Two terrorists behind the DusitD2 attack that left 21 people dead have been convicted.

Hussein Mohamed Abdille Ali and Mohamed Abdi Ali were on Thursday found guilty of 21 offences relating to financing and facilitating the January 15, 2019 terror attack in Nairobi.

In 2023, Mirie Abdullahi admitted to providing internet which helped the attackers link with Jilib, the Al Shabaab headquarters. He, however, left Abdi and Abdille battling the Director of Public Prosecution (DPP) on whether they were guilty of enabling the raid.

According to the prosecution, the attackers, led by Ali Salim Gichunge, exploited vulnerabilities in security and used fraudulent documentation to execute their plan. The conviction of Abdille and Abdi highlight the critical role of facilitators in enabling such acts of terror, from financing to providing logistical support.

Justice Diana Mochache ruling detailed the specific roles played by the two men.  Abdi was convicted for wiring Sh558,200 to Gichunge, the lead attacker, enabling him to fund critical aspects of the operation, including travel, accommodation, and procurement of materials.

Abdille, on the other hand, was found guilty of procuring fake identification documents, including school IDs and a birth certificate, which allowed the attackers to move freely within Kenya without arousing suspicion.

“It is my view that the accused persons committed a terrorist act through the offence of facilitation,” Justice Mochache stated. “The first accused (Abdille) facilitated the attack by procuring fake documents to allow the attackers to move without being identified.”

The prosecution’s case was bolstered by evidence from the US Federal Bureau of Investigation (FBI), which tracked several Facebook accounts used to coordinate the attack. These accounts, operating under aliases such as “Kim Sam”, “Abdul Hakim”, “Kezia Soze”, “Mohamed Yare Abdalla” and “Soze Kezia”, were linked to the creation and distribution of fraudulent documents.

One account, created on January 14, 2019, the day before the attack, was used to transmit live videos, amplifying the terrorists’ propaganda efforts. Another account, traced to an individual named Adam Chege in Jilib, was active as early as April 4, 2018, and was also linked to a foiled plot to attack the KICC, where Victor Odede was previously convicted.

The FBI’s analysis revealed that Abdille had shared samples of fake IDs, including a photograph matching his real appearance, directly implicating him in the planning process.

“The FBI testified on how they tracked certain Facebook accounts centered on the publication of fake school ID cards,” Justice Mochache noted.

“This shows he was actively involved with the planning of the attack.”

The judge said the defence’s counter-narrative failed to discredit the prosecution’s forensic analysis, witness testimonies, and comprehensive evidence.

CCTV footage provided a chilling timeline of the attack. At approximately 3.36pm on January 15, 2019, most people in the DusitD2 complex narrowly escaped death due to a five-minute window before the attackers, who entered at 3.41pm, began their assault.

The government’s swift response included locking down suspected escape routes and deploying a special forces team to neutralise the threat. This rapid intervention saved countless lives, but the attack’s sophistication underscored the need for a thorough investigation into its enablers.

Following the attack, detectives launched an extensive investigation to uncover the network behind the operation. Abdille was arrested in Mandera on January 31, 2019, while Abdi was apprehended on April 23, 2019.

The investigation revealed a trail of evidence, including 177 SIM cards recovered from Muchatha in Kiambu County and a Nokia 1030 mobile phone belonging to Gichunge. Chief Inspector Joseph Kolum, a key investigator, testified that the phone was used exclusively for M-Pesa transactions under aliases such as Eric Kinyanjui Munyi, Eric Kinyanjui, and Farouk.

Another phone, a Nokia 1010, recovered from a vehicle (KCN 340E) used by the attackers, had no SIM card but contained a balance of Sh59,700, which Gichunge had transferred to himself. The investigation also uncovered that Gichunge had registered for M-Pesa using a stolen identification card belonging to a Dr Eric Kinyanjui to facilitate communication with his accomplice, Violet Kemunto.

Kemunto, who was last traced to Mandera before reportedly fleeing to Somalia, was romantically involved with Gichunge and played a supporting role in the attack’s logistics.

The attackers’ journey to Nairobi followed a carefully planned route from Somalia through Garissa, Elwak, Moyale and Isiolo. Financial transactions linked the Dusit attack to a foiled plot in Merti, where a vehicle wired with improvised explosives was intercepted. Investigators noted that terrorists often scout multiple locations, settling on the one with the least security resistance.

“They often have four places and settle on that which is easier in terms of security checks,” Kolum explained. “You will find in their laptops even Google locations, but as you move down the attack, they leave traces.”

The investigation also drew parallels with the 2013 Westgate Mall attack, where lead attacker Abdinur used a similar cross-border route via Kampala and Busia to enter Kenya. In the Dusit case, Khalid Mahir Riziki, the suicide bomber, arrived in Kenya just two days before the attack, while Gichunge had been in the country for a year.

A particularly poignant detail emerged during the investigation: a love letter found in Gichunge’s jacket after he was killed. Addressed to Kemunto, the letter read: “Sasa babe, I hope you are fine. If you get this, maybe nimepata shahada or I am in the process. It pains me to leave you, but I love meeting with Allah as well. Beb, sorry for everything, and if Allah wishes, we shall meet once again in Janah.”

Signed “yours in love, Farouk,” the letter revealed Gichunge’s personal motivations and his manipulation of Kemunto, whom he had convinced to leave Kenya with promises of a better life in Somalia.

The attackers’ movements on the day of the assault were meticulously documented through CCTV footage. “Team A” led by Gichunge entered the Cavendish building, fired at fire ducts, and shot at a staff member before returning to the Dusit Hotel, where they were overpowered by the SWAT team at 3.42pm. Another team, including Riziki, detonated explosives at the Secret Garden Restaurant and targeted multiple offices, including the Red House Group, LG, Horizon, and Colgate Palmolive, before being neutralized on the sixth floor of the hotel at 6.19pm.

The prosecution presented 156 witness statements, ultimately relying on 45 to build their case.

The convictions represent a significant milestone in the fight against terrorism. The case is set for mitigation on June 17, when the court will determine the sentences for the convicted men.