Al-Shabab showed gruesome social media savvy during attack

PARIS As the deadly attack unfolded inside Kenya's Westgate mall, the militants who claimed responsibility for the spreading mayhem sent out tweet after tweet, taunting the Kenyan military, defending the mass killings and threatening more bloodshed.

Each time Twitter shut the account down - a total of five times, according to a U.S.-based security analyst - al-Shabab started a new feed. The sixth account included a post on Tuesday linking to a photo that purported to be two of the attackers "unruffled and strolling around the mall in such sangfroid manner" and mocking Kenya's security forces for their repeated assurances over two days - also tweeted - that the siege was nearly over.

It wasn't the first time al-Shabab has live-tweeted a terrorist attack, according to J.M. Berger, a U.S. based terrorism analyst who monitors the group's online presence. The militants offered comments in real time or nearly so in recent attacks in Mogadishu and the attempted assassination of the Somali president. But the drawn out Kenya attack, which left dozens dead, brought the group to a much wider stage, amplified by its social media savvy.

"The person who runs their Twitter account has obviously invested a lot of energy in the process of grabbing headlines, and for Shabab, the account allows them to amplify the message that they wish to send with the attack itself," Berger told The Associated Press.

The al-Shabab message, at least according to the tweets, appeared directed at the international community and Kenya specifically to leave Somalia to the militant Islamic group. But there may been a broader message, analysts say:Al-Shabab has allied itself with al-Qaeda's global message and its global war.

Berger, who has called out al-Shabab before for violating Twitter's terms of service, did so again after the attack began on Saturday, announced by gunshots, grenades and the group's chosen hashtag #Westgate. The account was closed. A new feed opened, the handle sent to journalists on the al-Shabab email list, with crisp assurances tweeted back to users who requested their names be added.

But as the death toll rose - and images were broadcast worldwide of the terror, which included a bloodied woman and terrified children, the group found itself roundly condemned - the tweets became more defensive: "Mujahideen have no desire to kill women & children and have done everything practically possible to evacuate them before attacking #Westgate."

The communications onslaught, which included back and forth tweets with Kenya's security forces, had police at one point appealing to "all Kenyans to ignore the propaganda of those intent of dividing us and breaking us down."

Interestingly, the group's message in the Somali language social media was slightly different - and tailored to a more domestic audience than the largely English-language Twitter feeds, said Cedric Barnes, a Nairobi-based analyst for Crisis Group.

"Part of the reason might be to align itself more with the international struggle rather than the Somali-centric war," Barnes said. The attack and propaganda efforts show "how sophisticated Shabab is but also some of the networks that assisted in this. It's incredibly cynical but quite deliberate."

• Kenyan president: Terrorists defeated, more bodies trapped in rubble
• Kenya attacker reportedly freed boy who called him "a very bad man"
• Kenya says mall attackers included "two or three" Americans

Twitter has not explained why it shut down the accounts, but it prohibits "direct, specific threats of violence against others." The Washington-based SITE Intelligence Group, which monitors jihadist websites, said al-Shabab had been closed down five times, with the sixth account opening Tuesday - a tally that roughly coincided with AP's count of recent shutdowns of their account.

But if al-Shabab was having a hard time staying ahead of email and Twitter administrators, Kenya's government was having at least as hard a time with its own message.

"They've really been a model for poor crisis communication. Shabab was further able to sap their credibility by undermining their claims," said Daveed Gartenstein Ross, an al-Shabab expert with the Washington-based Foundation for Defense of Democracies.

Gartenstein Ross drew parallels with the 2008 terror attack in Mumbai, India, which lasted three days and - nearly as long as the one in Kenya - unfolded before the eyes of millions of television viewers. In that case, 10 gunmen laid siege to India's financial hub, leaving 166 people dead and a host of questions about their motives and identities.

A more recent parallel is the dayslong hostage taking at an Algerian gas plant in January, when Islamic militants linked to al Qaeda broadcast real-time accounts of what was happening inside via a Mauritanian news service known for ties to the group. In that case - as in Kenya - the militants' account ended up being more open than the Algerian government's reassurance's and downplaying of the death toll, which climbed to more than three dozen hostages in the four-day standoff.

Al-Shabab is a different, more aggressively public organization, analysts say. Its militants eagerly claimed responsibility in Kenya as they have for multiple attacks in Somalia, their base. The fear that spread across Nairobi - as well as al-Shabab's decision to go public immediately - was calculated by a group whose name means "The Youth" in Arabic.

An extremist Islamic terrorist force that grew out of the anarchy that crippled Somalia after warlords ousted a longtime dictator in 1991, al-Shabab is estimated to have several thousand fighters, including a few hundred foreigners, among them militants from the Middle East with experience in the Iraq and Afghanistan conflicts. Others are young, raw recruits from Somali communities in the United States and Europe.

Al-Shabab said the mall attack was in retribution for Kenyan forces' 2011 push into neighboring Somalia. African Union forces pushed the al-Qaeda-affiliated group out of Somalia's capital in 2011.

"As an operation itself, it caused chaos, it's made the Kenyans look bad, it's inflicted a cost upon the civilian population. They got their message out to the world for several days," Gartenstein Ross said.

He said it would be appropriate if Twitter continued to shut down al-Shabab, an opinion not shared by everyone in intelligence community, which values many public communications as insight into terror groups. But he said it came with costs.

After the first few times the account was shut down, a series of fake Twitter feeds sprang up, all purporting to be speaking for al-Shabab and carrying false information about the attack. That added to confusion in the first two days of the siege, but Gartenstein Ross said neither al-Shabab nor Twitter was to blame, emphasizing that people need to become more discriminating about their social media sources.

"It's not like there's a natural right to having a Twitter feed again. When you become a mass murderer, you forsake some rights. Perhaps having a Twitter feed is one of those," he said.

Berger, whose own efforts to troll al Qaeda and keep terror groups from posting threats have gotten some attention in the recent past, said there are good reasons to take them down this time around.

"By knocking them down over and over again, Twitter kept them from collecting many thousands of followers that it would have kept for the long haul. It is likely impossible and possibly undesirable to permanently deny them the use of services like Twitter," he wrote in an email exchange with The Associated Press. "But there are good reasons to weed a garden, even if we can never fully eradicate weeds."