SNAPSHOT: Al-Shabaab attack in Nairobi highlights terror risk to hotels and business travellers

On 15 January 2019, militants from Somalia-based insurgent group al-Shabaab attacked the DusitD2 Hotel complex in Kenya's capital Nairobi, killing at least 14 people. The attack demonstrates the terror risk posed by al-Shabaab in Nairobi and throughout the wider region. 


  • At around 1500 local time on 15 January, four heavily armed gunmen clad in black entered the DusitD2 Hotel complex on Riverside Drive in the Westlands neighbourhood of Nairobi, the capital of Kenya.
  • Authorities have confirmed 14 people were killed in the 19-hour complex attack that began with an improvised explosive device (IED) blast in the hotel car park and person- borne IED (PBIED) detonation in the hotel's main foyer, killing and injuring an unconfirmed number of guests and workers. A conclusive casualty count has yet to be fully corroborated, but it has been reported that an American Brirtish-South African and a Spanish citizen were killed. More foreigners are expected to be among the fatalities and wounded.
  • More than 700 people were rescued.
  • Al-Shabaab gunmen reportedly moved up floor-to-floor, searching for more targets and finally entrenched themselves on the 7th floor, where elements from the paramilitary General Services Unit (GSU) eliminated them.
  • The Australian consulate is located in the award-winning business hotel, but whether it sustained any casualties has not been verified. (DusitD2 won The Best Luxury Business Hotel at the World Luxury Hotel Awards in 2017.)
  • Somalia-based insurgent group, al-Shabaab, claimed the operation on its radio station, Andalus, initially stating that 47 people were killed.
  • The 15 January siege occurred on the third anniversary of the al-Shabaab attack on the AMISOM El Adde military base in southern Somalia, where up to 150 Kenyan soldiers were killed. Significant date attacks are a hallmark of al-Shabaab.
  • The operation was also executed in response to recent escalation of US air attacks against al-Shabaab in Somalia.
  • Symbolically, al-Shabaab understands the weighted importance of spectacular attacks in creating a strong narrative of sustained militant activity.
  • It demonstrated lethal effectiveness when the economy of force is applied: the use of a heavily armed, very mobile four-man assault team and the willingness to cause civilian casualties as the attack was staged in a highly frequented part of the hotel where the use of a PBIED component would inevitably lead to mass casualties.
  • The DusitD2 Hotel complex offered ample opportunity for the assault team to carry out a mass-casualty attack, similar to the 2013 Westgate Shopping Mall siege, where 67 people were killed. Westgate is approximately 1.5km north of the DusitD2 complex, in an area of Nairobi that is considered high-end and well-secured.
  • The 15 January attack shattered this perception of security and exposed vulnerabilities with devastating effect, particularly in relation to the hotel's security architecture.
  • Fortunately, fatality numbers were lower than in the 2013 attacks, partly due to the response times and operational effectiveness of the security forces. Improvements to anti-terror operations have been made since 2013, but the success of the 15 January attack deeply underscores the prevailing terrorism threat to Kenya, and in particular Nairobi and the hotel industry and business travellers.
  • In light of this recent development, travel and/or security departments are advised to carry out independent security risk assessments of hotels as part of their duty of care requirements. This should include a list of hotels assessed, including more discreet ones, as safe for travellers to use.
  • There are certain features to look out for, broadly covered under: physical security, housekeeping, access and egress control, electronic surveillance, evacuation planning and information security, among others.
  • Foreign businesses are advised to:
  1. Review risk management plans to ensure that they are fit-for-purpose.
  2. Carry out a threat identification and site assessment that should entail blast and explosion analysis, structural stability analysis and a chemical, biological and radiological (CBR) threat assessment.
  3. Design a risk management programme aimed at protecting the office/accommodation and its occupants as well as putting together crisis management and disaster recovery plans.
  4. Consider providing travelling staff with tracking devices with geo-fencing and incident alert capabilities.
  • For business travellers, reducing the risk through an effective journey management plan is essential. They should:
  1. Ensure they have a meet-and-greet service upon arrival at the airport and use vetted security-trained drivers for movements inside and outside the city.
  2. Keep a low profile, maintain good situational awareness and minimise the exposure by avoiding high-risk areas and/or situations such as crowded public venues or visit these areas during off-peak hours.
  3. Minimise exposure to police and the security forces as these groups are likely to be targeted, particularly by al-Shabaab. Avoid chokepoints, such as narrow streets and bridges, and be aware of any potential egress points.