Devon Knudsen says: “It’s likely that there will be more attacks of a similar scale before Nairobi’s soft targets can make necessary security improvements.”

Media commentary on the now-concluded siege of the Westgate mall in Nairobi demonstrates widespread recognition that a major shift has occurred in al Shabaab’s targets and threat-level. Where the media seems to slightly misinterpret the attack is explaining Westgate as a sudden dramatic increase in al Shabaab’s abilities. More than a dramatic jump in capacity, the attack shows a change in focus and motivation by al Shabaab’s core planners.

It’s likely that there will be more attacks of a similar scale before Nairobi’s soft targets can make necessary security improvements. Larger-scale attacks affecting more influential political constituencies would have major political and economic repercussions at a time when Kenya is already struggling to balance tensions from the past two elections, major constitutional changes, and economic crises. In turn this would jeopardize decades of public and private investment in the Horn, as well as recent democratic consolidation. It’s therefore imperative to try to understand the full implications of this shift.

Until the Westgate attack, sites targeted by al Shabaab in Kenya could largely be grouped into four categories: sites with a religious affiliation, such as the April 2012 attack against a church in Nairobi or the twin church attacks in Garissa three months later; attacks against night clubs, such as the May 2012 Bella Vista attacks in Mombasa, and June 2012 beer garden attacks in the same city; attacks against police officers and soldiers, especially near the Kenyan border with Somalia; and attacks in Nairobi against sites with almost no symbolic value and little to no security.

This tells us several things. For one, elements within al Shabaab already possessed some moderately advanced attack capacity, and used it in Somalia as well as against defense personnel In Kenya. At the same time, other attacks were low risk and required little sophistication to carry out, and the perpetrators still seemed to struggle and make mistakes. Some claim these smaller attacks were carried out by amateur affiliates, such as al Hijra, which grew out of the Muslim Youth Center, or al Shabaab admirers who had, at most, tenuous connections to its leadership.

Another important thing to note is that all of the attacks since the 1998 embassy bombings had few casualties and had some, but limited, impact on Kenyan politics or the economy. These attacks also arguably weren’t “˜successes’ for al Shabaab, and provoked criticism from within the group itself as well as from communities which had previously supported the organization. There was considerable discussion of how the group was failing. It seemed evident that the era of high-stakes attacks in Nairobi carried out by Al Qaeda over a decade ago was long over.

So what changed? Al Shabaab has recently undergone dramatic changes.  The group has seen splits and changes in leadership, including Ahmed Abdi Godane’s consolidation of power. These developments are related to the strengthening of relations with al Qaeda as well as major military, territorial and outreach setbacks which some argue give al Shabaab a more urgent desire to focus more on Kenya.

If these developments caused al Shabaab’s leadership, or at least the most sophisticated entities within al Shabaab, to want to put real pressure on the Kenyan government to end its military interventions in Somalia, they would need to change their strategy. The kinds of attacks seen prior to Westgate wouldn’t have achieved that objective.

The Kenyan government doesn’t have a very active track record of responding to security threats affecting economically disempowered sections of its population, or even its police officers and lower ranking member of the armed forces. Unsurprisingly, al Shabaab’s earlier attacks elicited no governmental concessions. That has all changed. Considering the extent to which Nairobi functions as a hub for the international community, Westgate is not a top-level target. Despite what some commentators are saying, it was not the most secured, most cosmopolitan, or most ostentatious of Nairobi’s many upscale malls. Nevertheless, the attack sufficed in getting the government’s attention. President Uhuru Kenyatta’s nephew and sister were both in Westgate when the attack started, and the latter died in the attack.  The government immediately responded with incentives to al Shabaab to participate in talks.

If al Shabaab’s leader Ahmed Abdi Godane is to be believed, we can likely expect more attempts at large-scale attacks. It’s going to be especially difficult for Nairobi to defend itself against these attacks for several reasons. For one, Nairobi is largely unprepared. For years, western governments have been warning their citizens in the city of possible attacks against upscale malls or anywhere that foreigners congregate in large numbers, but after years of limited-reach attacks, most moderately high-end facilities were taking a similarly limited approach to their own security. Following the 1998 bombing, the US government had invested heavily in the security of its embassy and aid agency, and the UN had followed suit, but many other foreign government entities remain relatively exposed. It is easy to find buildings that have security guards at some entrances but not all. At times metal detectors are broken or switched-off.

Secondly, from the information currently available, it looks like the Westgate attack had two parts, one of which required high levels of planning and coordination, and one which was relatively rudimentary. Kenyan intelligence officers reported that al Shabaab members or affiliates had acquired space in the mall for perhaps up to eight months in advance. There have been some conflicting reports on the use of explosives in the attacks, but the main explanation for why the Kenyan forces waited so long before pursuing the terrorists inside the mall is that the attackers had planned to lure high numbers of soldiers into the mall and then detonate explosives they had stored in the rented space. This ended up not happening.

What did happen was fairly simple: the attackers gained access to the mall by storming a back entrance, where the security guard or guards present were unable to stop them. They then used guns and grenades to take hostages and then used the hostages to manipulate events outside the mall. If this is an accurate understanding of the attack, it implies that al Shabaab could carry out large attacks without the kind of sophistication seen in some al Qaeda operations elsewhere. When you put these two points together, it means that now that al Shabaab has shown that it wants to carry out large scale attacks against major targets in Nairobi, there is a great risk of them being able to do so in a wide array of locations. In addition to unacceptable human casualties, a series of major attacks would have devastating implications for Kenya’s economy and democratic transition as well as regional stability. A better understanding of al Shabaab’s plans and a more practical foreign policy approach to region both need to be global priorities.

 Devon Knudsen works on the Horn of Africa for the Africa Center for Strategic Studies.  The views expressed in this article are entirely her own.