Detectives investigating the Dusit complex attack are racing against time to piece together a watertight case against the accused of the first batch of suspects expected back in court on Thursday.
More than 10 suspects who were arrested in different parts of the country are being held in connection with the 20-hour siege that left 21 people dead.
Police are also in pursuit of more suspects linked to the attack some of whom are believed to have crossed the Kenyan border into Somalia.
Those that are believed to have sneaked into Somalia are Hussein Aden Hussein alias Etto, Dido Muhammed Fugicha and Hussein Aden Hussein.
Those in police custody have been identified as Oliver Kanyago Muthee, Joel Ng’ang’a Wainaina, Ms Gladys Kaari Justus who runs an M-Pesa shop in Maua, Meru County, Guleid Abdihakim and a Canadian identified as Osma Ibrahim who will be in police custody until February 18, 2019.
Others are George Ndung’u, Mukhtar Ibrahim, Isaac Hussein and Sakina Abdalla, Ibrahim Ali Buyo, Aden Hassan and Mohamed Abdirahman Abdalla.
On Tuesday, police arrested Hassan Abdi on Waiyaki Way in Nairobi. Police believe he helped to fund the attack. He was in possession of millions of shillings. The money was sent from South Africa and Abdi was to distribute it among several individuals who police believe are terrorists in Somalia.
“At some point, he received Sh9 million from South Africa which he withdrew through one M-Pesa till number and a bank in Eastleigh,” investigators revealed.
It also emerged that Abdi had registered 52 SIM cards, 47 of them between the months of October, November and December.
Investigators revealed that the 47 SIM cards were “registered using different identity cards and names and were only being used on two handsets that were traced to Eastleigh.” The police narrative is that he withdrew the money at the bank in Eastleigh that saw the manager, Ms Sophia Njoki Mbogo, arrested.
Ms Mbogo has denied the allegations raised against her and told Senior Principal Magistrate Martha Mutuku that she has never dealt with any of the terrorism suspects either personally or professionally.
Police say she allowed huge amounts of money to be withdrawn via the bank without raising the alarm.
Another individual who is in police custody and is believed to have been in constant communication with the main suspect, Salim Gichunge, who was killed during the attack, and his wife Ms Violet Kemunto, is Ismael Sadiq Ibrahim.
“His phone was actively used to send money to the attackers and we believe it was meant to fund terrorism,” police said, adding that they need to obtain all his financial records. Abdinoor Maalim Osmail, a lawyer, is the other suspect who police believe received Sh100 million in a period of three months.
Police say that the money was used to actively fund terrorism.
“He has also registered several mobile phones that were used to receive money for terrorism purposes,” police said.
Another suspect who is still being grilled by investigators is Abdullahi Muhumed Hassan, who is also said to have received and made calls that were linked to terrorism activities.
His call records, according to investigators, reveal that he was also in constant communication with Faisal Mohammed, who was involved in the Garissa University attack. All these details, according to the sleuths, were obtained after two phones believed to belong to Gichunge were found in the car that ferried the terrorists to the scene of crime.
Gichunge is believed to have registered four mobile phones while his wife had registered six.
This week, the prosecution, in a sworn affidavit, asked the court to give it more time to analyse data on the items that were in their possession.
“Going by the issues raised herein and the leads being followed up by the team of investigators, the respondents are a flight risk and should thus remain in custody pending investigations being carried out on their possible illegal criminal activities,” read part of the affidavit.
The police are working to establish whether some staff at the Dusit complex were involved in planning and executing the attack.