The two car stickers were distinctive and security agents now say they were being used by the terrorists’ sleeper cell to identify their vehicles.
One of the stickers was of a man wearing an M50 gas mask — an above-the-neck respirator — used for protection against biological and chemical agents.
The other was a car decal of a man, his head bent and wearing a black headscarf.
“These were their identification stickers,” a senior security source privy to the investigations told the Nation at the scene.
While CCTV footage showed four terrorists entering the complex, police sources say they killed six of them, meaning some could have entered the building in advance.
At House No. E9 in Muchatha’s Guango estate, Kiambu County, one of the terrorists, a clean-shaven man with a goatee, had rented a bungalow, where he lived with a girlfriend.
He loved cats, too, and would occasionally buy meat for them.
His tinted Toyota Ractis, KCN 340E, and which was unable to go through the DusitD2 barrier, was by yesterday still at the road leading to the complex after crashing into a drainage ditch beside the first security barrier.
Locals knew him as Ali Salim — a man who spoke fluent Kiswahili and had good rapport with neighbours — in the gated community, although he always hid his face with a cap.
Rent for these four-bedroom houses could reach Sh50,000 a month and for the last 10 months, some of the planning for the attack was carried out here.
A few weeks to the attack, the car would be driven to Chiromo and parked by the roadside.
A man who sells second-hand clothes at the junction of Chiromo Road and 14 Riverside Drive claimed he had noticed the car several times.
“They would normally park by the roadside and no one left the car. And when they did, one would go and come back with coffee from the restaurant,” the hawker was quoted saying.
Two days before the attack, a waiter at the restaurant told the Press that one of the terrorists — noticeable because of a “big scar” on his hand — went to the restaurant and ordered coffee.
“I knew one of them because he had a big scar on one of his hands. Then on Tuesday, the same group arrived at the restaurant — this time armed. I saw them. They shot six of my friends, four didn’t die but two succumbed,” the waiter was quoted by Capital FM.
Security sources say that the terrorists’ car had arrived at the Chiromo/14 Riverside Drive junction around 2.30pm and was parked at the entrance for 30 minutes.
Adjacent were maize roasters who target the University of Nairobi students whose Chiromo hostels are adjacent to DusitD2.
For the 30 minutes, the occupants never left the tinted car and then drove towards the drop arm barrier on Riverside Drive.
It is not clear how the car ended up in the storm water ditch adjacent to the barrier, but initial information was that some Australian forces some 100 metres from the scene rushed there first and engaged the terrorists.
By then, the terrorist had thrown a hand grenade towards some escaping guards and it landed at the left side of a parked Toyota Yaris, KBL 471N, the flying shrapnel deflating its tyre but causing little damage.
“They only had grenades but we have not seen any VBIED (Vehicle Borne Improvised Explosive Device),” a security official told the Nation.
As the alarms set off at just about 2.30pm, the four terrorists shot their way into the compound past the second barrier where they hurled more grenades towards a taxi bay, setting three cars on fire.
By this time, security from the adjacent Australian embassy had responded, at first thinking it was a bank robbery at the I&M Bank, which is within the complex.
CCTV footage captures four terrorists trying to gain entry into the offices, but are frustrated by the locked steel doors.
They then head towards the restaurant where one of the terrorists blows himself up at Secret Garden Restaurant killing several people.
“Why are you killing our brothers and sisters in Somalia?” one of the attackers is alleged to have asked before shooting.
Within minutes, DusitD2 was swarming with security details, who were swiftly mobilised and led by GSU commandant Douglas Kanja, DCI director George Kinoti and Flying Squad commander Musa Yego.
The game changer was the Recce squad, a special unit that stormed the building pushing the terrorists to the upper floors, where they had been frustrated by the steel doors and bulletproof windows in some of the offices.
Unknown to the terrorists, DusitD2 is akin to a fortress where doors can only be opened using passwords.
Security officers say these barriers saved many of the more than 700 DusitD2 complex workers, who were later rescued.
Initial footage showed some of the terrorists trying to shoot some of the glass doors without success, before going down to the restaurant.