On January 25, 2018, at around 1 pm, a pink and white-themed wedding took place in Nairobi’s Buru Buru estate.

Women in headscarves and Swahili dresses danced to the Nubian Dukalo song “Kabalagala Ngonja” by Master Drapari, played through two mid-range speakers.

The groom, Farouk, entered a house made of iron sheets painted light brown and cream to meet his in-laws and bride, Khadija.

Farouk, clean-shaven, wore a black suit with the designer’s label still sewn on his left sleeve, a white shirt, a black bow tie, and eyeglasses. 

Unlike other weddings where the groom is accompanied by his family and community to collect the bride, Farouk arrived alone. He appeared preoccupied with avoiding the camera, fidgeting or turning away whenever it captured his face.

“Mapenzi ndio zawadi kubwa utatupatia sisi (Love is the greatest gift you will give us),” Khadija’s father told Farouk before her aunt interjected with a demand that they must be three by the end of the year (2018).

“Mwaka huu muwe watatu,” she said before ululating and bursting into a rendition of William Ingotsi’s song, “Mwana wa Mberi ni Shikhoyelo” (The first-born son is a real joy). Other women joined in.

Farouk was then introduced to a woman in dark glasses and informed that she was his bride’s gogo (grandmother).

Taking Farouk’s hand, she led him into a room filled with women and presented him with his bride.

Khadija wore a white wedding dress, her smile visible through the veil whenever she parted her red lips.

“Nimewapatia na mikono miwili, muende muongeze kizazi (I have given her to you with both hands, go and increase the family),” she said, before the women erupted into a celebratory Kalenjin song.

“Iyoni Ng’o Tumi… Iyoni kole neee? (Who agrees with the ceremony? How do you perceive it?)” the women sang as they led the couple out to join the other guests under a tent. 

The Islamic wedding might have passed unnoticed, known only to those in attendance.

However, for security agencies and the courts, this wedding became crucial in unravelling the identities of Farouk and Khadija and in understanding the planning and execution of the DusitD2 attack.

As the nation would later learn, Farouk was a cold-blooded killer, a terrorist—Ali Salim Gichunge. His bride, Khadija, was Violet Kemunto Omwoyo, also known as Khadija Mahmoud.

The Standard exclusively obtained documents, videos, CCTV footage, and conducted multiple interviews to piece together the untold story of the planning and execution of the DusitD2 Hotel attack on January 15 to 16, 2019.

Unknown in-law

From the footage, Gichunge lived a deceptive life. His in-laws knew nothing of his Al-Shabaab training or his plot to attack Kenya. Worse still, they had married off their daughter to a man whose family they had neither seen nor heard from.

A lead investigator, speaking on condition of anonymity, told this reporter that Gichunge was an enemy within. According to him, the wedding and its planning were carried out meticulously, raising no suspicion that he posed a threat to Kenya. 

“You see, Gichunge was the groom, but he avoided the camera, which was unusual. Something was hidden within him, and when we analysed it later, it was interesting. He arrived here in 2018,” the officer said.

Surprisingly, the officer revealed that Gichunge had been involved in maintaining security at Muchatha, Kiambu County, where he had rented a house.

“He was involved in the security of the estate. I think this is where we go wrong—assuming everyone is good,” the officer noted.

Interviews and CCTV footage revealed that Gichunge, Mahir Khaled Riziki (the suicide bomber), Osman Gedi, Adan Mohamed Noor, and Siad Omar Abdi may have had other targets in mind.

On January 14, 2019, a day before the attack, two attackers conducted a reconnaissance mission. Dressed in black suits, Riziki and Omar arrived at the hotel in a taxi and were ushered in by the lobby agent at 11:25 am. They proceeded to the Zing Terrace and had lunch for almost an hour.

They then left on foot through the main entrance, turned at the Arlington block, and returned to Soi Restaurant, where they ordered drinks and sat at the back terrace at around 2:30 pm.

Later, they exited separately—one through the secret garden walkway, the other through the pedestrian exit—before taking another taxi.

On the day of the attack, January 15, at around noon, Gichunge was seen at Two Rivers Mall wearing a hat, black trousers, and a large checked shirt. He visited the butchery section, appearing tense as he frequently glanced at the exit.

CCTV footage later captured him at the Carrefour Supermarket counter, paying for an item before leaving. Another camera spotted him outside in a jacket and sandals, carrying a shopping bag.

Meanwhile, at 3:19 pm, DusitD2 cameras recorded a white Toyota NZE, registration KBR 243D, at the security checkpoint. The vehicle, believed to have transported Riziki, proceeded to the hotel’s driveway, between Soi Restaurant and the hotel’s main entrance, where he alighted in a black suit.

Suicide bomber

While on a phone call, Riziki walked towards Secret garden, this time looking uneasy. Minutes later, he strolled back and stood at the edge of the walkway between I&M and Zing bar. He was still on call.

He moved back and forth, while on a call for about five minutes through the pedestrian walkway in the middle of the complex, between Hannover, Dusit, and Belgravia blocks, towards the Secret Garden restaurant.

He then stopped at the ridge overlooking Amadiva saloon and the water fountain, this time scrolling his phone, and made another call.

The CCTV captured this call for about four minutes. He then returned to the Arlington direction, and minutes later, he briskly walked back again and stood slightly off the path.

The suicide bomber then stood on the grass outside the open facing the café terrace, still on a phone call for approximately one minute before he exploded.

The investigation revealed that the attackers targeted DusitD2 because it housed foreign nationals. Comparing the attack to Westgate in 2013, the senior officer noted a key difference—the presence of a suicide bomber in 2019.

“In the Westgate attack, we had four attackers. In 2019, there were also four, but this time, one wore a suicide vest as a trigger for the attack,” he said.

Further inquiries linked Riziki to Masjid Musa Mosque, where he had been previously arrested alongside controversial cleric Aboud Rogo.

“If you join terrorism, you remain in terrorism. Riziki was arrested in 2014 at Masjid Musa,” the officer revealed.

CCTV footage also captured another vehicle parked near Chiromo Campus Hostel, carrying the remaining attackers. At 3:31 pm, four gunmen alighted 100 metres from the security barrier and opened fire. A Wells Fargo guard fled for safety.

A minute later, one of the attackers turned back and threw a grenade towards the parked cars, causing an explosion. They then fired at the parked taxis outside the rank. They then shot towards the parking silo exit, damaging a car that was exiting and three others at the Belgravia visitors’ car park.

The attackers then split into two groups—one heading towards Hannover Driveway,  while the other went through the water fountain footpath, accessing the Secret Garden restaurant, Amadiva Saloon and other buildings connected within the complex.

According to the Anti-Terror Police Unit (ATPU), the complex’s rare exit routes saved many lives.

The government swiftly responded by sealing potential escape routes. 

“We suspected the attackers would escape. What we had to do was to close the Garissa route, then coming towards Nairobi, we had to do a thorough check. We also liaised with our colleagues from Moyale route,” he said.

At the same time, a special team was dispatched to neutralise the attackers.

 “We had a SWAT team neutralising the attackers, which led to recovery of firearms, unexploded grenades, cartridges. They helped in clearing the scene conducting forensic analysis, including DNA and mobile phone tracking. Here, we were able to get faces of the attackers. The attack left 21 people dead,” he explained.

The investigator said the second phase was to look for evidence connecting the suspects, those who facilitated their movement and documentation.

Investigators discovered that the attack had been orchestrated via Facebook. 

“What I remembered that was so critical was that this attack was planned through Facebook. Why Facebook? Of course, we got information about the falsification of documents of the terrorists, you know, sending some pictures like a school in Mandera, telling them to use these documents, with the birth certificate to evade the barrier,” he narrated.

Detectives unearthed the entire plot from Facebook accounts “Kim Sam,” “Abdul Hakim,” “Kezia Soze,” “Mohamed Yare Abdalla,” and “Soze Kezia.”

One account, created on January 14, 2019, was intended to transmit live footage of the attack. Another, dating back to April 4, 2018, was traced to Adam Chege in Jilib, Somalia, a key figure in the plot.

The same Facebook account was linked to the Kenyatta International Conference Centre (KICC) plot where Victor Odede was jailed with attempting to blow up the building.

In the meantime, some of the Dusit’s enablers, such as Mire Abdullahi, are facing the long hand of the law today.

Abdullahi admitted admitted to four charges in court, including cyber terrorism. He provided internet services through kit serial number 259364 VSAT used in coordinating the attack.

At least 177 SIM cards were recovered from Muchatha, and a mobile phone belonging to Gichunge, which aided investigators in tracing the attack from Jilib, Somalia. Gichunge had at least 11 mobile lines.

Mobile phone analysis

During the hearing of the case, Abdullahi, Hussein Mohamed Abdile, and Mohamed Abdi Ali were accused of committing acts of terrorism, aiding and abetting terrorism, and conspiracy to commit terrorist acts.

Another investigator, Chief Inspector Joseph Kolum, told High Court Judge Diana Mochache that the first item they analysed was a Nokia 1030 mobile phone.

He stated that the phone was used  for financial transactions. He said Gichunge used aliases such as Eric Kinyanjui Munyi, Eric Kinyanjui, or Farouk. “It appears the phone was dedicated to M-Pesa transactions only,” said Kolum.

The mobile phone was recovered from a house in Muchatha where Gichunge had been residing.

The second phone, a Nokia 1010, also had no Sim card. It was recovered from a vehicle with registration number KCN 340E, which the terrorists used to enter the hotel.

According to Kolum, Gichunge used the phone to chat with Kemunto a day before the attack. The phone also had a balance of Sh59,700, which Gichunge had transferred to himself.

Gichunge also registered for M-Pesa using a doctor’s lost identification card and Dr Eric Kinyanjui’s ID to register Kemunto’s line.

Kemunto was last traced to Mandera and is believed to have crossed into Somalia after the attack.

According to the investigator, the attackers, who were from Somalia, had identification cards and certificates with them during the attack.

“We were able to obtain this information through ICT and from our counterparts. We observed how they fabricated fake signatures and used pseudonyms to acquire documents for travel,” he said.

Security agencies connected the attack to the foiled Merti attack through financial transactions, with one of the accused persons alleged to be at the heart of it.

“We identified a link between a particular suspect who had communication with him in 2018, provided financial support, and had ties to  Gichunge, the lead attacker in the Dusit attack,” the officer said.

The vehicle, which had been wired with improvised explosives, was intercepted at Merti.

“They often have multiple potential targets and choose the one with the least security checks. You will often find Google location searches on their laptops,” said the officer.

He added that, in the Westgate attack, Abdinur, the lead attacker, flew to Kampala twice in July of the same year. He then took a Probox vehicle to cross the border through Busia, heading straight to Eastleigh

The terrorist would then exit through the northeastern route back to Somalia.

According to the officer, the Dusit attack followed a similar pattern. He explained that Riziki, the suicide bomber, arrived in Kenya two days before the attack.

Meanwhile, the story of Gichunge and Kemunto did not end with their wedding.

When Kenyan special forces neutralised the terrorists, the investigator stated that they found a love letter in Gichunge’s jacket.

The letter, addressed to Kemunto, was written on a small piece of paper. He addressed her as “love” and urged her to forgive him.

“Sasa babe (how are you, babe). I hope you are fine. If you get this, maybe nimepata shahada (I have attained martyrdom) or I am in the process. It pains me to leave you, but I love meeting with Allah as well. Beb, sorry for everything, and if Allah wills, we shall meet once again in Jannah,” he wrote before signing off as ‘yours in love, Farouk.’ 

Before the attack, the two had taken a flight to Mombasa for a holiday. Gichunge had convinced her to leave by promising her a better job in Somalia.

Kemunto’s last communication with Gichunge was from Mandera as she was closing to Burahawa before disappearing.

According to the officer, during investigations into terrorism financing, they came across advertisements by Kemunto selling electronics and household items.

Back at DusitD2, the attackers split into two groups. One group entered the Cavendish building, searched around, and began shooting at the fire ducts. They spotted a staff member, and Gichunge, who was leading Team A, shot at him. The group then returned to the Dusit Hotel, where the SWAT team overpowered them. This occurred at 3:42 pm.

The other terrorists in Team B entered the Secret Garden restaurant, where Riziki had detonated his suicide bomb, and fired indiscriminately at staff and guests for two minutes. They then accessed the Hannover building through the main door.

The officer stated that they recorded 156 witness statements but focused on 45. The investigations were conducted during the COVID-19 pandemic.