and wearing green chest rigs/web gear for their AK-47 magazines (at least six 30-round magazines each) and grenades (as many as six each). Photographs from The Star and The Standard also showed that two of the gunmen were armed with two magazines taped together. If there were four gunmen, then the estimated combat load for each gunman (or, how much ammunition each one carried) could have been eight magazines, or 240 rounds of 7.62 x 39 ammunition. This is a total of at least 960 rounds for the group. They could have been carrying as many as six hand grenades each, meaning 24 in total for the group.

If reporting on ammunition and grenades stored in the hotel room was accurate, then the terrorists might have had access to at least twice as much ordinance than they were carrying.

Some reports said the terrorists left a bomb in the car they arrived in, and other sources said this was false. There definitely was an inspection of the car by ordnance disposal (EOD, or the “bomb squad”), however, according to Daily Nation.

 

Phase 2, Initiation of the Attack, 15 January

2:30 pm: The terrorist gunmen arrived outside the Dusit compound and staged up for the attack

As the suicide bomber prepared to deploy to the Secret Garden restaurant, eyewitnesses interviewed by Daily Active Kenya said four attackers in a Toyota Ractis hatchback drove up to the street entrance of the Dusit’s driveway and waited for 30 minutes.

Additional reporting from The Star said the police think a taxi might have taken some or one of the attackers to the Dusit compound, but they have released little more on this angle.

3:05 pm: The assault began with a suicide blast at the Secret Garden restaurant

An eyewitness saw the bomber talking on his cellphone moments before he detonated, apparently chastising the assault team for being late. Then, at 3:05 pm, he detonated just outside the Secret Garden restaurant, this according to CCTV footage posted by The Nation. Authorities figure this was the audible signal for the assault team to enter the Dusit compound. Eyewitness John Maingi, who works at the Secret Garden, told the press that right after the explosion, “When I peeped outside I saw a human leg which has been cut off.” This was from the suicide bomber.

3:06 pm (estimated): The terrorist assault team entered the compound

The hawker interviewed by Daily Active Kenya that saw the terrorists in their Toyota stage up on the street also watched the vehicle enter the Dusit driveway, and then he heard shooting and explosions.

The Ractis did not make it to the second guard house, however. Either by gunshot, grenade explosion, or other means, the car suffered a flat tire, and the attackers made the rest of the way on foot.

Reports by Newscabal.com.co.UK said that guards from the nearby Australian embassy exchanged fire with the car-borne terrorists as they first penetrated the compound, but nothing more has been released on this angle.

Interestingly, video posted by Scroll of the Ractis shows small holes – possibly bullet or shrapnel holes – in the right rear passenger side door. This suggests that one of the attackers might have been wounded in the initial attack. CNN video here at the 3:31 mark shows one of the attackers with a slight limp or an odd, shuffling gait, indicating a possible combat wound.

The attackers then made it to the second guard house and parking lot where they fired at anyone in view. They also either threw grenades at three cars in the parking lot or set them alight. Massive flames engulfed all three cars.

 

Phase 3, Terrorists Penetrated the Main Dusit Compound, Hasty Rescues Enacted

3:32 pm: The terrorist assault team penetrated the main Dusit compound

As the gunmen transitioned from the parking lot into the main compound of the Dusit (CCTV video from CNN shows this movement is time stamped 15:32), multiple reports, including from police chief Joseph Boinnet, said the terrorists threw a grenade at a bank’s glass door, and then a suicide bomber detonated in the foyer or lobby of the hotel, according to Global News. Serge Medic, Swiss citizen and security company owner who ran to the scene to help said, “The main door of the hotel was blown open and there was a human arm in the street severed from the shoulder.”

The suicide bomber reported in the hotel lobby or foyer has not been confirmed. This particular explosion might have been part of the confirmed suicide bomber at the Secret Garden restaurant. CNN video here at the 1:16 mark showed the confirmed suicide bomber’s blast wave (concussion) traveling from the restaurant toward the hotel, a distance of about 50 feet. The hotel lobby or foyer explosion might also have been from a grenade.

The Mirror reported that scores of Kenyan and foreign civilians, some armed, plus a British Special Air Service commando, immediately responded to the chaos. Combined, their heroic efforts resulted in the rescue of as many as 700 people from the compound.

 

Phase 4, Terrorists Entered dusitD2 and Office Buildings

3:45 pm (estimated): The terrorists entered the dusitD2 hotel and office buildings

As the attackers moved deeper into the main compound of the Dusit complex, they assailed the dusitD2 and nearby office buildings, including, but not limited to, the Grosvenor and Hanover buildings. It is not yet clear how deeply the terrorists penetrated the office buildings. Some reports said office building door security and robust access control kept the terrorists from entering certain office areas. At least six men who worked for the company, Cellulant, were killed in the Cavendish building after heroically evacuating over 50 of their colleagues to safety.

Eyewitness Cyprian Otieno told the BBC he had gone to the dusitD2 to meet a friend for a drink. He heard an explosion and then the attackers emerged, firing AK-47s at everyone in view. Otieno said he heard them shout to each other in Swahili, “Kill them, kill them.” Hotel security told everyone to evacuate the immediate area, which was the ground floor of the hotel and the location of the Zing Lounge and Bar (which served coffee as well). Other restaurants there included the Soko and Soi restaurants, and the Soko Gormet restaurant. Hotel guests panicked and fled. Otieno said, “Sorry to say at that point it was every man for himself. We were all together in the beginning but after a few minutes the attackers began shooting…I can’t even really remember what happened afterwards.”

The Standard reported one person said they saw people who were trying to evacuate through the main gate of the Dusit compound running back to the hotel because the gunmen were coming from that direction.

Eyewitness Mr. Mamadou Dia told the Daily Nation he had just stepped into the hotel as the suicide bomber behind him at the Secret Garden detonated. Gunfire then erupted, and panic ensued as he saw a hotel waiter get shot. Mr. Dia fled to his business partner’s hotel room. They then decided to egress from the hotel, and upon descending into the lobby, they saw people running in every direction under raking automatic weapons fire. Hotel security managed to apply some order, however. They gathered 15 people (two hotel staff and 13 guests, including Mr. Dia), and took them to a room on the first floor where they sheltered in place.

As the terrorists pressed closer to the hotel, reported Nairobi News, dusitD2 revenue director Bernadette Konjalo was directing panicked people to the ground floor exits. She was standing at the entrance of the hotel when the attackers approached, so she stepped back into the building. The terrorists, however, advanced quickly and shot her.

Barista Reuben Kimani told the press he recognized one of the attackers as someone he had served coffee to days prior. They shot six of his colleagues.

A masseuse at the dusitD2’s spa heard the chaos and evacuated her station. She saw several people covered in blood in the main lobby/ground floor area, said the Bangkok Post. She said people tried to evacuate via the nearest exit, but the terrorists were in their way and opened fire. She and other staffers eventually ran across the hotel’s lawn, one by one, taking cover behind a tree at one point, because they were under fire. “The gunshots seemed to be never ending,” she said.

 

Phase 5, Hotel Guests and Staff Sheltered in Place, Police Enacted Rescues

3:55 pm (estimated): Hotel guests and staff sheltered in place, police began daring rescues of trapped guests

After their initial raking of the hotel lobby with AK-47 fire, at least some of the terrorists, reported The Standard, appear to have taken positions in the hotel and/or office buildings and fired down on anyone trying to flee the compound. Some people fled the attack zone under fire, and others sheltered in place. At this stage, police began to rescue pockets of people from the hotel and office buildings.

5:30 pm: Hotel rescue enacted

The BBC said a waiter who was with Mr. Dia’s group received texts saying the police knew where they were hiding, and to stay put because a rescue team was on the way. An hour and a half later, the police rescued them. But all was not safe, as terrorists shot at them from positions around the compound. So, this group of evacuees fled under fire with police returning fire as well.

5:20 pm: Hotel rescue enacted

Two Chinese nationals who videoed their ordeal from within the dusitD2 said they were jarred by an explosion and gunshots they said they heard at 3:27 pm, reported the South China Morning Post. Terrorists blocked them from leaving via the hotel stairway, so they sheltered in place in a suite with 12 others. They wedged a mattress against the door, pulled the curtains, and called the Chinese embassy. By 5:20 pm, Kenyan security forces reached their position and evacuated them via the hotel’s glass shattered lobby. Gunfire was still ongoing as they fled.

6:00 pm: Hotel rescue enacted

June Chepkemei told the Daily Nation she was attending a meeting for the Konza Technopolis Development Authority when the terrorists attacked the hotel. She and five of her colleagues sheltered in place in the bathroom of room 417. She heard intermittent gunfire and screams, indicating that the terrorists were going through the hotel, shooting people as they went. It is important to note, however, that reporting up to 15 February said no hotel guests were killed, and only six staff were killed. Some guests might have been wounded, however, especially since the spa worker saw people in/around the hotel with blood on their clothing.

Ms. Chepkemei was texting with a friend who told her al Shabaab had attacked her hotel, not to answer the door if anyone knocked, and that a rescue team would soon be there. A knock at the door did eventually come, and Ms. Chepkemei said if it had not been for the warning texts from her friend, she would have opened the door and most likely would have been killed along with her colleagues.

Later, Ms. Chepkemei took charge of her group and decided to flee the hotel because the pressure of the situation had become too much. Her company’s crisis training – a result of the ultra-violent al Shabaab Westgate Mall attack in 2013 – told her not to go to the roof or the front of the building, so she led her colleagues to the nearest hotel stairwell/fire exit. They ran into trouble, however. She told the press, “Here, the gunshots were too many and too close so we made a quick decision to rush back upstairs and hide in the room that one of the consultants at our workshop was staying in at the hotel.” Then, just before 6:00 pm, Kenyan police reached her room and took her and her colleagues to safety.

 

Phase 6, Police Isolated the Terrorists in the dustitD2, 16 January

3:00 am (and possibly earlier): The RECCE Squad isolated the terrorists in the hotel

The Standard provided detailed reporting of the commando mission to retake the hotel. By at least 3:00 am, and possibly earlier, two seven-man commando teams of the elite RECCE Squad belonging to the police’s General Service Unit had sealed off the bottom of the hotel. From the third floor, they sent a robot (at least one, maybe more) through the hotel to reconnoiter the building and locate the terrorists. The robot was armed with signals-locating technology to aid in this effort. When the robot made it to the sixth floor, it detected terrorists in a room above on the seventh floor.

The terrorists were communicating with cohorts in, 1) Rauka (a small town sitting directly on the north-northwest border of Nairobi), 2) Kiambu County (in south central Kenya), and, 3) Somalia (probably the location of their control/commander). They sent pictures of the Dusit victims to the control asset in Somalia. It should be noted that al Shabaab was in communication with their control asset in Somalia during the Westgate Mall siege in 2013, and the 2008 Mumbai attackers (three hotels, including the Taj Mahal) did, likewise, with their control in Pakistan via satellite phone.

Eventually, one commando team locked off the 6^th floor stairwells from the lower floors. After this, they cut power to the hotel.

Another team, using ascending techniques, then made entry into the seventh floor, forcing the terrorists to retreat. They tried to make it to a lower floor, but the locked stairwell trapped the terrorists where they were.

Kenya’s National Security Advisory Committee at Harambee House received word from the RECCE Squad that the terrorists were trapped in a hotel room, and they ordered police to evacuate the rest of the 172 hostages from the building.

 

Phase 7, Police Neutralized the Terrorists in the dustitD2

4:00 am: RECCE Squad made their final assault

At 4:00 am, security forces decided to decisively engage the terrorists. Commandos made a dynamic entry into the terrorists’ room using shields while pouring automatic weapons fire onto the gunmen. The terrorists managed to toss two grenades at the commandos, which wounded two, but their shields blocked most of the blasts, and they neutralized the terrorists near instantaneously.

The Star said police officers discovered a stockpile of grenades and rounds of ammunition in what the Kenyan press called “a bulletproof room” (no explanation as of yet) where the commander and/or the rest of the terrorists were hiding. Police said, “It took us very long to break into the room because the armoured door was very difficult to break. When we finally did, the commander, who was the last person to be killed, had so many grenades and rounds of ammunition in the room.”

10:00 am: The Kenyan government declared the property retaken

The property was considered retaken by the government by 10:00 am the next day, Wednesday, said the Daily Nation.

Soon after the government had taken over the compound, the Dusit corporation released a statement expressing its sorrow and dismay over the attack. It provided phone numbers and email contact information for people who had family or friends in the hotel at the time, and for the press as well regarding reporting inquiries.

Later, the Dusit corporation issued another statement that asserted hotel guest safety and security was its number one priority, and that hotel employees had been killed in the attack. It also restated emergency and press contact information.

 

Phase 8, Aftermath

The aftermath of the Dusit compound attack will continue to unfold in the months and years to come. This will include police investigations and trials, insurance investigations and payouts, hotel repair and remodeling, medical treatment for the wounded, review and upgrading of government intelligence and security procedures, review and upgrading of corporate intelligence and security for the hotel and office buildings, and the like. Mourning for the deceased and acknowledgement of the human losses will continue for a lifetime.

16 January – 4 February: Overall casualties tallied

Police Inspector General Joseph Boinnet said the death toll was 21 civilians and five terrorists, reported Daily Active Kenya. The number of wounded was 30, said The Star. The nationalities of those killed was:

• 16 Kenyans
• 3 people of African descent yet to be identified
• 1 Briton
• 1 American

Nairobi News and other outlets said six employees of the dusitD2 were killed, and anywhere between one and three were wounded.

Two of the hotel dead, said The Standard, were Dedricks Lemisi and Zachary Nyabwanga. They were working security at the complex for Senaca International Security, Ltd.

EturboNews reported that no guests at the hotel were killed. There is no word yet on guests that might have been wounded.

22 January – 8 February: The hotel announced it was closing for repairs and renovations

Nairobi News on 30 January said the hotel would remain closed until upgrades could be implemented. Specifically, the paper reported, “The hotel team is now working on beautifying the property, as well as introducing new dining concepts, with a view to being fully operational soon. The exact reopening date will be confirmed in due course.”

Later, on 8 February, TTR Weekly ran a headline that asserted, “Dusit Nairobi reopens in June.” In the meantime, the hotel would concentrate on cleanup and repairs, property improvement, upgraded and rebranded food and beverage venues, and multiple community outreach measures.

The Independent quoted dusitD2 Nairobi general manager Michael Metaxas as saying of the reopening efforts, “The spirit of determination that runs through the entire 14 Riverside community [the Dusit hotel and office complex] is heartening to see, and the support from everyone has been and continues to be, incredible. This positive energy is driving us as we prepare the hotel to delight guests and visitors once more with delightful service, impressive design, and safe and comfortable surroundings for people to socialize, stay and conduct business.”

The same news outlet quoted Dusit International Chief Operating Officer Lim Boon Kwee as saying, “As ever, the safety and well-being of our guests and employees remain our priority, and we will continue to have rigorous security procedures in place that contribute to the high levels of comfort and care for which we are known worldwide.” 

6 February: Scores of business in the Dusit quickly reopened, security increased

At least 15 companies in the Dusit office complex resumed operations within days of the attack, clearly indicating the business offices were not the focus of the onslaught. Business Daily Africa named them as: Regus, Vitality Clinic, Qatar Airways, I&M Bank, Gen Africa, Red House Group, Pernod Ricard, Dusit Restaurant, SAP, AC Nielsen, Commission on Revenue Allocation, LJA, and Safari Trails.

Business Daily Africa additionally said some of the Dusit compound upgrades include multiple layers of security.

6 – 16 February: Preliminary insurance issues

Muir Analytics’ interviews with insurance experts and press reporting said that insurance payouts for damage sustained during the attack, business losses, and related issues was ongoing as of 16 February. Business Daily Africa said Kenya-based GA Insurance was the insurer, and that Kenya Reinsurance Corporation would be making payouts to two underwriters.

16 February: Early estimations of dusitD2 financial losses

If the hotel is closed for 136 days and reopens on 1 June 2019, then business losses regarding RevPAR alone (excluding other revenue streams such as food and beverage) could be $1,888,700 USD. This is based on an average room cost per night of $137.50, a conservative figure arrived at by surveying a range of room prices for the hotel through various online booking sites. This does not take into account cleanup, repairs, remodeling, care funds for families of the deceased and the wounded, and the rebranding measures management discussed. These costs can equal and even surpass RevPAR losses as demonstrated by the extensive efforts to rebuild and rebrand the Oberoi Hotel Mumbai in the aftermath of the November 2008 terrorist raid on Mumbai.

15 January-present

Government investigations into the network that attacked the hotel are ongoing and comprehensive. Multiple arrests have been made, and some of those detained have been released. Further investigations and a trial of those indicted will reveal more details of the attack over the coming months and years.

Sources and further reading:

“DusitD2 Nairobi Moves To Reopen Following Terror Attack,” Independent, 10 February 2019.

“dusitD2 Nairobi hotel to reopen after January terrorist attack,” eTurboNews, 9 February 2019.

“Dusit Nairobi reopens in June,” RTTR Weekly, 8 February 2019.

“GA Insurance faces dusitD2 payout claims,” Business Daily Africa, 6 February 2019.

“Kenya’s ambulance ‘Uber’ at heart of siege rescue,” The Star, 4 February 2019.

“Inside the re-opened dusitD2 Hotel complex,” Business Daily Africa, 1 February 2019.

“Dusit Hotel to remain closed as renovations continue,” Nairobi News, 30 January 2019.

“Gone but not forgotten, cerebration of terror attack heroes and heroines,” The Standard, 24 January 2019.

“Kenya Reopens DusitD2 Hotel, One Week after Deadly Attack,” Voice of America, 22 January 2019.

“Heroes who saved the day at the Dusit terror attack,” NewsCabal.co.uk, 20 January 2019.

“Dusit Hotel now says they lost six employees and not four in terrorist attack,” Nairobi News, 20 January 2019.

“Dusit hotel to hold memorial for 6 employees on Wednesday,” Capital News, 19 January 2019.

“Terrorist were transported to Dusit by taxi, say police,” The Star, 19 January 2019.

“‘Death was so close I had to send my final wishes’,” Daily Nation, 19 January 2019.

“Terrorists hid bullets, grenades inside Dusit,” The Star, 19 January 2019.

“How Recce Squad trapped and eliminated terrorists in DusitD2 siege,” The Standard, 18 January 2019.

“Kenyan security find an explosive after deadly hotel attack,” Associated Press, 18 January 2019.

“How security forces outplayed terrorists in rescue mission,” Daily Nation, 18 January 2019.

“DusitD2 Hotel manager who died helping colleagues and guests to safety,” Nairobi News, 18 January 2019.

“A Chinese businessman’s terrifying account of brutal Nairobi hotel attack,” South China Morning Post, 18 January 2019.

“Thai hotel staff head home after surviving Nairobi terrorism,” Bangkok Post, 17 January 2019.

“Four staff of DusitD2 died in terror attack, three seriously injured,” The Star, 17 January 2019.

“Anatomy of terrorist attack on DusitD2 hotel,” Daily Nation, 17 January 2019.

“Dusit hotel survivors recount ordeal,” Daily Nation, 17 January 2019.

“‘I was prepared to die’: survivors recount chaos of Nairobi attack,” The Guardian, 16 January 2019.

“Dusit attack: 21 confirmed dead, 5 terrorists eliminated, says Boinnet,” Daily Active Kenya, 16 January 2019.

“Nairobi attack: Kenyan authorities confirm 15 dead after hotel terror attack,” Agency France Press, 16 January 2019.

“Dusit Attack: Full statement update by Inspector General Boinnet,” Daily Active Kenya, 16 January 2019.

“Nairobi hotel: ‘How we survived DusitD2 siege’,” BBC, 16 January 2019.

“Nairobi attack: Kenyan authorities confirm 15 dead after hotel terror attack,” AFP via The South African, 16 January 2019.

“SAS hero who stormed Kenya hotel alone ‘was out shopping as terrorists attacked,”The Mirror, 16 January 2018.

“Terrorists at Dusit D2 Hotel Attack at Riverside Killed,” Kenyans, 16 January 2019.

“Eye witness alleges attackers of Dusit D2 Hotel visited the site twice,” Daily Active Kenya, 15 January 2019.

“Kenya: Al-Shabaab gunmen occupy hotel and office complex in Nairobi, huge blast reported,” Sxcroll.in, 15 January 2019.

“14 reported dead after Kenya hotel attack claimed by Somali Islamists,” Reuters via Global News, 15 January 2019.

Copyright © Muir Analytics 2019