Terrorism threat in Kenya ahead of the December festive season

Terrorism continues to pose a significant threat in Kenya, particularly in the counties bordering Somalia, the coastal region, and the capital, Nairobi. From January to October of the current year, Castor Vali documented 90 incidents related to terrorism. This contrasts with 69 terrorism-related incidents that were reported over the same 10-month period in 2022. On an annual basis, there were 83 incidents reported in 2022, 64 in 2021, 73 in 2020 and 77 in 2019, as illustrated below. The trajectory indicates a stable increase in terrorist attacks over the last three years.

As depicted in the graph below, all the 90 incidents recorded this year have occurred in the counties bordering Somalia: Mandera, Wajir, Garissa, and Lamu. Additionally, bomb scares were reported in Nairobi and Kiambu counties. Despite a period of calm in Nairobi and the coastal region, the threat remains high. Al-Shabaab has claimed responsibility for 34 attacks; however, Castor Vali sources associated all the recorded attacks to the militants.

Why al-Shabaab?

Despite the efforts of local, regional and international forces in stabilising Somalia, al-Shabaab continues to execute mass-casualty attacks, particularly along the northeastern border, in Lamu’s coastal county, and the capital, Nairobi. This is manifested in high-profile complex attacks such as the 2015 Garissa University assault, resulting in 148 casualties, and the Manda Bay Air Strip attack in Lamu in 2020 during which three US nationals (a serving member of the US Armed Forces and two military contractors) were killed and millions of dollars’ worth of aircraft, vehicles and equipment destroyed and attacks in Nairobi, including the 2013 Westgate Mall siege that claimed 67 lives, and the 2019 14 Riverside Drive attack resulting in 22 fatalities, including foreign nationals.

Moreover, the existence of the Islamic State (IS) in Somalia poses another security risk. While there has not been a direct attack attributed to the group in the country, Kenya serves as both a recruitment hub and a transitional outlet for IS. Furthermore, the region remains exposed to persistent risks from various global terrorist organisations.

Why is the threat enhanced in December?

Based on historical data and trends identified by Castor Vali, global and regional developments and upcoming Christian holidays, December remains a high-risk period. Indeed, the militant group often opts to carry out attacks during significant dates in both the Christian and Muslim calendars, as well as anniversaries of successful al-Shabaab attacks, particularly those against Kenyan troops in Somalia. These patterns are likely to persist into the upcoming year.

Historical attack patterns

Analysing Castor Vali data over the past eight years, most attacks occurred in January, May, June, July, August, and December. In the last four years, a consistent pattern has emerged, with December marking the initial peak before a gradual decline in attacks in March and April. The second peak tends to occur in May and June due to Ramadan. This pattern often extends to August.

December consistently remains a peak period, with increased militant activity, as illustrated in the attacking patterns observed from 2019 to 2022. During this period, militants increased their attacks, disrupting religious celebrations in some areas, carrying out assaults on dates of past successful attacks in Kenya and Somalia. This period was characterised by increased militants’ assaults on security installations and personnel, as well as incidents targeting civilian vehicles, telecommunications infrastructure, and kidnappings. Additionally, there is commonly a rise in cross-border movements by militants carrying firearms, rocket propelled grenades (RPGs), machine guns, materials for making improvised explosive devices (IEDs), and food supplies.

The ongoing Middle East conflict

The ongoing conflict between Israeli forces and Hamas fighters is heightening the risk environment in Kenya. Since the war’s onset in early October 2023, both state and non-state actors have expressed their perspectives on the conflict. Of interest was Al Qaeda’s general command that renewed calls for attacks on American, European, and Israeli interests worldwide, in support of the Hamas fighters. The IS also echoed this call, heightening the global risk of terrorism attacks.

Domestically, the Kenyan government initially expressed support for the Israeli government’s actions but later retracted its stance. In contrast, on Thursday 21 October, al-Shabaab’s leadership released a statement expressing support for Hamas fighters and praising their actions against Israel. The statement also hinted at al-Shabaab’s intention to coordinate “solidarity attacks in East Africa” aligned with Hamas. Such an attack is likely to elevate the militant’s profile within the region and boost the group’s recruitment efforts. Furthermore, it will align with a pattern of al-Shabaab linking its actions to global events, such as the US recognition of Jerusalem as Israel’s capital, which they cited as motivation for the assault on the 14 Riverside Complex in Nairobi. This indicates al-Shabaab’s strategy of leveraging international dynamics for justification and inspiration across its operational countries in East Africa.

Tactics

In the past four years, the choice of al-Shabaab militant tactics in Kenya has consistently been influenced by the selected targets and attack locations. This is highly likely to remain the case in the short-medium term. The fundamental attack strategies have remained constant. As demonstrated in the graph below, over the last 12 months, 57 per cent of recorded assaults primarily employed small arms and light weapons, including RPGs, PK machine guns, and AK-47 rifles. RPGs were utilised to target both stationary and mobile objectives near the Somali border, primarily against security bases, vehicles in transit, and telecommunication masts.

Meanwhile, IED attacks ranked as the second most prevalent form of assault accounting for 36 per cent, with a primary focus on moving vehicles along unpaved routes. Some incidents involved a combination of IEDs and small arms fire, where the detonation of an IED is followed by gunfire or RPGs, resulting in higher casualty numbers.

Outlook

A sustained wave of assaults is highly likely to continue to occur in the northeast in the short-medium term. Along the Somali border, security personnel and their installations, communication masts, non-locals, police reservists, Lamu Port-South Sudan-Ethiopia-Transport (LAPSSET) installations and staff will remain primary targets. Nairobi and other urban centres, like Mombasa, will, however, remain desirable targets. Office buildings, shopping malls, and places of entertainment that accommodate or attract expatriates or international firms, particularly those with links to capacity building/security in Somalia, are judged to be particularly vulnerable. Other potential targets include embassies, commercial and government buildings, airports, places of worship, buses, trains, and other transport hubs.

The militants might aim to conduct a high-profile attack in major towns to coincide with the 21st anniversary of the Paradise Beach Hotel attack in Kikambala, north of Mombasa, that occurred on Thursday 28 November 2002. During the attack, three suicide vehicle-borne improvised explosive device (SVBIED) bombers simultaneously targeted Israeli tourists, resulting in the killing of nine Kenyans and three Israeli nationals. An Israeli charter jet narrowly avoided being hit by surface-to-air missiles during the attack. The group claiming responsibility for these attacks identified itself as the Army of Palestine. According to media sources, at the time of the attack the hotel was owned by an Israeli national and, hence, selected as a target. However, given the complexity of such an assault, militants might opt for displaced attacks involving the use of person-borne IEDs (PBIEDs) in crowded places such as churches and social places, mirroring tactics used in other high-profile attacks, particularly in Somalia.

Additionally, incidents of lone-wolf attacks in support of the Hamas fighters also remain high. Since October, assaults allegedly motivated by the conflict have so far been reported in Israel, France, Spain, the US and in the Egyptian port city of Alexandria during which two Israeli tourists were gunned down.

There is a high likelihood that militants may choose static targets, particularly security installations, quarries, and religious outlets within northeastern Kenya, or plan high-profile attacks utilising small arms, SVBIEDs, and grenades in major towns. This strategy might be particularly aimed at locations like Nairobi, where adverse weather conditions could impede the response time of security agencies and other first responders resulting in mass casualties. The ongoing heavy rains in the northeast region, leading to flooding, act as a deterrent to the assembly and wiring of IEDs. This could lead to fewer incidents of IED attacks along key routes in the northeast over the short-medium term. However, the militants could exploit the rainy period, as it provides them with cover to smuggle in their weapons and materials, potentially enabling them to prepare for an attack during the festive season and after the rainy period.

Despite the existing threat during the upcoming festive season, various security agencies will intensify countermeasures to mitigate risks. Historically, during this period, there has been heightened surveillance, increased patrols, and the deployment of additional police officers in identified hotspot areas. Private security firms will also reinforce internal mitigation measures, conducting more rigorous screening and surveillance as a deterrent. Additionally, Western countries are likely to reassess their travel advisories, advising their nationals to maintain a high level of alertness and avoid crowded areas and places frequented by foreign tourists. They are also likely to caution against any plans by their citizens to visit counties bordering Somalia.

Advice

Clients are advised to maintain heightened awareness, especially in potential target locations, during the festive season, which is considered one of the high-risk periods of the year. Castor Vali actively monitors all security developments across the country and provide real-time comprehensive assessment and advice. Additionally, clients are urged to monitor national and foreign government warnings/advisories about imminent attacks and elevated risk periods.

The terrorism heatmap – The last 12 months (Nov 2022 to Oct 2023)

Castor Vali Support

To support our clients in tracking, forecasting, and mitigating the above risks, Castor Vali has developed a variety of tools, including intelligence subscription packages and in-house training. 

To read more about our products and services see our Africa Security Information Service.

We also encourage our clients to test our services and offer free trials to interested clients at any time. Please complete the form below to access these reports: