Posts Tagged ‘lone actors’

A longer essay this morning in the Observer looking at the impact of the murder of Lee Rigby on the face of terrorism five years on from when it looks place. Some reactions on twitter already, look forward to hearing more people’s thoughts (feel free to contact through comments or the contact page). I am careful about saying that this is the harbinger of the end in the conclusion of the piece, as it could be for this expression, though as I have written elsewhere, it is depressingly likely that things will evolve in other ideological directions.

How Lee Rigby’s murder changed the face of terror

Lee Rigby memory

The murder of Lee Rigby five years ago ushered in a wave of ‘easy’ extremist violence. But will such random acts result in radical Islam losing its malign ideological power?

by 

Just under five years ago, two men ran down and then butchered with knives Fusilier Lee Rigby as he walked back to his barracks in Woolwich, south London. Still covered in Rigby’s blood, the older of the two men calmly spoke to the cameraphones of those nearby, justifying his act, declaring it revenge for atrocities in “Muslim lands”. Armed police arrived soon afterwards, shooting the attackers and detaining them. But their act had already been memorialised and continues to resonate half a decade later.

Rigby’s murder was not the first time knives had been used in a violent Islamist act in the United Kingdom. In one example, three years earlier, a young east Londoner called Roshonara Choudhry walked into her MP’s constituency surgery and stabbed him, in revenge, she said, for voting for the war in Iraq. Stephen Timms survived his attack and the act was so strange at the time that it took quite a while for people properly to realise what had happened.

Terrorist groups had been urging such attacks for some time. Al-Qaida’s English-language magazine, Inspire, called for people to carry out such acts regularly under the title of “just do it” terrorism. It had been particularly proud of Choudhry’s act, highlighting how a woman had been stepping up to carry out acts that men, as the magazine put it, were failing to do.

But the important difference is that these previous acts had not “worked” – as in resulted in death. In contrast, Rigby’s murder was public, brutal and recorded for posterity. Shocking in its nature, it seemed a very different terrorist attack to those that we had been used to: such as the coordinated operations of 9/11 or 7/7 or the team of marauding gunmen who executed the Mumbai attack in 2008.

Yet, as time passes, it is clear that Rigby’s murder has had a substantial impact on the terrorist threat picture in the UK and around the world. It was the most public terrorist knife attack and it became something of a model. In the UK alone, at least 16 plots or incidents took place afterwards in which bladed weapons were either used or planned to be used.

The transmission of terrorist ideas and methodology is something that is hard to track precisely. But in the first instance, a public “success” such as this will breed emulation. This was most clearly visible in the immediate wake of the attack in two incidents. A few days after the murder in Woolwich, Alexandre Dhaussy, a French recent convert to Islam known to authorities for his radical views and petty criminal activity, stabbed a soldier in the neck as he patrolled in La Défense in Paris. A week later, after an imam called for prayers for Rigby’s family during a service at HMP Full Sutton in east Yorkshire, a group of radicalised prisoners kidnapped a guard, called for the release of other extremists and tried to take over part of the prison. In both cases, questions were asked about the degree of ideological commitment of the attackers, but it seems clear that their action was in part inspired by the murder of Rigby.

People leave the London Bridge area with their hands up after the 2017 terrorist attack
 People leave the London Bridge area with their hands up after the 2017 terrorist attack. Photograph: Neil Hall/Reuters

In the longer term, the Woolwich action and imagery provided people with an example to copy and perceived heroic figures to follow. Almost a year later, Brusthom Ziamani, a confused young man who had moved in (now banned) al-Muhajiroun circles and looked up to Adebolajo as an older brother – he described him to his girlfriend as a “legend” – was arrested by authorities as he went to carry out an attack similar to that of his idol.

For others, the act lives on in imagery and legend. Nadir Syed, another al-Muhajiroun extremist who was later convicted of planning a knife attackagainst authority figures, was found to have shared images of Rigby’s killers among his friends on social media.

On the other side of the ideological spectrum, in January 2015, Zack Davies started hacking at a South Asian man he saw in a Tesco supermarket in Mold, Wales, shouting “white power” and saying that he was undertaking the attack in revenge for Rigby. Later investigation showed he was an isolated and paranoid young man who was obsessed with the far right.

The drama of the act is transmitted through the media, which help magnify it and give it resonance. This brings it to others’ attention and gives them a sense of great acts of history at play. In the longer term, it generates a wealth of imagery that can be used and manipulated by groups to show the message they are advancing.

Ultimately, the key thing the Rigby murder showed was that there was no need to overcomplicate the terrorist act. Rather than build a bomb, go to a training camp in a far-off land, source expensive and elusive weapons or gather a large network of people, you could conduct a highly effective terrorist attack using tools sitting in your kitchen and your car.

Rigby’s murderers Michael Adebolajo and Michael Adebowale were, in fact, committed and long-term extremists connected to the al-Muhajiroun network in the UK. They were linked to a group of British extremists in Yemen alongside the radical Islamist Anwar al-Awlaki (the preacher whose videos inspired Choudhry, she claimed, to attempt to kill Timms). Adebolajo was arrested in November 2010in Kenya trying to get into Somalia to join the militant al-Shabaab group. He had first appeared on security services’ radars in mid-2008 on the fringes of a network linked to individuals who were trying to obtain material to conduct a terrorist attack and had been in direct contact with core al-Qaida; he had in fact been active in the al-Muhajiroun community as early as 2003 when he was only 19.

Adebowale, the junior in the partnership, had a similar history. He was first investigated by MI5 in 2011, but is known to have had contact with a “subject of interest” to the security service as early as 2009. At the time, he was just coming out of a young offender institution where he had been incarcerated on narcotics charges. Leaving prison, he was reported to be wearing Islamic robes and had adopted a more hardline Islamist ideology. He then joined in the constant churn of activism that marks al-Muhajiroun, showing up at protests, attending events, shouting for cameras.

So while they might have been two jihadist drifters, they nevertheless managed to carry out a terrorist act that captured attention and set a new example. We still do not know the degree to which they were talking to others about doing this, but it does not completely matter. They were committed, long-term extremists who decided to act in a way that they could and, in the process, they changed the dynamic of how we saw terrorism and terrorist acts.

The UK had not experienced a successful violent Islamist terrorist attack since the 2005 bombings on London’s public transport system. Repeated cells had been disrupted, including the 2006 airlines plot, which would have probably killed more than the 9/11 attacks had it succeeded in bringing down up to eight airlines on transatlantic routes. In 2007, a double car bombing in the heart of London was thwarted (two bombs were discovered and disabled), as was a subsequent vehicle-borne explosive device at Glasgow international airport.

The pattern still seemed to be for terrorists to want to achieve large-scale spectaculars that brought mass casualties or caused massive economic damage.

This was not true across the ideological spectrum. Shortly before the Rigby attack, an elderly Muslim man had been stabbed and killed in Birmingham. At the time, it was not clear what had taken place in the murder of Mohammed Saleem. It later turned out to have been the act of a lone far-right extremist from Ukraine, Pavlo Lapshyn, who had arrived in the UK on a scholarship only five days earlier and set off on a one-man terror campaign. But after this stabbing, Lapshyn reverted to what he seemed to really enjoy doing and set off a series of bombs outside mosques in the West Midlands. At the time, questions were asked about whether the murder of Saleem might have inspired Adebolajo and Adebowale, but there was no evidence of this. Rather, they carried out a targeted act of terror in advance of the ideology to which they were dedicated.

The Woolwich attack was shocking for many reasons. There was an ease and randomness about it that seemed so much more brutal than anything that had been seen before. The fact that the men had undertaken their act, paused for the cameras, not attacked anyone else, all showed a level of calculation and menace that suggested something new was afoot.

While horrific, the suicide bombings on the London underground were comprehensible and left a distinct trail: training camps, terrorist leaders in far-off countries directing individuals and sophisticated plots involving hard-to-assemble bombs. Adebolajo and Adebowale changed this profile, showing how everyday household items were redeployable as terrorist weapons.

The wider effect was to lower the threshold of what constitutes a terrorist attack, suddenly making the act much more “accessible”. And this is reflected in what came next, with repeated attempted attacks using bladed weapons, as terrorists realised that this was all that was needed. In the UK alone, at least 16 plots of this type are identifiable on the violent Islamist end of the spectrum. On the continent, the pattern is similar, with the car and bladed weapon terrorist methodology becoming depressingly ubiquitous.

Terrorist groups tried to claim credit. Al-Shabaab, the group that Adebolajo had tried to join in 2010, released an hour-long video taking its title from his comments to camera. In it, al-Shabaab championed the Woolwich murder and elevated it into the pantheon of lone actor terrorist attacks. It called for others to emulate this and seemed to suggest targeting various individuals who were seen on film commenting in the wake of the murder.

Just over a year later, the methodology was given an extra jolt of life by the Isis leader Abu Muhammad al-Adnani’s fatwa, which electrified the extremist community. It ran thus: “Kill a disbelieving American or European – especially the spiteful and filthy French – or an Australian, or a Canadian… and kill him in any manner or way however it may be. Smash his head with a rock, or slaughter him with a knife, or run him over with your car…” This was of a piece with an approach advanced by an al-Qaida theorist called Abu Bakr Naji. In his book The Management of Savagery, Naji advocates the use of persistent and extreme violence to grind an enemy down, using as crude tactics as possible. Adnani’s savage litany resonated and subsequent terrorist attacks have clearly drawn inspiration from it.

Numerous cells of plotters were shown to discuss its effect and appeared to accelerate plotting in response. At the same time, the speech was following a path that had already been trodden by Rigby’s murderers. The narrative tying Adebolajo and Adnani together was on display in the Nadir Syed case, where he discussed on social media the importance and inspirational impact of the Adnani fatwa, while praising Adebolajo’s act.

It is in many ways extraordinary that things have turned out like this. In the first instance, the attack by Adebolajo and Adebowale, while a tragedy for the murdered soldier’s family, was in some ways a reflection of how hard it had become to launch terrorist attacks in the UK. The security services had learned how to manage the threat. Complicated plots got disrupted; networks of extremists had been penetrated. Many of those in the al-Muhajiroun circle of friends were in jail or under surveillance. Out of this effective security response emerged the assault on Rigby.

But what could not be known at the time was how the simplicity of this attack would inspire others and show them an “easier” path to take, offering crazed individuals a path to perceived grandeur through others’ misery using tools they had lying around the house. The ideology was accessible through the internet and easy to regurgitate, the methodology and targeting was easy; suddenly, the idea of terrorism was no longer an elite activity for the select few who had access to specific groups and weapons.

In the wake of the Woolwich attack, there was a renewed crackdown on the extremists who make up al-Muhajiroun. It did not eliminate them, but it took some off the streets and a growing number went to Syria. For them, Islamic State’s declaration of the caliphate in June 2014 changed everything, forcing them to make a choice between joining what they had advocated for years or showing themselves up as empty loudmouths.

While there continued to be plots that were disrupted, the ideology spread beyond their tightknit community and sprang up in random circles and homes around the country. Khuram Butt, a known al-Muhajiroun extremist who was the focus of police investigation, was the leader of the cell who, using a van and knives, murdered eight people as they enjoyed a night out, close to London Bridge in June 2017. His act was one that had clear inspiration from his previous al-Muhajiroun comrades.

Yet while diffusion of the threat picture has made it more dangerous, it has also started to tear at its coherence. It becomes quite hard to maintain a consistent ideology when you are trying to bring together organised and ideologically motivated plots with what look like random acts of terror. The spectrum from the concert massacre in Manchester to the bafflingly incompetent attack attempted by Mohiussunnath Chowdhury against police at Buckingham Palace is wide.

An Uber driver angry at the world, Chowdhury entered the wrong co-ordinates into his satnav the first time and found himself stuck outside a pub before figuring out the way to Buckingham Palace. Once there, he drove at a police van, shouting: “Allahu Akbar” and was subdued by police officers with CS gas. One officer was injured as Chowdhury brandished the samurai sword he had with him.

The bus destroyed by a terrorist’s bomb in London’s Tavistock Square, July 2005
 The bus destroyed by a terrorist’s bomb in London’s Tavistock Square, July 2005. Photograph: Peter Macdiarmid/Getty Images/PA

This is the issue difficult to assess: when terrorism has become so random, how does it still maintain any of its ideological power? The attacks of 11 September 2001 or the 2015 massacre at the Bataclan concert hall in Paris have an archetypal imagery about them. They capture the maxim advanced by Brian Michael Jenkins, a former US special forces officer and one of the early writers about modern terrorism, who argued that “terrorism is theatre”. The drama and scale of the act draws attention and advances a group’s message.

And this is important to remember: terrorists are fundamentally seeking to advance a political ideology and message. The terrorist act is a way to deliver this. Consequently, the act needs to have drama and effect. A large network plotting to carry out a mass atrocity is a terrifying concept, which will draw attention to itself.

The Rigby murder in its novelty had an equal drama. But as time went on, this approach lost its lustre. In a city where a campaign of stabbings is the major criminal activity preoccupying the police, what effect will a random ideologically motivated one have? If the act becomes indistinguishable from other murders that take place in our societies every day, how does the group continue to advance its message?

This is something that al-Qaida theorists have worried about. The godfather of the lone actor methodology, Abu Musab al-Suri, highlights in his text The Global Islamic Resistance Call that campaigns repeatedly failed because of a lack of proper “education” of ideologies among terrorists. As networks were ground down through confrontation with authorities, “the cadre of supporters that had been formed through lengthy education were expended and the level of education declined among the succeeding bases of cadre”, he writes. This resulted “in the complete failure [that] manifested itself in the inability to realise the goals of the general project”. In other words, as the terrorists committing the act became more detached from the core group, the strength of the ideology was weakened.

Seen in this light, it is possible that we might try to interpret the murder in Woolwich as the beginning of the end or, cleaving to caution, at least the beginning of a path that might take us towards the end. Isis, and its brutality, has extended the lifespan of this threat by years, but ultimately the trajectory will be downward.

Terrorist attacks that are indistinguishable from random murders that take place in our cities or from the brazen acts of lunatics will increasingly have less power to shock. And with no coherent movement, the truly dangerous ideological core will struggle to motivate the right people to launch an effective struggle that has a goal. Rather, it will be occasional lunatics who hurt ordinary citizens but ultimately are unable to change anything. Societies have survived sustained terror campaigns and while none of this is any sort of panacea to those who lose loved ones, the terrorist project is in decline.

Five years on from the murder in Woolwich, the act has achieved a totemic place in the jihadist canon. Yet, decades from now, it might be seen instead as a harbinger of the end of a movement.

Raffaello Pantucci is director of international security studies at the Royal United Services Institute for Defence and Security Studies (Rusi)

Mohammed Ajmal Kasab, one of the gunmen in the 2008 Mumbai terrorist attacks, which left 166 people dead
 Mohammed Ajmal Kasab, one of the gunmen in the 2008 Mumbai terrorist attacks, which left 166 people dead. Photograph: Sebastian D’souza/AP
Advertisements

Catching on a piece from a little while ago for the Times Thunderer column, looking at the effectiveness and issues around deradicalisation programmes. Got a bit of a reaction online. The title is a bit more robust than the piece itself, as my point was more that in some cases a more intense engagement may be able to catch and steer people off the past they are on. Ultimately, people will only really de-radicalise if they make the choice to reject or move on from the ideas. But making them engage with programmes might help catch some more, and that in itself would never be a bad thing.

Been doing some bigger writing which will still take a while to land, but hopefully have some effect. As ever, do get in touch with feedback or thoughts. In the meantime, spoke to Neue Zürcher Zietung about UK jihadis, Middle East Eye about UK jihadi links to Libya, South China Morning Post about China’s problems with jihadis, and randomly to AFP about the Philippines. This aside, the China Steps Out book in which Matt and myself co-authored a chapter looking at China in Central Asia got a substantial write-up by the Council on Foreign Relations in the US. Thanks again to Josh and Eric for their work and patience editing the volume.

Thunderer

 the times

 

The trial of the Parsons Green bomber Ahmed Hassan raises a fundamental question about how we tackle extremism. The court heard that Hassan was identified as a risk before attempting to blow up a Tube train but was never compelled to attend deradicalisation courses run by Prevent, the government’s anti-extremism programme.

Trying to make people attracted by violent Islamist ideology turn their back on it is extremely hard. Success is often only possible if they are identified early enough, when they are still questioning these poisonous ideas, and encouraged to change their minds themselves.

This is why Channel, the anti-extremism programme run by local authorities and the police, has for so long relied on people to take part voluntarily. But the Hassan case shows that if nascent extremists refuse to take part, then the authorities must take tougher action.

The case for compulsion particularly applies to those aged under 18 who are often the most vulnerable and susceptible to radicalisation. Children have more malleable minds and stand to benefit more from a strategy that compels them to attend courses and interviews as part of Prevent. In many cases, they do not have any real understanding of the ideas to which they have been exposed and can be easily turned around. Others may appear wise and manipulative beyond their years but can still be helped to see sense by compulsory deradicalisation.

Another lesson from the case of Hassan, 18, who last week was jailed for life, is that the different strands of counter-extremism strategy need to talk to each other. It is extraordinary that, having failed to engage with the Channel element of Prevent, nobody followed up on why Hassan had effectively dropped off their radar. Neither was there adequate investigation into several occasions when he expressed worrying behaviour. Nor were his foster parents warned of the concerns about him. Each individual failing might be explained away but cumulatively, they let a bomber run loose. The only thing that saved commuters at Parsons Green was the fact he failed to build a successful device. Without greater compulsion from now on, we may not be so lucky next time.

Raffaello Pantucci is director of international security studies at the Royal United Services Institute (RUSI)

A new piece for an excellent outlet that I occasionally contribute to, the CTC Sentinel, which is an interview with Neil Basu, the Senior National Coordinator for Counterterrorism Policing in the UK. It is quite a wide-ranging discussion around the current threat picture, recent problems, and future threats that might mature. It got a bit of a bounce getting picked up by The Times, Daily Mail, The Sun, Asharq al Awsat, and some other local UK outlets. It was also suitably spun by RT. Thanks to editor Paul for all his hard work on it! Separately, spoke to Vice about the Jihadi Beatles, and Arab News about foreigners fighting with Kurds.

A View from the CT Foxhole: Neil Basu, Senior National Coordinator for Counterterrorism Policing in the United Kingdom

DAC-Neil-Basu-06-600x429

February 2018, Volume 11, Issue 2

Authors: Raffaello Pantucci

Deputy Assistant Commissioner Neil Basu is Senior National Coordinator for Counterterrorism Policing in the United Kingdom, a role he was appointed to in October 2016. He is responsible for delivering the police response to the Pursue and Prevent elements of the Government’s CONTEST strategy. In this role, he coordinates the policing response to threats arising from terrorism and domestic extremism nationally and also manages the Metropolitan Police Service’s Counter Terrorism Command (SO15). In his career, Basu has worked as a detective in all ranks to Detective Superintendent, served as the Area commander for South East London, and headed London’s Armed Policing within Specialist Crime & Operation.

CTC: How has U.K. counterterrorism policing evolved to confront the changing threat?

Basu: 9/11 was the contemporary game changer. In the U.K., it started off with some plotting between 2002 and 2004, which wasn’t just concentrated in London. It was also regional. Then you get to 2005, and in the worst way possible, we were taught that this was actually embedded in local communities: domestic home-grown terrorism with some direction from abroad. So there was a need to build regional capability, and that was the start of the network that we have today. Now we have nine counterterrorism units—embedded regionally, collocated with MI5, building intelligence in local communities, [and] connected into local community policing.

Given the nature of the threat we now face, we need to be even more focused on communities and more focused on getting local information. While the ambition is still there for the mass spectacular—and the July 2017 airline plot in Sydney, Australia, was a recent example of that—IS [the Islamic State] has been encouraging supporters living in the West to carry out high-impact/low-complexity attacks. Because of the military push on the ground in Syria and Iraq and the effective eradication of IS’ geographical territory and their ability to project that abroad, it is much harder for them to send trained people back. Borders have closed. Turkey has done well with their border.

The big threat for us now is the ideology that’s been diffused onto the internet and the calls for attacks by its followers in the West by IS online. The caliphate may have been defeated militarily, but it has now become a virtual network. What we’re not seeing is a reduction in people’s willingness to align themselves with this ideology. So even though there is no caliphate to go and fight for, in the minds of some British extremists, the fight carries on because they can aspire to go to Libya or another ‘province.’

In confronting this evolving threat, we have to be more ‘fleet of foot’ at a time when ‘going dark,’ due to the widespread availability of encrypted apps, has become the new norm. We can no longer depend upon all the usual intelligence-gathering apparatus.

CTC: Has the locus of the threat abroad shifted? Syria and Iraq was where the threat was, but would you now look to Libya as a place where you could see the same sort of a threat emanating from?

Basu: You would be completely foolish not to worry about Libya. All of the coalition thinks that that is going to be a tremendous problem in years to come. Anywhere there is ungoverned space, anywhere there is fragile political governance is a potential source of threat. But it is not clear that it is going to be easy for terrorists to move from location to location. We already know of eight or nine IS affiliates around the world that have claimed allegiance, with [fighters in] Libya being one example. Libya is very close to home for Europe and our allies, but for a long time, it was not the focus for our attention. For us in the U.K., what happened in Manchester was a big wake-up call to the fact that there were people who had traveled back and forth to Libya doing much the same thing we were preventing people from doing in Iraq and Syria and who had a similar hatred for this country. And oddly enough, these travelers were second or third generation [immigrants], not necessarily the generation you would assume.

CTC: The Manchester attack and its links to Libya were particularly striking given the similarities with other networks and plots seen previously in the U.K., in particular historical networks linked back to terrorist groups in Pakistan.

Basu: You would have to take a huge leap of faith to say Salman Abedi [the Manchester suicide bomber] was not traveling to and from Libya with some malicious intent and that it was all just about family and socializing and not about training. We’ve long known that training overseas can battle-harden people. It’s not just being able to fire a gun; it’s the psychological bar that you overcome by being brutalized in theater. Once you get a taste for violence, the second time is much easier. And cops know that from dealing with violent criminals.

CTC: A year after the cluster of plots in the first half of 2017, do we have any more clarity on what precipitated all of that terrorist activity in the U.K.? 

Basu: JTAC [Joint Terrorism Analysis Centre] was very good at saying something is coming. Security analysts understood that once there was a military push on the ground against them [Islamic State fighters] in Syria and Iraq, they were going to start lashing out. Leaders like [Abu Bakr] al-Baghdadi and [Abu Muhammad] al-Adnani, before he was killed, were telling followers in the West they didn’t need to ask permission from an emir; they could just go ahead and launch attacks.

This was the backdrop that was making security forces nervous. Then, and this is a personal view, Khalid Masood [the March 2017 Westminster bridge attacker] launched his attack. He had no clear and obvious connection to either IS or al-Qa`ida. He was clearly someone who cherry-picked the bits of Islam that he believed justified what he did. Whether his particular religious interpretations was the actual driver for what he did, I am of two minds, but his motivation died with him. There is no concrete information that it was for the glory of the caliphate or for the glory of IS or for the glory of AQ. But what he did achieve was that he gave fellow violent extremists the understanding that the U.K. was not such a hostile place to launch attacks and that by using this simple methodology you could succeed. Some violent extremists admired him for actually going ahead and doing it. Some criticized him for not doing a very ‘good job.’ But at the end of the day, what it did say to them was that ‘my plot could work. What I have been thinking of doing, I could actually do.’

CTC: Have you seen much of a change in the threat picture since Raqqa has fallen? Or has it had no effect?

Basu: What we’ve seen is a lot more chatter, a lot more people thinking that they have a chance of successfully carrying out attacks. So the pace and tempo, the number of leads that we think are concerning, the pace has gone up. Whether or not this is linked to the push in Raqqa is hard to tell.

In terms of plots, the trend is towards less sophistication, more amateurism. We’ve not seen a growth of extremists. We’ve seen more conversations among extremists expressing the belief they can launch successful attacks here. So definitely the pace of plotting activity we’re looking at has gone up. But then that was predictable as well. I don’t think anyone thought the military defeat of the group in Syria and Iraq was going to be the end of this. We are dealing with an ideology, which is being spread online and has global reach, and we to need to confront this by clamping down on what’s being spread through the internet and better engaging with people who are vulnerable to the extremist message.

CTC: Earlier this year, Minister of State for Security Ben Wallace stated a significant number of British nationals who signed up to fight with extremist groups in Syria and Iraq had gone missing somewhere in the region.1 What do we think has happened to those who are unaccounted for? Where have they ended up? 

Basu: I think there’s probably more in detention overseas, including in YPG or Kurdish or SDF detention, than we currently know. We obviously won’t know everyone who’s died. It’s a warzone and difficult to be definitively accurate. We estimate that 15 percent of the 850 foreign fighters that have traveled from the U.K. to Syria and Iraq have died. There are some we absolutely know died, and there are ones we guess are deceased because, for example, they are no longer communicating. Establishing the fate of the others is going to be very difficult.

I think we have made it very clear how hostile it would be for foreign fighters if they return here. The policy is very clear. You do not get to come back here if you did manage to get over there and you are a fighter.

About half of the 850 who traveled to Syria and Iraq since the onset of the Syrian civil war have returned to the UK. The large majority of these came back very quickly and early on. Some of those were genuine aid workers. Some were people who thought they were going to build a caliphate, not necessarily be immersed in a war. Generally speaking, the people who came back quickly are not where the bigger threat lies.

The larger threat is posed by the return of committed recruits who went there to be trained. When it comes to people who we know are back in the U.K. that we suspect fall into this category, we have either tried to build a case or we’ve monitored them or we have talked to people who know them. As far as those who are still overseas are concerned, we have been making it very clear that this will be a very hostile place to come back to, and I do not think most of these foreign fighters will want to come back. They will want to fight on, and that’s why they have been so committed to being in theater for this length of time.

We are still not seeing what many predicted was going to be a large reverse flow as the so-called ‘caliphate’ disintegrated. Instead, we are seeing just the odd person come back.

When it comes to those still unaccounted for—and who are not being held in detention in the region—I have no doubt a number might be trying to reach other IS strongholds. It is almost impossible to say what has happened to these people. I think we overestimated the stand-and-fight-until-you-die attitude. Some of these foreign fighters will want to fight another day. It is also too early to say where they will coalesce. Could it be the Philippines? Could it be Libya? But it is worth thinking about how practically easy it would be for somebody who is not Arab-speaking, doesn’t necessarily ‘look the part,’ to meld into society in a place like Libya. Very difficult, I would think.

If you crunch the figures: about 850 foreign fighters who went, about half who came back, 15 percent who died, you’re probably looking at a cohort of about 300 that we know traveled who are still out there. Not all of those are mono-Brits; a lot of those are dual nationals. Like other countries, we operate on the principle that we don’t want you back, and therefore we will deprive you of your British passport. And the government has done that. Because of this, the ones who could come back are about a third of this 300 number. And for those among these who end up coming back, we are absolutely waiting for them. That’s the bottom line.

CTC: British officials have said a residual risk is posed by about 20,000 individuals who were previously the subject of counterterrorism investigations. This is a very large number. How is it possible to manage the risk from such a large community of people? Who is going be responsible for managing this? Is this a job for the security services?

Basu: It’s impossible for any country to allocate resources for that kind of number. And every country will have a similar issue. That number will always grow. Because there will always be people who have been considered a national security threat but are no longer considered a national security threat. There is no way the security services or policing can manage all of those on their own. What we have to make sure is that there are ways of assessing whether the risks still exist or not in specific cases, and that’s going to involve something that the security agencies have never done before, which is sharing information from the secret space into multi-agency partners who may be able to help assess that risk. This is not a new concept. Multi-agency public protection arrangements for serious and violent offenders already exist. These individuals live in communities, and there are all kinds of measures in place to manage them. Local authorities need to be informed in a similar way as when people convicted of TACT [terrorism legislation] offenses return to their communities.

People get hung up on the full 20,000 number that is circulated, but what we need to be focused on is what the actual risk in that group is. The bigger risk to us are the additional 3,000 open cases that U.K. security minister Ben Wallace has talked about. That’s where the larger risk lies. A lot of the nervousness has come from the fact that we had two people come out of the 20,000 pot and attack us last year—Khalid Masood and Salman Abedi—while London Bridge attacker Khurram Butt was in the 3,000 who were being looked at. But we would be making a terrible mathematical mistake if we said that we need to swivel all of our guns onto the 20,000, when the 3,000 is where the big risk is.

What exists in that 20,000 is the possibility of people reengaging, like Abedi and Masood. How do you spot that reengagement? Do we have the right triggers in place so that when somebody who has previously shown signs of violent extremism reengages or does something or contacts someone of concern, it comes onto our radar screen?

The only way we are ever going to significantly improve coverage of this is by alerting a broader number of U.K. agencies about who is in the 20,000 pot. David Anderson [former Independent Reviewer of Terrorism Legislation in the United Kingdom] has stated this is something we are going to have to get much better at. We have already learned a great deal from the Operational Improvement Review in the wake of the attacks, and Mr. Anderson praised the work that had been done. But clearly more needs to be undertaken to tighten up our processes to prevent such attacks from taking place.

We are going to run pilot programs and see where we get to on this larger group, to see whether there are issues around reengagement. As a result in some of those cases, we will end up moving them deeper into the safeguarding space: they don’t want to be engaged in extremist activity, they might choose to volunteer, and they might want assistance in all kinds of ways, whether that’s mental health, education, or intervention providers providing religious instruction. There might be people who genuinely want to get off this extremism carousel. And there might be others who are reengaging who become a risk again, and we need to look at them from a law enforcement and security perspective. We are only going to be able to know this is the case if more people are helping us, and that includes my core policing colleagues outside of the specialism of counterterrorism policing. They will be used to the principles; they just need to learn to apply them to terrorism offenders. The key is information sharing and spreading the risk, but because we work in a top-secret world, that’s a cultural change, which is easy to call for out loud like this but really difficult to achieve.

CTC: We keep seeing TATP showing up in terrorist plotting. Is there more that could be done to stop that? 

Basu: A few very obvious things need to be done. We need much more help from the private sector. Anyone who sells materials that could be used in this process needs to be engaged with, and we need to be much quicker at spotting suspicious purchasing activity. Same with the banking sector and suspicious transactions—all of which has been in place for some time, but we need to be much better at it. And we need to make sure that we remove anything that looks like bomb-making instruction from anywhere on the internet. The difficulty is that some of this stuff is O-level [type] chemistry experimentationa that is available online and aimed at children and students. So some of it is not IS appearing online saying ‘this is how to blow people up.’ And so there is a danger is being disproportionate in what we take down and what we don’t. TATP is still dangerous, volatile, and difficult to make, but it is probably not as difficult as we thought it was. So you don’t need to be a chemical engineer to be able to do this kind of stuff.

CTC: When it comes to social media and its role in encouraging or directing terrorism, is there more, from the policing perspective, that you can do? 

Basu: This is principally a role for intelligence agencies rather than police. What it does require, however, is close cooperation from social media companies. And where there isn’t cooperation, we need to consider coercive measures. Governments need to consider legislation. In reality, 2017 was a wake-up for the U.K. and for a lot of companies, not just in the CSP [communication service provider] space. It is about corporate social responsibility [for] how they protect their clients. I do not think it is acceptable anymore to say, “I’m defending free speech” if free speech involves blowing people up. The companies need to be in that space. There are positive signs that they are in that space. They’ve been in front of various hearings and political leaders. I’ve no doubt that they are listening, but they need to make sure their business models are effective in dealing with this now. They’ve got the brainpower, and they’ve got the resources, and they need to help.

CTC: Turning to the threat posed by the Extreme Right Wing (XRW) in the U.K. It has been discussed as an escalating problem for some time. Has it now crossed the threshold of being a national security threat?

Basu: It is too early to see how much it should be escalated. The threat assessment should be looked at by JTAC, and where we think there is a national security threat, then the security services should be involved. The far-right group National Action was the first time we saw anybody who was organized in the XRW space in a way that would represent a national security threat. Thankfully, it is nowhere near the same scale or problem as we’ve had from the IS-inspired or -directed [threat] or the AQ [threat] prior to that or the IRA threat prior to that. That is really something to be proud of in the U.K. culture and tradition that we don’t have this mass wave of extreme right wing. So far, we have seen people try to get on the back of that and not be incredibly successful. They are still relatively small, relatively disconnected, relatively disorganized groups.

My biggest concern about the extreme right wing, which is not a national security threat, is the Darren Osbornesb of the world, the Thomas Mairs of the world [the murderer of Member of Parliament Jo Cox], and the lone actor with the mental health problems, depression, drugs, and the personal grievance who is acting alone. It is spotting people doing something like that which is very difficult.

The biggest concern for the country should [be] that violent Islamist extremism and violent right wing extremism will feed off each other. Islamophobia is something we have to be really clear about in policing: hate is hate. And we should be very, very robust and have a zero tolerance towards hate crime. And if we don’t do that, and Muslim communities are being stigmatized and attacked because of things a tiny minority of people are doing, I think we will create problems for ourselves. The Muslim community is going to be thinking that it is unfair and unjust. I think we don’t have parity at the moment in the way that we look at things. But we don’t have parity because at the moment, the scale of the threat is not the same. I do not want to wait for the scale of the threat to get to a point that something has to be done about it. You have seen a lot of the robust action we’ve taken against National Action, and that was because we were determined to stop this [from] becoming the next problem.

CTC: What about the policy side? The latest iteration of CONTEST [the U.K. counterterrorism strategy] is due out in a few months. What is your particular view on the “Prevent”c pillar of the strategy? 

Basu: Prevent is the hugely controversial part of the strategy. Government will not thank me for saying this, but an independent reviewer of Prevent, as suggested by David Anderson, would be a healthy thing. In fact, he would be excellent in the role. Prevent is, as a Prevent officer who used to work for me said, five percent of the budget but 85 percent of the conversation. Prevent is the most important pillar of the four pillar strategy.d There is no doubt in my mind about it. We’re pretty good at Pursue; we’re pretty good at Prepare, as people have seen in our response. What needs to be better in Protect is the private sector, and I think there’s a big willingness, like there is with CSPs, to understand that they need to protect their customer base better. And whether that’s insider threats, cyber threats, or security guards [in] crowded places, there is an understanding that they need to invest more in that. But Prevent is the key.

There is still this hangover of toxicity around the Prevent campaign that we need to stop, because people need to understand that this about stopping people in the pre-criminal space ever getting anywhere near criminality. And Prevent needs to concentrate on how it does that. That cannot be a job for the police and security services. That has got to be a wider societal pillar. The more that policing and security service could withdraw from Prevent in order to focus Prevent work on problem solving within communities and getting communities to deal with it, the better in the long-term. There will always be a role for policing because we are a frontline. And here I don’t mean counterterrorism policing but the other 115,000 or so police officers who are in the frontline working together with communities. But actually the big responsibility is how do we get everyone else interested and involved and talking positively about some of the brilliant work that is going on.

Prevent, at the moment, is owned by the government, but I think it should be outside central government altogether. I think people who are running their local communities should be taking the lead. Local leaders around the country should be standing up and talking about this, not central government, security services, and counterterrorism police. Communities should be talking about protecting themselves from the grassroots up. When you see Prevent working on the ground brilliantly, that’s where it’s working, and largely unsung and un-talked about. Substantial community resilience is produced by that sort of work, and giving people that resilience is important and communities have to help each other do that. I would love to see a professional communications company say, as part of their social responsibility programming, “I’ll give free training to anybody from youth or whoever who wants to start a conversation around this.” That would be great. Rather than the government handing over a sum of money and then it becoming state sponsored with accusations of demonizing communities, it should be locally generated. We have gotten all of that messaging the wrong way around, it should be grassroots up.

Previously, this was not being done. But there are increasingly some phenomenal voices who’ve got real gravitas in their communities who are beginning to talk about the issues. The mayor of London, Sadiq Khan, is a really good example of that. He is not central government, he runs a city, and the protection of the city is his concern, he should be doing that, not MI5. Not the Cabinet, and the National Security Council and New Scotland Yard.

CTC: The threat picture we talked about is about a scattering of diffuse, random, isolated loners who latch onto ideologies, launching lone actor-style attacks. Have you seen any evidence in the attack planning of anything more substantial than that? Or is that really where the heart of the threat now sits? And is that where the threat picture going forward is going to be?

Basu: We will never eradicate the ambition [of extremists] to put a complicated network together to do a big, spectacular attack. The difficulty with that for a terrorist is that all that planning and all that preparation makes you very vulnerable. Where people aren’t vulnerable is when they are sitting in their bedrooms, using encrypted apps or not using any technology at all, and not having any contact with the outside world. Thomas Mair was a good example of that: no one spotted that happening because he was just a bit of an odd, loner, social misfit. No one saw any triggers that would be interpreted as leading him to that extreme level of violence. That is the bit that concerns me. We are seeing people who are vulnerable to suggestion, who have low-level mental health challenges, which probably don’t hit any clinical threshold. So even if they presented to the National Health Service, they would not look like they were someone of concern. It might be a low-level mental illness, but it’s a low-level mental illness with a lot of other red flag markers around it—for example a propensity towards violence. You can be seriously mentally ill and not violent. Nobody should ever stigmatize people with mental health, or put the two things together. But it is that kind of thing that concerns me most, and we are seeing more of that. And most disturbingly, very young and more female interest in violence.

That disturbs me and has got to have come from social media, if you think where kids get all of their information and how fast that they get it … and then how easy it is to go from—it’s a horrible expression—‘flash-to-bang,’ from having no understanding [of] what they are dealing with to a tiny, partial, ridiculous kind of notion of what religion or what violence, or what freedom of expression, or what these things mean because they picked it up in six-second soundbites on their phone. That malleability worries me a lot, and that concern seems to be being replayed around the world in my conversations with partner agencies across the European continent. So how we influence that younger, very vulnerable generation is going to be a key question. A revamped Prevent strategy is going to be a large part of the answer.     CTC

Substantive Notes
[a] O-levels are exams students in the United Kingdom used to take at age 16.

[b] Darren Osborne is the recently convicted extreme right-wing terrorist who drove into a crowd outside the Finsbury Park mosque in June 2017.

[c] “Prevent” is the forward-looking aspect of the strategy that focuses on preventing individuals from being drawn to extremist ideas.

[d] The other three pillars are “Pursue,” “Prepare,” and “Protect.”

Citations
[1] Roger Baird, “Government has lost track of hundreds of British jihadi fighters,” International Business Times, January 5, 2018.

Another piece to catch up from this past week, this time drawing on a previous project we worked on at RUSI looking at Lone Actor Terrorism. Co-authored with colleague Mo again, this one focuses on extreme right wing terrorism and its particular expression through lone actors for the BBC.

The clues right-wing terrorists give away

  • 9 February 2018
Police guard a street in Finsbury Park after a vehicle hit pedestriansGETTY IMAGES
Police guard a street in Finsbury Park after a van drove into a crowd near a mosque

Preventing terror attacks by lone individuals poses a serious challenge. But there are sometimes behaviours and actions that might give them away.

The growing problem of extreme right-wing terrorism in the UK has been highlighted by two high-profile cases in the past week.

First, Darren Osborne was sentenced to a minimum of 43 years in prison, after being found guilty of driving a van into a crowd of Muslims near a London mosque, killing one man and injuring nine other people.

In the second case, white supremacist Ethan Stables was convicted of preparing an act of terrorism, after planning a machete attack at a gay pride event in a pub in Barrow, Cumbria. He awaits sentencing.

Plans to kill by lone individuals such as these have been a persistent feature of the extreme right wing for many years.

Terrorists who act alone are often seen as particularly difficult for the authorities to spot.

Our research suggests that, more often than not, lone actors imagine that they belong to a wider movement – sometimes attending group activities such as rallies and conducting online research.

But it is often the case that they are not obviously connected to a wider group that might be under surveillance.

If they are planning to use weapons that are everyday items, such as knives or vehicles, it becomes even harder for the authorities to set up “trip wires” – the checks that might catch them before they act.

Ethan Stables, bare-chested with an air rifle
Ethan Stables was convicted of planning an attack on a gay pride event

However, it is not the case that these “lone actors” should be seen as entirely detached: there are often behaviours, or actions, that might act as a warning about their intentions.

It is significant that both Osborne and Stables spoke publicly of their intentions to carry out attacks, as many lone-actor terrorists are less secretive than might be expected.

A project led by the Royal United Services Institute examined “leakage” of intentions in 120 lone-actor terrorist cases of any type between 2000-14.

Individuals had leaked information about their plans in about half of all cases.

Osborne’s trial heard that he had told a soldier in a pub: “I’m going to kill all the Muslims. Muslims are all terrorists. Your families are all going to be Muslim. I’m going to take it into my own hands.”

Meanwhile, Stables was stopped because he decided to announce to the world via Facebook that he planned to carry out an attack, posting to a chat group the words: “I’m going to war tonight.”

This type of leakage was common among both the extreme right wing and violent Islamist perpetrators that we studied.

And among those on the extreme right wing, most of this leakage took place online, as in the Stables case.

The reasons for this are difficult to discern, but could be linked to the fact that many of those involved lead comparatively isolated lives.

Given the relative anonymity found on the internet, people can live out fantasies through their online profiles, to compensate for their unsatisfying offline lives.

In contrast, we found that among Islamist extremists, the leakage tended to take place among family members or friends.

Arrest picture of Darren OsborneMET POLICE
Darren Osborne was found guilty of murder and attempted murder

It was also the case that among a third of the lone-actor terrorists examined by the study – again, both right-wing extremists and violent Islamists – there were potential signs of underlying mental health conditions.

Osborne’s partner described him as a “loner and a functioning alcoholic” with an “unpredictable temperament”.

Stables said that his mother had told him to leave home as a result of his mental health difficulties.

The judge has requested further psychiatric assessments, to help assess whether Stables should be sent to a secure hospital, or prison.

Thomas Mair, the killer of MP Jo Cox, was also a loner described as having mental health problems.

Islamist extremist Nicholas Roddis, who left a hoax bomb on a bus, was described in court as “prone to fantasy” and the judge pointed to his “immaturity and isolation”.

Muslim convert Nicky Reilly, who tried to blow up a restaurant with a nail bomb and later died in prison, had learning difficulties and Asperger’s syndrome.

Clearly, only a tiny minority of people with such difficulties would go on to commit a terrorist act, but greater awareness might help spot some perpetrators before they act.

Health workers and police are now working together on a nationwide projectto help identify people referred to counter-terrorism programmes who are in need of treatment for mental health problems.

None of this paints a picture of particularly sophisticated terrorist plots, or networks, in particular among those on the extreme right.

Rather, it suggests isolated individuals acting out an extreme ideology – and, in most cases, this has been the nature of the plots.

Potentially more worrying for the UK is the emergence of a more organised extreme right wing, with the recent banning of the neo-Nazi group National Action, for example.

On continental Europe this problem has existed for some time. The German case of the National Socialist Underground – which is accused of the murders of 10 people – being just one example.

Across the continent, the ideology around far-right extremists is varied and diverse, but some common threads can be found.

Racial “purity” is often highlighted, as are claims that the world is run by powerful elites, including Marxists, liberals and Jews.

Some minority groups are presented as posing a threat to European culture and society.

These ideas were echoed in the choice of targets and the details in both Osborne’s and Stables’s respective trials.

On the stand, Osborne stated he wanted to murder London Mayor Sadiq Khan, or Labour leader Jeremy Corbyn.

Once he had committed his act, he was heard to say: “I’ve done my bit,” in reference to his attempt to murder Muslims.

Children lay flowers in tribute to the victims of a van attack in the Finsbury Park area of north London.GETTY IMAGES
Flowers in tribute to victims of the 2017 Finsbury Park attack

Stables’s plan to attack a gay pride event reflected his desire to push back against what he saw as an “impure” homosexual culture.

As isolated individuals, they may be typical of the overriding majority of extreme right-wing terrorists in the UK.

But the continued existence of such people – often drawing on the ideology of a more organised extreme right wing, or the xenophobic beliefs of a vocal minority – has a damaging effect on society, causing frictions between communities and tearing at our social fabric.

Not only do their actions hurt those caught up in attacks, but they can drive others on the extreme right, as well violent Islamists – who use the sense of a divided society to justify their actions.

It is easy to simply dismiss Osborne and Stables as pathetic losers angry at society.

But they represent a broader trend that has worrying potential ramifications for the United Kingdom.

Presentational grey line

About this piece

This analysis piece was commissioned by the BBC from experts working for the Royal United Services Institute (RUSI), an independent think tank specialising in defence and security research.

Raffaello Pantucci is its director of international security studies, and Dr Mohammed Elshimi is a research analyst in its national security and resilience team. Follow him @raffpantucci


Edited by Duncan Walker

Further catching up on posting, this time a piece from this Thursday’s Telegraph looking at the juxtaposition with the fall of Raqqa and MI5 head Andrew Parker’s menacing round of interviews about the nature of the threat that is currently faced. Additionally, spoke to the Independent around the story, the Wall Street Journal about the lack of more attacks with foreign fighters in Europe, the Arab News about the threat from peripherals on terrorist networks, the Financial Times about London’s preparations to counter terrorism, to Sky News about the UK government’s issues with social media companies and terrorism, to the Independent again about the Las Vegas shooter, and on the other side of the coin, to the Financial Times about a visit by the PLAN to the UK as part of a global tour and UK-China military relations.

It’s not Isil’s returning terrorists we should worry about. It’s those who are already here

An anti-Isil commander celebrates in the main square of Raqqa, October 17, 2017 CREDIT: BULENT KILIC/AFP/GETTY

On the same day that Raqqa fell, the head of MI5 Andrew Parker gave a set of interviews in which he talks about facing the most severe threat that he has seen in his over three decades working in the intelligence agencies. This dissonant set of messages highlights the degree to which the terrorist threat that the UK is facing has transformed.

From a terrifying but comprehensible phenomenon directed by surreptitious foreign networks, we are now facing a confusing and diffuse one whose link to terrorist organisations is ever looser.

Isil’s loss of territory has not produced the surge in terrorist plots that was expected. Since the beginning of the year, the UK has faced five successful terrorist attacks – and yet, with the possible exception of the Manchester bombing, none have involved foreign fighters. Rather than the individuals who went off to fight in Syria and Iraq, the threat comes from individuals who are still at home.

In some ways this lack of a sudden surge is not surprising. The notion of an uptick in threat from foreign fighters after the collapse of the Caliphate was predicated on the notion that Isil was somehow holding themselves back – saving the potential strikes back home until they were at their weakest point. This clearly lacks much connection with reality, where we can see that the group has been consistently shouting, directing and instigating terrorist plots in the West for the past three years.

What has changed, however, is the nature of the threat back home, where we continue to see individuals being mobilized by extreme ideologies but finding it harder to travel. Instead, a community of frustrated travellers is developing around the world, at a moment when the ideology and methodology of what constitutes a terrorist attack has become diffuse to the point that it is indistinguishable from random acts of social violence.

This helps explain the picture that we are seeing at the moment. A threat abroad appears to be decreasing (through loss of territory, capability and manpower) just as a different sort of threat is expressing itself at home. But there is still an important question to be asked about what is going to happen to those individuals who went abroad to fight. Even according to Andrew Parker’s latest figures, at least a few hundred are still out on the loose somewhere.

What these individuals will do is going to be determined in large part by their reasons for going to Syria in the first place. For some, the motivation to go and fight was ideologically pure and focused abroad. They were going to fight motivated by a sense of injustice, a driving sense of religious duty or a desire to defend the Syrian people. For them, it is possible that the fight in Syria and Iraq is just the first stage in a long life of constant struggle. Among the first foreign fighters to the battlefield in Syria were fighters who had toppled Libyan leader Gaddafi.

For others, the motivation was more selfish – seeking to flee a chequered past back home and gain redemption on the battlefield. Still others were drawn by friends, family, a sense of adventure or some other reason which now leaves them stranded in a conflict zone. Some will possibly change sides to continue fighting in Syria; some will settle down in some ungoverned space; others will die, and yet others will move on to further zones of conflict. Few went out in the first instance to come back home and be terrorists. Most were driven by a desire to do something abroad.

Shi'ite Popular Mobilization Forces (PMF) and Iraqi army members in a series of armoured vehicles gather on the outskirts of Hawija, Iraq October 4, 2017. Thick smoke billows on the horizon in front of them
Iraqi forces and Shi’ite militia gather on the outskirts of Hawija during a campaign against IsilCREDIT: STRINGER/REUTERS

In many ways it is to the affiliates that we should most worry about the foreign fighter flow. In places like Sinai, the Philippines, Libya, parts of Central or Southeast Asia or Afghanistan, there are locations were Isil affiliates are taking root. Those that can accept these battle-hardened warriors will welcome them, enhancing a range of problems that until now have appeared deeply localised. Local governments have varying degrees of capability to manage these problems. In the fullness of time, one of these affiliates may pick up the banner of the global organization and become the new Isil core.

The threat comes from when these affiliates decide to launch attacks against the West, either in their immediate neighbourhood, or further afield. The base in Libya has already produced a number of problems in Europe – this may grow. Others may start to express themselves too. But MI5’s attention is apparently on the domestic situation, where instead the difficulty lies in the fact that they are facing a threat that is increasingly hard to predict. A community of individuals who once seemed peripheral are now becoming the main danger.

Raqqa has now fallen. Isil is not yet finished. But at the same time, terrorism has already evolved into a new form that security services are struggling to manage. Foreign fighters will undoubtedly be part of the picture, but, currently at least, they are not where the core of the problem lies.

It has been a busy day. Events in Barcelona are still a bit unclear, but it sounds like we are moving towards some resolution. In the meantime, catching up on posting latest contribution for the excellent West Point Combating Terrorism Center’s journal CTC Sentinel. Thanks to Paul for his excellent and patient editing. More to come on this topic invariably, and some more catch up to do after this week’s atrocities in Spain.

Britain on Alert: The Attacks in London and Manchester and the Evolving Threat

Abstract: After a respite from mass-casualty terrorism for more than a decade, thus far in 2017 the United Kingdom has suffered three such attacks and a higher tempo of jihadi terrorist plotting than ever before. Absent from the threat picture so far are any Paris-style plots in which the Islamic State has dispatched operatives to launch attacks in the United Kingdom. At this early stage of the investigations, it appears that the Westminster attacker had no contact with the Islamic State and that the Manchester and London Bridge attackers were at most loosely connected to the group. The current threat environment is mostly made up of individuals and smaller scattered cells planning lower-tech attacks with very short planning and operational cycles—sometimes remotely guided by the Islamic State—rather than cells trained and dispatched by the group. But this could change as more British Islamic State recruits return home. With over 20,000 British nationals and residents subject to counterterrorism investigations since 9/11, a growing number of ‘frustrated travelers,’ and a complex and unpredictable set of threats, the United Kingdom faces an unprecedented security challenge. 

It has been a difficult year so far in the United Kingdom. After a period of relative stability, the United Kingdom has abruptly faced a period of deep political turmoil and a series of terrorist strikes that killed 36 people. While the full story around the terrorist plots that rocked the country during the first half of the year is not yet entirely clear—with multiple public and confidential reviews currently underway—the series of cases has led to deep introspection about how the United Kingdom manages the risk posed by the growing number of radicalized individuals at home. In July, Commissioner of the Metropolitan Police Cressida Dick stated that “since March this year, the [threat] tempo has changed. What we are seeing is now being described by the experts as a ‘shift’ in threat, not a spike.”1

This article argues this shift has to be understood as a permanent adjustment in the threat. There has been significant continuity in recent years in the nature of the threat faced by the United Kingdom, with a noticeable move away from large-scale plots to smaller scattered cells, with the tempo of plotting increasing noticeably. The article builds on a previous article in this publication in March 2016, which laid out the United Kingdom’s threat picture through analysis of a series of disrupted terror plots.2 The conclusion then was that “the public threat picture has been dominated by lone-actor plots”3 rather than more ambitious plots directed by the Islamic State like the Paris and Brussels attacks, an assessment that has not been challenged by the attacks in London and Manchester this year. Although only tentative conclusions can be made at this stage, the information that has come to light suggests these plots were significantly less ambitious and complex than some of the conspiracies seen in continental Europe and were carried out by men with at most loose connections to the Islamic State.

This article first outlines what is now known about the March 2017 Westminster Bridge attack, the May 2017 Manchester bombing, and the June 2017 attack on London Bridge and Borough Market. It then assesses what these attacks and other thwarted plots reveal about the broader threat picture in the United Kingdom and the challenges faced by security services.

The return of terrorism to the headlines in the United Kingdom this year was all too predictable. After a period of almost three years with the threat level at the second-highest level of ‘severe,’ British authorities had long warned that an attack was highly likely. Disruptions took place regularly. In early March 2017, the Metropolitan Police Service’s Assistant Commissioner for Specialist Operations Mark Rowley, who is also the National Police Chiefs’ Council (NPCC) lead for counterterrorism, stated that since the murder of Lee Rigby in May 2013, authorities had disrupted 13 terrorist plots. In defining the nature of the plots, Rowley stated “some of them have been more sophisticated [in their] planning looking to attack public spaces, or police offices or the military, not that dissimilar to some of the attacks we have seen in Belgium and France and elsewhere. There is a whole range from the simple to the complicated.”4 This built on comments by then-Prime Minister David Cameron in the wake of the Paris attacks of 2015 in which he stated that agencies had disrupted at least seven plots in the previous six months, “albeit attacks planned on a smaller scale.”5

The Westminster Bridge Attack
Notwithstanding this tempo of disruptions and public statements about the terrorist menace, Khalid Masood’s attack on Parliament on March 22, 2017, still shocked the British public. Using a Hyundai Tucson SUV rented in Birmingham a day earlier,6 Masood drove through the crowds of mostly tourists crossing Westminster Bridge at 2.40 PM. Hitting numerous pedestrians and knocking some into the river, he drove into the gates in front of the Houses of Parliament and then ran at a police officer standing guard, stabbing him with a knife. Masood was then shot dead by the close protection team of Defence Secretary Michael Fallon, who happened to be leaving Parliament at that moment.7

In the wake of the attack, which killed five people, authorities undertook a number of arrests near locations where Masood had lived, detaining 12 people in total. All were subsequently released.8 Born Adrian Russell Elms, Masood was a troubled 52-year-old who had lived an itinerant life, married three times, and had four children by two different women. He appears to have converted in prison while serving time for assault.9 He was twice incarcerated and arrested numerous other times for incidents involving attacking others. His case was of such concern to Sussex Police that in 2009, they filed a report highlighting the escalating nature of his violent behavior.10

In addition, Masood had featured in counterterrorism investigations. Prime Minister Theresa May confirmed that he had surfaced on the fringes of previous cases, stating “he was once investigated by MI5 in relation to concerns about violent extremism. He was a peripheral figure. The case is historic. He is not part of the current intelligence picture.”11 He was investigated after his telephone number was found among the contacts of a member of a cell of individuals from Luton who were jailed in 2013 for planning to bomb an Army barracks.12But he was not a priority of the investigation, and greater attention has been placed on his further radicalization more recently in Birmingham.13

Nevertheless, there has been little evidence produced that Masood was linked to any other co-conspirators or that he had conducted his assault with any external direction. He sent a WhatsApp message shortly before his assault reportedly stating his attack was a response to Western interventions in the Middle East, but the person he sent it to was cleared by authorities of any prior knowledge of the attack or culpability.14 A claim issued by the Islamic State in the wake of the attack was also dismissed as it showed no evidence of being anything but opportunistic. The group has praised Masood in subsequent publications, including quite specific incitement to people to emulate his attack, but the group has never demonstrated any access to information pertaining to him that was not already in the public domain. Authorities have concluded that Masood most likely acted alone and that the full extent of his motivations may never be known.15 As Neil Basu, NPCC’s senior national coordinator for counterterrorism, put it, while the police “found no evidence of an association with Islamic State or al-Qa`ida, there is clearly an interest in jihad.”16 While it is unlikely that Masood was completely isolated, the lack of any subsequent arrests or any charges issued as well as some fairly telling statements by police that his motivations may never be known highlights that, for authorities, the case is largely closed.

The Manchester Bombing 
The contrast between the Westminster attack and the bombing exactly two months later on May 22 in Manchester by Salman Abedi is stark. Using a device that he appears to have constructed himself in Manchester using tools that are publicly available,17 Salman Abedi, a 22-year-old British national of Libyan descent, walked into a crowd of families and children as they left an Ariana Grande concert and detonated a well-built bomb made of TATP and packed with shrapnel.18 Killing himself and 22 others, Abedi’s attack immediately sparked something of a panic among U.K. authorities. Concerned about the sophisticated nature of the device and the fact that Abedi was a known figure with deep extremist contacts, counterterrorism agencies immediately feared that a bomb maker might be on the loose. A wide net was cast, and the terrorist threat level was raised by the Joint Terrorism Analysis Center (JTAC) to its highest level, ‘critical,’ meaning an “attack is expected imminently.”19


Emergency response vehicles parked outside the scene of the terror attack in Manchester, England, on May 23, 2017. (Paul Ellis/AFP/Getty Images)

Nevertheless, while over 20 arrests were carried out, no charges have been issued. In early July, Greater Manchester Police held a press conference at which they highlighted that while they believed Abedi may not have acted alone, he was not part of a larger network. “We don’t have evidence of a large network. We do, however, suspect others were either aware [of] or complicit in the knowledge of this attack … We do believe that there are other people potentially involved in this … further arrests are possible,” Detective Chief Superintendent Russ Jackson, head of the North-West Counter Terrorism Unit (NWCTU), stated. 20

Abedi is reported to have had significant connections in radical circles in Manchester. Many of Abedi’s links tie back to the community of young men from the city going to fight in Syria. He reportedly visited wheelchair-bound (following injuries sustained during his involvement in the 2011 uprising in Libya) Abdal Raouf Abdallah, another Libyan-British national, in jail a number of times in early 2017. Abdallah had been jailed for his role in facilitating the travel of others to Syria.21 He was also reportedly in close contact with Raphael Hostey, a prominent British Islamic State fighter from nearby in Manchester, who used the kunya Abu Qaqaa and was the sponsor for numerous Britons who joined the group.22

It is, however, Abedi’s links in Libya that have raised the most scrutiny. His father, Ramadan Abedi, a prominent onetime member of the now-defunct Libyan Islamic Fighting Group (LIFG), reportedly returned to fight—bringing his son Salman with him—in the revolution that overtook the country in 2011.23 A long-time and committed member of the LIFG, he was well-connected in the community around the jihadi group and was also reportedly seen in Bosnia a number of times during the civil war in that country in the 1990s.24

British authorities have made clear they wish to question Abedi’s brother Hashem.25 On May 24, 2017, the Special Deterrence Force, a Tripoli-based militia under the nominal control of the Interior Ministry, released a statement saying it had detained Abedi’s father and brother Hashem. The militia claimed that Hashem had confessed while in detention that both he and Salman were members of the Islamic State and that Hashem had admitted he had been in the United Kingdom during the planning phase of the attack, had been aware of the plot, and had been “constantly in touch” with his brother. Hashem also reportedly admitted to helping to purchase the bomb components. On May 25, a spokesperson for the militia stated on Libyan television that the two brothers had been in contact by phone just 15 minutes before the bombing.26 Questions remain over these confessions, including over whether they were made under duress. Hashem is still in Libya and has not been charged in the United Kingdom. Analysis of his social media accounts show he was in contact with Hostey’s brother.27

According to the Greater Manchester Police, the two Abedi brothers both left for Libya on April 15, with Salman returning to the United Kingdom on May 18, just four days before the bombing. It was the latest in a number of trips Abedi had made back and forth to Libya. Investigators believe bomb-making materials were obtained before the trip to Libya and stored in a car and that when Salman Abedi returned to Manchester, he purchased other materials for the device including nuts as shrapnel and quickly assembled the bomb.28 The high volatility of TATP—the quick speed at which it evaporates or sublimes and thus becomes useless as an explosive—meant he almost certainly made the explosive substance in the days between his return from Libya and the attack, sources told CNN.29

It remains unclear whether Abedi received training while in Libya. Abedi appeared to be single-mindedly focused on building the bomb when he returned to the United Kingdom, suggesting it is possible he received training or final instructions on his last trip.

Similar to Masood’s attack, the Islamic State issued a statement praising Abedi’s act, but it demonstrated no proof of any prior knowledge.30 Notwithstanding the alleged declarations by his brother to the Tripoli militia, had Salman been closely linked to the Islamic State in Libya, it would be surprising that he would not have recorded a martyrdom video and left it with the group, or least some photographic evidence showing his connections. At the same time, investigators continue to believe that he had some greater degree of links to terrorist groups abroad than Masood. However, the exact nature of these links remains unclear.

The London Bridge and Borough Market Attack 
On June 3, 2017, less than two weeks after the Manchester bombing, London was struck once again. On a balmy evening, Khuram Butt, Rachid Redouane, and Youssef Zaghba drove a van they had rented earlier in the afternoon into the Saturday night crowds gathered near London Bridge. Ramming the van into a fence adjacent to the pavement near the end of the bridge, the trio then leapt out of the vehicle and started attacking passersby in the adjoining Borough Market area with long knives they had bound to their wrists with leather straps. They wore plastic bottles covered in black tape wrapped around their bodies to give the impression of wearing suicide vests and had a number of Molotov cocktails made up in the van.31 Within eight minutes of police receiving the call, armed response officers arrived and shot and killed the three men, though not before eight revelers had been killed and 48 injured.32

One of the attackers was almost immediately identified as a figure well-known to the security services. Butt, who authorities believe was the ringleader of the group, was a prominent and active member of the al Muhajiroun network of extremists that has been at the center of the United Kingdom’s violent Islamist terrorist threat for the past two decades. Butt himself had been repeatedly featured at the center of investigations and was most recently on bail for ‘low-level’ fraud for which he was not ultimately going to be prosecuted.33 More embarrassingly for British authorities, he had been featured in a widely viewed documentary called The Jihadis Next Door, which followed a number of prominent al Muhajiroun members, including Siddartha Dhar, also known as Abu Rumaysah (who fled to Syria with his family soon after filming and was believed to have become a new “Jihadi John” figure in Islamic State films34), as well as others who have been convicted of a variety of terrorism and extremism charges.35

The other two were less well known to British investigators, though it rapidly emerged that the Moroccan-Italian Zaghba had been flagged to British authorities through a European intelligence sharing system as someone of concern to Italian authorities after he was stopped at Bologna airport in March 2016 on his way to Turkey. Carrying a small bag, little money, a telephone with Islamic State videos on it, and a one-way ticket, he raised suspicions by telling authorities that he wanted to head to Syria.36 Nevertheless, he was released after being turned back. He subsequently traveled onto his native Morocco and then ultimately London, where he took on part-time work in the services industry.37 The third attacker, Redouane, appears to have led an equally peripatetic life, alternatively claiming to be Moroccan or Libyan and stating his birthdate was in 1986 and 1991 on different documents.38 He had married an Irish woman and had a child with her, who he appears to have visited at his estranged partner’s home in Barking the night prior to the attack after a lengthy hiatus.39

Planning for the event appears to have taken place over a two- to three-week period prior to the attack.40Police believe Redouane’s bedsit in Barking was the location where plotting occurred,41 though the men appear to have also congregated in a number of sporting locations, including an outdoor pool42 and a gym that was established by a pair of brothers who had previously been identified as being involved in al Muhajiroun activity.43

It remains unclear the degree to which the London Bridge attackers may have been directed by the Islamic State or any other extremist group, though the Islamic State did again claim the attack.44 Given Butt’s known association with individuals who have gone on to become prominent figures within the Islamic State, like Abu Rumaysah (who is still suspected to be at large and was featured in the same British television documentary), he would have had ample opportunities to establish contact with the group. Senior leadership figures within al Muhajiroun, like Anjem Choudary and Mizanur Rahman, have been prosecuted for supporting the Islamic State.45 Others like Abu Rahin Aziz,46 Shahan Choudhury,47 Mohammed Reza Haque,48 and Hamza Yaqub49have been publicly identified as having fled to join the group. Many others have tried going to Syria and been caught at various stages of their journeys. Given the close contact the group’s members maintain with those back in the United Kingdom even after they have gone over to Syria, it seems likely that Butt would have had at least some contact at some point with Islamic State operatives in Syria.

While the Islamic State’s immediate claim contained no information that was not already in the public domain, the group’s subsequent mention of the attack in the 10th edition of its magazine Rumiyah did offer battlefield names (kunyas) for the fighters, which had not been discussed in the public domain, identifying them as Abu Sadiq al-Britani, Abu Mujahid al-Britani, and Abu Yusuf al-Britani.50 The accuracy of this information is unclear, however, with it contrasting with Butt’s known kunya of Abu Zeitoun.

Observations on the Three Attacks 
One key question for authorities is the degree to which the three cases were connected.51 Thus far, no evidence has been made public to show any level of connectivity, beyond the potential that the three plotters were somehow inspired in their timing by each other’s actions.a The available evidence suggests the attacks were carried out by individuals or small cells who, though possibly inspired by the Islamic State’s ideology, were either not connected to the group (Westminster) or only loosely connected (Manchester and London Bridge). There is no indication that the Westminster and London Bridge attackers trained overseas. In the London Bridge plot, at least two of the attackers, Butt52 and Zaghba, were frustrated travelers to Syria. In the Manchester plot, Abedi is known to have traveled to Libya a number of times (though the exact nature of these trips is complicated by his Libyan heritage). Abedi’s single-minded focus in constructing a device just a few days after returning from Libya suggests it is possible he traveled to Libya for the purpose of learning how to build a device.53 The New York Times, citing U.S. and European intelligence sources, reported Abedi met with members of Katiba al-Battar, a Libyan Islamic State brigade, at some point while in Libya and kept in touch with the group on trips back to the United Kingdom, but this has not been confirmed by British authorities.54Given that Abedi reportedly participated in fighting against Muammar Qaddafi, one possibility is he received bomb-making training while spending time with a militia group in Libya. There was some public speculation Abedi may have traveled to Syria as well, but this has not been substantiated.55 No evidence has yet surfaced of external direction, and it cannot be ruled out that Abedi learned to build the bomb off the internet given there is evidence he viewed various online videos on bomb making.56 But the relative sophistication and effectiveness of the device, and the trickiness of making TATP, points to the possibility of at least some bomb-making training or practice overseas.

Increased Tempo
In the wake of the Westminster attack, there was a noticeable uptick in the tempo of arrests being conducted by police disrupting active attack planning. In June, Commissioner Dick said about one person a day was being arrested in counterterrorism investigations.57 The reasons for this increase are not totally clear, but it is likely the result of both lower tolerance of risk by British authorities and a growing threat. In the first instance, a successful attack highlighting a failure in intelligence would change counterterrorism agencies’ perspectives on ongoing investigations, making them reconsider various subjects of concern. Second, police concerns of copycat attacks likely sped up arrests of subjects of interest who had been under surveillance for some time. A third likely reason is the increasing push and resonance of Islamic State messaging about individuals staying home to launch attacks. This is a phenomenon that has been obvious since Abu Muhammad al-Adnani’s speech in May 2016 in which he stated, “The smallest action you do in the heart of their land is dearer to us than the largest action by us, and more effective and more damaging to them … And if one of you wishes and tries hard to reach the Islamic State, then one of us wishes to be in your place to hurt the Crusaders.”58 As it has become harder to travel to Syria and the group has been losing territory, more supporters of the group in the United Kingdom are becoming frustrated travelers who are responding to this messaging.

British police thwarted five plots in between the Westminster Bridge and Manchester attacks.59 Just over a week after Masood’s attack, police in Birmingham arrested brother and sister Ummariyat Mirza and Zainub Mirza, who were accused of planning a beheading attack.60 Two weeks later, Ummariyat Mirza’s wife, Madihah Taheer, was arrested and charged with supporting her husband in his plot.61 At around the same time, police arrested a 17-year-old girl of Moroccan origin from London for allegedly plotting to launch some sort of attack under direction of a fighter from Coventry who was killed in April by a drone strike in Syria. The teenager, who cannot be named for legal reasons, was apparently married to the fighter through Skype and had sought to obtain guns and grenades to launch an attack in the United Kingdom under explicit direction from the Islamic State.62

Even more alarmingly, 27-year-old Khalid Ali was detained in Whitehall, a short month after Khalid Masood’s attack on Westminster, in a dramatic mid-afternoon swoop as he walked around with a bag full of knives and shortly after throwing his phone into the river. He was charged with bomb making linked to activity he undertook in Afghanistan years before, as well as the alleged plan he was in the midst of when he was arrested in Whitehall.63

The same day that Ali was detained along Whitehall, police in Willesden in northwest London and Kent undertook a series of raids, detaining six people in what they believed was another cell actively plotting attacks. The case was deemed of such concern that authorities stormed the premises using CS gas and guns. One woman was shot during the entry.64 The initial reporting indicated a cell of six were involved, including an individual who had been stopped in Turkey alongside two teenagers who were reportedly en route to Syria.65 In the end, however, the failed traveler was not charged, and three women (including a mother and daughter) were presented in court for allegedly planning an unspecified knife attack.66 Finally, five days prior to Abedi’s attack, police in East London arrested four men for planning an alleged car bomb and knife attack in central London reportedly inspired by Masood’s actions.67 The four men were arrested on May 17.b

This intense spate of arrests presaged the Manchester and London Bridge attacks and reflected a changed threat assessment by authorities as they sought to roll up a number of cells that had been under surveillance for some time. As noted above, in many cases, authorities feared that Masood’s abrupt success might stimulate others to emulate him—something that had been seen historically after successful attacks. The murder of Lee Rigby in May 2013 by two extremists linked to al Muhajiroun helped stimulate others to attack, including an extremist who the very next day attacked a French soldier patrolling in the La Defence area of Paris. More generally, the attack model deployed against Rigby is one that has become a template many British extremists seek to emulate, often themselves making direct reference to that 2013 attack.

Arrests have continued at a high rate in recent weeks. Three men were picked up on the day of the general election, June 8, with one charged on an unspecified plot. The 33-year-old man in question, Irfan Khan, was allegedly a long-time consumer of online radical material and had allegedly recently viewed material linked to the London Bridge attack when he was arrested, demonstrating the potential inspirational effect of that attack.68 Later in June, police in Birmingham arrested Tarik Chadlioui, a 43-year-old Moroccan cleric who was wanted on terrorism charges in Spain for being the spiritual leader of a cell supporting the Islamic State.69 One of his followers in Majorca is accused of planning a stabbing attack of pedestrians on the island.70

A Constant Threat 
None of this, however, points to large-scale attack planning in the United Kingdom. While a number of the disruptions suggest plots approaching the scale of the London Bridge or Manchester attacks, there was little evidence presented in court of conspiracies with the capability to launch larger Paris-style assaults. Unlike disruptions on the continent in Europe, where cells in possession of automatic weapons and with clear evidence of individuals who have been to foreign battlefields are regularly disrupted, so far there is no evidence that has been made public of this model of plot in the United Kingdom.

More typical have been plots similar to that mounted by a cell of individuals from Birmingham who were planning a knife and bomb attack in the United Kingdom before their arrest in late 2016. Although the so-called “three Musketeers” behind this plot were potentially dangerous, and two had, five years previously, very briefly made it to a training camp in Pakistan, there was no evidence presented at the trial that their plot was directed from overseas; it emerged at trial that the conspirators joked about their inadequate skills, with one likened to one of the useless extremist characters from the film Four Lions, a satirical movie that pokes fun at some of more inept practices of British jihadis.c

The earliest disrupted plot linked to Syria, that of Erol Incedal, included accusations of a planned marauding gunman scenario with some direction from overseas.71 Incedal was cleared of these charges and ultimately convicted of possession of a bomb-making manual.72 But beyond this, the attack planning seen in the United Kingdom has been fairly consistently small cells or isolated individuals seeking to launch low-grade attacks on soft targets around the country. While there are often links to known extremists or networks, where there has been direction, it has been in the form of remote guidance by extremists based in Syria and Iraq.73

None of this is to say that authorities do not continue to see aspiration and intent by terrorist groups to launch more sophisticated plots in the United Kingdom. Thus far, however, the threat has mainly consisted of small-scale unsophisticated plots. While this suggests terrorist groups like the Islamic State have been facing difficulties in infiltrating directed cells into the United Kingdom, authorities are still confronted by a challenging threat picture and one that is in many ways more complicated with these scattered and disparate cells, which are difficult to track. Adding to the challenge is the unpredictability of individuals or small cells autonomously deciding to act using very low-tech methods and weapons, which makes it a very difficult to manage and prioritize threats accurately.

Managing Risk 
The question of prioritization is the key issue at the heart of considerations about how to manage the current U.K. threat picture.d In all three of the cases featured in this article, attackers were known and had been investigated—to varying degrees—by authorities. In at least two cases, Abedi and Butt, they had been a focus of investigations, but no prosecutable case had materialized, leading investigators to move on to other cases that appeared to be of higher priority. With limited resources, such choices have to be made.

The volume of activity that U.K. security services are currently focused on was illustrated most clearly in the wake of the Manchester bombing when Security Minister Ben Wallace revealed on the BBC’s flagship Today program that authorities had 500 investigations underway, involving some 3,000 subjects of interest. In addition, he revealed, there were a further 20,000 former subjects of interest (i.e. former targets of counterterrorism investigations in the post-9/11 period) who remained of peripheral interest to the security services. The numbers have since grown even higher, according to British police. Butt, the London Bridge ringleader, was among the 3,000 current subjects of interest. But it was from the 20,000 considered to be only a residual risk that the Manchester and Westminster attackers had come.74 This larger pool includes individuals who have featured in investigations over the past almost two decades of counterterrorism cases in the United Kingdom. Some are individuals who were on the fringes of plots; others are those who have been charged, convicted, served their sentences, and are now free once again. However, due to their observed activity, they are not deemed to be current priorities and have therefore been relegated by security services who instead focus their attention on those who have been demonstrating a higher level of alarming activity or potential attack planning. Given limitations in security services resources, only about 3,000 individuals can be focused on, and while the others are not forgotten, they are allocated a lower prioritization.75

In the wake of the two London and Manchester attacks, questions are being raised about whether this prioritization has been accurately calibrated.76 After the London Bridge attack, Prime Minister May stressed police and the Security Service MI5 would be reviewing their methods and more generally “how the terror threat is evolving, the way that terrorism is breeding terrorism and the increased tempo of attacks … in a way we haven’t seen before.”77 It has been reported that after the Manchester bombings, Britain’s security services began reevaluating the risk level of individuals categorized as former subjects of interest. One idea reportedly under consideration is to create systems for counterterrorism agencies to share information about former subjects of interest with the broader police force, taking advantage of the general police’s greater numbers of eyes and ears inside local communities. “It’s that wider cohort [of 20,000] that we have to keep an eye on as well; to see if any of them that reactivate, so to speak, and become dangerous again,” Mark Rowley, head of National Counter Terrorism Policing, stated in an interview earlier this month. “We’re going to have to improve what we do, but it is going to take a whole system effect—not simply counter terrorist specialists and MI5, but local policing, councils, and the public—to be able to deal with something which is becoming more of a cultish movement and less of a small terrorist organisation.”78

The U.K. threat picture is populated with seemingly disparate cells of individuals or clusters who are in some cases receiving direction from abroad through encrypted applications or social media, but in many cases are made up of perpetrators, as Prime Minister May stated, “inspired to attack not only on the basis of carefully constructed plots after years of planning and training—and not even as lone attackers radicalized online—but by copying one another and often using the crudest of means of attack.”79 The fact that the United Kingdom is also grappling with a threat from right-wing and anti-Muslim extremism risks provoking the sort of social tensions the Islamic State has long hoped would boost its appeal in the West.

It is, of course, still early days in the investigations into the London Bridge and Manchester attacks. It is possible more will be uncovered to show their connectivity to wider networks and plots. The plotting activity observed so far in 2017 points to a deeply diffuse and complicated threat picture in the United Kingdom, which is causing security services to revisit their methodologies and leading to arrests at increasingly early stages of the attack cycle. This can complicate subsequent convictions, but it is an imperative at a time when many plots are being carried out through low-tech means already in most citizens’ possession—cars and knives—and at a time when the flash-to-bang in plots can be counted in days rather than years.

Atop this complex domestic picture is the potential threat posed by the growing number of British jihadis who are expected to be returning home from Syria and Iraq. Exact numbers are impossible to know, but with hundreds already back,e authorities are already bracing themselves for an even more challenging threat environment when these battle-hardened veterans and their families return.     CTC

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI) and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists. Follow @raffpantucci

Substantive Notes
[a] This certainly seems to have been the case in the subsequent anti-Muslim terrorist attack launched by Darren Osborne, a 47-year-old who drove a van into the crowd outside Finsbury Park mosque on the morning of June 19, killing one. A long-troubled individual, Osborne was reported by neighbors to have been incensed by the London Bridge attack. No evidence has publicly surfaced that he was linked to extreme right groups. And it is suspected that Osborne may have intended to strike an al-Quds, pro-Palestine march through central London earlier in the day, but had been too late and chose the mosque instead. Osborne was reported to have been raving drunkenly at a local pub the night before the attack and to have been flagged to police as drunk and asleep in his vehicle later the same evening. Martin Evans, Ben Farmer, Hayley Dixon, and Hannah Furness, “Finsbury Park terror suspect ‘planned to attack’ Muslim march in London but was too late, it is claimed,” Telegraph, June 20, 2017.

[b] The four were charged on May 25. One was not charged with terror offenses but instead for seeking to “possess any firearm or imitation firearm with intent to cause fear of violence.” “Update: Four charged following Counter Terrorism investigation,” Metropolitan Police press release, May 25, 2017.

[c] The most disturbing aspect of the plot was that three of the plotters had been convicted and served time for previous terrorism offenses. Two of those convicted, Naweed Ali and Khobaib Hussain, had been previously arrested for going to training camps in Pakistan. They were also linked to a cell arrested in 2011 in Birmingham that was seeking to launch an al-Qa`ida-directed attack in the United Kingdom and helping others get to training camps in Pakistan. Mohibur Rahman, the third convicted “Musketeer,” had been previously convicted for possession of extremist material. He was initially arrested as part of a cell that pleaded guilty of plotting in 2010 to bomb the London Stock Exchange. The three “Musketeers” had met and re-radicalized during their prison sentences, raising questions around prison radicalization. “Operation Pitsford: The 11 men,” BBC News, April 26, 2013; “Terrorism gang jailed for plotting to blow up London Stock Exchange,” Telegraph, February 9, 2012; “Three Musketeers’ guilty of planning UK terror plot,” BBC News, August 2, 2017; Dominic Casciani, “Birmingham terror plot: Inside the sting that caught four jihadis,” BBC News, August 2, 2017.

[d] The issue of prioritization is also key in several other Western countries facing a significant threat, including the United States. For example, Orlando nightclub shooter Omar Mateen had been the subject of an FBI counterterrorism investigation, but the case was closed before he carried out the attack. Matt Apuzzo and Eric Lichtblau, “After FBI’s Enquiry into Omar Mateen, A Focus on What Else Could Be Done,” New York Times,June 14, 2016.

[e] While there are no official figures, most reports say that some half of the 850 U.K. nationals reported to have gone to Syria and Iraq have returned home. Martin Chulov, Jamie Grierson, and Jon Swaine, “ISIS faces exodus of foreign fighters as its ‘caliphate’ crumbles,” Guardian, April 26, 2017.

Citations
[1] Cressida Dick, “Commissioner gives key note speech at Mansion House,” MetPolice Blog, July 20, 2017.

[2] Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel9:3 (2016).

[3] Ibid.

[4] Matthew Weaver, “UK police have thwarted Paris-style terror plots, top officer says,” Guardian, March 6, 2017.

[5] Matt Dathan, “David Cameron to recruit 2,000 new spies amid claims UK foiled seven terror attacks in six months,” Independent, November 16, 2015.

[6] “Car used in Westminster terror attack was hired from Enterprise in Spring Hill,” Birmingham Updates, March 23, 2017.

[7] Ewan MacAskill, “Westminster attacker acted alone and motive may never be known, say police,” Guardian, March 25, 2017.

[8] Chris Johnston, “All 12 people arrested over Westminster attack released without charge,” Guardian, April 1, 2017.

[9] “Killer Khalid Masood left jail a Muslim, says childhood friend,” Press Association, March 25, 2017.

[10] Alice Ross, “Westminster attacker had record of increasingly violent attacks,” Guardian, May 15, 2017.

[11] Rowena Mason, “Theresa May’s statement – key extracts,” Guardian, March 23, 2017.

[12] “Four ‘planned to bomb Territorial Army base’ with toy car,” BBC NewsApril 15, 2013.

[13] Xantha Leatham and Omar Wahid, “Westminster terror attacker was radicalised in Birmingham in the past 12 months, sources claim,” Mail on Sunday, April 2, 2017.

[14] Kim Sengupta, “Last message left by Westminster attacker Khalid Masood uncovered by security agencies,” Independent, April 27, 2017.

[15] Vikram Dodd, “Westminster attack: Masood did act alone, police conclude,” Guardian, April 13, 2017.

[16] Robert Booth, “Westminster attacker Khalid Masood had interest in jihad, say police,” Guardian, March 27, 2017.

[17] Nick Hudson, “Manchester suicide attack: Abedi bought most bomb parts ‘himself,’” Policeprofessional.com, May 31, 2017.

[18] Paul Cruickshank, “London attack ringleader was under active investigation at time of assault,” CNN, June 8, 2017; C.J. Chivers, “Found at the Scene in Manchester: Shrapnel, a Backpack and a Battery,” New York Times, May 24, 2017.

[19] “Threat levels,” Security Service, MI5.

[20] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say,” Telegraph, July 6, 2017; Neal Keeling, “Police suspect others were involved in Manchester Arena attack – and may make further arrests,” Manchester Evening News, July 6, 2017.

[21] Joe Thomas, “Manchester Arena bomber visited terror convict in Liverpool prison,” Liverpool Echo, June 25, 2017.

[22] Andy Hughes, “Manchester suicide bomber Salman Abedi linked to key UK IS recruiter,” May 25, 2017.

[23] Nazia Parveen, “Bomber’s father fought against Gaddafi regime with ‘terrorist’ group,” Guardian, May 24, 2017; Jonathan Ungoed-Thomas and Dipesh Gadher, “Salman Abedi: the Manchester killer who was bloodied on the battlefields of Libya and brought evil back home,” Sunday Times, May 28, 2017.

[24] “Otac teroriste iz Mancestera bio kod mudzahedina u BiH,” Glas Srpske, May 31, 2017.

[25] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say.”

[26] Bel Trew, “Salman Abedi’s brother bought parts for Manchester bomb,” Times, June 9, 2017; “Manchester bomber’s brother and father arrested in Tripoli,” Libya Herald, May 24, 2017; Laura Smith-Spark and Hala Gorani, “Manchester suicide bomber spoke with brother 15 minutes before attack,” CNN, May 26, 2017.

[27] Josie Ensor, “Manchester bomber’s brother was ‘plotting attack on UN envoy in Libya,’” Telegraph, May 27, 2017.

[28] “Latest Statement from Detective Chief Superintendent Russ Jackson, Greater Manchester Police,” June 11, 2017. The statement is available at https://twitter.com/gmpolice/status/873926655059927041 and https://twitter.com/gmpolice/status/873926742553112578; Lizzie Dearden, “Salman Abedi travelled through Turkey and Germany four days before launching Manchester suicide attack,” Independent, May 25, 2017.

[29] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[30] SITE Intel Group, “#ISIS releases English-language version of claim for #Manchester bombing,” Twitter, May 23, 2017.

[31] “Terror ringleader ‘tried to hire 7.5 tonne lorry hours before London attack,’” ITV News, June 10, 2017.

[32] “London attack: What happened where in eight minutes of terror,” Sky News, June 5, 2017.

[33] Ralph Blackburn, “London Bridge terrorist Khuram Butt taught primary school children in Ilford,” Barking and Dagenham Post, August 2, 2017.

[34] Richard Kerbaj, “Jihadi Sid told sister: I’ll die for ISIS,” Sunday Times, January 10, 2016.

[35] “The Jihadis Next Door,” Channel 4; Vikram Dodd, Matthew Taylor, Alice Ross, and Jamie Grierson, “London Bridge attackers were regulars at Sunday afternoon pool sessions,” Guardian, June 7, 2017.

[36] Fiorenza Sarzanini, “L’Italia segnalo il killer di Londra fermato a Bologna per terrorismo,” Corriere della Sera, June 6, 2017.

[37] Ibid.

[38] “Update: London Bridge terror attack investigation,” Metropolitan Police press release, June 16, 2017.

[39] Sarah Knapton, Martin Evans, Nicola Harley, Harry Yorke, Ben Farmer, and Robert Mendick, “Khuram Butt, Rachid Redouane and Youssef Zaghba named: Everything we know about the London Bridge terrorists,” Telegraph, June 6, 2017.

[40] Paul Cruickshank and Nic Roberts, “London ringleader Khuram Butt was intensely investigated,” CNN, June 6, 2017.

[41] “Appeal for information on knives used in London Bridge terrorist attack,” Metropolitan Police Press Release, June 9, 2017.

[42] Dodd, Taylor, Ross, and Grierson.

[43] Neil Johnston, Georgie Keate, John Simpson, and Katie Gibbons, “Police were warned two years ago that gym was ‘training jihadists,’” Times, June 9, 2017.

[44] Francesca Gillet, “London attack: ISIS claims responsibility for London Bridge horror which left seven dead, Islamist State media agency confirms,” Evening Standard, June 4, 2017.

[45] Raffaello Pantucci, “Al-Muhajiroun’s European Recruiting Pipeline,” CTC Sentinel 8:8 (2015).

[46] Ruth Sherlock, “British man who joined Islamic State to skip bail ‘killed’ in Syria,” Telegraph, July 5, 2015.

[47] Dipesh Gadher, “Housing benefit funds family’s dash to ISIS,” Sunday Times, March 19, 2017.

[48] Josh Barrie, “The Giant: Second British extremist ‘identified in ISIS video,’” Independent, January 17, 2017.

[49] C vs. HM Treasury, before The Hon Mr Justice Cranston, judgment handed down August 5, 2016.

[50] Rumiyah 10, June 2017.

[51] “PM statement following London terror attack,” Downing Street press release, June 4, 2017.

[52] Damien Gayle and Jamie Grierson, “London attack: Khuram Butt’s family stopped him going to Syria, says cousin,” Guardian, June 8, 2017.

[53] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[54] Rukmini Callimachi, “Manchester Bomber met with ISIS unit in Libya, Officials say,” New York Times, June 3, 2017.

[55] Saim Saeed, “French interior minister: Salman Abedi had ‘proven’ links with Islamic State,” Politico, May 24, 2017.

[56] Fiona Hamilton and Alexi Mostrous, “Manchester Arena killer Salman Abedi used YouTube to build bomb,” Times, June 24, 2017.

[57] “London Bridge attack latest: Terrorists named as police say they were not under surveillance as they posed ‘low risk,’” Telegraph, June 6, 2017.

[58] Paul Cruickshank, “Orlando shooting follows ISIS call for U.S. Ramadan attacks,” CNN, June 13, 2016.

[59] “UK security services have thwarted five plots since March Westminster attack: source,” Reuters, May 25, 2017.

[60] Darren Campbell, “Two arrested in Alum Rock Road charged with multiple terror offences,” Birmingham Mail, April 5, 2017.

[61] Charlotte Paxton, “Birmingham wife of alleged extremist is charged with terror offenses,” Birmingham Mail, April 25, 2017.

[62] Vikram Dodd, “Teenage girl accused in court of plotting terror attack in UK,” Guardian, July 26, 2017.

[63] Martin Evans, “Westminster terror suspect appears in court charged with bomb making offences,” Telegraph, May 10, 2017.

[64] “Willsden shooting: Police foil ‘active terror plot,’” BBC News, April 28, 2017.

[65] Dipesh Gadher, Robin Henry, Rebecca Myers, and Luke Mintz, “Banned Saudi preacher link to raided ‘house of terror,’” Sunday Times, April 30, 2017.

[66] Danny Boyle, “Mother and daughter in terror plot case ordered to lift veils by magistrate who demands to see their eyes,” Telegraph, May 11, 2017.

[67] Steve Robson and Rachel Burnett, “Three men ‘plotted London terror attack involving car bomb driven through Westminster Bridge inspired by Khalid Masood atrocity,’” Mirror, May 27, 2017.

[68] “Man arrested in east London charged with terror offences,” Metropolitan Police press release, June 20, 2017, and “Terror suspect viewed London Bridge attack material before arrest,” Court News UK, June 21, 2017.

[69] Ben Farmer and James Badcock, “Birmingham counter-terror arrest: Alleged ‘spiritual leader’ of Majorca-based cell is held,” Telegraph, June 28, 2017.

[70] Fernando J. Perez, “Uno de los yihadistas detenidos en Mallorca planeo una ‘matanza’ en Inca,” El Pais, June 30, 2017.

[71] “Erol Incedal: terror accused enjoyed billionaire’s lifestyle secret trial files reveal,” Telegraph, December 11, 2015.

[72] Tom Whitehead, “Erol Incedal jailed for three-and-a-half years over bomb-making manual,” Telegraph, April 1, 2015.

[73] See Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel 9:3 (2016).

[74] “23,000 people have been ‘subjects of interest’ as scale of terror threat emerges after Manchester attack,” Telegraph, May 27, 2017; Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism,” Metropolitan Police, August 11, 2017.

[75] Dominic Casciani, “Manchester attack: The bewildering complexity of a terror inquiry,” BBC News, May 25, 2017; Sean O’Neill, “Spies gather to focus on biggest threats,” Times, June 8, 2017.

[76] Francis Elliott and Sean O’Neill, “May tells MI5 to ‘keep up’ with changing terror threat,” Times, June 5, 2017.

[77] Rowena Mason, “MI5 to review handling of London Bridge attack, says Theresa May,” Guardian, June 6, 2017.

[78] Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism.”

[79] “PM statement following London terror attack.”

A piece for the Observer newspaper this weekend, this time looking at the way the attack in Manchester fits into the broader threat picture in the UK. It was a busy period with the media around the attack with longer interviews captured online with the BBC’s Daily Politics (video), National Public Radio’s All Things Considered and Radio 24 (radio), as well as with Financial TimesTimes, Wall Street Journal, New York TimesLa Repubblica, Atlantic, AFP, Washington Post, and News Deeply.

Fighters who can’t travel to Syria pose growing threat

As Isis loses territory in Syria, the risks posed by would-be UK fighters must not be ignored
A police patrol in Hull for BBC Radio 1’s big weekend.
 A police patrol in Hull for BBC Radio 1’s big weekend. Photograph: Danny Lawson/PA

British security officials have long warned it was only a matter of time before there was another terrorist atrocity.

In late August 2014, the Joint Terrorism Analysis Centre (JTAC) raised the terror threat level to “severe” – meaning that, according to its independent assessment, the expectation was that a terrorist attack was highly likely. Responding to an increasingly menacing threat picture in Europe linked to the conflict in Syria and Iraq, that level stayed at severe until the attacks in Manchester, which caused JTAC to redo its calculations and raise it to critical – meaning an attack is imminent.

Once the level was raised to severe, there was a fairly constant pattern of terrorist plotting. In November 2015, as the world reeled from the attacks in Paris, David Cameron said seven plots had been disrupted in the UK over the previous year. At the beginning of March this year, Metropolitan Police assistant commissioner Mark Rowley said in the past four years authorities had disrupted 13 plots. In the wake of the Manchester attacks, a further five have been added to this roster.

While the details of many of these plots have not been made public, most appear to have been lone individuals or small cells planning knife attacks. It is not clear how many have involved the sort of ambitious planning that went into Paris and Brussels or even Manchester. But groups – al-Qaida, Isis or some other affiliate – continue to want to wreak misery.

The reason for the recent increase in activity is hard to pin down. In part, it may be a case of Isis being on the back foot and seeking to push out attacks in every direction: something that correlates with it losing territory and its foreign fighter contingent scattering to the wind, creating a wave of potential problems around the world. And this comes as al-Qaida has started to rear its head once again, menacing the world through new messages by Hamza bin Laden.

But there are other dynamics at play as well. One of the more under-investigated phenomena is what is happening to those aspirant foreign fighters who are unable to travel. Inspired enough to want to join a group like Isis, they find it increasingly difficult to do so – due to proactive security measures in the UK or more simply a much harder environment in Syria to get into. But being unable to travel does not remove the radical impulse. Actually it may enhance it further, with the frustration making the individual feel the link to the group more strongly.

Consequently, when the group shouts for people to launch attacks at home, rather than come to the battlefield, they may see this as a call to arms. The phenomenon of the blocked traveller maturing into a terrorist threat at home is not new, but as things become tougher it is only likely to increase the pool of potential radicals at home.

Finally, there is the exceptionally low threshold for what constitutes a terrorist attack. No longer do you have to launch a complicated plot: if you can, then all the better. But a public stabbing or running people down with a car will also suffice. Targets are open and indiscriminate, with anyone living in a non-Isis state considered fair game. This makes it very easy for anyone to pick up a weapon and become a warrior – meaning that not all of those who do are necessarily as doctrinally pure as a group might want. All of this shows how easy it is to become a terrorist these days.

It was unlikely that the terror threat level would be kept at critical for long, and it has now been reduced to severe. Exhaustion might have set in at the security agencies had it continued much longer. But the tempo of the threat picture in the UK has noticeably sharpened of late: from last year, which was punctuated by the disruption of major plots but dominated by a steady stream of smaller-scale arrests for travelling to, fundraising for, or support of terrorist groups, to this year, which has seen two attacks and at least five or six plots derailed.

It is clear that the terrorist menace is not shrinking away and is likely to linger around for some time longer, in particular if the war in Syria and Iraq continues to drag on, providing a consistently fertile ground for training camps and extremist ideologies.

Raffaello Pantucci is director of International Security Studies at the Royal United Services Institute and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists