The ‘New’ Playbook? Urban Siege in Nairobi

The ‘New’ Playbook?  Urban Siege in Nairobi

John P. Sullivan and Adam Elkus

Multiple teams. Suicide commandos. Hostages. Automatic rifles. Grenades. Improvised fortifications.  And indications that the attackers dug in for a long fight designed to maximize media attention. Once again terrorists used a page from the ‘urban siege’ playbook; this time at Nairobi, Kenya's up-market Westgate mall.

It’s been about two months since al-Shabaab gunmen employed the new playbook. On Saturday, 21 September 2013 squads of gunmen affiliated with the Somalia terrorist group al-Shabaab armed with assault rifles and grenades attacked the Westgate mall. They came to kill – and also came to die. With hostages and access to a large supermarket, they also prepared to dig in for the long haul. As of the writing of this piece, the siege is recent, and undoubtedly post-event analysis will reveal much more relevant information about the assault than we currently possess.

Al-Shabaab Strikes Westgate

At least 6 suspects, including a woman, were involved in the armed, hostage-barricade assault on the Westgate mall.  The attack began at about 12:30 pm on a Saturday afternoon. According to a Guardian report, four men approached the entrance firing at cars.  Then the first grenade detonated.  About 150 meters away, a second attack squad drove through barriers, and then dismounted and engaged bystanders with gunfire and grenades. The attack led to a four-day standoff yielding at least 72 deaths and hundreds of persons injured. Five attackers were killed, and one has reportedly escaped.  This was not al-Shabaab’s first strike; it has been active in both Somalia and Kenya since it split from the Islamic Courts Union in 2007.  Indeed, it has conducted nearly 550 attacks killing over 1,600 and wounding more than 2,100 prior to this attack. Almost a quarter of its attacks have occurred in Kenya, but this was its first ‘urban siege.’  To date, this was their first hostage-barricade raid, yet Al-Shabaab’s attack preferences including bombings and armed assaults (72.6 of their historical attacks) prepared them for this innovation.

What is ‘Urban Siege’?

Urban siege entails combined arms, ‘swarming’ attacks that bring multiple assault squads into play to attack a target or targets.  The goal is to draw in defenders to prolong the attack and maximize casualties and disruption.  By leveraging multiple, simultaneous assaults (known as swarming) response is complex. As a result, fog, friction, and the smog of terrorism is amplified. As the START Background Report on the attack noted, extended hostage-barricade attacks with durations over 24 hours are nearly five times as lethal as those that end within a day.

The most notable antecedent to the Westgate siege was the Mumbai attack. In that 2008 action Lashkar-e-Taiba (LeT) conducted a series of assaults—including complex hostage barricade situations—on seven separate targets in Mumbai, killing 171 and wounding over 250 during their three-day siege.  We viewed that as a seminal event in contemporary urban siege.  Indeed in our paper “Postcard From Mumbai: Modern Urban Siege” we called it a ‘Back to the Future’ incident where terrorists returned to urban guerilla tactics.

Though armed attacks and hostage situations are as old as terrorism itself, the urban siege is of a particularly recent vintage. Attackers do not aim to get out alive. Instead their goal is to kill as many as possible, taking hostages and building improvised fortifications to delay their own deaths and drag out the siege. Multiple teams are employed, often designed to overload the target's response capability and operational command and control.  The attackers succeeded in complicating response in Nairobi.  As recounted in the Guardian report, disorganized response, punctuated by infighting and a clash of egos among authorities—including a friendly-fire incident that led to disrupting the counter-assault—allowed the terrorists to regroup and actively hunt victims.  The security forces (police and military) violated the first goal of counter-assault for urban siege.  They failed to ‘stop the kinetic momentum!’

Response and Coordination Challenges

The latter point is not obvious to readers that visualize police tactical response as a simple matter of bringing overwhelming force to bear on a small number of attackers. In the aftermath of the Boston Marathon Attack, the Boston Police Department, for example, was roundly criticized for locking down the city and deploying massive amounts of heavily armed officers to combat two young men.  

Consider, however, the chaotic environment inside a police incident commander's headquarters in such a situation: conflicting reports are streaming in from every direction, the location and composition of the attack force is unclear, and it is still possible that there may be more attacks on the horizon. Response must be instantaneous, and an alphabet soup of agencies and departments must cooperate to ramp up from normal operations to emergency footing in the blink of an eye. Overnight, both regular and tactical law enforcement officers trained to de-escalate violent situations must embrace extreme violence to put down fanatical, heavily-armed murderers to prevent them from killing any more innocents. Bostonians were lucky that the attack force was minuscule, geographically confined, and acting alone. A larger, more distributed, better equipped, and better-trained force might have severely taxed police operational response.

Responding to urban siege is complex and outside the experience of most police departments.  Traditional police practice calls for responding officers to contain the site of a hostage-barricade situation and then call for specialized responders—SWAT teams—to respond and neutralize the complex threat.  Indeed, according to reports from the scene Nairobi’s police flying squad followed this dated approach when they arrived at 1:10 pm.  It wasn’t until three and a half hours after the initial shots were fired that Kenya’s ‘recce group’ a SWAT capability, responded at about 4:00 pm. Kenyan military forces (including infantry and rangers) arrived at about the same time, leading to conflict over command and a friendly-fire shooting with the commander of the “recce group’ killed and three police and one soldier injured. By the time the event ended on Tuesday, 24 September, blasts, mayhem, and killing had ensued.  The political dynamics of the event also went viral.  

It may be tempting to attribute the difficulty of police response in locales like Mumbai, India, Beslan, Russia and Nairobi to lack of government capacity and proper training. Such chauvinistic criticism overlooks the fact that police in such places—though perhaps under-resourced—have extensive experience dealing with heavily armed criminals and domestic terrorism that their Western counterparts generally lack.

The bitter truth is that a true armed assault by a dedicated, resourced, and fanatical opponent would tax the resources of any competent police department. Urban sieges are exceptional events that usually surpass the usual sequence of police roles and functions. They bridge the local/national/global levels, bringing to bear considerations, entities, risks, and responsibilities that go much higher up than the world of dragnets and squad cars.  Indeed, this is a case of a local, tactical event having profound global, strategic consequences.  From the onset of the Nairobi attack, Twitter became engaged. As one report notes, “Twitter captured the confusion of the attack in real-time as users first reported what they thought was an explosion. Shortly after noon, news started trickling through the social network that something had gone horribly wrong at Westgate mall.”  By the time the siege was over, the public, Kenya’s President Uhuru Kenyatta, al-Shabaab (#AlShabaab) and global civil society had weighed in. Indeed, as David Kilkullen has observed, the attackers’ (in both Mumbai and Nairobi) focus on foreigners combined with the intimate nexus among attackers and victims demanded by gun battles, which are more protracted than bombings alone, lead to enhanced terror effects and seems to have been calculated to maximize international attention.  Mobile phones and social media became tools of command and control, and amplified carnage for the terrorists. As a result, we posit that urban siege is intrinsically global in impact.

Counter-Swarming for Urban Siege

All is not lost. Police can train to fight and defeat armed assaults. The answer, however, does not necessarily lie in military-style police operators, tactical vehicles or Boston-style clampdowns. While these are all part of the solution, the most important aspects of defeating urban sieges lie in operational command, training, and synchronization among emergency response agencies. Incident command systems must be able to quickly scale up and direct a response force composed of many different government organizations and both process and red-team intelligence in real-time.  Lines of authority, interagency relations and cooperation, and emergency response routines and subroutines must be clear and well rehearsed, not improvised on the spot.   Effective ‘counter-swarming for urban siege must build from a baseline ‘full-spectrum policing’ capacity.  Police must be able to quickly shift from community policing to formed units that are able to repell and contain threats.  Addressing active shooters and combined arms swarms require immediate, adaptive, decisive counter-force action.

This must build from the concept that the first responding police must immediately engage the attackers and stop the kinetic momentum.  This requires more than good tactics or MAC-TAC (Multi-Assault Counter-Terrorism Action capabilities) training.  Full Spectrum Policing must be grounded in operational art.  Police operational art must integrate operational swarming, maneuver, and real-time intelligence support across the urban operational (battle) space.   This must be synchronized with community protection, political understanding, and media appreciation by both traditional and new media (social media) entities.  Civil police, military, intelligence, private security and governance structures must also be synchronized to address attacks on soft infrastructure like malls, public transport, and downtown districts.

All of this is infinitely more important than technology and gear. After all, the first line of defense will not be a heavily armed tactical trooper but a regular police officer.  The Mumbai, Beslan and Nairobi attackers all exploited the early chaos of the assault to kill wantonly and then entrench. The “golden hour” of an urban siege is far before the cavalry arrives to save the day. And the success of the entire effort depends on the command, control, and cooperation of the incident command units on various political scales of authority.

Conclusion: Adjusting Our “Playbook”

We are not helpless against urban siege. But first we must acknowledge it is a threat, and that worldwide terrorist attackers are eying malls, schools, sporting events, and urban centers as the next soft target to strike to further their political objectives.  As David Kilcullen aptly asserts, “urban environments, including complex pieces of urban terrain like shopping centres, hotels and industrial facilities, are the battlegrounds of the future. And the urban siege, with its commando-style tactics and guerrilla infiltration of a big city’s ebb and flow, is increasingly the tactic of choice for a wide range of adversaries.”  The Westgate attack is a simplified variation of Mumbai’s urban siege.  The target set was more limited, but the principles the same.  We have seen this set of tactics employed in South Asia, and now Africa. It is as Daveed Gartenstein-Ross noted “not a question of whether the Nairobi attack will be modeled, it will, and likely with a Western country as the target.”  Once we acknowledge the threat, we must next develop doctrine and training to counter it.  We must build our counter swarming playbook for urban siege.