Norwegian police are facing questions over how they lost track of a Somalia-born immigrant identified as one of the Nairobi shopping mall suspects after it was claimed he had been under surveillance several years ago.
Hassan Abdi Dhuhulow, a 23-year-old former high school student in Larvik, south of Oslo, was identified by friends as one of the suspected gunmen caught in new CCTV footage of last month's atrocity.
He was the first of the suspects to be named, although it remained unclear whether he had been killed in the siege or managed to escape.
Dhuhulow, a football-loving Chelsea fan once pictured wearing the team's strip, disappeared from Norway after leaving school in 2009. He is then believed to have joined al-Shabab, the Somali extremist group that carried out the Nairobi attack.
On Friday it was claimed Dhuhulow had been on the radar of the police services in 2007 after posting on Somali internet forums. He was also arrested by the Somali authorities last year over the murder of a radio journalist, but released due to a lack of evidence.
Norwegian police said they had "strong suspicions" the nation's citizens were among the perpetrators of the Nairobi massacre after they sent investigators to Kenya last week.
Officials said Dhuhulow had arrived in Norway in 1999 with his father and five siblings after his mother was killed in Somalia's conflict. He apparently became disillusioned with Western life and from 2006 began frequenting forums linked to Islamic radicals.
"I used to look over his shoulder at school and he was always on mysterious sites with languages I couldn't understand," a former classmate said. "One day I asked him what the page was about and he replied it was a guide to killing American soldiers."
Another former pupil said he had changed in his teens when he embraced religion and started wearing robes and a skull cap. He would also take a prayer mat to school.
Channel TV2 reported on Friday that the Norwegian Police Security Service had begun tracking Dhuhulow's online activities from 2007, saying "the man was under surveillance over time because of his internet activities and his contacts".
A expert on al-Shabab in Kenya said that after leaving Norway for Somalia in 2009, Dhuhulow joined a small group of trained fighters chosen to carry out targeted killings of al-Shabab's enemies. He allegedly had a reputation as a marksman.
Last year Somali authorities arrested him on suspicion of assassinating Hassan Yusuf Absuge, a radio journalist, in Mogadishu, but he was cleared.
"There was no evidence to link Dhuhulow to that killing, but we were aware that he was an important man among the Shabab and he should have been watched," said the source, who works with Somali officials. "He was allowed to disappear. I hear that he went towards Kismayo [a port city in southern Somalia] but there was no record of him from then until we saw the reports from Westgate."
Chief pathologist Johansen Oduor said remains believed to belong to three of the attackers had been removed from the rubble on Thursday and taken to the Nairobi City Mortuary, but that identification would likely require advanced forensics including DNA testing.
The remains were recovered next to AK-47 rifles. Kenyan security forces do not use that make of rifle.