Bowden read in Petit’s incident report that the UN staffer had recognized one of the raid commanders as Hassan Derow, the regional head of security for al-Shabaab, and another as the district head of security. But the young man executing the expulsion orders was a stranger. Petit also identified an unfamiliar “man in blue,” a black African dressed in an electric blue polo shirt, the only participant in the raid whose behavior was overtly hostile.

According to Petit, the man in blue differed from the other Shabaab commanders. He was not in uniform but was completely masked; at times he carried a Kalashnikov on his back. He commanded a nervous deference from the other militiamen. He spoke some English, and he demanded to know Petit’s nationality. He acted as an enforcer, making sure Petit and the FSCO did not communicate with Nairobi, and he insisted Petit always sit in his presence, as though he had recently received training in hostage management.

It seemed to Petit that the Baidoa raid was being directed by high-ranking authorities outside the compound, people he did not know. Unable to reach Sheikh Robow during the raid, Petit had wondered about the sheikh’s standing. Petit did not recognize the name of the Shabaab governor who had signed the expulsion order, and the raid commanders had made at least two lengthy calls to someone outside the compound seeking instructions after learning that all UN international staff would have to leave.

TRU assessments . Additional interpretation came from New York. On Monday, the day of the raid, the Threat and Risk Assessment Unit (TRU), a section of UNDSS at UN headquarters in New York had delivered an early assessment. Jean Lausberg, the Nairobi-based Chief Security Advisor (CSA) and head of the Security Management Team in Somalia, forwarded the report to Bowden and other UN Somalia team members.

TRU had analyzed the al-Shabaab expulsion orders, along with its public communiqué, and judged them the work of hardliners within the Shabaab movement who in the past had denounced UNDP, UNPOS, the United States and the African Union. UNDSS was new to the list. Citing linguistic evidence, the TRU analysts adduced a likely al-Qaeda influence. In a background section, they underscored connections between al-Shabaab and al-Qaeda, also noting the presence of “foreign extremists” in Shabaab leadership ranks. The analysts also confirmed that Sheikh Robow had recently lost his national leadership position. ^[33]

On Wednesday afternoon, TRU issued an update on the communiqué. They reported that it may have been drafted first in classical Arabic, and then translated into Somali, increasing the likelihood that the raid had been directed by foreign entities within al-Shabaab. Moreover, the UN had learned that the communiqué had been disseminated through jihadist forums controlled by Ayman al-Zawahiri, who was then al-Qaeda’s second in command.

CSA Lausberg highlighted TRU’s observation that “in view of disintegrated command and control structure within Al-Shabaab and continuing internal power struggle within its ranks, it is difficult to rely on any forms of agreement with individual Al Shabab local components since this can be either overruled by Al-Shabaab core or disrespected by its regional branches.”Lausberg agreed. In his view, the more moderate, Robow-led Shabaab faction that previously controlled Baidoa had been “overruled” by hardliners.