Small Wars Journal

The ‘New’ Playbook? Urban Siege in Nairobi

Sun, 11/24/2013 - 2:51am

The ‘New’ Playbook?  Urban Siege in Nairobi

John P. Sullivan and Adam Elkus

Multiple teams. Suicide commandos. Hostages. Automatic rifles. Grenades. Improvised fortifications.  And indications that the attackers dug in for a long fight designed to maximize media attention. Once again terrorists used a page from the ‘urban siege’ playbook; this time at Nairobi, Kenya's up-market Westgate mall.

It’s been about two months since al-Shabaab gunmen employed the new playbook. On Saturday, 21 September 2013 squads of gunmen affiliated with the Somalia terrorist group al-Shabaab armed with assault rifles and grenades attacked the Westgate mall. They came to kill – and also came to die. With hostages and access to a large supermarket, they also prepared to dig in for the long haul. As of the writing of this piece, the siege is recent, and undoubtedly post-event analysis will reveal much more relevant information about the assault than we currently possess.

Al-Shabaab Strikes Westgate

At least 6 suspects, including a woman, were involved in the armed, hostage-barricade assault on the Westgate mall.  The attack began at about 12:30 pm on a Saturday afternoon. According to a Guardian report, four men approached the entrance firing at cars.  Then the first grenade detonated.  About 150 meters away, a second attack squad drove through barriers, and then dismounted and engaged bystanders with gunfire and grenades. The attack led to a four-day standoff yielding at least 72 deaths and hundreds of persons injured. Five attackers were killed, and one has reportedly escaped.  This was not al-Shabaab’s first strike; it has been active in both Somalia and Kenya since it split from the Islamic Courts Union in 2007.  Indeed, it has conducted nearly 550 attacks killing over 1,600 and wounding more than 2,100 prior to this attack. Almost a quarter of its attacks have occurred in Kenya, but this was its first ‘urban siege.’  To date, this was their first hostage-barricade raid, yet Al-Shabaab’s attack preferences including bombings and armed assaults (72.6 of their historical attacks) prepared them for this innovation.

What is ‘Urban Siege’?

Urban siege entails combined arms, ‘swarming’ attacks that bring multiple assault squads into play to attack a target or targets.  The goal is to draw in defenders to prolong the attack and maximize casualties and disruption.  By leveraging multiple, simultaneous assaults (known as swarming) response is complex. As a result, fog, friction, and the smog of terrorism is amplified. As the START Background Report on the attack noted, extended hostage-barricade attacks with durations over 24 hours are nearly five times as lethal as those that end within a day.

The most notable antecedent to the Westgate siege was the Mumbai attack. In that 2008 action Lashkar-e-Taiba (LeT) conducted a series of assaults—including complex hostage barricade situations—on seven separate targets in Mumbai, killing 171 and wounding over 250 during their three-day siege.  We viewed that as a seminal event in contemporary urban siege.  Indeed in our paper “Postcard From Mumbai: Modern Urban Siege” we called it a ‘Back to the Future’ incident where terrorists returned to urban guerilla tactics.

Though armed attacks and hostage situations are as old as terrorism itself, the urban siege is of a particularly recent vintage. Attackers do not aim to get out alive. Instead their goal is to kill as many as possible, taking hostages and building improvised fortifications to delay their own deaths and drag out the siege. Multiple teams are employed, often designed to overload the target's response capability and operational command and control.  The attackers succeeded in complicating response in Nairobi.  As recounted in the Guardian report, disorganized response, punctuated by infighting and a clash of egos among authorities—including a friendly-fire incident that led to disrupting the counter-assault—allowed the terrorists to regroup and actively hunt victims.  The security forces (police and military) violated the first goal of counter-assault for urban siege.  They failed to ‘stop the kinetic momentum!’

Response and Coordination Challenges

The latter point is not obvious to readers that visualize police tactical response as a simple matter of bringing overwhelming force to bear on a small number of attackers. In the aftermath of the Boston Marathon Attack, the Boston Police Department, for example, was roundly criticized for locking down the city and deploying massive amounts of heavily armed officers to combat two young men.  

Consider, however, the chaotic environment inside a police incident commander's headquarters in such a situation: conflicting reports are streaming in from every direction, the location and composition of the attack force is unclear, and it is still possible that there may be more attacks on the horizon. Response must be instantaneous, and an alphabet soup of agencies and departments must cooperate to ramp up from normal operations to emergency footing in the blink of an eye. Overnight, both regular and tactical law enforcement officers trained to de-escalate violent situations must embrace extreme violence to put down fanatical, heavily-armed murderers to prevent them from killing any more innocents. Bostonians were lucky that the attack force was minuscule, geographically confined, and acting alone. A larger, more distributed, better equipped, and better-trained force might have severely taxed police operational response.

Responding to urban siege is complex and outside the experience of most police departments.  Traditional police practice calls for responding officers to contain the site of a hostage-barricade situation and then call for specialized responders—SWAT teams—to respond and neutralize the complex threat.  Indeed, according to reports from the scene Nairobi’s police flying squad followed this dated approach when they arrived at 1:10 pm.  It wasn’t until three and a half hours after the initial shots were fired that Kenya’s ‘recce group’ a SWAT capability, responded at about 4:00 pm. Kenyan military forces (including infantry and rangers) arrived at about the same time, leading to conflict over command and a friendly-fire shooting with the commander of the “recce group’ killed and three police and one soldier injured. By the time the event ended on Tuesday, 24 September, blasts, mayhem, and killing had ensued.  The political dynamics of the event also went viral.  

It may be tempting to attribute the difficulty of police response in locales like Mumbai, India, Beslan, Russia and Nairobi to lack of government capacity and proper training. Such chauvinistic criticism overlooks the fact that police in such places—though perhaps under-resourced—have extensive experience dealing with heavily armed criminals and domestic terrorism that their Western counterparts generally lack.

The bitter truth is that a true armed assault by a dedicated, resourced, and fanatical opponent would tax the resources of any competent police department. Urban sieges are exceptional events that usually surpass the usual sequence of police roles and functions. They bridge the local/national/global levels, bringing to bear considerations, entities, risks, and responsibilities that go much higher up than the world of dragnets and squad cars.  Indeed, this is a case of a local, tactical event having profound global, strategic consequences.  From the onset of the Nairobi attack, Twitter became engaged. As one report notes, “Twitter captured the confusion of the attack in real-time as users first reported what they thought was an explosion. Shortly after noon, news started trickling through the social network that something had gone horribly wrong at Westgate mall.”  By the time the siege was over, the public, Kenya’s President Uhuru Kenyatta, al-Shabaab (#AlShabaab) and global civil society had weighed in. Indeed, as David Kilkullen has observed, the attackers’ (in both Mumbai and Nairobi) focus on foreigners combined with the intimate nexus among attackers and victims demanded by gun battles, which are more protracted than bombings alone, lead to enhanced terror effects and seems to have been calculated to maximize international attention.  Mobile phones and social media became tools of command and control, and amplified carnage for the terrorists. As a result, we posit that urban siege is intrinsically global in impact.

Counter-Swarming for Urban Siege

All is not lost. Police can train to fight and defeat armed assaults. The answer, however, does not necessarily lie in military-style police operators, tactical vehicles or Boston-style clampdowns. While these are all part of the solution, the most important aspects of defeating urban sieges lie in operational command, training, and synchronization among emergency response agencies. Incident command systems must be able to quickly scale up and direct a response force composed of many different government organizations and both process and red-team intelligence in real-time.  Lines of authority, interagency relations and cooperation, and emergency response routines and subroutines must be clear and well rehearsed, not improvised on the spot.   Effective ‘counter-swarming for urban siege must build from a baseline ‘full-spectrum policing’ capacity.  Police must be able to quickly shift from community policing to formed units that are able to repell and contain threats.  Addressing active shooters and combined arms swarms require immediate, adaptive, decisive counter-force action.

This must build from the concept that the first responding police must immediately engage the attackers and stop the kinetic momentum.  This requires more than good tactics or MAC-TAC (Multi-Assault Counter-Terrorism Action capabilities) training.  Full Spectrum Policing must be grounded in operational art.  Police operational art must integrate operational swarming, maneuver, and real-time intelligence support across the urban operational (battle) space.   This must be synchronized with community protection, political understanding, and media appreciation by both traditional and new media (social media) entities.  Civil police, military, intelligence, private security and governance structures must also be synchronized to address attacks on soft infrastructure like malls, public transport, and downtown districts.

All of this is infinitely more important than technology and gear. After all, the first line of defense will not be a heavily armed tactical trooper but a regular police officer.  The Mumbai, Beslan and Nairobi attackers all exploited the early chaos of the assault to kill wantonly and then entrench. The “golden hour” of an urban siege is far before the cavalry arrives to save the day. And the success of the entire effort depends on the command, control, and cooperation of the incident command units on various political scales of authority.

Conclusion: Adjusting Our “Playbook”

We are not helpless against urban siege. But first we must acknowledge it is a threat, and that worldwide terrorist attackers are eying malls, schools, sporting events, and urban centers as the next soft target to strike to further their political objectives.  As David Kilcullen aptly asserts, “urban environments, including complex pieces of urban terrain like shopping centres, hotels and industrial facilities, are the battlegrounds of the future. And the urban siege, with its commando-style tactics and guerrilla infiltration of a big city’s ebb and flow, is increasingly the tactic of choice for a wide range of adversaries.”  The Westgate attack is a simplified variation of Mumbai’s urban siege.  The target set was more limited, but the principles the same.  We have seen this set of tactics employed in South Asia, and now Africa. It is as Daveed Gartenstein-Ross noted “not a question of whether the Nairobi attack will be modeled, it will, and likely with a Western country as the target.”  Once we acknowledge the threat, we must next develop doctrine and training to counter it.  We must build our counter swarming playbook for urban siege.

About the Author(s)

Adam Elkus is a PhD student in Computational Social Science at George Mason University. He has published articles on defense, international security, and technology at Small Wars Journal, CTOVision, The Atlantic, the West Point Combating Terrorism Center’s Sentinel, and Foreign Policy.

Dr. John P. Sullivan was a career police officer. He is an honorably retired lieutenant with the Los Angeles Sheriff’s Department, specializing in emergency operations, transit policing, counterterrorism, and intelligence. He is currently an Instructor in the Safe Communities Institute (SCI) at the Sol Price School of Public Policy, University of Southern California. Sullivan received a lifetime achievement award from the National Fusion Center Association in November 2018 for his contributions to the national network of intelligence fusion centers. He completed the CREATE Executive Program in Counter-Terrorism at the University of Southern California and holds a Bachelor of Arts in Government from the College of William and Mary, a Master of Arts in Urban Affairs and Policy Analysis from the New School for Social Research, and a PhD from the Open University of Catalonia (Universitat Oberta de Catalunya). His doctoral thesis was “Mexico’s Drug War: Cartels, Gangs, Sovereignty and the Network State.” He can be reached at



Tue, 12/24/2013 - 9:22pm

This is why every police officer should be trained as a tactical officer in this environment. The attack on the mall in Kenya, was nothing more than an active shooter situation.


Sun, 11/24/2013 - 11:45pm

Your recommendations seem sound and intelligent - but not particularly new or pertinent when applied through the lens of local police capacity. For instance, in Mumbai, the issue wasn't just the higher-order issues of rehearsal of a coordinated response to a multi-vector attack, but also of adequate policing and adequate equipping of first responders. For certain, they could've done better with a more focused, better resourced response plan that made the most of their first responders to provide inputs to better allocate follow-on resources...but the failures in Mumbai were pretty basic. Police officers without proper communications, personal protective gear, weapons (revolvers and clubs?), or training were not a match for a rehearsed, focused team of terrorists with AKs, IEDs, comms gear, and direction from veteran LeT terrorists.

I'm not sure that I'm confident in your depiction of Westgate as a 'swarm' attack. It appears to be an attack perpetrated by four active shooters against a relatively undefended 'target.' I don't view this in the same light as IRGCN fast boats swarming a transiting Carrier Strike Group or, similarly, a coordinated, dynamic multi-vector attack perpetrated by AQI or IAI against a hard target. Like most terrorism, it was perpetrated for sheer communicative and propaganda value rather than to attain a military defeat against an objective. To gain the functional defeat against such an attack, it's necessary not only to provide a better security response, but disrupt the communicative value of the act. Anti-swarming, as you propose, speaks to the first issue (and, yes, I believe your policy and procedural recommendations are sound), but only tangentially to the second.

Outlaw 09

Sun, 11/24/2013 - 1:46pm

Before we do counter swarming I would really suggest police and military forces fully understand just what swarming is, how is it implemented and the indicators of a swarm attack. This tactic goes really a long way back in history and has been used in just about every war since then.

This particular swarm attack while occurring in an urban setting is no different that those swarm attacks used by the IAI and the AQI countless times and quite successful by the way against the 1stCav in Diyala and Mosul in 2005 through 2008. And by the way they are again implementing swarm attacks in the last two years in Iraq.

Note: The problem with the Army not having recognized them was the terminology they used---when the term complex attack was used no one seemed after that to actually analyze the "complexity".

With an understanding by the Force of swarm attacks are just maybe those Iraqi attacks might have not had the impact they had.


Sun, 11/24/2013 - 8:39am

I wonder if we are trying to find a 'new' problem here. The authors refer to 'Urban siege entails combined arms, ‘swarming’ attacks that bring multiple assault squads into play to attack a target or targets'.

Surely there are ample examples before Mumbai, let alone Westgate Mall, of such attacks; armed attacks on essentially private, often diplomatic premises where access was the objective come to mind. The Iranian Embassy in London (1980 five days), the OPEC HQ in Vienna (1975 two days) and the Japanese Embassy, Lima (1996 one hundred and twenty six days).

What is different now is that the targets are buildings with mass public access, like Mumbai railway station (where more died than in the hotel). For sound operational reasons why would an armed group attack a 'hard target'? As a number of attacks on US embassies have shown.

I have argued in the past - in the police - with firearms officers and operational planners that they assumed those with guns will not move, let alone run etc. That assumption in the UK may have changed now, although the impression given is that just more fire-power has been added.

My fear is that the attackers - who are using armed propaganda - know that media coverage will be almost instant whenever they strike an urban target, with citizen footage, CCTV let alone their own media helpers. Rather than relying upon the arrival of the TV trucks etc, which invariably are few in number and located near their main focus. So I would expect a move away from national capital cities.

John and Adam,

I think your proposal for counter-swarming is appropriate, but suspect the challenges you pointed out regarding interagency cooperation between law enforcement agencies could be challenging to say the least. Just as in the military I suspect the key to making this work is having the right leaders in the right locations that are capable of not letting their egos get in the way of mission command (empower those that can respond instead of trying to establish 100% control). Seems that the process in Boston (although not an urban siege) worked well, and I trust most cities are studying it to garners lessons.

The only aspect of your article I call into question is your depiction of the assault on Westgate Mall. Hopefully you got your facts from those in the know since the open source reporting has been very contradictory. I have seen no evidence in open source reporting that indicates there were more than four terrorists, but even if there were six they created a disproportionate about of damage (even if it turns out that Kenya's security forces caused most of the damage and deaths the terrorists were the catalyst). Would appreciate it if you would clarify your position on whether or there were there six terrorists or as you wrote, "On Saturday, 21 September 2013 squads of gunmen affiliated with the Somalia terrorist group al-Shabaab armed with assault rifles and grenades attacked the Westgate mall."?