The Islamist militant attack on a Kenyan shopping mall increasingly appears to have been carried out by a dominant faction of al Shabaab, which has ideological and personal ties to al Qaeda, U.S. officials said on Thursday.
Based on initial reporting from the scene, which is still preliminary and uncertain, U.S. officials believe al Shabaab likely spent a great deal of time planning and staging the siege in Nairobi that killed at least 72 people.
Officials say, for example, the Islamist militants may have moved a large machine gun and supplies of ammunition into place somewhere inside the mall days or weeks before the attack - perhaps by renting a shop or secretly using space provided by a sympathetic shop owner or employee.
The attack has highlighted the reach of al Shabaab and its sharpening focus on targets outside of Somalia, the officials said.
U.S. officials say they don't believe Shabaab currently presents a threat to the U.S. mainland but does threaten U.S. interests in countries near Somalia.
Militants in June attacked a U.N. compound in Mogadishu, leaving 22 people dead, including the attackers. In July, the group claimed a car bomb attack on the Turkish mission in Mogadishu that killed three people.
Al Shabaab's first signature strike abroad came in 2010 when coordinated explosions killed more than 70 people in the Ugandan capital Kampala on the night of the World Cup soccer final. The group said the attack was to avenge the deployment of Ugandan peacekeepers in Somalia.
This type of targeting is further evidence of its shift in strategy following its loss of urban territory and revenue streams in Somalia over the past several years that weakened militant leaders, the officials said.
It is also evidence that leadership has further consolidated around Ahmed Godane, also known as Mukhtar Abu al-Zubayr, after a series of factional disputes inside the organization saw other leaders pushed aside and killed. American drone strikes also thinned their ranks.
Al Shabaab formally became part of al Qaeda in 2012, with Godane pledging his allegiance in a joint video with al Qaeda leader Ayman al-Zawahri.
"Now you see Godane kind of capitalizing on that, saying this is what we're doing to further the al Qaeda agenda," a U.S. defense official said, speaking on condition of anonymity.
In an audio posted on Wednesday night, Godane said the attack on the mall was in retaliation for Kenya's incursion in October 2011 into southern Somalia to crush the insurgents.
"Take your troops out or prepare for a long-lasting war, blood, destruction and evacuation," Godane said in the message.
The sophistication of the attack has led U.S. officials to speculate that either al Shabaab has become much more capable than previously thought, very quickly, or perhaps it has benefited from direct financial or personnel support from al Qaeda as Godane seeks to rebrand the organization as a significant international jihadist group.
U.S. officials have acknowledged uncertainty regarding key details of the attack, including whether U.S. or British citizens or residents were involved. U.S. officials said on Thursday there was no hard evidence yet demonstrating the involvement of U.S. citizens or residents in the attack.
Some officials said it was looking less likely than it was a couple of days ago, but cautioned the possibility could not be completely ruled out.
U.S. and European officials said they still don't know what to make of eyewitness accounts from attack victims describing a Caucasian woman giving instructions to the attackers. This led to a flood of speculation that they were referring to Samantha Lewthwaite, the widow of one of the militants who attacked the London subway system on July 7, 2005.
But U.S. and European officials said they have seen no evidence proving her involvement.
Al Shabaab spokesman Sheikh Ali Mohamud Rage told Reuters the gunmen who burst into the Israeli-built, upscale Westgate mall around midday on Saturday were "well-trained special forces." Their exact identity, though, remains unknown.
A Nairobi-based diplomat said it was possible Godane's own secret service, the Amniyat, an elite unit which has its own chain of command, logistics network and financial resources, carried out the raid.