The masked gunmen who infiltrated Nairobi's Westgate mall arrived with a set of religious trivia questions: As terrified civilians hid in toilet stalls, behind mannequins, in ventilation shafts and underneath food court tables, the assailants began a high-stakes game of 20 Questions to separate Muslims from those they consider infidels.
A 14-year-old boy saved himself by jumping off the mall's roof, after learning from friends inside that they were quizzed on names of the Prophet Muhammad's relatives. A Jewish man scribbled a Quranic scripture on his hand to memorize, after hearing the terrorists were asking captives to recite specific verses. Numerous survivors described how the attackers from al-Shabab, a Somali cell which recently joined Al Qaeda, shot people who failed to provide the correct answers.
Their chilling accounts, combined with internal al-Shabab documents discovered earlier this year by The Associated Press, mark the final notch in a transformation within the global terror network, which began to rethink its approach after its setbacks in Iraq. Al Qaeda has since realized that the indiscriminate killing of Muslims is a strategic liability, and hopes instead to create a schism between Muslims and everyone else, whom they consider "kuffar," or apostates.
"What this shows is Al Qaeda's acknowledgment that the huge masses of Muslims they have killed is an enormous PR problem within the audience they are trying to reach," said Daveed Gartenstein-Ross, director of the Center for the Study of Terrorist Radicalization. "This is a problem they had documented and noticed going back to at least Iraq. And now we see al-Qaida groups are really taking efforts to address it."
The evolution of al-Shabab is reflected in a set of three documents believed to be written by the terrorist group, and found by the AP in northern Mali earlier this year. They include the minutes of a conference of 85 Islamic scholars, held in December 2011 in Somalia, as well as a summary of fatwas they issued last year after acceptance into the Al Qaeda fold.
Baptized with the name al-Shabab, meaning The Youth, in 2006, the group began as an extremist militia, fighting the government of Somalia. As early as 2009, it began courting Al Qaeda, issuing recordings with titles like, "At Your Service Osama."
Until the Westgate attack, the group made no effort to spare Muslim civilians, hitting packed restaurants, bus stations and a government building where hundreds of students were awaiting test results. And until his death in 2011, Osama bin Laden refused to allow Shabab into the Al Qaeda network, according to letters retrieved from his safehouse in Pakistan. The letters show that the terror leader was increasingly troubled by regional jihadi operations killing Muslim civilians.
In a letter to Shabab in 2010, bin Laden politely advised the Somali-based fighters to review their operations "in order to minimize the toll to Muslims." Shabab did not get the green light to join Al Qaeda until February 2012, almost a year after bin Laden's death.
In an email exchange this week with The Associated Press, it made its intentions clear: "The Mujahideen carried out a meticulous vetting process at the mall and have taken every possible precaution to separate the Muslims from the Kuffar before carrying out their attack." However, even at Westgate, al-Shabab still killed Muslims, who were among the more than 60 civilians gunned down inside.
Their attack was timed to coincide with the highest traffic at the upscale mall after 12:30 p.m. on Sept. 21, a Saturday. More than 1,000 people, including diplomats, pregnant women with strollers and foreign couples, were inside when the fighters armed with grenades and AK-47s burst in and opened fire. At first the attack had the indiscriminate character of all of Shabab's previous assaults.
Rutvik Patel, 14, was in the aisles at Nakumatt, the mall's supermarket which sells everything from plasma TVs to imported kiwis, when he heard the first explosion. "They started shooting continuously, and whoever died, died," he said. "Then it became calm and they came up to people and began asking them some questions. If you knew the answer, they let you go," he said. "They asked the name of the Prophet's mom. They asked them to sing a religious verse."
Just across from the Nakumatt supermarket, a 31-year-old Jewish businessman was cashing a check inside the local Barclays branch when he, too, heard the shooting. The people there ran to the back and shut themselves in the room with the safe, switching off the lights. They learned, via text messages, that the extremists were asking people to recite an Arabic prayer called the Shahada.
"One of the women who was with us got a text from her husband saying, they're asking people to say the Islamic oath, and if you don't know it, they kill you," said the businessman, who insisted on anonymity out of fear for his safety.
He threw away his passport. Then he downloaded the Arabic prayer and wrote it on his palm.
Al-Shabab's attempts to identify Muslims are clear in the 16-page transcript from the conference of Islamic scholars held in the Somali town of Baidoa, an area known to be under Shabab control in 2011, according to Somalia specialist Kenneth Menkhaus, a political science professor at Davidson College in North Carolina. The scholars issued several fatwas defining exactly who was a Muslim and who was an apostate.
The document states it is halal, or lawful, to kill and rob those who commit crimes against Islam: "The French and the English are to be treated equally: Their blood and their money are halal wherever they may be. No Muslim in any part of the world may cooperate with them in any way. ... It leads to apostasy and expulsion from Islam," it says. Further on it adds: "Accordingly, Ethiopians, Kenyans, Ugandans and Burundians are just like the English and the French because they have invaded the Islamic country of Somalia."
Former FBI supervisory special agent Ali Soufan, who investigated the bombing of the United States embassies in East Africa as well as the attack on the USS Cole, said that the gathering of dozens of religious scholars in an area under Shabab control harkens back to an Al Qaeda conference in Afghanistan around 1997. That conference defined America as a target, Soufan said, leading to the bombing of American embassies in Kenya and Tanzania in 1998.
"You see something very similar here," said Soufan. "It's the same playbook."
In a second document dated Feb. 29, 2012 -- just two weeks after al-Shabab joins Al Qaeda -- the organization warns Muslims to stay away from buildings occupied by non-Muslims, chillingly predicting and justifying the death of Muslims at Westgate.
"And so all Muslims must stay far away from the enemy and their installations so as not to become human shields for them, and so as not to be hurt by the blows of the mujahedeen directed at the Crusader enemies," it says. "There is no excuse for those who live or mingle with the enemies in their locations."
Yet at the same time it says: "The mujahideen are sincere in wanting to spare the blood of their brother Muslims, and they don't want a Muslim to die from the bullets directed at the enemies of God."
This is a concession for an organization that since its inception had killed people constantly, said Rudolph Atallah, who tracked Shabab as Africa counterterrorism director in the Office of the Secretary of Defense from 2003 to 2007.
"They would just go and mow people down," Atallah said. "They are now sending a clear message that, 'Look, we're different ... We're no longer indiscriminately killing. We're protecting innocent Muslims and we are trying to kill quote-unquote 'infidels,' nonbelievers."
A similar tactic paid off in January after Al Qaeda-linked terrorist Moktar Belmoktar attacked a gas installation in Algeria, Atallah said. When his fighters freed hundreds of Muslim employees, a Facebook page dedicated to him exploded with "Likes."
Several hours after the gunshots at Westgate Mall, the people cowering inside the Barclays bank heard a commotion. As the attackers approached, the Jewish businessman spit on his hand to erase the words he had by then committed to memory.
The door opened.
He exhaled. It was the police.
Several floors above, 14-year-old Patel looked for a place to hide on the roof. When the jihadists came up the stairs and threw a grenade, he didn't hesitate. He jumped, crushing his ankle on the pavement below.
He said he would not have known how to answer their questions.