Security find new clues on the terror attacks

By Andrew M. Mwenda

Gen. Aronda informed Museveni  7 days to the attacks

Terrorists now using women to spy on targets

ADF Infiltrated intelligence

On July 4, the Chief of Defence Forces (CDF), Gen. Aronda Nyakairima, received a threat assessment from the Chieftaincy of Military Intelligence (CMI) detailing a serious threat from Allied Democratic Forces (ADF) terrorists working in conjunction with the Somali-based, al-Shabaab militant group.

Nyakairima sent a flash radio message of the threat to all units of the Uganda Peoples’ Defence Forces (UPDF), and copied President Yoweri Museveni, all cabinet ministers, intelligence organisations and police.

The next day CMI reinforced its defences at its head offices at Kitante Courts and the UPDF head offices in both Bombo and Mbuya were reinforced with barricades. At all security installations around Kampala and greater Kampala, increased security measures were put in place.

At the same time, information had been given to the police to communicate to the public about an impending attack. The challenge, however, was how to inform the public without creating unnecessary alarm. At some seminars and conferences, police claim to have informed listeners to be careful.

Warning signs were already well apparent by the time a group of 24 former ADF combatants were met on October 8, 2008, at the headquarters of the JAT in Kololo, Summit View. The former combatants, who had renounced violence to get amnesty and were retained by JAT as informers to help spy on their comrades, were led at the meeting by their former chief of staff, Benz Tushabe Munyangondo, while the JAT team was led by Major B. Monday, the director of counter terrorism.

The meeting was a pre-emptive security measure to divert the ADF reporters ahead of the Oct. 9 Independence Day Celebrations of that year, the Tripartite-Plus, COMESA and SADC heads of state summit in Kampala. During the meeting, the ADF were asked to submit a document of their grievances. It was later submitted signed by one Hussein Maiga and the aforementioned Benz Tushabe.

According to contents of the meeting, the ex-ADF combatants (referred to in the document as ‘reporters’) repeated their complaint that the government of Uganda and JAT had used and dumped them. They argued that the resettlement money they had received from the government was insufficient and that they felt forgotten.

In the document, ADF reporters complained that most of their combatants who got amnesty are youths who belong to the Salaf and Tablique sects of Islam. The document noted that dealing with these youths requires care as they are targets of continued recruitment efforts by ADF. However, the memo noted that as Muslims, the youths were agitated.

‘Most of these youth though (are) not much educated (and) are aware of the new Islamic renaissance in the world; the American invasion of Iraq and Afghanistan and the events taking place in Somalia,’ the document warned. ‘This should not be underestimated or (not) taken seriously because these are practicing Muslim youths who regularly meet at least five times a day for prayers. Government should come up with a program to engage these Muslim youths in active economic activities to avoid idleness and redundancy.’

Security sources say ADF reporters had been trying to meet president Museveni to present him their grievances. State House sources say they had not secured such audience by 7/11. The last time ADF had a meeting with the president was on February 03, 2004 which was organised by then chief of staff, Maj. Gen. Joshua Masaba and attended by then minister of state for security, Betty Akech.

At the time, the president directed that jailed ADF leaders Maneno Majaliwa and Sserwanga Bukenya be released so that they work as a team by conducting mass mobilisation campaigns to convince other ADF combatants to renounce rebellion. They were not released until four years later. These betrayed promises increased disgruntlement.

Because many of them work with and inside Uganda’s security organizations, some ADF terrorists had accumulated a lot of information on the location of security organisations, especially JAT. They knew of their internal structures, their operational plans, the names, home addresses and car number-plates of security operatives.

In an August 2008 internal assessment by JAT, it was stated that ‘Analysis of information obtained from the recent arrested ADF operatives and their communications indicate that their intentions are; (among others), ‘elimination of security personnel.”

In the same internal assessment, JAT reported that ADF intentions were: ‘Elimination of their defected comrades now working for security, resumption of bomb attacks against the public with interest in crowded places and to intensify recruitment with emphasis on educated citizens irrespective of religion.’ The document had names of ADF operatives on the run.

At the time, JAT had planned to arrest and exterminate urban terrorist squads and those in the countryside. Among the operations JAT had carried out was the arrest of one Seka Adam Nsubuga Mukalazi, Yudaya Nansubuga and Mubiru Muhammad, all siblings of Ali Mubiru for their connection with ADF activities on July 25, 2008. On August 8, 2008, they arrested Joseph Ouma and one Waskile in Busia for being connected to a ‘suspicious number.’ On August 10, 2008, Bukomeko Muhammed and Magelo Shaffik were also arrested by tracking team.

As a result of these operations, many ADF combatants began to surrender to government under the belief they would receive amnesty, monetary compensation or getting jobs in the army and other security organisations. Because ADF was built around their religious faith, the government’s main advantage over the terrorist organization was its ability to provide them with monetary incentives. However, when this was not forthcoming, the ADF reporters inside JAT and the UPDF became susceptible to re-joining the terrorist group as double agents, leaking internal state intelligence within security agencies to ADF and provide misleading intelligence to security organisations.

Moreover, by the time of the bomb blasts on 7/11, there had been reports of massive recruitment by ADF. The reports also indicated that ADF was transporting most of its recruits to DR Congo through Kenya, Tanzania and Rwanda before crossing to Goma. There were also intelligence reports that ADF was recruiting largely from eastern Uganda especially in Busoga where there are many Muslim living in poverty. The challenge therefore was not lack of information but rather how to operationalise it.

New security information shows that there were suicide bombings at both Kabalagala and Lugogo. This theory is based on the discovery of two severed heads of the suspected suicide bombers at both sites. According to police, the existence of a severed head is often a sign of suicide bombing as the suicide jacket tends to destroy the middle body leaving only the head and limbs.

Secondly, police sources say that the severed head at Lugogo was of a Somali while the one in Kabalagala was of a Ugandan. According to security sources, this is the first ‘evidence’ of the coordination and alliance between ADF and Al Shabaab. The identities of the suicide bombers have not yet been established. Last week, Kenya arrested a Ugandan suspected of links with the terrorism bombings in Kampala. Ugandan security suspects he is an ADF person. According to security sources since ADF does not have a prior record in suicide bombing, this must be a new tactic introduced through its work with Al Shabaab.

The link between the two terrorists organisations is further strengthened by the theory that ADF knows Kampala very well; Al Shabaab, not so much. As mentioned earlier, ADF has internal sources within Uganda’s intelligence services especially JAT. For Al Shabaab to succeed in its operations, it needed the ADF infrastructure.

At the Lugogo scene, security found a Koran next to the severed head of the suicide bomber. Inside the Koran were telephone numbers which also have given police important leads. Again, The Independent is withholding these numbers in order not to jeopardise police investigations. From these leads, police suspect the bombs were assembled in Kampala, largely but not entirely, around Namasuba towards the end of June.

On July 12, security organisations deactivated a bomb at Makindye House. The bomb had failed to explode the previous day. It is not yet clear why the bomb did not go off on July 11 like happened at Kyadondo Rugby Club in Lugogo and at the Ethiopian Restaurant in Kabalagala. However, security retrieved a mobile phone Nokia 1208 series handset from the suicide jacket in which the ‘improvised explosive devise’ was held.

According to police sources, the telephone was attached to the devise as a detonator. The sim-card inside the phone, police sources say, was first inserted into the handset on July 8 just after midnight at Mukwano shopping centre in downtown Kampala. From these clues, security forces proceeded to follow the other sim cards this phone had used between then and 7/11.

Police sources told The Independent that the handset retrieved from the suicide jacked had previous used Somali telephone numbers. This therefore was not the first time Somalia was featuring in intelligence as connected to the ADF. The ex-rebels in their 2008 document had clearly informed authorities of this possible link. The Somali numbers on the phone thus added to the general picture of increasing coordination between Al Shabaab and ADF terrorists in their work.

However, the phone handset had also previously used Kenyan number from June 24th to June 28th. This further creates the link to some terrorists working in Kenya and therefore giving an early indication of their regional reach. Since the bombings took place amidst increasing ADF attacks in the DRC two weeks earlier, it is now clear among security sources that this was only a decoy to distract security from plans in Kampala.

Therefore, the terrorists have gone international, currently working through four countries ‘ Somalia, Kenya, DR Congo and Uganda. There are Safaricom and MTN numbers that were involved in the bombing, which The Independent has been made privy to. However, we have decided not to publish them on the advice of security officials as it would jeopardise police investigations. What it shows, however, is that security organisations are getting the right clues to track down terrorists.

But nothing more was done. On July 7th, Uganda sent a team to Nairobi to work with Kenyan security on handling some terror suspects who had been arrested there.

Meanwhile, on June 30th, the Joint Anti Terrorism Taskforce (JAT) under CMI had killed one Twaha Mohammed Kakdande, the overall commander of the Allied Democratic Forces (ADF) rebels at a place in DRC called Mwalika camp. On July 8th, JAT had also arrested a number of ADF collaborators in Mayuge District. Yet in spite of all this activity and prior knowledge of the plans by terrorists, and in spite of such operations, security was unable to stop them from attacking Uganda on July 11.

According to the Chief of CMI, Brig. James Mugira, this is a product of fighting asymmetric warfare. Terrorists tend to attack where you least expect them; they avoid your strong points and attack you where you are at your weakest. Ugandan security has no capacity to be everywhere. Mugira told The Independent that fighting terrorism requires the cooperation of all citizens especially those who manage bars and restaurants.

However other intelligence insiders say that the terrorists were successful partly because endemic corruption in security organisations has crippled the ability to devote more money to information gathering. Often, operational funds are used by intelligence bosses to enrich themselves leaving operatives in the field without resources to do the work. ‘National security has been compromised at the altar of personal enrichment,’ a security source said.

However, Mugira has dismissed this claim saying that at least JAT is well funded. If any operative is complaining, it is because they failed to clearly justify their operations. Mugira said that a culture had evolved in security where operatives would use the excuse of fighting terrorists to make money. So he introduced a system where every operation has to be justified in advance by showing its potential benefit.

After 7/11, security made an assessment of the internal weaknesses that could have given the terrorist an advantage. One concern was the failure to use the Joint Intelligence Committee effectively to share intelligence information. For example, External Security Organisation (ESO) had been warned by both USA and South Africa about an impending attack but had not share this information with Internal Security Organisation (ISO).

Second, JAT had a lot of information on the location and telephone numbers of terrorists. Most of its intelligence was technical and of a general nature ‘ that terrorists had recently increased their activities. However, the Rapid Response Unit (RRU) of the police had picked information on the plans by terrorists to bomb Kampala but did not have good intelligence on their location. If JAT and RRU had been interfacing, their joint information would have nipped the terrorists’ plans in the bud.

As Uganda prepared for CHOGM in 2007, there was a massive crackdown on ADF cells in Kampala. Using JAT as the spearhead, security organisations infiltrated terrorist cells arresting and detaining many of them. It disrupted their communication infrastructure, disorganised their flow of money and heavily disconnected one group from coordinating with another. By end of 2007, their back was broken.

However, the operation then under CMI chief, Leopold Kyanda also involved a lot of abuses and corruption, a factor that discredited the otherwise good results of his work. People were arrested, tortured and money extorted from them for their release. Security sources say Kyanda borrowed money from loan sharks at high interest to fund operations. By the time he left, JAT was broke and heavily indebted.

Security sources say when James Mugira came in, his first attention was to improve the image of JAT. He issued new instructions against detention of people without trial, and against torture. He promised that if anyone tortures suspects, he will personally deal with them. Secondly, he said people arrested on suspicion of terrorism, their cases should be investigated expeditiously and then handed over to police. ‘JAT should respect the law,’ Mugira told its officials in his first meeting with them.

Security sources feel that although this was a great improvement from the days of Kyanda, it also came with costs. Mugira believed that JAT officers had exaggerated the ADF threat in order to make money off operations. So he did not increase their operational funds. Most of their activities went into limbo and old contacts were not reactivated.

By March 2010, there were reports that some ADF were going to Somalia to train with Al Shabaab. Security did little or nothing partly because there was no money for operations. A security source told The Independent that operatives cannot find money for transport and food. The little money that comes for operations is appropriated by the chiefs.

By 7/11, it was clear to intelligence that because of earlier security vigilance against the terrorists, ADF had now built new cells outside what security already knew. A security assessment report which The Independent has seen says that ADF ‘has continued to receive money through forex bureaus and bus companies for its operations, ADF operatives have continuously acquired forged identification and travel documents including LC recommendation letters which look authentic.’

The assessment further says that ADF had replaced its traditional operatives who could be identified by intelligence organisations and whose networks had been infiltrated by security agents with new ones unknown to security. There was also increasing use of Salaaf Mosques as centres of recruitment and indoctrination.

Finally, the assessment showed that ADF operatives were now using foreign telephone numbers to evade security. Many of their operatives have been disguising as hawkers and boda boda motorcycle taxi riders while the organisations have generally begun using women instead of men to avoid suspicion and detection.