By Katharine Houreld and David Lewis
NAIROBI (Reuters) - The relatively swift end to an attack on a Nairobi hotel and office complex highlights improvements in Kenya's counterterrorism capabilities since Somali militants overran a shopping mall in the same neighborhood five years ago.
This time, the authorities flooded the area with elite units, including the paramilitary General Service Unit (GSU) and its crack Recce squad, along with a new force trained by the United States to respond to emergencies at American facilities.
Still, the death toll might have been higher had it not been for the rapid intervention of some quick-thinking private security personnel before the government teams arrived en masse, security sources who took part in the operation said.
Tuesday's two-pronged assault by a suicide bomber and at least four gunmen, claimed by the Somalia-based al Qaeda affiliate al Shabaab, killed 21 people and sent hundreds fleeing from the 14 Riverside Drive complex in the Kenyan capital.
However, the attack was over in 20 hours - a far cry from the four-day-long incident at Westgate shopping mall in 2013, which ended with 67 dead, some from friendly fire, and the Kenyan army going on a massive looting spree among the bodies.
When the government teams arrived this time, they were better prepared and more methodical in their approach – even if communication was sometimes shaky and it wasn't initially clear who was in charge, according to six security professionals, most of whom did not want to be identified for operational reasons.
Unlike in 2013, when foreign security professionals were quickly barred from the scene, Kenyan units worked closely with British and American special forces and private security professionals who were among the first to arrive.
"Involvement of the private security operators was crucial," said a security source in contact with local and international personnel at the complex. "They delayed the attackers for just enough time to allow the government response to get into place."
At the heart of the Kenyan response was a newly formed unit trained under the U.S. Special Program for Embassy Augmentation and Response (SPEAR), set up in 2014 to improve the ability of local forces to respond to emergencies at American facilities after a U.S. ambassador was killed in Benghazi, Libya.
SPEAR units are funded by diplomatic security and are also active in Chad, Iraq, Mauritania, Niger, Nigeria, South Sudan, Tunisia and Mali, where they responded to an attack on a European Union office near the U.S. Embassy last year.
In Nairobi, SPEAR took charge as darkness fell, operating through the night with another team of five security professionals and medics until President Uhuru Kenyatta announced the next morning that all attackers had been killed.
"We took a lot of lessons from Westgate," said Joe Mucheru, Kenya's information minister. "This was a multi-agency approach and response."
SUICIDE BOMBER
Tuesday's lunchtime crowd had largely thinned out at the Secret Garden restaurant in the complex when a young man dressed in black wandered down a pink stone path nearby at nearly 3:30 p.m. (1230 GMT)
He stood outside the restaurant for nearly a minute. Waiters walked around him, and a passer-by heard him repeating, "Where are you?" in Swahili, presumably into a phone, a security professional said.
Then the man exploded with such force his limbs were scattered 50 meters apart, a sign he may have been wearing a professionally made suicide vest, two security professionals said. If so, it would be the first suicide attack in Kenya since a 1998 truck bombing at the U.S. Embassy killed 213 people.
Moments later, four men in black shot their way through the front gate of the complex, set three cars ablaze and then split into two teams, CCTV showed.
One private security professional who was already inside the complex called a friend, lighting up the phones of a tight-knit community: Americans, Britons, Israelis and Kenyans who work in the security industry. Many rushed to the scene with body armor and weapons at the ready.
Serge Medic, a Swiss national who owns a security firm, was one of the first to arrive along with a Kenyan man, identified by another security professional as a senior counterterrorism officer in civilian clothes, and an unidentified Kenyan man.
All were armed.
They advanced together until they came under fire, Medic said. As they retreated, they saw the distinctive red berets of the GSU, often deployed to quell riots. Medic worked with some colleagues and two GSU members to clear an office block.
'ABSOLUTELY FEARLESS'
Around the same time, a member of British security firm Halliday Finch was creeping down a riverbed at the back of the complex. As he drew near, he saw six bodies on a footbridge and a man struggling to help a woman shot in the leg.
The man, fearful of being overheard, gestured that two attackers were in the complex. The Halliday Finch employee entered cautiously, carrying rope that a friend had requested to make a zip line to evacuate people trapped on an upper floor of an office block.
Then the gunmen opened fire. Someone in the houses on the other side of the river must have been carrying out surveillance for them, the Halliday Finch man said. That's when eight GSU members showed up, he said.
"They had no senior officer, so they embedded into my mission," he said. "They were absolutely fearless. When I said there was a terrorist just the other side of the wall, they said, 'Then let's take them'. I had to hold them back."
These actions, security sources said, allowed civilians to flee and denied the militants room to maneuver in the initial stages of the attack. Some security experts believe the gunmen intended to take hostages and force a drawn-out siege.
Instead, they entered buildings housing the offices of international companies, shooting at elevators and dropping grenades down stairwells before some holed up on the upper floors of the dusitD2 hotel to take pot shots at those fleeing below, a security official said.
PLAN IS FIRST CASUALTY
More units arrived, along with the Kenyan Red Cross, whose medics ran crouching under fire to evacuate victims on stretchers. Helicopters circled overhead.
Two black armored cars from the U.S. Embassy roared into the complex at about 5 p.m. and were used to help shield office workers fleeing from the militants' fire.
The evacuation of the complex was complicated by security systems that required a key card to open many doors, and by locked fire escapes in at least one building. Kenyan special forces used small charges to breach locked doors and gradually clear each floor, another security professional said.
Some of the Kenyan units had radios, but not all. At one point, a police officer threw scribbled notes out of a window to colleagues seven floors below, a witness said.
At another point, an officer trying to get intelligence from a helicopter ran out of credit on his phone and had to get more sent from his headquarters.
Three security professionals told Reuters they saw no evidence of a command post, though another said he heard one that had been set up in a building outside the complex.
Civilians were escorted out through the front gate and directed to neighboring university grounds. Once there, no one took down phone numbers or obtained statements to identify who had seen the attackers, one witness said. No one was searched until after the third building was cleared.
But the security official said observers shouldn't be too harsh. Some solutions may have been ad hoc, but they worked.
"The first casualty of contact is always your plan," he said. "The key is for the Kenyans to improve their tactics, techniques and procedures ... They need specialized units for this."