Safaricom Report Links KDF To Theft Of Their Merchandize During The Westgate Terror Attack

Report on Theft of Safaricom Merchandise During the Wesgate Terror Attack

1. Detailed findings

Introduction

Between 25^th and 27^th September 2013, during and after a terrorist attack on Westgate Shopping Mall, numerous mobile phones and airtime at Safaricom Westgate Retail Centre were stolen.

We carried out a detailed analysis on stolen merchandise to determine key suspects involved in this theft. The following steps were followed to arrive at the findings in section 1.3 of this report:

We identified the serial numbers of the merchandise that was available for sale at Westgate Retail Center as at 25^th September 2013 but mysteriously disappeared after the terror attack on the 27^th September 2013;
We checked the mobile numbers that used or were using the handsets and airtime that had disappeared in the aftermath of the attack;
We examined whom among the users of the stolen merchandise were at the “scene of the crime” between the 25^th and 27^th September 2013, the period the merchandise disappeared;
We analysed the connection, if any, between users of the merchandise who were at Westgate and users of the merchandise who were not at Westgate. This is to establish the individuals who had most likely passed on the merchandise to those that were not at the “scene of the crime”;
Based on the patterns we had seen from the steps above, we attempted to identify whether any of the suspects was connected to the Kenya Defence Forces (KDF) since most of the individual users of the stolen merchandise were mostly in or around known KDF facilities.

1. Summary of the findings

Of all the handsets that were stolen from Westgate shop, 528 handsets (valued at KES 5.5 M) had been used on our network as on 10^th December 2013.

A total of 1,283 unique mobile numbers had used these handsets. 618 of these numbers were found to be frequently located in military sites;
98 mobile numbers had used the stolen handsets more than once;
73 mobile numbers which used the stolen handsets were at Westgate at certain instances during the period of theft (25th to 27th September 2013);
Normal operating locations of 48 mobile numbers out of the 73 which were at Westgate at the time of loss seem to be in the military camp locations.

1.3. Persons involved and extent of involvement

Name of suspect	Mobile number	Stolen merchandise used	Was suspect at Westgate between 25 and 26^th Sept?	Connection with other users of stolen merchandise through frequent communication	ID used in MPESA	Frequent Location of suspect
AUGUSTUS KAVII	0725641244	SAMSUNG TEXTO GT-E2220 Serial Number: 354663055235750	YES	THOMAS M KATIKU (User of Samsung Galaxy Trend Serial No: 357508052685520); EDWARD SAMMY (User of Bonga Nokia Asha 205 Serial No: 353700059710830; MOSES MULWA MULANG’A (User of Samsung Galaxy Pocket Serial No: 356938054872120) IRENE MWENDE KASIVA (User of Samsung Galaxy Ace S5830 Serial No: 354722058645280)	National ID: 26012181	DoD_HQ Embakasi_DoD Kahawa Nanyuki
STEPHEN K. KIMANI	717897614	NO	YES	DANIEL WAWERU National Id Card 26125369 Phone: 726520404 USED STOLEN AIRTIME(Location: 1365-Gilgil_hill_HUB_OUTL ) HARON KARIMI National Id Card 25841511 Phone: 720913477 USED STOLEN AIRTIME(Location: 5305-Gilgil_Teachers ) MICHAEL GIKURU GIKURU National Id Card 25324115 Phone: 723079566 USED STOLEN AIRTIME(Location: Celtel_Gilgil-IEBC) SIMEON K MUKOLA National Id Card 25997114 Phone: 715682586 USED STOLEN AIRTIME(Location: 3343-Gilgil_Teachers_OUTL) DANIEL WAWERU National Id Card 26125369 Phone: 726520404 USED STOLEN AIRTIME(Location: 1365-Gilgil_hill_HUB_OUTL )	Military ID: 24392261	Gilgil_Hill_Hub Lanet Hub
KEVIN ODUOR	719362254	NO	YES	EPHRAIM KIRIMI ID:95248960 Phone 726676462 (user of Huawei Y210) DOMINICK O OWINO ID: 27018780 Phone 719153388 (user of Partial Alcatel One Touch 4010 T-POP Bonga)	Military ID: 26999037	Gilgil Lanet Isiolo
ISSAK H HAJI	720353563	356536053047960 -LG Optimus L7	YES	ADAN ABDI MUSTAFA ID: 27501734 Phone: 720059344 (User of LG Optimus L7 SN:356536053051120) ALINASIR DAUD YUNIS ID: 26688516 Phone: 722724515 (User of LG Optimus L7 SN: 356536053053370) SAADIA HAJI ID: 22623564 Phone:723354783 (User of LG Optimus L7 SN: 356536053047960)	Military ID: 26688487	DoD_HQ Embakasi_DoD Kahawa
JOHN MWANGI	721749246	357341053184760 -Partial LG E400 Optimus L3 Bonga	YES	SHEM WAINAINA ID: 25442408 Phone- 725307469 ( User of Lenovo 10” Tablet Serial No :868014010454060) – also located at Military site GEOFREY MURIUKI ID:25900308 Phone:723946371 User of Samsung Galaxy S4 SN: 357504056844740) Caroline Wanjiru Njeri ID:30001650 Phone:701262699 (User of LG E400 Optimus L3 SN:357341052407000) MUNYORO JOSEPH CHACHA IDNO: 29763496 Phone: 705029490 (User of Samsung Galaxy Pocket SN: 356938054872380) – Joseph is also located at Military site.	25066031	DoD_HQ Embakasi Gilgil Langata_DoD Nanyuki
JOE MATHENGE KINGORI	720205721	868096015290320 – Huawei Y210	YES	LUCY WAMBUI MUCHEMI ID: 28768221 Phone: 714968554 (User of LG Optimus L7 SN: 356536053053350) DENNIS G K ID: 28669510 Phone: 728588326 (User of Huawei Y210 SN: 868096015290320) BONIFACE KINGORI ID: 28690099 Phone: 729589641 (User of Samsung Galaxy Trend SN:357508052683440)	27160589	Embakasi Gilgil Langata_DoD
MAINA M	727739589	357508052690400 -Samsung Galaxy Trend	YES	WILSON KIRITU ID: 26934917 Phone: 724854239 (user of LG E400 Optimus L3 SN:355656059554330) – also located at Military site. MERCY WANGU KANYIRI ID: 25213874 Phone: 726865664 (user of Alcatel One Touch 4010 T-POP SN:869294014319860) Mercy Wangu Kanyiri ID: 25213874 (User of Alcatel One Touch 4010 T-POP SN: 869294014319860)	28660300	DoD_HQ Embakasi Langata_DoD
BONIFACE MUTHONI	713177803 701413909	868096015287470 -Huawei Y210	YES	EPHANTAS NJERU ID: 27724397 Phone: 708265796 (User of Huawei Y210 SN: 868096015287470) MARY NDUNGE ID: 9413620 Phone: 704983263 (User of Huawei Y210 SN: 868096015287470)	29905820 29905920	Embakasi_DoD Langata_DoD Langata_DoD
OKENO WILLIAM	714672488	Handset 869294014526400 -Bonga Alcatel T-pop Also used stolen Airtime worth Kshs 1000	YES	LOKADOKOI EKENO NAGUMO ID: 47948720 Phone: 724620126 (User of Tecno P3s SN: 358249050157220) Paul a ekeno ID: 20532642 Phone: 726743443 (User of Bonga Alcatel T-pop SN: 869294014522770) EGIALAN EKENO HOSEA ID: 25287458 Phone: 712107139(User of Tecno P3s SN: 358249050157220)	26068162	Eldoret Gilgil Lanet Kahawa Barracks
PAUL WANJAU	729315508	869294014324130 -Alcatel One Touch 4010 T-POP	YES	JOHNSON KATANA ID: 23481588 Phone: 720676176(User of LG E612 Optimus L5 SN: 357542050522040) – – also located at Military site. ALFRED MWANGI ID: 24779475 Phone: 724770491(User of Nokia 210 SN: 355513050238080) JULIAH MUTHONI NJOROGE ID: 27971684 Phone: 717949025(User of NOKIA LUMIA 920 SN: 356355054560570)	24120691	Langata_DoD
JOSEPH KIBE MWANGI	707307924	355656059556240 -LG E400 Optimus L3 Airtime worth Ksh 8,000	YES	HARON KARIMI ID: 25841511 Phone: 720913477(User of NOKIA LUMIA 820 SN: 354105056739660) – also located at Military site. JOSEPH MWANGI ID: 27328473 Phone: 703821960(User of Samsung Galaxy Trend SN: 357508052682840) MARTHA KARIUKI ID: 28461495 Phone: 723565751(User of Partial Nokia 210 Bonga SN: 355513050147390)	27328473	Gilgil Kahawa Barracks
STEPHEN KONONGO	729707707	869294013696810-Alcatel One Touch 4010 T-POP	YES	SUSAN WANJIKU KIRUKU ID: IDNO 26295517 Phone: 717988185(User of Partial Alcatel One Touch 4010 T-POP Bonga SN: 869294013696810) MARTIN WAMAI ID: IDNO: 13725066 Phone: 721308756(User of Partial Alcatel One Touch 4010 T-POP Bonga SN: 869294013696810)	24309979	DoD_Hq
KIMUNGUYI JOSEPH	717449250	353700059715880-Nokia Asha 205	YES	VICTOR NDIGA ID: 29514227 Phone: 727293936(User of Huawei Y210 SN: 868096015287870) ISAIAH KURUMBA ID: 27149275 Phone: 718328029 (User of Huawei Y210 SN: 868096015287870)	20933040
ERICKSON MOSOMI	726587922	Airtime worth Ksh 1,000	YES	0KENO WILLIAM National Id Card 26068162 Phone: 714672488 USED STOLEN AIRTIME(Location: 1365-Gilgil_hill_HUB_OUTL ) KENNEDY ALUODO National Id Card 26205493 Phone: 728357448 USED STOLEN AIRTIME(Location: 3173-Celtel_Gilgil_OUTL) ERASTUS M KYUTU National Id Card 23746715 Phone: 704905605 USED STOLEN AIRTIME(Location: ) ALLAN OKANDA National Id Card 26495378 Phone: 719899294 USED STOLEN AIRTIME(Location: 1365-Gilgil_hill_HUB_OUTL) JANE WAMBUI National Id Card 9441012 Phone: 728797650 USED STOLEN AIRTIME(Location: 3343-Gilgil_Teachers_OUTL) ROBERT ROTICH 24655161 Phone: 703238815 USED STOLEN AIRTIME(Location: 3343-Gilgil_Teachers_OUTL) ABRAHAM MELI National Id Card 26214154 Phone: 720996814 USED STOLEN AIRTIME(Location: Loc_unavailable)	Military ID 24508167	Gilgil
ONDIEKI NYAANGA DAVID	0718221111	LG E400 Optimus L3 SN:357341052407240	YES	VIOLET OMWEGA ID:25880844 Phone:0700896370 (User of Alcatel One Touch 4010 T-POP SN:869294014319850) VERAH NYABIBA ID:30046756 Phone:0728384145 (User of Samsung Galaxy Pocket SN:356938054868150	27745499	DoD_HQ Langata_DoD
CHARLES MITEI	0720358036	Samsung Galaxy S3 Mini SN:358309053765170	YES	CYNTHIA JEPLETING TOO ID:28398663 phone:728726091 (user of Samsung Galaxy S3 Mini SN:358309053765170) DOMINIC NGETICH ID:28525471 phone:703934654 (user of BlackBerry 9220 SN:354481052860270)	25494180	DoD_HQ Eldoret Kahawa Lanet Langata_DoD
CATHERINE TABITHA MAKATI	0727997039	Huawei Y210 SN:868096014993350	YES	BRIAN MUKOLWE ID: 30014711 Phone: 701288215(User of LG E612 Optimus L5 SN: 357542050522960) BRIAN INJENDI MUKOLWE ID: 30014711 Phone: 708761080(User of LG E612 Optimus L5 SN: 868096014993350)	29503688	Embakasi Kahawa
BERNARD OCHENGO	0715469192	Samsung GT- B7610 Louvre SN:359652021186780	YES	RODGERS MOSE ID: 28239321 Phone: 727759771(User of Samsung GT- B7610 Louvre SN: 359652021186780)	27484805	DoD_HQ Kahawa
EPHRAIM KIRIMI	0726676462	Huawei Y210 SN:868096015024190	YES	CHARITY CHUMARI ID: 26393901 Phone: 718806875(User of Huawei Y210 SN: 868096015024190)	95248960	Gilgil, Isiolo Kabete,,Kahawa Lanet
DENNIS KOLA	0723492905	Huawei Ascend Y300 SN:868438018940490	YES	ANZUNZU MUSEBE ID: 23067324 Phone: 724072933(User of Huawei Ascend Y300 SN: 868438018940490)	21498425	DoD_HQ Embakasi,Kahawa
CYPRIAN MAKORI	724125321	LG Optimus L7 SN:356536053050960	YES	EMILY KEMUNTO NYABUTI ID: 24589915 Phone: 714200145(User of LG E400 Optimus L3 SN: 357341052409260)	27235091	Kahawa
MZEE DAVID	718131045	Nokia 210 SN: 355513050178020	YES	SARAH KOECH ID: 27725744 Phone: 728055171(User of Nokia 210 SN: 355513050238110)	25667924	Gilgil Langata_DoD
STEPHEN K. KIMANI	717897614	ZTE Modem MF637U SN:351817041249210	YES	EUNICE WANJUGU MUNYI ID: 23385724 Phone: 705292428(User of Blackberry Z10 SN: 354010058220220)	24392261	Gilgil Lanet
DANIEL WAWERU	726520404	Huawei Y210 SN: 868096015290950 Airtime worth Ksh 1,000	YES	JOSEPH WANGUI ID: 25132676 Phone: 721125105(User of SAMSUNG TEXTO GT-E2220 SN: 354663055238800)	26125369	Embakasi
MOHAMED KIDZAYO	716530736	Samsung Galaxy Pocket SN: 353768059640470	YES	MWANAISHA OMAR ALI ID: 30160764 Phone: 706572471(User of Partial Samsung Galaxy Pocket Bonga SN: 353768059640470)	00001986 (False ID)	DOD_HQ Kahawa
EDWARD MURITHI	729691624	Tecno P3s SN: 358249050061150	YES	CAROLINE KAWIRA ID: 24381992 Phone: 726537268(User of Tecno P3s SN: 358249050057360)	24977183	Kahawa
CALEB TUVEI TUVEI	717404400	NOKIA LUMIA 820 SN: 354105056739660	YES	STELLA NKATHA MUNGANIA ID: 20005381 Phone: 720481547(User of NOKIA LUMIA 820 SN: 354105056739660)	24517490	Gilgil Kahawa Barracks Lanet
ERASTUS M KYUTU	704905605	Samsung Erica 3G GT-E3309 SN: 357185050622120 Airtime worth Ksh 15,500 used by himself and worth Kshs 21,500 used by people believed to be his relatives by the fact that they share the surname “KYUTU”	YES	EVARLYN MUNYAO ID: 26108470 Phone: 716416982(User of Samsung Galaxy Pocket SN: 353768059629450)	23746715	Embakasi, Gilgil Kahawa Barracks
FREDRICK B KIPLANGAT	722428570	Samsung Galaxy Trend SN: 357508052683070	YES	REGINA JEMUGO ID: 23177674 Phone: 728614962(User of Samsung Galaxy Trend SN: 357508052683370)	21680883	Embakasi Kahawa Barracks
ALLAN OKANDA	719899294	Huawei Y210 SN: 868096014939390 Airtime worth Ksh 1,000	YES	EVALINE MINAYWA SINGAH ID: 26285464 Phone: 716765149(User of Huawei Y210 SN: 868096015292890)	26495378	Embakasi Gilgil, Kahawa Langata_DoD

2. Conclusion

We believe that the individuals above who used the stolen merchandise are either military officers or live in military facilities based on the following:

They have been consistently located in or around military facilities in the last three months;
Some of the individuals used mobile numbers that were registered using military ID numbers;
They were located at Westgate between 25^th and 27^th September when the military rescue operation was ongoing. At that time the premises were restricted and could only be accessed by KDF personnel and other security agents.

Recommendation

We recommend that KDF conducts further investigations to ascertain whether these individuals are members of their organization and if so, hold them accountable for their actions. Safaricom will provide any other information, in its possession, to assist KDF in these investigations.

Appendices

Appendix 1: Registration Details

FIRST NAME	MIDDLE NAME	SURNAME	MOBILE	DOB	DOCTYPE	ID NUMBER
STEPHEN	K.	KIMANI	717897614	01/01/1986 00:00:00	Military ID	24392261
KEVIN		0DU0R	719362254	02/15/1988 00:00:00	Military ID	26999037
ISSAK	H	HAJI	720353563	01/01/1989 00:00:00	Military ID	26688487