Nairobi Mall Attack: Sleuths Go ‘Tweet’ in Pursuit of Insider
[CAPTION]: Forensic investigators working on this picture (courtesy Al-Shabab on Twitter) and CCTV footage from the KDF (link below) suggest insider involvement that could unmask the face of Westgate Mall attack.
Forensic experts are now investigating whether an insider within the security agencies may have been involved in Westgate Mall tragedy in Nairobi on September 21.
“We are chasing clues on Twitter… we are looking at this picture (above),” said the expert. “We are into much less digging and into more lab work, computers and stuff. Right now our computer section is doing a lot of work, even though Twitter is yet to respond to our official request for support.”
An alleged Twitter account from Al-Shabab released the picture in the early morning of September 23, almost 48 hours after mowing down hapless victims caught up in the mayhem that Saturday noon.
While releasing the image (above) that has captivated forensic investigators, the alleged Al Shabab gloated in an account @HSM_PressOffice (now established to be a fake Al-Shabab Twitter account that was broadcasting from within the doomed mall) over their exploits. The account had been set up that vey same day.
It gloated: “ a 14-hour standoff relayed in 1400 rounds of bullets and 140 characters of vengeance and still ongoing. Good morning Kenya! It’s slowly approaching the 24-hour mark – the darkest 24 hours in Nairobi – highlighting the sheer fragility of the Kenyan nation. The Mujahideen are still firmly in control of the situation inside Westgate Mall. Negotiation is out of the question!”
The forensic investigator doubts this message was from Al-Shabab, given their knowledge of the organisation and its communication techniques.
The forensic team are studying the Al-Shabab picture, along with the statements: “a 14-hour standoff relayed in 1400 rounds of bullets and 140 characters … It’s slowly approaching the 24-hour mark – the darkest 24 hours in Nairobi.”
The forensic investigator says: “This was a coded message, the giveaway being 14, 14, 14 and 24, 24 and the words ‘darkest hour’ in Nairobi.
“The unofficial decoding is: “The number fourteen is repeated three times, the number 1 also three times, the number ‘4’ three times and ‘0’ three times and we know three floors went down inside the mall. The second set of numbers could read September 24 after midnight (24-hrs) and evacuate by 3 am (Nairobi’s darkest hour).”
Highlighting the picture on his laptop computer again, the forensic investigator picks out the difference in the picture, and a copy of CCTV footage handed over by the KDF.
“Stop … stop! Here, go a little back … there, play now; pause … you see,” he points out at a frozen frame from the CCTV footage.
We are on Cam2 13/09/21 13:07:02DVR [courtesy CNN] : http://www.youtube.com/watch?v=VOq6owl8k4M ]
The date is September 21, 2013 on Cam 2 and the time is around lunchtime in Nairobi, seven minutes-and-two seconds past 1pm, freeze the KDF CCTV footage at that precise point and compare it with the picture above.
The screen-shot from the CCTV footage provided to forensics by KDF, at this point, is the exact match, angle, lighting and calibration to the screenshot that Al-Shabab allegedly released to show that their fighters were still in control of the reign of terror.
“This [picture] was not [taken by] Al-Shabab,” insists the forensic expert.
The expert argues the photo was a screenshot less than an hour after the shooters walked in. Yet it was released two days later to shock the nation into waiting until KDF completed its “mop up operation”.
“Ask yourself, if KDF was in charge of the floors, including the CCTV room, how did the terrorists (attackers) regain control of the CCTV room, download the clips, upload them on a computer, rewind an old clip, play, freeze, capture screen-shot and Tweet,” the expert questions.
Indeed asking myself, to find answers to pertinent questions, one must look back.
None was helpful, not even Foreign Secretary Amina Mohammed, who brazenly told a global audience on Monday, 23 September, the attackers were Americans from Minnesota, Britons, Canadians, Finnish and Samantha Lefthwaithe.
Hot in the heels of her statement, another tweet from the fake Al-Shabab account was announced by CNN and reiterated word for word what Amina had said: “three of the attackers are from the United States, two are from Somalia and there is one each from Canada, Finland, Kenya and the United Kingdom.”
It was not Al-Shabab tweeting, but somebody else inside Westgate with the KDF. Al-Shabab were not happy with this. Their account was already shut and someone else was posting terror tweets using their name. Al-Shabab resorted to e-mail denouncing the tweets about Westgate saying “Until recently our account was @HSMPROffice and that has been suspended and we do not currently have any other active account.”
Drawing wrath on another fake account purporting to be Al-Shabab, the Somali militants wondered why that account had never been shut since 1 March when it was first set up, according to the complaints they made via email.
The forensic experts have promised to share more information as it emerges.