UK counter-terrorism | Raffaello Pantucci

Posts Tagged ‘UK counter-terrorism’

The Evolving Terror Threat to the UK

Posted: January 17, 2023 in Royal United Services Institute
Tags: counter-terrorism, Jihadi, lone actors, terrorism, UK, UK counter-terrorism, UK terrorism, XRW

Another piece from late last year, this time for RUSI looking at the threat assessment provided of the current threat picture to the UK and the work of his Service by MI5’s chief in November. It digs into what he said, and tries to draw on wider data to build up a more detailed picture of what is going on with the picture he painted.

The Evolving Terror Threat to the UK

As the government conducts a review of its counterterrorism strategy, a speech by the head of MI5 offered some pointers about the changing nature of the threat.

*Main Image Credit Big picture: Director General of MI5 Ken McCallum gives a speech on threats to the UK on 16 November 2022. Image: PA / Alamy*

In mid-November, MI5 Director General Ken McCallum gave his annual threat assessment speech, outlining the threats to the UK that his service was monitoring. Much of the focus of the subsequent media reporting was on the state-based threats that he covered (emanating from China, Russia and Iran), but he also highlighted that since his last presentation in July 2021 his service had disrupted eight ‘late-stage attack plots’. Only briefly mentioned was that during this same reporting period, the UK had suffered three terrorist attacks – leading to the death of one attacker and Sir David Amess MP. A close examination of all of this plotting suggests that some important tweaks are necessary to the UK’s CONTEST counterterror strategy to ensure it is able to deal with the complicated threat the UK continues to face.

In his speech, McCallum outlined that the plots the MI5 had detected emanated from ‘a mix of Islamist and extreme right-wing terrorism’ and that the ‘lines demarcating what is and is not terrorism’ were increasingly hard to draw. The focus was largely on lone actor plots (or self-initiated attackers), which his service found across ideologies. He also mentioned the continuing aspiration by groups to launch something more substantial, though this has become much harder for them. All of this may seem a fairly clear assessment, but it is in fact quite difficult to dig into in much detail given current levels of reporting around terrorist plots in the UK.

Security Service reporting around attack plots is increasingly opaque. The habit currently is to refer to disrupting ‘late-stage attack plots’, in which the investigators think that the individual was going down a path of trying to launch an attack rather than conduct some other form of terrorist activity (for example, dissemination of extremist material, radicalisation of others or fundraising in some way). Yet what exactly this looks like has not been clearly defined, and an examination of reporting around terrorism arrests in the UK since July 2021 (when he last gave the speech) reveals only six cases can in which some form of identifiable attack was reportedly being planned.

Many of these are still being managed through the courts, and consequently specific mention needs to be done carefully, but drawing on open source reporting, the following trends are visible in the caseload.

In ideological terms, half appear to have Islamic State inspiration, while the other half have elements of extreme right-wing (XRW) thinking in their make-up. In two of the XRW cases, the ultimate target was a 5G mast, suggesting the influence of conspiracy theories. Both of these cases had deep anger against the government also present in reporting, and both plots involved older individuals (38, 59 and 59). The 59-year-olds were a male and female pair who were reportedly in contact online.

All of the other cases are made up of teenagers, with two cases involving pairs (one two boys of 15 and 19, and the other a male/female 17/18-year-old pair). Of the Islamic State-inspired ones, only one case involves someone with a name of likely Muslim origin, while the others all appear to be non-Muslim origin names, with no reference to conversion in their cases. The targets are all quite general, but it appears that anger against the police or security state is high on their priority list, with two accused of conducting hostile reconnaissance of security establishments (one from each ideology).

They are scattered around the country, and were all active on various online platforms – from large established Telegram groups to gaming platforms and Discord. At least two of the younger boys are identified as being diagnosed with autism spectrum disorders.

When held up against the three attacks that took place during the reporting period which McCallum mentioned only briefly in his speech (Sir David Amess’s murder, the Liverpool Hospital bomber and the Dover migrant centre firebomb), the most obvious similarity is the older nature of the XRW terrorist who attacked the Dover migrant centre. A 66-year-old, his profile fit that of the last four older male XRW terrorists in the UK who launched lone actor plots (Jo Cox MP’s murderer; the Finsbury Park mosque attacker; a man seeking to kill Muslims who stabbed a person in Surrey in 2019; and a Britain First supporter who drove into a curry house owner in Harrow in June 2017). The previously mentioned two disrupted cases seeking to strike 5G masts also somewhat fit this profile.

The other two do not. The ideology of the Liverpool bomber remains unclear, and while he was a younger man, neither he nor Sir David Amess’s murderer were teenagers. Sir David’s attacker appears to have a been a residual case from the cohort of young men radicalised by Islamic State who waited years to launch his attack. This stands in contrast to the confused Islamic State-inspired teenagers in the arrested cohort.

It is hard to know what to draw from this. The most obvious point is the continuation of the previously identified trend of older men (for the most part) being those interested in launching XRW attacks. The fact that 5G masts are a desirable target highlights how the conspiracy theory-driven ideologies that thrived during the pandemic have taken hold among parts of this community. It does suggest a possible new profile of offender that security forces might need to focus on (as general as it might seem). On the violent Islamist side, the Sir David Amess case highlights that there are still residual concerns around the Islamic State-linked cohort, highlighting the long tail this problem can have.

The other side to the age question is the seeming lack of attacks involving teenagers. It is clear from other reporting that the volume of teenagers being arrested is up, but not many are actually launching attacks. Among the XRW community, there have not been any teenagers involved in attacks, and one has to go back to September 2017 and the attempted bombing of an underground train at Parsons Green to find a teenager inspired by Islamic State launching an attack. This is not to discount the potential threat posed by this group, or to suggest that security forces only need to respond to the threat they observe, but it is likely worth considering the extent of the menace actually posed by this young cohort. Jonathan Hall QC, the Independent Reviewer of Terrorism, has raised similar questions, identifying parts of this alarmingly young cohort as ‘keyboard warriors’.

It is also notable that in three of the cases, pairs of individuals were arrested, and in two others there is evidence that the individual was plotting with others online. Only one appears from reporting to be an isolated actor (though this may of course be untrue). This hammers home the oft-repeated point that lone actor terrorists are never really alone. It also raises questions around the three successful attackers – all of whom appear thus far to have been identified as isolated.

This picture is, of course, incomplete and the dataset too small to draw any scientifically satisfactory conclusions. McCallum referred to eight plots, while this author was only able to locate six. But taking this group alone, it is notable how there is a balance between the XRW and violent Islamist groups. The actual danger posed by all of them in national security strategic terms is questionable, though any threat to life clearly needs to have substantial resources dedicated towards countering it. Another aspect McCallum touched upon which is increasingly obvious in XRW plots is the desire to own or use 3D printers to manufacture weapons. Whether this is just for collection or for actual use is unclear, but it helps overcome one of the major hurdles faced by terrorist cells in the UK, which is sourcing weaponry that they can use to cause mass carnage. Guns are hard to obtain in the UK, while bombs require practice to make. Bladed weapons will always limit capability.

Bigger potential terrorist threats were hinted at in other ways. In his speech, McCallum also referred to at least 10 incidents since January of threat to life or kidnapping in the UK involving Iranian actors. This is not new behaviour for Tehran, but the volume when compared to the indigenous domestic threat is notable. It will be interesting to see how much he identifies similar threats from China and Russia, the two other adversaries highlighted, in the future – Russia of course already has form for such action in the UK – and how (or if) the counterterror strategy might seek to address this threat.

There are aspects of the threat beyond the speech which also bear noting. Earlier in November, a 20-year-old and a 17-year-old were arrested in Birmingham for planning to join Islamic State Khorasan Province. This followed earlier reporting of Taliban officials detaining a pair of Britons crossing over from Uzbekistan who were trying to join the group, and a video that emerged from Pakistan which showed an individual identifying himself as Asadullah from England calling for people to come and join the jihad in Pakistan in a strong British-sounding accent. There is a longstanding connection between the UK and jihadist groups in South Asia, and it appears to still be active.

Looking further afield, Syria continues to host a number of potentially threatening groups and UK-linked individuals in Kurdish custody, while Africa has been repeatedly identified as an area where a growing volume of terrorist groups affiliated with al-Qa’ida and Islamic State continue to gather and plot. While it is not clear how much of a threat any of this poses directly to the UK, it illustrates that the threat picture remains fairly constant across much of the globe.

But focusing back on the UK and McCallum’s speech, the most important thing is to try to unpick which aspects of the threat require additional consideration and engagement as the government goes through a review of the CONTEST counterterrorism strategy, and the long-awaited review of PREVENT is released. The threat has clearly changed; it remains to be seen in what way the response will.

The 9/11 Attacks: Two Decades of Countering Violent Extremism

Posted: September 14, 2021 in RUSI Journal
Tags: counter-terrorism, CVE, research, terrorism, UK, UK counter-terrorism

Another September 11 anniversary linked piece, this time a short introductory essay for a collection of RUSI Journal articles assembled from the past twenty years which sketch out some of the main issues touched upon in the journal on terrorism. The request from the editors was to write something which tries to capture how research has evolved over this period. Re-reading the pieces (confess did not quite get to all of them), I realize that the Journal has really been a major outlet for various prominent voices for some time. Lots of interesting bits to read there and I would recommend taking time to read them while they are still open access until the end of the year.

The 9/11 Attacks: Two Decades of Countering Violent Extremism

Terrorism did not start with the attacks of 9/11, but there can be no doubt that these events changed the way that we think and look at the phenomenon. Terrorist spectaculars in themselves were not new – Carlos the Jackal had perfected the art, while seasoned terrorism watcher Brian Michael Jenkins had coined the phrase ‘terrorism is theater’ as early as 1974. But the magnitude and ambition that Al-Qa’ida displayed seemed to change things. For security experts, it pushed what had been largely seen as a niche specialisation into the centre ground of security thinking.

Within the research community it also engendered a new wave of thinking and research as people struggled to comprehend, explain and analyse the apparently new phenomenon that had burst on to our screens that clear September day. Much of the early discourse was an attempt to define what had just happened, both in terms of trying to comprehend who Al-Qa’ida was, but also to appropriately frame the response. The decision by the US to immediately move to a bellicose context meant a deeply conflictual stage was set early on. The decision to follow the invasion of Afghanistan with the invasion of Iraq only further complicated this discussion, steering us away from solely confronting Al-Qa’ida to taking on all adversaries out there. This muddying continues to ripple through the problems we see today.

Yet the truth that slapped the UK brutally in the face in July 2005 was that the threat was in fact one that came from within. Already in the wake of the 9/11 attacks, the UK was shocked to discover there were young Britons fighting alongside the Taliban and Al-Qa’ida. The shoe bombers later in the year were evidence of what this could turn into. And in 2005, Londoners woke to the grim reality that these individuals were willing to come back and commit atrocities on their home soil. This exposed a key dimension that was going to be needed in the response: to find ways of better engaging with the wider communities within our societies from which these individuals came. The need for a holistic response had already been identified in 2003 in the early versions of the counterterrorism strategy CONTEST, but what this actually meant in practice and how essential this was only became apparent later.

But the converse of this holistic, all-of-society response, was to turn everyone into a security agent. Something that rankled parts of society who felt that the approach was overly intrusive and stepping all over civil liberties which a liberal-democratic society should cherish. While politics played some role in this discourse, the reality was that much of the political establishment was largely supportive of expansive powers being given to security services in their pursuit of shielding us from violent extremists.

The perennial conundrum this created, however, was that there was a conclusion that the problem came from within and we needed to work with Muslim communities in particular to deal with the problems. But at the same time, those very communities disliked the exaggerated negative attention they were receiving, feeling even more ostracised by the very policies purportedly developed to help them to better integrate.

These were unfortunately not debates that were ever really resolved, and took place against the backdrop of a threat that continued to evolve and develop. From being almost entirely directed by Al-Qa’ida using bases in Pakistan drawing on the UK’s deep human connection with that country, the terrorist threat spread to places such as Somalia and Yemen. Young Britons continued to get animated by extremist ideas and were drawn to an ever-expanding range of locations to join fundamentalist groups. This broadened the range of places the research community needed to understand. But it also highlighted the deep persistence of the problem even after senior figures and camps got hammered by the increasingly far-reaching UAV (drone) strike campaigns.

This particular tactic raised a new set of questions for the UK – around proportionality and state assassination. The US had clearly already set a path in this direction, but for the UK the discussion was a complex one which touched on a complicated history of the Irish troubles. The UAV capability provided a level of reach that was unparalleled, but it raised complicated ethical issues. Legal systems in the UK were already struggling with new legislation aiming to criminalise possession of material, ideas and conviction for acts which had not taken place.

And then the emergence of the Islamic State from the civil war in Syria appeared to suggest the entire cycle was repeating itself once again but closer to home. There were new tweaks to the Islamic State menace, whose exceptional online presence provided researchers with an extraordinary level of data and information which they could use to analyse the threats posed by the group. Individual terrorists could be spoken to from the battlefield. Group messaging became global and accessible instantaneously, something Osama bin Laden could only dream of achieving.

This also sharpened problems that were already emerging. The lone-actor threat had already started to appear in the UK in 2007. But by the time the war in Syria took off, it had become a more prominent part of the threat. In part no doubt as a result of an effective security response which made it harder for large-scale plots to get through, but also as a result of the fact that the ideas were now so diffuse that anyone could easily access them and react to them.

The research discourse also started to evolve. As we moved into a time of isolated terrorists, the question of ideology and group identity started to get overtaken by research focusing on individual stories, causes and narratives. This in turn created a wave of research trying to craft the nuanced responses that would be required to deal with a problem which was as unique as each individual who had become involved. This then opened up a focus on different sub-groups – be it on the basis of gender, age or mental health. This transformed the nature of communities that researchers were focused on.

But the grim reality is that the problem of terrorism has never really left us and is unlikely to. During this 20-year chapter defined by the opening salvo of the 9/11 attacks and closed (at least in political narrative terms) by the US withdrawal from Afghanistan, the world has gone through many contortions. The research community has found itself following and echoing these. But often the most frequent finding is that these problems are not new, the drivers are as much personal as societal, and the danger is that we continue to reinvent the wheel as we seek to find an answer to what is likely an intractable societal ill. Terrorism existed pre-9/11, and it is going to follow us deep into the future.

The RUSI Journal has published extensively on these themes over the past 20 years. This collection of articles traces how our understanding has evolved since that momentous day in September 2001.

Twenty Years After 9/11: Reflections from Alex Younger, Former Chief of the United Kingdom’s Secret Intelligence Service (MI6)

Posted: September 13, 2021 in CTC Sentinel
Tags: Afghanistan, counter-terrorism, terrorism, UK counter-terrorism, UK terrorism

Another piece linked to the September 11 anniversary, this time another interview of the series that I have been doing for CTC Sentinel. There are a few more recent pieces to publish, and some bigger research pieces for CTC in the pipeline. The interview was done initially before the fall of Kabul and then we revisited some of the questions afterwards.

Twenty Years After 9/11: Reflections from Alex Younger, Former Chief of the United Kingdom’s Secret Intelligence Service (MI6)

Sir Alex Younger was a career intelligence officer in Britain’s Secret Intelligence Service, MI6, for 30 years. He served in Europe, the Middle East, and Afghanistan. He was appointed as Director of Counter Terrorism in 2009, and as Chief from 2014 to 2020. Prior to SIS, he served in the British Army as an infantry officer.

Editor’s Note: The following is the transcript of an oral interview conducted ahead of the 20th anniversary of 9/11. It has been lightly edited by CTC Sentinel.

CTC: Take us back to 9/11. You were already working in SIS (the Secret Intelligence Service, MI6) at the time. How much of a shock was the attack to SIS and to U.K. intelligence more broadly?

Younger: Clearly, it was a shock, and it was designed to shock. Visually, it was an extraordinarily traumatic and shocking sight, and that was the point. The attack was designed to be the ultimate provocation, and that was the effect that it had. It also engendered huge uncertainty because at the time we had none of the knowledge we now have with hindsight, and it seemed eminently probable that this was the first of a number of such attacks. To this day, I am pleasantly surprised that it did not lead to a series of similar outrages. In fact, on that day, I remember thinking that the very building I was sitting in could be on the list. So it also had a very personal effect. And it was clear that it did change everything.

CTC: How did 9/11 change the work and thinking at SIS? Did change occur immediately after the attack itself, or did it take some time for it to filter through the organization?

Younger: No, it was pretty quick. I think if you looked at the situation on the day before September 11, by and large terrorism was still treated as a discrete set of regional but probably even national phenomena rather than something strategic. When you looked at our version of terrorism in the U.K., for example, it felt very different to what was being faced in France. By and large, it was our domestic colleagues [at MI5] who were in the lead on all of this in the U.K. International partnership was less important. Secondly, and this may have been a failure of imagination as much as anything else, people did not conceive of things going on in far off places, like in failed states like Afghanistan, as actively threatening their homelands. That connection wasn’t considered adequately. It was obviously there theoretically, but I do not think it was properly internalized.

Bear in mind that we, as the U.K., were somewhat ahead of the pack in many respects for the very sad reason that we had dealt with terrorism for decades generated by the IRA [Irish Republican Army]. That was a quintessential domestic, politically orientated problem—all the things that the attack of September 11 was not.

So the main changes were two-fold. One, a pretty instant ovenight understanding that what happened in Afghanistan obviously mattered to the security of our people, and that, of course, put my service properly into the fight. And then secondly, an understanding of the premium on partnership. We realized that, by and large, we all had the same problem and it was coming from similar places. The days where you could take a not-my-problem or, worse, beggar my neighbour approach to terrorism were well and truly over.

CTC: You are one of many SIS officers who served in Afghanistan. You’ve stated that after 9/11, you and your colleagues had a “profound impulse to step forward into the line of danger” and that you felt that your organization was “one of the few that could make a difference, faced with a wholly new, and open-ended, threat from international terrorism.”¹ Talk us through the role SIS played in going after al-Qa`ida in Afghanistan and has played in detecting and [working to thwart] jihadi terrorist plotting around the world.

Younger: It’s an odd thing to say, but in some ways, we were the lucky ones; terrorist attacks are awful things, but we are in a position to do something about them. I think one of the most difficult experiences after something like 9/11 or 7/7 [the al-Qa`ida attack of July 2005 on London’s transport system] must have been a sense of helplessness in the face of this hidden menace, set against [the] very human wish and need to get involved and do something. In SIS, we had the privilege, if you can call it that, to be in a position to do something about attacks in however small a way. That also, of course, conferred a frightening responsibility, which I would not pretend was a light burden for anyone. Our mission intensified in this new and difficult context. But it was our traditional mission. Put simply, we discovered that groups of people in far-off lands, predominantly in failed states which constituted a permissive environment for terrorists, were organizing to kill our citizens. It was our job specifically to get inside those groups, to reveal what was going on, and to work in partnership to stop it—a task, albeit in different contexts, that is as old as SIS.

CTC: How shocking was it to discover that there were British nationals involved in these networks? The July 7 attacks of 2005 were the archetypal example of this link, but there were also many other plots, as well as Brits fighting with the Taliban when the Americans went into Afghanistan. How much did that particular community become a focus of work?

Younger: It was not a shock in the sense that we had already seen al-Qa`ida rather successfully—the ideology, that is—appear within communities that should otherwise call the United Kingdom home. People born here and who nonetheless conceive for various complex reasons to be in a state of war with their own country. So, it was not intellectually out of kilter, but speaking as a British citizen, someone who lives here and cherishes the values the U.K. espouses, it still remains a profoundly shocking fact. I am a huge beneficiary of all of the things that are good about this country, and I make it a principle of life to try to put myself in other people’s positions to try to understand their choices. But I nonetheless find it extraordinary that a country that has provided succor to people is turned upon in this way.

But what I think is not the important thing. The important thing is for us to properly understand the thought processes and conditions that lead to people making these choices. To deal with this problem in the longer term, we have to understand these underlying issues and deal with them. We in the CT [counterterrorism] community working in the Pursue strand of our strategy^a are not the solution here. What we are is the means for buying time and a way to suppress the problem, to provide space so that the political, psychological, social, and cultural aspects that lie at the heart of this problem can be fully addressed.

CTC: Beyond Afghanistan, were there any parts of the world SIS was particularly focused on when it was going after the threat?

Younger: I always thought we had two jobs. One was to join the community of nations in bearing down on the networked jihadi threat; be part of a networked solution to a networked threat. Additionally, I was very conscious of our need to play our part as a globally engaged power across the globe in dealing with these problems. Things that happened in far-off countries affected us and others. It was very difficult to isolate the terrorist problem to a specific geography, and it was our job to be making a contribution to counter the problem.

But I also felt that we are a medium-sized power, and it would be a huge mistake to set ourselves up as a global policeman. We are just not suited for that, and I do not think there is a particular appetite within the U.K. to play that role. It simply is not practical. So our priority needed to be to bear down on places and people that were generating a direct threat, either to the U.K. or to our citizens and allies. The most forbidding and essential aspect to a successful counterterrorism campaign is to prioritize. You naturally prioritize on the threats to the lives of our citizens and those of our allies. So that takes you to places where we have a contiguous geography in all senses of the word, not just physical but human and societal, and so in particular South Asia: India, Pakistan, and Afghanistan. Our links to that whole region are profoundly enriching for our country, but sadly, there is a negative aspect. These links are exploited by extremists.

CTC: How did SIS change its practices of working with other agencies and allies in the United States and elsewhere as a result of 9/11? What were the most significant changes you observed in its wake?

Younger: To extend my recipe about effective CT, I would say it is one percent inspiration and 99 percent teamwork. Suddenly, and bear in mind intelligence services are broadly configured around the need-to-know principle, counterterrorism forced us to rapidly shift to a dare-to-share principle. It became evident that the risks of not sharing frequently in counterterrorism were far more forbidding than the risks of sharing. It was a complete inversion of our normal paradigm.

We embarked—it has to be said, led by the United States—in an aggressive pursuit of effective partnership with the countries where the threat was coming from. Which, of course, immediately generated a set of really serious ethical and legal considerations because normally you are partnering with a country that’s very different from a prototypical Western liberal democracy, and this brings a whole set of challenges with it. And that was the thing that hit us pretty quickly. There was a lot that was familiar about the task, which for SIS since 1909 has been about finding out what is going on and doing something about it. But there is something about counterterrorism and the need to share to be effective, and the need to do something with what you find while remaining consistent with your laws and values, that brought with it a set of really new and very difficult disciplines into play almost overnight. That was tough because it was matched with the impulse I described in the speech you mentioned earlier, which is to do stuff. And our absolute impulse, which I’m still proud of, was to get out there and be shoulder to shoulder with the United States, which had suffered the most grievous attack.

CTC: 9/11 happened as we were on the cusp of the current information revolution. Al-Qa`ida was quite an early adopter of the internet. Could you talk us through the complexities of adopting to this new world and how it might have impacted intelligence collection and counterterrorism in particular?

Younger: I think it was most important on the CT capability side: information sharing, data discovery, recognizing that huge holdings of data would very rarely make any sense unless they were compared with other huge holdings of data. That was the really big issue and change. It was actually on our side of the fence rather than the terrorists’ where the data and technology was most important. When it comes to our adversaries, it is worth remembering this was 2002. The internet as a means of propagating ideas was still pretty nascent. You have to fast forward to Daesh [the Islamic State] before you get to the profoundly internet-enabled terrorist phenomenon that is such a major preoccupation today. And there wasn’t any cyber component to the threat; I think there were a couple of small attempts at cyber-terrorism, but I don’t think anyone seriously attempted that with any great effort or impact.

Predominantly for me, the bigger change was the astonishing revolution that took place in the latter part of my career where we had access to abundant information, technical data, and other things, and struggled to figure out how to manage and decipher it all. The real issue was, again ensuring it was done in a manner that was lawful and consistent with our values, using that information to get the right answer before terrorists acted.

CTC: With the Arab Spring and the death of Usama bin Ladin, there was a sense 10 years ago that the global jihadi terror threat was waning. But within just a few years, the Islamic State had taken control of vast swaths of Syria and Iraq and embarked on a global terror campaign. Was SIS surprised by the speed and extent of the rise of the Islamic State? What for you are the lessons learned for the future when it comes to identifying and confronting such gathering threats as early as possible?

Younger: I don’t think the phenomenon of Daesh itself was a surprise insofar as you could see in the situation in Iraq a sort of textbook environment for radicalization. The speed of it was absolutely a surprise, and the asymmetric success that Daesh enjoyed in 2014 was pretty stunning. I am sure you will remember those images. That was a shock. However, a significant galvanizing factor was quite particular to that time and place. Essentially, hardline elements of Saddam’s former intelligence apparatus rapidly changed sides and brought a pretty hardcore level of security expertise to what I think otherwise would have been quite a disparate insurgency. It was a really evil combination of a rapidly intensifying and mutating jihadist ideology galvanized in a pretty cynical way by a lot of former Soviet-trained Iraqi operatives. And that produced what we subsequently saw, which was an incredibly intractable and difficult security problem. Allied to this was the more modern phenomenon that we have just been talking about, which is their realization and capacity to conduct a digital campaign and propagate the jihadist single narrative in a far more sophisticated way than had been possible hitherto.

It was also profoundly worrying to see the caliphate set up as a working example of the jihadist ideology on earth, operating and to the extent that it did. And that success, while it lasted, pulled people in, which was a significant source of threat to us as those people were pulled from their host communities, including here in the U.K., and retained links back home alongside the capacity to use those links. I remember thinking at the time that this was an open-ended, toxic, and extraordinarily dangerous situation. One of the things I am most proud of is the role we played in removing the caliphate from Syria. It remains in many important ways an unfinished and very open situation, but if I cast my mind back to, say, 2014 and you had told me we would ultimately prevail over the caliphate, that would have been, in my mind, a very good outcome. Not least because specific British operators within Daesh were very prominent in the group’s campaign and a source of extreme national shame and embarrassment.

CTC: Could you tell us a bit more about the indicators you saw for the rise of the Islamic State? Looking at that experience, are there any other parts of the world where you could envision something similar happening?

Younger: I remember at the time being very concerned about the way that [Syrian leader Bashar al-] Assad was behaving towards his own people and the brutality he was meting out. I think this in large part was what would feed the Daesh phenomenon. But even with hindsight, we can’t beat ourselves up for failing to see the speed and scale with which it happened, because it is quite a dramatic butterfly effect, in the sense that small changes to the inputs made a large difference to the outputs. There were several different, unrelated factors that coincided to put Daesh’s development at the worse end of anybody’s expectations of what might happen. In large part, this surprise is why they were so militarily successful, because they were just moving so much faster than anyone’s understanding of the threat.

CTC: What is interesting looking back is that in the end, the United Kingdom did not face the same sort of threat as continental Europe from the Islamic State terrorist organization in Syria and Iraq. What plots we did see were of a much smaller magnitude than, for example, the November 2015 Paris attacks. It could be that you and your colleagues were just doing a fantastic job and that’s what kept the threat away, but I wonder was there anything else to it. Was there anything about the way the United Kingdom was connected to the battlefield that seemed different to the earlier wave of al-Qa`ida-linked threats from South Asia? Can you tell us why you think the United Kingdom did not end up with the same sort of threat?

Younger: Well, I think we had a head start in terms of doing counterterrorism for decades and learning some very hard lessons in part through mistakes. We learned early the importance of being joined up within our various security services, which placed us ahead of the pack. We therefore likely did pose a more difficult environment for terrorists to operate in than the average in Europe. But I would not want to exaggerate that lead. The reality is that we were all vulnerable and we all faced this phenomenon together.

Looking back, however, the role of charismatic and prominent individuals should not be underestimated, so part of the reason that brought the particular intensity of threat to both France and Belgium was that their nationals happened to be in influential and capable positions within the caliphate. And so in that sense, for them it was really a case of bad luck. But that’s how it was. And if you take that reality alongside the fact that those countries are not islands and that firearms are therefore more accessible than they are in the U.K., then you have some part of the answer to the question. We will not ever, of course, absolutely know the answer, but I would also highlight that European counterterrorism capabilities at that time were growing much more effective and continued to [do] so.

CTC: Twenty years on from 9/11, there is again this sense that the global jihadi threat is in retreat. What is your assessment? Have you been surprised by the growth of the Islamic State in Africa in particular? Where do you think we may see jihadi threats coming from next?

Younger: It is really difficult to speculate. Broadly speaking, I would say that the threat is less than it was, and I would link that to the successes we have had in terms of suppressing the networks in Syria and Afghanistan. This is combined with a much more effective counterterrorism machine across the technical, foreign, and domestic spaces that are much better integrated than they were. Our counterterrorism capability is an order of magnitude more effective and capable than it was in the past.

Set against this reality are two issues. One, as the Manchester attack illustrated,^b a spontaneous, non-directed attack is just as devastating as networked plots. Terrorism is now more spontaneous and delegated, but that does not mean it is less dangerous, something the Manchester attack sadly showed. But terrorism of this sort is a different type of problem, and in some ways, it has now reverted to being much more conditioned or sensitive to the domestic conditions in the target country, rather than being primarily something that is directed from abroad (in the U.K. at least). It is still fundamentally underpinned by a single narrative, which is very effectively propagated online by groups like Daesh and al-Qa`ida.

Yet, at the same time, it is also at the moment pleasing to see that international terrorist networks, both al-Qa`ida and Daesh, are to some extent in abeyance because we have been successful against them. There is no real cause to pause and celebrate that fact because Africa and the Sahel are looking dangerous and difficult. In addition, there is, of course, Afghanistan.

CTC: MI5 Director General Ken McCallum recently warned that terrorists will seek to take advantage from the U.S. and NATO withdrawal from Afghanistan.² In the wake of the fall of Kabul, how concerned are you by this, and what needs to be done to ensure that Western intelligence is best placed to detect and thwart any future international attack plotting from the country?

Younger: The sudden collapse of the Afghan government was brought on by [a] set of unforgivable unforced errors. Trump’s inexplicable decision to abandon any political conditionality in his withdrawal “negotiations,” his immoral pact with the Taliban that essentially made it OK to attack Afghans, if Americans were left alone, creating a dynamic that led directly to the collapse of the Afghan Army. And the Biden administration’s tactical missteps: the abrupt removal of all enablers, and the decision to do this in the middle of the fighting season. All without any meaningful allied consultation.

The consequences are [evident]: harrowing scenes at the airport; Afghans who chose to support us left behind; and the loved ones of our fallen soldiers asking what it was all for.

And they are strategic: this sends a damaging message. It is a humiliation for the “West” and represents encouragement for despots and autocrats everywhere who know they can simply wait for Western democratic resolve to weaken with the passage of time. I was in Afghanistan in the period after the Soviets left. Najibullah’s government proved to have far more staying power [than] the one we chose to underpin at vastly higher cost. What does that say?

Even in these circumstances, though, it is important to retain some balance. The idea that this somehow represents the end of American power is grossly overdone. When it comes to counterterrorism, we would be wise to remember that U.S. agencies, particularly the CIA, have been at the forefront of developing the most powerful global CT network ever known; there are people alive in all of our countries who would not be, were it not for their efforts. Their work, capability, and partnership will become more important, not less.

Most importantly, however crass U.S. policy might appear, it does represent a welcome if belated realization that there is rarely a pure military solution to a terrorist problem. The causes are ultimately political, and so must be the end game. It became obvious a number of years ago that nation building, Western style, was either wholly impracticable or beyond the resources allied nations were prepared to commit. A way had to be found to integrate politically the powerful Pashtun nationalist faction represented by the Taliban. But the leadership to do this, including in Afghanistan, was not there. I do believe that the comparatively light Western military presence could have been maintained much longer and used much more effectively as a bargaining chip. But it was not the solution.

What does this mean for the threat? That depends on what the Taliban do next. They have sought to project a reassuring message, but history teaches us to approach this with caution. We discussed earlier what it was like in 2001/2002: how stunning it was to discover the degree of terrorist infrastructure that existed in Afghanistan, specifically in the Tora Bora complex. There had been a wholesale state capture by al-Qa`ida of Afghanistan, to a degree that none of us could have really imagined. Right there you have a worked example of what happens when Afghanistan is left unsupported and to its own devices. The Taliban took over and were wholly permissive to al-Qa`ida, who, in turn, organized at almost military-scale capability to attack our countries. You have to ask yourself why that wouldn’t happen again, because obviously it could as it has happened before. There are a few factors that make the current situation different. Clearly the Taliban are not stupid and will have noticed what happens to them when they allow people to operate out of their territory in the manner that al-Qa`ida did before 2001. So while they might be conflicted, I imagine this will weigh on their considerations. Afghanistan itself is also a very different place and the population has very different expectations than they would have had in the 1990s. So not everything is the same, making a clean comparison complicated.

My main plea is that we remain engaged across the intelligence, defense, security, diplomatic, humanitarian piece. That’s much more difficult if you do not have a security or even diplomatic presence on the ground, but history shows us what happens when you turn your back on Afghanistan.

Above all, we need an approach by regional states that rises above their narrow struggle to assert sectoral interests that it has been Afghanistan’s tragedy to host.

CTC: With the U.S. and NATO militarily withdrawal from Afghanistan and the resulting Taliban takeover of the country, how do you think regional powers like China, Russia, Iran, and of course Pakistan will react going forward? What is their long-term view of Afghanistan and the terrorist threats there, and how do you think they will try to mitigate them?

Younger: I think this is a very good example of ‘be careful what you wish for.’ All of those powers in their different guises have been campaigning for NATO to leave for some time, and we are now where we are. They will undoubtedly enjoy the reputational damage that this causes the Western coalition, but beyond that, I cannot see how this is going to improve their security situation in any way. Most obviously, China has a border with Afghanistan. We do not have any physical border there. We are a long way away, and yet we have been the ones essentially being custodians of security. Clearly, there is going to be a lot of thought going on in Beijing about how what is now an open flank is going to be dealt with. There has been a lot of speculation about how Belt and Road [Initiative] can be used to exploit what at one level is a new opportunity in Afghanistan, but the reality is that this is a highly unstable and radicalized place that borders one of China’s most sensitive regions.

With Russia and Iran, it is a pretty similar story. With Pakistan, we have just seen exactly the successful, radicalized, Pashtun Islamist takeover [in Afghanistan], that much of their security apparatus has facilitated and worked for over years, seeing, as they did, a stable Afghanistan as a source of strength to India. Wiser heads have pointed out that Pakistan’s stability depends on successful control of its own radicalized Pashtun elements, a task that will be rendered close to impossible with a radicalized Islamist takeover of their western neighbor.

CTC: In this era of great power competition, there is concern that countries might start to use (or increase their use of) terrorist groups as proxies to strike against each other, especially in a situation with an asymmetrically powerful United States. How do you see this issue? To what degree might shifting prioritization away from counterterrorism to great power competition impact counterterrorism capability?

Younger: I think states and terrorism have always been intertwined to some degree because terrorism happens in geographies. You could also argue that the al-Qa`ida phenomenon distorted all of our longer-term security priorities, but most specifically those of the United States. When the history is written, you will probably see that the U.S. response to a rising China was more muted because it was prioritizing the terrorist threat posed by al-Qa`ida. I think we’re still a bit too close to that to be able to really judge this balance. But what is certain is that great power competition introduces a potential existential threat in a way that counterterrorism does not. What terrorism does, which is almost as difficult and certainly as pernicious, is undermine the social fabric of our countries. This is why governments take it so seriously and why there is so little tolerance of it. But clearly when it comes to conventional destructive power, an international conflict is a far more significant issue.

To look at the question of use of terrorist proxies: With the advent of hybrid warfare, states, and most prominently non-democratic states, have become adept at integrating all aspects of national power into their security toolkit. Relationships with militant groups can and have become another of those tools. You cannot rule out the possibility of these things being used to attack us. Look at the way Russia has used militant groups in the Ukraine.

CTC: The recent U.K. Integrated Review stated that “It is likely that a terrorist group will launch a successful CBRN attack by 2030.”³ According to a May 2021 report by an U.N. investigative team looking at Islamic State activity in Syria and Iraq, “evidence already secured indicates that ISIL tested biological and chemical agents and conducted experiments on prisoners as part of [a biological and chemicals weapons] programme, causing death.”⁴ Given the intelligence you saw come out of Syria and Iraq, how concerned are you about this threat vector?

Younger: These are difficult attacks to mount, so I would say they are unlikely, but they are very high impact. So it is a classic example of low-likelihood, high-impact threat, which is the sort of problem that is very difficult to deal with. That is, however, our life in the intelligence business. Particularly the issue of how you prioritize your effort against that specifically is hard. My way of getting out of that conundrum is to observe that, broadly speaking, it is the same individuals who are involved in the broad range of all terrorist activity. So insofar as your strategy needs to, and I believe it does need to, be focusing on key individuals and networks and key geographies, I do not think that this approach is invalidated by any expectation of the CBRN threat being more or less likely. You could, if it got sufficiently serious, take the completely opposite view and start going after it as a particular category of problem and look at it in those terms, but I think my advice would still, broadly speaking, be it is the same thing and the same people coming to attack us, just in a very wide variety of different ways, which will include CBRN. Clearly, they are hankering after the most spectacular impact they possibly can achieve.

CTC: In the wake of the COVID-19 pandemic, there has been renewed concern that terrorists or other bad actors could obtain or engineer and then deploy a more dangerous virus than even SARS-CoV-2. As the 2018 U.S. Strategy for Countering WMD Terrorism noted, “advances in biotechnology could theoretically allow even a single individual working in a laboratory to engineer pathogens that could have catastrophic effects.”⁵ What is your assessment of the biological threat landscape and what role can intelligence agencies play in preventing an engineered pandemic from materializing?

Younger: Clearly you have got a worked example in front of us. I have no idea if terrorist leaders noticed and wanted to do something similar, but I would be very surprised if that thought has not occurred to them. I would have thought, though, that the same logic applied as we were just discussing about CBRN threats more broadly. Having said that, we clearly do not want to suffer from a lack of imagination about what might happen, as arguably was the case before 9/11. We need to conceive that something like that could happen, but sadly, that is all too easy to do. I hope that as our intelligence services are collecting throughout the world, they are staying highly sensitized to this possibility, but what the signatures of that activity would be and if they would essentially be different to all the stuff that we ordinary do, I do not know.

CTC: In the wake of the events of January 6, there has been growing concern around the world about the threat posed by far-right extremism and its increasing transnational interconnectivity. According to MI5 Director General McCallum, “Of the 29 late-stage attack plots disrupted [in the United Kingdom] over the last four years, fully 10 have been Extreme Right Wing.”⁶ To what extent has going after violent extreme far-right networks been a priority for SIS, and do you think it will be a priority in the future?

Younger: I think it is incredibly serious. The concerns I have about terrorism writ large, but hitherto Islamist terrorism, are the effect that they have in degrading trust between citizens. It is trust that underpins our democracy and our social cohesion. So it is nothing to be taken lightly. In some ways, maybe the rising extreme right is the reaction that terrorists have sought to precipitate, but I actually think it is much broader than that and a function of a whole set of phenomena that we see in the modern age—most specifically, the internet.

The extreme right would become an issue for people like me while I was working for SIS if it was predominantly organized overseas and was done in an organized way, and unless those two facts are true, frankly there is not a lot we can bring to the party. My view is that it probably is not the situation at the moment. So in that sense, and you will have heard it from what Ken said, it remains a really significant and rising domestic preoccupation.

CTC: The lack of much external direction and links makes it less of a focus and role for SIS?

Younger: Were we to see a replica of the scenario we saw in 2001, when a group of terrorists that were organizing in a failed state, successfully radicalizing people within the U.K. to carry out attacks here, that would change things undoubtedly and bring it front and center for SIS. But that’s not how I would characterize it at the moment. There have been some individuals going to foreign battlefields like Ukraine, and we saw the same thing happen with elements of the Yugoslavia civil war. I am not ruling it out as a possibility, but I do not think at the moment we see that. CTC

Substantive Notes
[a] Editor’s Note: The United Kingdom’s counterterrorism strategy (called Contest) has four pillars:
Prevent: to stop people becoming terrorists or supporting terrorism
Pursue: to stop terrorist attacks
Protect: to strengthen protection against a terrorist attack
Prepare: to mitigate the impact of a terrorist attack

[b] Editor’s Note: On May 22, 2017, 22 people were murdered when Salman Abedi detonated a bomb in a crowd leaving a music concert at Manchester Arena. “Manchester attack: Who were the victims?” BBC, June 17, 2021.

Citations
[1] Alex Younger, “MI6 ‘C’ speech on fourth generation espionage,” U.K. Foreign & Commonwealth Office, Secret Intelligence Service, December 3, 2018.

[2] “Director General Ken McCallum gives annual threat update 2021,” MI5, July 14, 2021.

[3] “Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy,” Cabinet Office, updated July 2, 2021.

[4] “Sixth report of the Special Adviser and Head of the United Nations Investigative Team to Promote Accountability for Crimes Committed by Da’esh/Islamic State in Iraq and the Levant,” United Nations Security Council, May 3, 2021, p. 9.

[5] “U.S. National Strategy for Countering Weapons of Mass Destruction Terrorism,” December 2018, p. 1.

[6] “Director General Ken McCallum gives annual threat update 2021.”

Ignoring UK terrorists like Shamima Begum is not the answer

Posted: March 5, 2021 in Times
Tags: counter-radicalization, prisons, terrorism, UK, UK counter-terrorism, UK terrorism

Back on my one of my more traditional topics which has become a lot less newsworthy of late in a new short piece for UK’s The Times Red Box about the never ending Shamima Begum case. Am sure this is not the last we will hear of this case, and my sense is that the subsequent problems that might emerge from the case are only likely to get longer the more she is left out in Syria. Hard to see how this is going to end well sadly.

Ignoring UK terrorists like Shamima Begum is not the answer

As she has for almost three years, Shamima Begum continues to sit in a dusty camp in Syria waiting for some resolution to her stage in life. Having made a catastrophically bad decision at 15, she is bound in a limbo to which there likely seems no end. The problems around her case, however, have not been resolved by the Supreme Court’s decision that simply prolongs her stasis.

There are numerous questions around her case, but three in particular distinguish themselves as needing immediate attention. First is the problem of her age. When she ran away to Syria at 15, she was committing a criminal terrorist act at an age younger than an anonymous Cornwall boy who pleaded guilty a few weeks ago to being a key UK figure of the online extreme right-wing group Feuerkrieg Division.

As a key organiser for the group online, he helped recruit others, vet members, and pushed followers online to move forwards to committing online acts of terrorism. Having pleaded guilty, he was given a two-year youth rehabilitation order, while a 17-year-old he had recruited and stirred into action was given a five-year custodial sentence for planning a terrorist attack.

It is difficult to compare the cases of course in part as we do not know what Begum did while she was in Syria. However, it does seem odd that our criminal justice system is able to handle teenage terrorists with relatively light custodial sentences while this young woman who started down a path when younger than them is on the receiving end of a literal life sentence.

We seem able to handle murderers, rapists, and other serious criminals through our ordinary criminal justice system, but we are incapable of managing a fanatical young woman.

Putting this to one side, it is also important to realise how utterly porous and unstable the situation in which Begum finds herself is. The camps in Syria are managed by a Kurdish fighting group that is ill-suited to keeping them and is far more pre-occupied with its own survival than the fate of those sitting in the camps. From their perspective, the foreigners are useful in that they keep the world’s attention on them, but they do not much care what actually happens to them.

The result has been regular escapes and clear evidence of support from networks back in the homes where they came from. In February, Turkish authorities detained French, Russian and New Zealand Isis women who had managed to sneak out of Syria. Investigations by UK newspapers have shown how online funding networks exist with links to the UK to raise money to help Isis women in these camps.

The point is that as static as the camps are, the people within them are not. This means that the method of simply leaving people over there and hoping the problem will go away is not an answer. And far more dangerous than leaving them in the camp is the prospect of them escaping unfettered and unobserved.

There is a final American angle to this dilemma. While President Biden is doubtless going to be focused on other things for the time being, it is a source of continued irritation in Washington that Europe has not found a way of managing its nationals in these camps.

While under Trump this complaint joined a long list of irritants with an administration that most wanted to try to avoid having to deal with, under Biden, the question will become more pressing and harder to ignore. Europeans spent a lot of time telling Washington off for Guantanamo Bay. How long before some in Washington start to draw similar comparisons?

There is no doubt that managing the return of Begum and the many others who joined Isis will be complicated. But the answer to this problem is to deal with it head on and on a case by case basis, rather than uniformly strip passports and dump on someone else people who are British responsibilities. Doubtless some of these individuals are hardened and irredeemable criminals who should serve long sentences for their crimes, but it is equally likely that some may be people who can be rehabilitated after some punishment. In this way they are similar to the many of thousands of others who have been through the British criminal justice system.

The answer to terrorism is to treat it like an ordinary criminal act rather than an extraordinary behaviour. We seem able to do that with teenage terrorists at home, it is not clear why we cannot with Begum.

Raffaello Pantucci is a senior associate fellow at the Royal United Services Institute

A View from the CT Foxhole: Jonathan Evans, Former Director General, MI5

Posted: March 29, 2020 in CTC Sentinel
Tags: AQ, counter-terrorism, Environmental, ISIS, MI5, terrorism, UK, UK counter-terrorism, XRW

More belated posting, this time of another interview with CTC Sentinel of a senior UK counter-terrorism official, this time Jonathan Evans the former head of MI5. Previous ones have been with the current head of Counter-Terrorism Command and the former head of JTAC. Lots of interesting thoughts, insights and a few new details which might appeal to some.

A View from the CT Foxhole: Jonathan Evans, Former Director General, MI5

Lord-Jonathan-Evans-preferred-1-1200x800

March 2020, Volume 13, Issue 3

Authors: Raffaello Pantucci

Lord Evans of Weardale served as Director General of the U.K. Security Service MI5 between April 2007 and April 2013. He joined the Security Service in 1980, and he first worked on counter-espionage investigations. During the late 1980s and 1990s, he had various postings in Irish-related counterterrorism. From 1999 onward, Evans was directly involved in countering the threat from international terrorism. In 2001, he was appointed to the Security Service’s Management Board as Director of international counter terrorism, 10 days before the 9/11 attacks on the World Trade Center in New York. Evans became Deputy Director General in 2005. It was announced in October 2014 that he would become a Cross Bench life peer, after a personal nomination by the Prime Minister for his public service.

CTC: Your career in the Security Service, MI5, spanned a series of terrorist threats. Could you tell us which were the biggest evolutions you noted across ideologies and groups?

Evans: There were a number of key developments over the period I was in the Service [MI5]. First amongst them was the rise of Irish terrorism as a strategic threat rather than just something that was of concern in Northern Ireland. During my time in the Service, it became very central to London government concerns, and the Service was very involved in countering it. But it was very political terrorism, carefully calibrated to try to have a specific policy impact on the British government in contrast to the different focus of some other groups.

At the same time, we were also looking at a variety of other smaller—from the U.K. point of view—threats in terms of Palestinian terrorism in the late 70s and particularly into the 80s, and terrorism arriving from the various diaspora communities in the U.K. At one stage, we were putting a lot of focus on Sikh extremism, as there was quite a lot of support activity here which was important to the Sikh extremist activities in India. The same with the PKK^a who were doing a lot of fundraising in the U.K. from Kurdish communities. A lot was done through intimidation, basically racketeering, by PKK elements in north London.

But the other really big development was the emergence of al-Qa`ida as an issue in the 1990s. From a U.K. point of view, this issue impacted us through the fact that quite a lot of the ideologues from whom groups sought fatwas were based in the U.K., like Abu Qatada, Abu Hamza, and so on. A number of people involved in the Algerian GIA—the early forerunners of what then became al-Qa`ida in the Islamic Maghreb [AQIM]—were based in the U.K., and so we were looking at al-Qa`ida from that point of view. Partly because the Americans were so focused on it, because of the attack on the USS Cole and the Africa embassy attacks, and then that transferring into the domestic threat in the period after 9/11. After then, it became by far the biggest terrorism threat that we were facing.

The initial turning point at which we took this seriously was in the second half of the 1990s, when we found that some of our European partners—in particular, the French—were very focused on the Algerian threat. Their view was that there were significant elements of this based in the U.K. This is the Londonistan period. They assessed that the Algerian elements in London were feeding into the threat that expressed themselves through the metro bombings in 1995 in Paris. So, in a sense, our initial response was in support of European friends, rather than on our own account.

There are various conspiracy theories about the Londonistan period including the notion that Her Majesty’s Government (HMG) in some way gave a free pass to the terrorist sympathizers in the U.K. on the basis that they would not attack us. This is a complete fabrication. The problem was that we didn’t actually know what was going on because we were not looking. There was all sorts of stuff going on that we just were not aware of. It was not that we were deliberately turning a blind eye, just that we had not noticed. With the creation of al-Qa`ida, the threats in the Middle East, and the problems in France particularly from the Algerians, we started to pay more attention, and once we started looking, the more we found. But at that stage, it was not actually plots to mount attacks in the U.K.

The first indication that we had an actual, live, real threat in the U.K. was in November 2000 with the arrest of Moinul Abedin and a co-conspirator in Birmingham.¹ The co-conspirator was completely exonerated by the courts and subsequently rearrested on other charges. There was some precursor activity by them in Manchester some years before the attempt.

The lead that started the Birmingham investigation came to us from another European country, where, because they had come across an attempt to purchase terrorist equipment through criminal circles, they tipped us off and said “we came across this; you probably ought to look at these people.” That was the first time we’d come across them. We investigated and eventually realized that they were doing something which was immediately threatening. They were arrested on the 23^rd of November [2000], which was the first arrest of anybody in the U.K. linked to al-Qa`ida who was planning an attack here. We knew they had to be planning an attack here because they had a large quantity of very volatile homemade explosive in their apartment, although we [still] don’t know the target.

At the time, we couldn’t directly link it into al-Qa`ida, although it looked as though it probably was. However, with the fall of the Taliban and the Afghan camps in 2001/2002, evidence came to light which demonstrated that this was an at least inspired al-Qa`ida plot of some sort. A few individuals such as Tariq Mahmood, known as T-Bone, who subsequently became very instrumental in fomenting terrorism out of Pakistan’s tribal areas into the West, appear to be have been involved in the margins of that operation.^b

CTC: Having been involved in the investigation into the United Kingdom’s first al-Qa`ida-linked plot, you then watched as the threat evolved and matured through a whole series of plots including the July 7, 2005, attack on the London public transport system. Could you tell us about how that pre-9/11 investigation was similar or different to subsequent plot investigations?

Evans: That particular pre-9/11 investigation was the only one that appeared to have an element of direct threat to the U.K. in it. After 9/11, obviously, there was a lot of pressure on MI5 to provide assurance to HMG that if there were anything like a 9/11 being planned in the U.K., that that was identified. And in fact, there was not, as far as I recall, a huge amount of directly threatening activity that we could identify immediately after 9/11. We had a lot of resources given to us, but it was entirely proportionate to the threat we found. We were able to put the resources to good use. But in the immediate wake of 9/11, it was certainly not the sort of level of threat that developed later.

We started to see attempted attacks from 2002/2003 onwards, the most visible and probably the best known of which was the attack plan that we called Operation Crevice. It was a complex interlocking set of activities involving individuals in the U.K. home counties based out of Crawley and up into Luton. They were mostly likely planning to attack the Bluewater shopping center, but they had also talked in some detail about central London. They did not appear to have necessarily pinned down exactly what their target was going to be. But there was also a separate leg to the plot, which was an attempt to purchase what they thought was radiological material in Belgium. In fact, they were unable to source anything radiological, and it turned out to be a relatively common scam at the time, which was called Red Mercury.

The plot itself, however, appeared to be encouraged and fomented by al-Qa`ida in the tribal areas. It was one of the early ones we saw. It involved predominantly British citizens or British residents of Pakistani heritage, something which became something of a theme for this period.

One of the people who appeared in the margins of Operation Crevice was Mohammed Siddique Khan. At the time, we assessed him—probably rightly actually—as not being a terrorist himself but being a criminal who had some little scam going on at the edges of the Crevice group. He was noted and not prioritized because there was a lot going on and there were a whole series of investigations running at that point. We saw a very significant change in temperature between the second half of 2001 and the second half of 2003/2004. We saw a lot more apparent attack planning of various sorts, some of which was clear to us as a result of the questioning of American detainees who were giving information on networks in the U.K. Prioritization became very acute during this period, and unfortunately, one of the individuals who was prioritized out was Mohammed Siddique Khan, who went on to be the primary instigator of the 7 July [2005] bombings in London.

One notable thing about the July 7 bombings is that while they were an appalling and ambitious attack that killed many, the group of plotters did not fundamentally differ from all the other plans that failed to come to fruition. The only difference between the July 7 cell and all the others was that the police weren’t able to arrest them beforehand.

What you had that was different about the threat picture then versus now was the deliberate initiation or promulgation of plans from Pakistan, using intermediaries from al-Qa`ida Central into the U.K., using U.K. residents or citizens as the people who mounted the attack. Rashid Rauf is the most obvious of these intermediaries.² Tariq Mahmood, T-Bone, became another of them, and there were one or two others. And that was characteristic of the period. From an intelligence point of view, this was a vulnerability because they were planning and trying to have an element of command and control over what was going on, which gives you some attack surface from an investigative perspective.

Whereas if you are merely facing the sort of terrorism that one has been seeing in the last few years involving low ambition and technology, without a command and control network, there is not nearly as much to investigate. On top of this all, the ‘flash to bang’ [in this more recent type of terrorism] can be very rapid.

After the July 7, 2005, attack, the next lowlight—so to speak—was the liquid bomb plot, Operation Overt, in 2006. With the police and the other agencies, we developed very good coverage of the plot as it matured. Again, it was fomented from Pakistan, there was command and control back into al-Qa`ida senior leadership in the tribal areas, and we were able to watch carefully and then move to intervene at the critical point in order to stop anything happening. That plot felt like some of the later-stage investigations into Irish terrorism that we had been doing. Because we had good intelligence coverage of what the Irish terrorist cells were doing, we could intervene at the relevant point, and we felt like we had a good insight into individual plots that were being prepared. Had that plot come to fruition, it would have possibly killed more people than were killed by 9/11 and would have been extremely difficult in terms of Anglo-U.S. relations. At the time, we were working extremely closely with the U.S., and we owe them a huge debt of gratitude for the support they were giving to us over that period. The U.S. have a quite extraordinary scale and spread of intelligence capabilities, and those were being used very regularly to help safeguard the U.K. There were some tensions in the run-up to the conclusion of Overt, but the fact of the matter is that actual arrest decision was triggered maybe just 24 hours earlier than might have been the case had we not had that American pressure. But it was a matter of judgment; I do not think it was a very critical issue.

CTC: To move to the present day, could we turn to the topic of resource allocation? If you think back to 2017, the volume of people being investigated for Islamist terrorism in the United Kingdom was around 3,000, and there was discussion of another 20,000 posing a residual risk.³ Could you talk through the capability to manage this kind of threat volume?

Evans: The question of managing the volume of threat intelligence, or potential threat intelligence, has been one of the continuing themes of the last 20 years. As you grow your intelligence capability, as the public become aware of the fact that they need to be alert and not alarmed, as the police are very focused on terrorism cases, then that does create a lot of incoming material that may indicate potential threats. But you cannot, despite the enormous investment in capacity that the British government has made over the past 15-20 years, follow up everything with equal speed and attention. So, you have to make judgments.

We developed quite a lot of resource into what one might call triage: looking at the whole flow of incoming intelligence, deciding what was most credible and most indicative of a threat, and focusing on that. This helped us decide how to deploy resources to deal with the most credible and threatening material in order to chase down any threats, which is the only logical way of dealing with it. During the time that I was involved in counterterrorism, I do not think we ever had a successful terrorist attack that came about from one of the top priority operations we were focused on. This was because we were able to put a lot of resources into priority investigations, get insight into what was going on, and make sure that the threat did not materialize. The problem was always with the material that had been assessed to be of a lesser priority, because it was in there that risks would suddenly eventuate. Because even though it was entirely logical and sensible to not focus on them on the basis of what you knew, actually you never have perfect insight.

As you grow the intelligence machinery, we started to know something about everybody who did something threatening on the streets of the U.K. And having this information but not acting upon it could be said to be a demonstration of the reach and effectiveness of the intelligence service or it could be interpreted as a blunder. But it is almost intrinsic to the nature of intelligence prioritization that the most important decision made is what not to do. And it is there that the risk lies. That is now well recognized, and post the 2017 attacks in the U.K., there was a review into this area, some work done on additional resources and further work into whether there are ways in which you can provide a degree of automation of this process. The idea being that it becomes an anomaly detection issue: you have normal activity taking place, then something changes, and this provides you with some direction about where in the potential target population you should look for a threat. Logically, this makes a lot of sense, as long as you’ve got good enough intelligence coverage to be able to detect anomalous or changed behavior. But again, if what you are looking for is a 9/11-sized plot, then you have quite a lot of opportunity to gather intelligence. If you’ve got somebody who’s been self-radicalized and whose weapon of choice is a hire [rental] car, then what is it that you’re going to spot? Hiring a car and driving to London does not necessarily suggest that there is a threat, but it does mean you could if you choose to kill people.

It is surprising to me it has taken so long for terrorist groups to get to this stage. I can remember talking 10 or 12 years ago and saying if al-Qa`ida stopped trying to outdo themselves with a plot that was even more dramatic than 9/11 and just got on with killing some people, that would be really difficult for us. Unfortunately, that’s exactly what happened. But what I would say—and this sounds rather a harsh point, but it is an important one—as a society, we can, if we choose to, continue with normal life relatively unaffected by occasional stabbings and vehicles being driven into the general public. Horrible and terrible as those events are, they are not a strategic threat to us. We are speaking soon after the atrocious events on London Bridge where [on November 29, 2019] two individuals were killed through stabbing by a known terrorist. I don’t know for certain, but I suspect if you look across London that week, there were probably other people killed in stabbings that have nothing to do with terrorism and do not get the publicity. We give the terrorists something of what they want in the way in which we react to their terrorism, which of course is classic terrorism theory from the 1960s. We need to think about how we respond to this and just not play up to what the terrorists are trying to get us to do.

CTC: Looking at the case of the November 2019 London Bridge attacker Usman Khan in particular, this raised a whole series of issues about people who have been in prison. A lot of those you were investigating are now coming toward the end of their prison sentences, if they have not already. How do you think HMG can manage or mitigate this problem, and do you think there are adequate measures in place to deal with it?

Evans: I do not think there are adequate measures in place to deal with this problem. I personally feel that we should have considerably longer sentences for terrorist aggravation where there are offenses. Deradicalization and the whole Prevent agenda is absolutely critical, but it is also by far the most difficult for government of the four pillars of the Contest strategy.^c Because, from a government perspective, if you want more of the Pursue pillar, which is the part of the response which is following terrorists around and stopping them [from] doing nasty things, then you give more money to the Security Service, Police, and so on, and it happens. The Protect pillar, which focuses on hardening targets and building defenses, is similar: if you want to reduce vulnerability in the environment you allocate adequate resources, and it happens. But Prevent is about changing people’s minds. It is about arguing with them about their theology, something Western governments are peculiarly badly equipped to do. It is also very difficult to tell whether it’s working because how do you know whether somebody has genuinely repented or whether they are merely saying it because they want to be released from prison? There are clear successes in the Prevent strategy, but equally, there are some pretty spectacular failures.

We need to keep trying to find the best way of working on deradicalization [and] anti-radicalization. Anti-radicalization might be a bit easier than deradicalization, but it is always going to be something which is difficult for a secular Western government to engage with. I believe that there is a strong religious element in some of the Islamist terrorism. In the early days, [the U.K.] government was very uncomfortable about anything that had religion in it and did not want to talk about it and did not want to see it as a religious issue. They would much rather see it as an issue to do with politics, economic deprivation, or whatever. And while I am sure all those have a contributory element to them, religion does as well. However, having an argument about religion is something which government departments are not that great at. It is much easier for the Emiratis who used to be very puzzled as to why we didn’t do more about this. They would issue the sermons for mosques from their government to be read out in the mosques every Friday. I do not think the British government has many people who could write credible sermons for the mosques around the U.K. even if they had the ambition to do so.

There is also the question about what is the definition of success. The British government has been slightly in two minds about this over the years. Is the measure of success that people stop terrorism, or is it that they stop adopting what might be perceived as extremist views? Government has changed its mind periodically on that question. It is probably easier to stop people adhering to terrorism than it is stopping them adhering to views that be might be not aligned to what might be perceived as British values.

A number of the programs in the Middle East [that] seem to have had some success are successful in giving strong theological support to the idea that people should not be attacking the regime because it is an Islamic government and deserves at least their acquiescence. But this acceptance is (a) very different thing from saying that somebody necessarily signs up to what might be seen as mainstream British values on rights of women and so on. The government has chopped and changed a bit on where it stands. Some of what appeared to be fairly successful anti-radicalization measures that were being implemented at one stage were dependent upon support and engagement from some parts of the Muslim community that had extremely conservative views on issues such as women, and may have had views on Israel that diverged from the British government’s. But crucially, on the issue of whether Muslims have a moral and religious duty to attack the United Kingdom, they and the U.K. government had come to the same conclusion. All this complicated things: you are giving government support to a group who, in a number of their areas of their belief, are very far from the mainstream and whose views might be seen as extremist. As a result, I am always slightly skeptical of the viability in the U.K. of the counter-radicalization efforts some Arab countries have proclaimed to be successful, because it is not always clear to me that this is transferable to the U.K. And even if it was, it would probably be struck down by the courts in the U.K.

CTC: Turning to the question of foreign terrorist fighters [FTFs], what kind of a threat do you see from the contingent of people who went to Syria and Iraq, those who are still at large? And what do you think the government should be doing with the ones in SDF [Syrian Democratic Forces] custody?

Evans: I think there is a threat. I have considerable sympathy for the view that Ed Husain takes,^d which is that if people have been involved in violent extremism and then decide that this actually has been an error and a mistake on their part, we could reasonably expect them to actively seek to counter extremism in this country rather than just saying “oh I made a mistake, I’m very sorry.” If there is genuine belief that they made an error and they have seen the error of their ways, then I do not know why you would not expect them to be giving evidence against people with whom they were cooperating and who took part in appalling crimes in Iraq and Syria. There has been a problem with getting evidence from those areas that could be accessible in the British courts. The question is why are the repentant members of that group not giving evidence and audibly reaching out to the community in saying that they want to help push back against extremism. Some people are contributing in this way, but many are not. I would like to see actions as well as words if we are going to accept that people have changed their minds.

CTC: On the FTF question, how does this compare to the earlier flows that you saw going? For example, those who went to Afghanistan.

Evans: There are some parallels. If you look at the history of radicalization in the U.K., there are similarities with earlier flows. The whole Kashmir dispute and conflict was very important in pushing people towards political, in fact relatively extreme political, positions and then across into more general extremism. Then there was the Balkans conflict, which radicalized a broader pool, where quite a lot of the grand old men of British Islamism were involved, and then went on to be very influential in bringing those sorts of messages back to the U.K. Then finally you had the same process in Afghanistan in 1999-2001 with the al-Qa`ida camps there [being] a sort of university of terrorism. From that, 9/11 was spawned alongside lots of the attacks that we saw in 2003-2010 period.

Syria has many of the same characteristics. There were people going out knowingly and actively taking extremist positions, others instead taking humanitarian positions to get out there. But once they are there and have the experience of being out there, the teaching they receive on the battlefield, the bonds of comradeship they form, the actual physical experience of battle, all work together to make them more radicalized and then ultimately bringing the threat back with them. It was absolutely clear during the post-9/11 period that this threat had been exported from Afghanistan and by those that had gone to Afghanistan, and I think that even from my slightly more distant position today, Iraq/Syria has many of the same characteristics.

The unique selling proposition for IS [the Islamic State] was the fact that it presented itself [as] a caliphate and it held territory. I always took the view that the very first thing you have to do in this particular case is take the territory away from them so as to demolish their claim to a status of a caliphate. But you needed a military process to take away some of their legitimacy. And now we will go, I guess, into a long period of threat from the [jihadi] alumni of Iraq/Syria.

CTC: I did want to pick up on your mention of the Kashmir issue and its capacity to be a push-factor toward radicalization in the United Kingdom, given the recent tensions in the region.

Evans: My main point there was that because of the particular shape of the Pakistan-Kashmiri diaspora in the U.K., Kashmir is a real hot-button issue. Inevitably, the recent actions of the Indians in Kashmir are likely to further have inflamed tempers. People care desperately about Kashmir in places like Bradford, and it is a radicalizing issue. So I would have thought that it is an exacerbating factor, although I don’t have a particular reason to believe that it will then turn itself against the U.K., given the fact this is an India-Pakistan conflict point. I can certainly see it as an intercommunal issue, although on the whole over the years, intercommunal issues haven’t really played out very heavily in the U.K. People have very strong views, but surprisingly, they don’t tend, for the most part, to play out on the streets of our cities.

CTC: An ideology that has increasingly worried people and has come under greater focus recently is the extreme right wing. Has its rise as a threat surprised you? Was it something you were focused on?

Evans: Yes, I was focused on right-wing extremism. I have always taken an interest in the far right, partly zoologically, because some of the individuals involved are so wacky that it is quite fascinating to watch them. I can remember back in the 1980s and 1990s, the saving grace of far-right extremists is that because they had such extreme and odd views, they tended to be extreme and odd people who did not tend to be very good at working with each other. You saw groups that tended to fragment and split like something out of a Monty Python film into smaller and purer groups. So, they never quite managed to get their act together into something more substantial. But from the early 2000s, and in those days it was mostly a police focus, from time to time individuals would come to light who were on the fringes of the far-right groups, who had been building bombs in their garden sheds, and who hated Muslims and so on. These cases were redolent of other earlier cases such as the London nail bomber, David Copeland, who went on a bombing campaign in London in 1999.⁴ He was on the fringes of the far right, not an active member of any particular organization, but took it upon himself to build bombs which he used to attack the ethnic and gay communities in London. Around the same time, there was a group called Combat 18, which was quite active and was itself a fragment of the far right. There were a few individuals in that group who started to espouse the idea of terrorism The [Security] Service worked closely with police to undertake some disruptions in the late 1990s of Combat 18 associated individuals who were consorting with people of similar cast of mind in Eastern Europe and the former Soviet bloc. These groups had explicitly decided that terrorism was part of the way forward in order to try to destabilize what they characterized as the Zionist Organized Government (ZOG).

We’re seeing similar sorts of actors again now in the far-right scene. Partly I suspect it is a reflection of the social pressures on communities as a result of austerity measures [in the U.K. in the years after the 2008 financial crisis]. There seems to be a constituency of disaffected males (for the most part, but not entirely) who find extreme right-wing beliefs attractive. And they have started to get their acts together to organize into groups and plot. And there is some evidence that they have been consciously and deliberately inspired by the perceived success of the violent Islamists in getting their grievances on the table as a result of violence and thought and thinking “well, we can do something like that.” Certainly during my time, it was the English Defence League (EDL) who had started to develop this narrative. The EDL was not quite the same as other extreme right-wing groups, but they were a reactionary group that fed off and were mutually symbiotic with [the British Islamist extremist grouping] Al Muhajiroun (ALM). The EDL emerged explicitly in response to ALM activity, though in fact they both needed each other ideologically to advance. ALM needed the EDL because they gave them justification for their position and vice versa. So, they were both mutually beneficial to each other. Looking at the threat picture now and how it is evolving, I am not surprised that we have an extreme right-wing threat. We have seen signs of it emerging for 10 years-plus, and the fact that it is now more organized with groups like National Action [a proscribed U.K. extreme right-wing group] was almost predictable.

CTC: Turning to the threat from Irish terrorism and its current state, you mentioned the importance of the threat when you joined the Service. Currently, the threat to Northern Ireland from Northern Ireland-related terrorism is assessed to be higher than the terrorist threat facing the United Kingdom as a whole from all forms of terrorism.^e Could you give us some reflections on the current state of this threat?

Evans: MI5 took over primacy for national security in Northern Ireland when devolution took place in 2007, given national security cannot be devolved.^f This led to greater responsibilities for MI5 in the region, and it became fairly evident quite quickly that despite the tremendous political success of the 1998 Good Friday Agreement, there was a rather fissiparous, but significant group of dissidents who did not accept the political settlement and wanted to foment terrorism. The solution, insofar as it was a solution, to IRA terrorism at the time was a political solution, which was to reach a negotiated accommodation between the different communities which both sides could just about manage to accept. There was a deliberate decision back then on the part of the republican groups to go down the political route because they saw that as a more effective way of achieving their aims, and as a result of that, there was also a diminution of support for terrorism for violence by the loyalist groups.

The current problem is that there is not a similar deal to be done with the dissidents that are left because they are irreconcilables and therefore the response to them over past 10 years has been a straight security response. During the time I was the Director General of MI5, we had more officers pro rata in Northern Ireland than we had in the rest of the U.K. because of the fact that there were many potentially lethal plots being fomented by the dissident groups. And from time to time, one of those would succeed. There has been a periodic drumbeat of terrorism for the last 10 or 15 years in Northern Ireland, with occasional attacks or attempted attacks on police or prison officers. There was a bomb outside our headquarters just outside Belfast in 2010⁵ [and then subsequently another in 2015⁶]. This hasn’t gone away. And there is the additional problem that because of the link between criminality and terrorism, various people have an interest in it not entirely going away.

The question of the moment is whether the political tensions in Northern Ireland around Brexit and the potential for a hard border with the Republic will mean terrorism will rebound? My view on this [is that] it will give probably a little twist and boost to the dissident groups. They will be able to say that the entire settlement that created the more stable current situation was based on the false premise of European unity. But I would be completely astonished if Sinn Fein [the political party that was closely associated with the IRA] decided to go back to terrorism because the Good Friday Agreement has worked well for them; they are the only political party which has got significant and substantial representation north and south of the border [in both Northern Ireland and Ireland]. If anything, the recent developments with regard [to] Brexit probably give them more hope that a future poll might lead to reunification through the ballot box, so why spoil that potential opportunity by going back to violence. So I would totally discount the idea that the IRA might decide to return to terrorism. The dissidents will probably get a boost, but they [would] struggle to get things back to where they stood in 1985. Partly because security capabilities have developed considerably over that period and [because] there is much greater investment, and therefore I think it would be harder for them. And also, I don’t think they have a core of community support which is sufficient to sustain a big, long-term terrorism threat in the way that Sinn Fein were able to do for the IRA during the 1970s, 80s, and 90s.

CTC: To talk briefly about Brexit, you’ve been vocal about the negative consequences on U.K. security. Could you comment on that more broadly than Ireland? And how it will impact the United Kingdom’s response to terrorism?

Evans: I think the narrow question of intelligence sharing in Europe will not be immediately impacted by Brexit because intelligence sharing and intelligence matters have never been within European Community (E.C.) competence, and therefore the structures for enabling that are not E.U. structures. Those relationships will continue. The U.K. has been an overall net contributor to those relationships, and it is valuable to both sides that those relationships continue. But when it comes to interventions [disruption operations], those are very often law enforcement interventions. And law enforcement, policing, is within E.C. competence, and therefore things like Europol will be impacted. Whilst I would imagine that we will be able to negotiate sensible engagement with Europol, we will not be part of the core Europol community because we will not be part of the European Union. So, remaining involved with Europol will, at the very least, require extensive negotiation; it is not simply a case of people saying, “well, we want them in, so we let them in.” It would be a legal question, and it is unlikely we will be in as advantageous a position in terms of law enforcement cooperation as when we were members. The net effect will be a less effective response, in my view.

Secondly, and very importantly, the U.K. has been for some time a voice in political discussions within Europe for the security dimension of problems to be given appropriate weight. On issues such as data sharing, data protection, and so on, the fact that the U.K. has very forcefully promoted the importance of national security, as well as data privacy, has meant that the overall policy positions that the E.U. have come to have tended to be ones which were different than would have been the case if the U.K. had not been there. The U.K. has had allies in achieving these outcomes, of course, but we have been very vocal and effective in lobbying to get these goals. Now we are not going to be at the table in the same way, and while we have a wonderful diplomatic service who will excellently represent our interests and seek to influence others, it will not be the same as being at the table with a vote. From that point of view, one of the dangers is that the E.U. will take policy positions which are less security-friendly than they would otherwise have been had the U.K. been there in the debate as a full member. And whilst we will not be a member of the European Union, we will still be deeply affected by the decisions they make because we are a close neighbor and we are still going to be closely connected. The danger is that we get a policy framework which is less facilitative of information sharing and security concerns than would otherwise have been the case, something that will be a net negative in national security terms.

CTC: Finally, a more future-looking question. You mentioned earlier the attention you historically paid to the PKK and Sikh extremism, and we have talked about the threat from extreme right-wing terrorism. Are there any other issues or ideologies out there which you see as brewing terrorist threats?

Evans: I do find that a very difficult question. I suppose the question is whether there is an unspoken-for political movement out there which could become the fuel for future terrorist threats. There was a kind of canary in the mineshaft in regard to what happened with Islamism in the U.K. in the Salman Rushdie affair^g because it demonstrated that there was a very vigorously held strand of thought out there which was in tension with the assumptions of the way in which British society should work in the 1980s and 90s. And I’m not trying to overemphasize the linkage, but the protests and anger around the Rushdie Affair amongst Britain’s Muslims did show that there was an issue here, which, because of circumstances, grew. The problem is identifying similar issues in the future. Predicting the future is an unsatisfactory process, because the truth is you do not know what is going to happen and how things will develop. I cannot identify here and now what the next such issue might be, but the key to establishing what might emerge in the future is to look at the areas where there is political tension which is not being addressed as this is where problems are likely to emerge.

CTC: Some have, in the past, expressed concern that the radicalization of [elements of] the environmental movement might lead to violence. Do you think this is a possible risk?

Evans: I suspect it is not an area where terrorism would be the response. The truth is that non-violent activism by [environmental activists] has had an impact over the last few months and is changing people’s political minds. Within this context, terrorism would be counterproductive. It is like animal rights in many ways: there will always be a small group of people who will go for violence because they have a predilection for it. Animal rights was quite a concern 15 years ago, and there were moves in the late 1990s towards terrorism by some of the extremists amongst the movement. And you could maybe see something like that emerge amongst the more extreme environmental position, but that’s different to mainstream environmentalism. So you might see individuals going down the route of violence, but I doubt that it will develop into the major phenomenon that Irish terrorism was for a generation, that Islamist terrorism has been, or even the far right, because you need a particular set of issues to take place to it for it to mature to that point. Key to this is a large, unaddressed political issue.

So whatever you think of the outcome of the recent election in the U.K., the fact that some of the legitimate concerns, that were being used as a pretext by English nationalists, have now been formally acknowledged at the ballot box might be a good outcome, even though it is sort of disconcerting for southern liberals. There was a significant alienated and disenfranchised group out there who didn’t think the system was taking any notice of them. And that’s where you need to be concerned about extremists exploiting legitimate concerns. Disaffected English nationalists were manifesting themselves at the extremes in things like the British National Party (BNP) and National Action, which fed the undertone that articulated itself as extreme right-wing terrorism. And attention still needs to be paid to this group, as it is not clear that they will feel entirely assuaged as a result of the fact that people are paying wider attention to them now. Terrorist problems emerge when you have a significant population who feel alienated and nobody takes notice of them, causing frustration and anger. CTC

Substantive Notes
[a] Editor’s note: The PKK is the Kurdish Workers Party, a Kurdish militant group based in Turkey focused on creating a free Kurdish state. They have recently become known for their links to Kurdish groups fighting against the Islamic State, but are more prominently known for their decades-long terrorist campaign against the Turkish state.

[b] Editor’s note: Tariq Mahmood, a U.K. national from Birmingham, was announced arrested by Pakistani authorities in late 2003 and accused of links to al-Qa`ida. “Pakistan holds British al-Qa’eda suspect,” The Telegraph, November 17, 2003.

[c] Editor’s note: There are four pillars to CONTEST, the U.K. government’s counterterrorism strategy. These are: “Prevent: to stop people becoming terrorists or supporting terrorism; Pursue: to stop terrorist attacks; Protect: to strengthen our protection against a terrorist attack; Prepare: to mitigate the impact of a terrorist attacks.” See “CONTEST: The United Kingdom’s Strategy for Countering Terrorism June 2018,” p. 8.

[d] Editor’s note: See Ed Husain, “Take these claims of ‘rehabilitation’ with a bucket of salt,” Daily Telegraph, December 7, 2019. Ed Husain is a British commentator who rose to prominence in 2007 when he published The Islamist, an account of his experiences as a member of Hizb ut Tahrir in the United Kingdom. Having left the group and repudiated extremism, he rose to prominence as a commentator, author, and activist speaking, writing, and advising on Islam around the world.

[e] At the time of publication, the assessed threat to the United Kingdom from terrorism is “substantial” and the threat to Northern Ireland from Northern Ireland-related terrorism is “severe.” See “Threat Levels,” Security Service MI5.

[f] Editor’s note: The United Kingdom is made up of England, Wales, Scotland, and Northern Ireland but administered from London. Devolution has occurred over time and meant that greater powers have passed to regional assemblies like the Scottish Parliament, the National Assembly for Wales, the London Assembly, and the Northern Ireland executive. This grants these regional legislatures and their executives powers over certain legislation. National security sits outside this system, however, and is controlled and implemented centrally across the entire country.

[g] Editor’s note: Salman Rushdie’s 1988 novel Satanic Verses resulted in anger among a significant number of Muslims around the world, including inside the United Kingdom. In 1989, Iran’s Ayatollah Khomeini issued a fatwa against Rushdie. In 1998, the Iranian government declared that it no longer sought Rushdie’s death. For more, see “Satanic Verses, Novel by Rushdie,” Encyclopaedia Britannica.

Citations
[1] Editor’s note: For more on this case, see Phil Mackie, “Moinul Abedin: UK’s first al-Qaeda inspired bomber,” BBC, March 2, 2012.

[2] Editor’s note: Rauf’s involvement in al-Qa`ida plots against the United Kingdom is outlined in detail in Raffaello Pantucci, “A Biography of Rashid Rauf: Al-Qa’ida’s British Operative,” CTC Sentinel 5:7 (2012).

[3] Andrew Parker, “Director General Andrew Parker – 2017 Speech,” Security Service MI5, October 17, 2017.

[4] Editor’s note: For more on this case, see Sarah Lee, “London nail bombings remembered 20 years on,” BBC, April 30, 2019.

[5] Editor’s note: “Bomb explodes outside MI5 headquarters in Northern Ireland,” Reuters, April 12, 2010.

[6] Editor’s note: Henry McDonald, “Police investigate explosion at MI5 headquarters in Northern Ireland,” Guardian, August 14, 2015.

Tougher Sentencing Won’t Stop Terrorism

Posted: February 12, 2020 in Foreign Policy
Tags: counter-terrorism, de-radicalization, lone actors, prison radicalisation, terrorism, UK, UK counter-terrorism, UK terrorism

And finally in this catch up wave, a piece from earlier this week for Foreign Policy looking in some more detail at the recent burst of terrorist attacks in the UK. To also catch up on some media appearances, spoke to the Guardian about recidivism amongst terrorists in the UK, to Yahoo News and the Daily Mail about the vogue of using fake bombs and knives in attacks, the earlier RSIS piece on Streatham was picked up by Eurasian Review, on the other side of the coin spoke to CNN about China and Europe and the earlier Telegraph piece commenting in the wake of the UK’s Huawei decision was picked up by China Digital Times.

Tougher Sentencing Won’t Stop Terrorism
A string of attacks in Britain have led Boris Johnson’s government to seek simple remedies that won’t fix the problem.

Raffaello Pantucci | February 10, 2020, 4:10 AM

Police assist an injured man in London, on Nov. 29, 2019 after reports of shots being fired on London Bridge.

Police assist an injured man in London, on Nov. 29, 2019 after reports of shots being fired on London Bridge. DANIEL SORABJI/AFP via Getty Images

In the wake of Britain’s third terrorist incident in two months—a stabbing carried out by a recently released terrorist offender in the South London neighborhood of Streatham—the U.K. government is reaching for the most obvious legislation at hand to prevent such attacks and seeking to extend the detention of convicted terrorist offenders.

Drafting policy in the wake of a terrorist attack is always fraught with danger. With emotions high, people will grasp at whatever flaw in the system seems obvious at that moment—police surveillance, parole leniency, sentencing laws—and use that as the basis for new policies. Yet the consequences of such knee-jerk reactions can be far-reaching, and undoing the damage later can be complicated. Most worryingly, quick fixes tend to overlook the real reasons behind the problem. While some of the government’s proposed responses—such as increasing investment in probation—deserve to be applauded, the push to simply extend detention won’t address the issue at hand.

It is helpful to start by looking at the three recent cases in detail. The first took place Nov. 29, 2019, when a released terrorist offender used knives and a fake suicide vest to attack a rehabilitation conference he was attending, murdering two people before being shot by police on London Bridge. On Jan. 9, a convicted terrorist prisoner in the HMP Whitemoor prison in Cambridgeshire led an attack using bladed weapons and fake suicide vests against prison wardens. And on Feb. 2, a recently released terrorist offender was shot down as he sought to pursue an attack on shoppers in Streatham using a knife and a fake suicide vest. Given these incidents happened within the span of a few months and appear similar on the surface, they have been treated as a trend. Yet a close examination reveals many differences.

While some of the government’s proposed responses—such as increasing investment in probation—deserve to be applauded, the push to simply extend detention won’t address the issue at hand.

All three cases involved individuals who had been convicted of terrorism offenses and had served or were serving time for them. But when they launched their attacks, they were at very different stages of their sentences—in HMP Whitemoor, the convicted terrorist offender still had years to go (and now will doubtless have many more), while the London Bridge and Streatham attackers had been released on license. The London Bridge attacker had been out of prison for about one year and had, during that time, participated in a deradicalization program. He had stopped in the months prior to the attack; the full story of what took place in the intervening months has not yet emerged.

In contrast, the Streatham attacker never engaged in any deradicalization programs while in prison and on release appears to have quite quickly decided to carry out an attack. Evidence of his determination was clear after his initial arrest on May 17, 2018, following an investigation into his online activity. Not only did police find voluminous amounts of extremist material that he had shared with his family and friends, but they also found notebooks full of expressions of his desire to be a martyr and bomb-making plans.

Following his arrest, he was interviewed 19 times, during which time he largely responded “no comment” to all of the questions posed. During his sentencing hearing on Dec. 17, 2018, the judge commented on his level of fanaticism, something also emphasized by the head of the U.K. counterterrorism command when he commented on him post-sentencing.

The three cases are therefore quite distinct: The HMP Whitemoor case involves an individual who is facing a long incarceration, the London Bridge attack concerns a man who started to engage with a deradicalization program and then stopped, and the Streatham attacker seemed very firmly set on a course toward committing a violent crime. A failure in deradicalization programs was only potentially an issue in the London Bridge attack. The attacker seemed to be on a positive path once out of prison but then veered off course for reasons that are still not clear.

Of the three, a longer prison sentence would be most clearly relevant in the Streatham case, though it is unclear that the additional year in prison he would have had to serve if he’d completed his full sentence would have been enough to deter him from carrying out an attack. He had not shown any evidence of abandoning his ideas and was of such concern to security services that they had maintained intense surveillance on him after his release. It is hard to imagine that another year in prison would have done much to deradicalize him.

History actually shows that recidivism among convicted terrorist offenders in the U.K. is quite rare.

For the attacker in HMP Whitemoor, an already heavy sentence will now likely double. Longer sentencing may not have much effect (except to increase his eagerness to attack more guards). In fact, reporting on the case suggests that he has been radicalizing other prisoners, leading ad hoc sharia courts, and causing problems for prison guards.

And beyond these three cases, it is important to remember that there is a large number of terrorist offenders in prisons, many of whom are due to be released soon. These are the ones who might be affected by the government’s rushed policies. Yet no evidence has been produced that they are all in the same bracket as either the Streatham or London Bridge attacker. History actually shows that recidivism among convicted terrorist offenders in the U.K. is quite rare.

According to my research, since 2013, out of approximately 40 known plots, there have been just six plots involving people who had previously been charged with or convicted of terrorism offenses. Two plots involved people who had been charged for prior extremist activity: a group from 2014 that wanted to stab a poppy seller during Remembrance Day and a group known as the Three Musketeers that was arrested in 2016 plotting a knife and bomb attack. One of the three had been previously arrested alongside the London Bridge attacker, while the other two were part of a failed 2011 attempt to travel to a terrorist training camp in Pakistan.

According to Home Office figures, during the year ending June 2019, 53 prisoners held for terrorism-related offenses were released. Most, as far as authorities know, have not reoffended. It is therefore clear that not every terrorist offender who is released from prison will behave like the Streatham attacker.

A more salient similarity among the three cases is the attackers’ relative youth at the moment of first being arrested.

The London Bridge attacker’s house was first raided when he was 17 years old, the Streatham attacker was arrested for the offense for which he was jailed at 17, and the HMP Whitemoor attacker was picked up for involvement in a terrorist plot when he was 18.

While this is not a new phenomenon—two of the 2005 London bombers were 18 and 19 years old—there has recently been an increase in very young people becoming involved in active terrorist plotting. One of the cases of concern in the press at the moment is of an anonymous boy who was arrested at the age of 14 for being involved in an Islamic State-linked plot to attack security officials in Australia and is due for release soon.

This growing cohort of young offenders suggests that the process of radicalization is taking place at a very young age, when people are more susceptible to negative influences. In other contexts, young people who are drawn into violent or criminal activity are dealt with through criminal sanctions and engagement in rehabilitation programs, given that the young tend to be more susceptible to influencing. If such young people are being radicalized, the government needs to reconsider how it is handling such cases. Long prison sentences are undoubtedly justified in some cases, but the youth of the offender might mean that, in other cases, a more intensive rehabilitation program might help place them on a better path.

Finally, there is the question of copycat attacks. It is clear that the three attacks were in part inspired by each other—the attackers all chose to use the same methodology of knives and fake suicide vests, which is a relatively new innovation on the U.K. terrorist scene. In the wake of five terrorist attacks in 2017, Metropolitan Police Assistant Commissioner Neil Basu commented how the first attack using a car against tourists on Westminster Bridge and knives on police in front of Parliament had to some degree inspired the others. As he put it, the March 2017 Westminster Bridge attacker “gave fellow violent extremists the understanding that the U.K. was not such a hostile place to launch attacks and that by using this simple methodology you could succeed.”

The dilemma law enforcement officials face is how to stop attacks from inspiring other attacks. The question is likely around coverage of incidents, rather than anything to do with the incidents themselves.

The vogue for knife attacks started in 2013 after two radicalized individuals murdered an off-duty soldier by running him down and then trying to decapitate him on a street in South London.

Covered in the victim’s blood, they then declaimed their radical message to bystanders’ smartphones and the world, filling news broadcasts for weeks afterward and showing other terrorists how easily successful attacks could go viral and grab the world’s attention. The answers will not be found in prisons; to effectively break these chains of attacks, governments and journalists need to think carefully about how terrorist incidents are covered and reported.

The questions of the effectiveness of deradicalization programs, occasional recidivism, very young offenders, and the inspirational effect of attacks will not be answered by a simple extension of sentencing. While there may well be cases where offenders should be imprisoned for longer, it is not a solution that is applicable to all. And it is counterproductive to publicize certain cases in the press when it is clear from history that the majority of individuals who have served sentences for terrorism offenses have not returned to terrorist activity. Having their names and faces splashed in the press is unlikely to help with their rehabilitation and might leave them feeling ostracized and motivate them to return to terrorism.

Judicial and policy decisions must be objective and delivered without emotion. If a government chooses to pass new legislation on terrorism at a moment when the country is reeling from attacks, it is unlikely to make sensible and dispassionate judgments. There may well be gaps in legislation, but the British government must be careful to ensure that any new legislation addresses real problems, rather than simply pandering to the public’s fears.

Raffaello Pantucci is a senior associate fellow at Britain’s Royal United Services Institute and a visiting senior fellow at the S. Rajaratnam School of International Studies in Singapore. He is the author of We Love Death As You Love Life: Britain’s Suburban Terrorists. Twitter: @raffpantucci

Responding to Streatham: Managing Low-Tech Terrorist Threat

Posted: February 11, 2020 in RSIS
Tags: counter-terrorism, lone actor, terrorism, UK, UK counter-terrorism, UK terrorism

Almost up to date, now my inaugural piece for my new Singaporean home RSIS in the form of one of their commentaries, this time looking at the recent spate of terrorist incidents in the UK using the Streatham attack as the peg.

Responding to Streatham: Managing Low-Tech Terrorist Threat

Raffaello Pantucci

ICPVTR / Commentaries / Country and Region Studies / Europe / Middle East and North Africa (MENA)

10 February 2020

Synopsis

The 2 Feb Streatham attack in south London does not appear to have been part of a larger plot. But it has once again shone a negative light on the UK’s approach to counter-terrorism and de-radicalisation, this time under the newly appointed government.

Commentary

ON 2 FEBRUARY 2020, the south London district of Streatham saw a knife-and-fake bomb attack in which a man was shot dead by police after stabbing two people. ISIS claim of responsibility has little credible evidence; despite the young man’s reported pledge of allegiance to ISIS, there is no proof they were in contact.

The attack, however, comes against a political context which will demand some reaction. The re-installed Tory government has now faced three incidents on its watch. The outward similarities in all three draws public attention. The United Kingdom fears that it could find itself in the midst of another 2017 when the country suffered five terrorist attacks in relatively quick succession.

More Copycat Attacks?

The most immediate concern for authorities will be the possibility of a copycat incident of some sort. The Streatham attack itself was already a copy. The knife-and-fake-bomb model is one that was deployed in 2017 on London Bridge, on London Bridge again in November 2019, and then in Her Majesty’s Prison (HMP) Whitemoor in early January 2020 when a convicted terrorist offender and a prisonmate attacked prison guards with bladed weapons and fake suicide vests.

Further emulation might be possible given the simplicity and relative success (in media terms) of the attack. The approach of using knife-and-fake-bomb is a new innovation that has been proven to deliver easy success. The Streatham attack showed how you could wait until the moment of attack to arm yourself, completely compressing the time to attack.

It is hard to completely assess at this stage the exact nature of inspiration that the three plots played towards each other. But on the basis of previous chains it is likely that any subsequent spontaneous ones are likely to come sooner rather than later. More considered plots do not necessarily fall within this analytical framework.

Undirected “Campaign” of Lone Actors

At this stage, the Streatham attack appears as an isolated act. However, as 2017 showed in the UK, a terrorist campaign no longer needs to come in the form of a series of directed attacks; it can also happen to a series of incidents like this. Both Al Qaeda and ISIS have championed the lone actor model of attack repeatedly.

Understanding how to analyse potential lone actors from a pool of potential offenders was a major question to emerge from 2017, and it will likely now be revisited again.

It is worth noting that security authorities were very concerned about the Streatham attacker. The fact he was being monitored as he went about his Sunday business by an undercover armed response unit (armed response units are rare in the UK) shows a high level of risk management assessment.

The high level of concern was visible earlier as well. The counter-terrorism lead at the time of his detention and the sentencing judge all publicly expressed concern about his level of radicalisation. Reporting from his time in prison has suggested that he refused engagement with de-radicalisation programmes.

Offender Management in Prison

A running theme between the London Bridge, HMP Whitemoor and Streatham incidents is prison. However, there are differences that are important to highlight. While the Streatham incident took place days after the offender’s release, the London Bridge attacker waited over a year to launch his attack, for some part of which he engaged with a de-radicalisation programme.

In contrast, the HMP Whitemoor offender still has a number of years on his sentence (a sentence which is likely now to become longer). It is therefore hard to judge where the useful comparison is to assess where the problems might lie.

Recidivism is rare among UK terrorist offenders – prior to the London Bridge attack last year, no successful plots involving recidivists had been seen. While there is a cadre of radicalised individuals who consistently show up on charges for various related offences (often individuals drawn from the Al Muhajiroun community), actual attacks (or plots) by people previously convicted of terrorism offences is a relatively new innovation in the UK context.

Prior to the current cluster, the UK had only seen two since the conflict in Syria started (out of around 40 or so plots that have been disrupted or taken place).

Youth Radicalisation and Long-term Monitoring

Another similarity between the three recent cases is the relative youth at the time of first offence of the three men. The Streatham attacker was 17 when he first came to authorities’ attention, the London Bridge attacker’s house was first raided by counter-terrorism authorities when he was 17 and the HMP Whitemoor offender was 18 when he was arrested on his way to launch a knife attack.

Aside from what this means for radicalisation, it presents a long-term issue for authorities when it is considered alongside the fact that the UK has seen a terrorist attack by a 52-year-old (London Bridge, March 2017). Authorities may have decades of monitoring ahead of them with all of the expense and resource that entails.

Beyond Deradicalisation Programmes

The attacks have drawn attention to the effectiveness of de-radicalisation programmes. While the Streatham attacker refused to engage, the London Bridge attacker before him had been engaged for some time before stopping in the months prior to his attack. In other words, de-radicalisation programmes are not relevant across all of the cases and such dramatic failures are a new phenomenon in the UK.

The UK has had almost two decades of Islamist terror offenders, but only recently are we seeing such attacks from amongst recidivists. At the same time, it is clear that this is where the current heart of the problem lies given the growing number of people coming out of prisons or back from Syria.

This means more offenders (or people of concern) who will need attention for longer. The idea of using probation services better to manage such offenders is good, but this means probation needs a considerable uplift.

Streatham is now the 11^th known attack with Islamist links that the UK has seen since the Conservatives took power in 2010. While the nature of the threat has changed, it is not clear that all aspects of the response have kept up.

Problematically, however, the current commentary emanating from Whitehall suggests that the response is likely to focus on punitive measures pandering to a political base.

About the Author

Raffaello Pantucci is a Visiting Senior Fellow at the International Centre for Political Violence, Terrorism Research (ICPVTR) of the S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University (NTU), Singapore.

A View from the CT Foxhole: Neil Basu, Senior National Coordinator for Counterterrorism Policing in the United Kingdom

Posted: February 21, 2018 in CTC Sentinel
Tags: Al Qaeda, counterterrorism policing, ISIS, lone actors, policing, UK counter-terrorism, UK terrorism, XRW

A new piece for an excellent outlet that I occasionally contribute to, the CTC Sentinel, which is an interview with Neil Basu, the Senior National Coordinator for Counterterrorism Policing in the UK. It is quite a wide-ranging discussion around the current threat picture, recent problems, and future threats that might mature. It got a bit of a bounce getting picked up by The Times, Daily Mail, The Sun, Asharq al Awsat, and some other local UK outlets. It was also suitably spun by RT. Thanks to editor Paul for all his hard work on it! Separately, spoke to Vice about the Jihadi Beatles, and Arab News about foreigners fighting with Kurds.

A View from the CT Foxhole: Neil Basu, Senior National Coordinator for Counterterrorism Policing in the United Kingdom

DAC-Neil-Basu-06-600x429

February 2018, Volume 11, Issue 2

Authors: Raffaello Pantucci

Deputy Assistant Commissioner Neil Basu is Senior National Coordinator for Counterterrorism Policing in the United Kingdom, a role he was appointed to in October 2016. He is responsible for delivering the police response to the Pursue and Prevent elements of the Government’s CONTEST strategy. In this role, he coordinates the policing response to threats arising from terrorism and domestic extremism nationally and also manages the Metropolitan Police Service’s Counter Terrorism Command (SO15). In his career, Basu has worked as a detective in all ranks to Detective Superintendent, served as the Area commander for South East London, and headed London’s Armed Policing within Specialist Crime & Operation.

CTC: How has U.K. counterterrorism policing evolved to confront the changing threat?

Basu: 9/11 was the contemporary game changer. In the U.K., it started off with some plotting between 2002 and 2004, which wasn’t just concentrated in London. It was also regional. Then you get to 2005, and in the worst way possible, we were taught that this was actually embedded in local communities: domestic home-grown terrorism with some direction from abroad. So there was a need to build regional capability, and that was the start of the network that we have today. Now we have nine counterterrorism units—embedded regionally, collocated with MI5, building intelligence in local communities, [and] connected into local community policing.

Given the nature of the threat we now face, we need to be even more focused on communities and more focused on getting local information. While the ambition is still there for the mass spectacular—and the July 2017 airline plot in Sydney, Australia, was a recent example of that—IS [the Islamic State] has been encouraging supporters living in the West to carry out high-impact/low-complexity attacks. Because of the military push on the ground in Syria and Iraq and the effective eradication of IS’ geographical territory and their ability to project that abroad, it is much harder for them to send trained people back. Borders have closed. Turkey has done well with their border.

The big threat for us now is the ideology that’s been diffused onto the internet and the calls for attacks by its followers in the West by IS online. The caliphate may have been defeated militarily, but it has now become a virtual network. What we’re not seeing is a reduction in people’s willingness to align themselves with this ideology. So even though there is no caliphate to go and fight for, in the minds of some British extremists, the fight carries on because they can aspire to go to Libya or another ‘province.’

In confronting this evolving threat, we have to be more ‘fleet of foot’ at a time when ‘going dark,’ due to the widespread availability of encrypted apps, has become the new norm. We can no longer depend upon all the usual intelligence-gathering apparatus.

CTC: Has the locus of the threat abroad shifted? Syria and Iraq was where the threat was, but would you now look to Libya as a place where you could see the same sort of a threat emanating from?

Basu: You would be completely foolish not to worry about Libya. All of the coalition thinks that that is going to be a tremendous problem in years to come. Anywhere there is ungoverned space, anywhere there is fragile political governance is a potential source of threat. But it is not clear that it is going to be easy for terrorists to move from location to location. We already know of eight or nine IS affiliates around the world that have claimed allegiance, with [fighters in] Libya being one example. Libya is very close to home for Europe and our allies, but for a long time, it was not the focus for our attention. For us in the U.K., what happened in Manchester was a big wake-up call to the fact that there were people who had traveled back and forth to Libya doing much the same thing we were preventing people from doing in Iraq and Syria and who had a similar hatred for this country. And oddly enough, these travelers were second or third generation [immigrants], not necessarily the generation you would assume.

CTC: The Manchester attack and its links to Libya were particularly striking given the similarities with other networks and plots seen previously in the U.K., in particular historical networks linked back to terrorist groups in Pakistan.

Basu: You would have to take a huge leap of faith to say Salman Abedi [the Manchester suicide bomber] was not traveling to and from Libya with some malicious intent and that it was all just about family and socializing and not about training. We’ve long known that training overseas can battle-harden people. It’s not just being able to fire a gun; it’s the psychological bar that you overcome by being brutalized in theater. Once you get a taste for violence, the second time is much easier. And cops know that from dealing with violent criminals.

CTC: A year after the cluster of plots in the first half of 2017, do we have any more clarity on what precipitated all of that terrorist activity in the U.K.?

Basu: JTAC [Joint Terrorism Analysis Centre] was very good at saying something is coming. Security analysts understood that once there was a military push on the ground against them [Islamic State fighters] in Syria and Iraq, they were going to start lashing out. Leaders like [Abu Bakr] al-Baghdadi and [Abu Muhammad] al-Adnani, before he was killed, were telling followers in the West they didn’t need to ask permission from an emir; they could just go ahead and launch attacks.

This was the backdrop that was making security forces nervous. Then, and this is a personal view, Khalid Masood [the March 2017 Westminster bridge attacker] launched his attack. He had no clear and obvious connection to either IS or al-Qa`ida. He was clearly someone who cherry-picked the bits of Islam that he believed justified what he did. Whether his particular religious interpretations was the actual driver for what he did, I am of two minds, but his motivation died with him. There is no concrete information that it was for the glory of the caliphate or for the glory of IS or for the glory of AQ. But what he did achieve was that he gave fellow violent extremists the understanding that the U.K. was not such a hostile place to launch attacks and that by using this simple methodology you could succeed. Some violent extremists admired him for actually going ahead and doing it. Some criticized him for not doing a very ‘good job.’ But at the end of the day, what it did say to them was that ‘my plot could work. What I have been thinking of doing, I could actually do.’

CTC: Have you seen much of a change in the threat picture since Raqqa has fallen? Or has it had no effect?

Basu: What we’ve seen is a lot more chatter, a lot more people thinking that they have a chance of successfully carrying out attacks. So the pace and tempo, the number of leads that we think are concerning, the pace has gone up. Whether or not this is linked to the push in Raqqa is hard to tell.

In terms of plots, the trend is towards less sophistication, more amateurism. We’ve not seen a growth of extremists. We’ve seen more conversations among extremists expressing the belief they can launch successful attacks here. So definitely the pace of plotting activity we’re looking at has gone up. But then that was predictable as well. I don’t think anyone thought the military defeat of the group in Syria and Iraq was going to be the end of this. We are dealing with an ideology, which is being spread online and has global reach, and we to need to confront this by clamping down on what’s being spread through the internet and better engaging with people who are vulnerable to the extremist message.

CTC: Earlier this year, Minister of State for Security Ben Wallace stated a significant number of British nationals who signed up to fight with extremist groups in Syria and Iraq had gone missing somewhere in the region.¹ What do we think has happened to those who are unaccounted for? Where have they ended up?

Basu: I think there’s probably more in detention overseas, including in YPG or Kurdish or SDF detention, than we currently know. We obviously won’t know everyone who’s died. It’s a warzone and difficult to be definitively accurate. We estimate that 15 percent of the 850 foreign fighters that have traveled from the U.K. to Syria and Iraq have died. There are some we absolutely know died, and there are ones we guess are deceased because, for example, they are no longer communicating. Establishing the fate of the others is going to be very difficult.

I think we have made it very clear how hostile it would be for foreign fighters if they return here. The policy is very clear. You do not get to come back here if you did manage to get over there and you are a fighter.

About half of the 850 who traveled to Syria and Iraq since the onset of the Syrian civil war have returned to the UK. The large majority of these came back very quickly and early on. Some of those were genuine aid workers. Some were people who thought they were going to build a caliphate, not necessarily be immersed in a war. Generally speaking, the people who came back quickly are not where the bigger threat lies.

The larger threat is posed by the return of committed recruits who went there to be trained. When it comes to people who we know are back in the U.K. that we suspect fall into this category, we have either tried to build a case or we’ve monitored them or we have talked to people who know them. As far as those who are still overseas are concerned, we have been making it very clear that this will be a very hostile place to come back to, and I do not think most of these foreign fighters will want to come back. They will want to fight on, and that’s why they have been so committed to being in theater for this length of time.

We are still not seeing what many predicted was going to be a large reverse flow as the so-called ‘caliphate’ disintegrated. Instead, we are seeing just the odd person come back.

When it comes to those still unaccounted for—and who are not being held in detention in the region—I have no doubt a number might be trying to reach other IS strongholds. It is almost impossible to say what has happened to these people. I think we overestimated the stand-and-fight-until-you-die attitude. Some of these foreign fighters will want to fight another day. It is also too early to say where they will coalesce. Could it be the Philippines? Could it be Libya? But it is worth thinking about how practically easy it would be for somebody who is not Arab-speaking, doesn’t necessarily ‘look the part,’ to meld into society in a place like Libya. Very difficult, I would think.

If you crunch the figures: about 850 foreign fighters who went, about half who came back, 15 percent who died, you’re probably looking at a cohort of about 300 that we know traveled who are still out there. Not all of those are mono-Brits; a lot of those are dual nationals. Like other countries, we operate on the principle that we don’t want you back, and therefore we will deprive you of your British passport. And the government has done that. Because of this, the ones who could come back are about a third of this 300 number. And for those among these who end up coming back, we are absolutely waiting for them. That’s the bottom line.

CTC: British officials have said a residual risk is posed by about 20,000 individuals who were previously the subject of counterterrorism investigations. This is a very large number. How is it possible to manage the risk from such a large community of people? Who is going be responsible for managing this? Is this a job for the security services?

Basu: It’s impossible for any country to allocate resources for that kind of number. And every country will have a similar issue. That number will always grow. Because there will always be people who have been considered a national security threat but are no longer considered a national security threat. There is no way the security services or policing can manage all of those on their own. What we have to make sure is that there are ways of assessing whether the risks still exist or not in specific cases, and that’s going to involve something that the security agencies have never done before, which is sharing information from the secret space into multi-agency partners who may be able to help assess that risk. This is not a new concept. Multi-agency public protection arrangements for serious and violent offenders already exist. These individuals live in communities, and there are all kinds of measures in place to manage them. Local authorities need to be informed in a similar way as when people convicted of TACT [terrorism legislation] offenses return to their communities.

People get hung up on the full 20,000 number that is circulated, but what we need to be focused on is what the actual risk in that group is. The bigger risk to us are the additional 3,000 open cases that U.K. security minister Ben Wallace has talked about. That’s where the larger risk lies. A lot of the nervousness has come from the fact that we had two people come out of the 20,000 pot and attack us last year—Khalid Masood and Salman Abedi—while London Bridge attacker Khurram Butt was in the 3,000 who were being looked at. But we would be making a terrible mathematical mistake if we said that we need to swivel all of our guns onto the 20,000, when the 3,000 is where the big risk is.

What exists in that 20,000 is the possibility of people reengaging, like Abedi and Masood. How do you spot that reengagement? Do we have the right triggers in place so that when somebody who has previously shown signs of violent extremism reengages or does something or contacts someone of concern, it comes onto our radar screen?

The only way we are ever going to significantly improve coverage of this is by alerting a broader number of U.K. agencies about who is in the 20,000 pot. David Anderson [former Independent Reviewer of Terrorism Legislation in the United Kingdom] has stated this is something we are going to have to get much better at. We have already learned a great deal from the Operational Improvement Review in the wake of the attacks, and Mr. Anderson praised the work that had been done. But clearly more needs to be undertaken to tighten up our processes to prevent such attacks from taking place.

We are going to run pilot programs and see where we get to on this larger group, to see whether there are issues around reengagement. As a result in some of those cases, we will end up moving them deeper into the safeguarding space: they don’t want to be engaged in extremist activity, they might choose to volunteer, and they might want assistance in all kinds of ways, whether that’s mental health, education, or intervention providers providing religious instruction. There might be people who genuinely want to get off this extremism carousel. And there might be others who are reengaging who become a risk again, and we need to look at them from a law enforcement and security perspective. We are only going to be able to know this is the case if more people are helping us, and that includes my core policing colleagues outside of the specialism of counterterrorism policing. They will be used to the principles; they just need to learn to apply them to terrorism offenders. The key is information sharing and spreading the risk, but because we work in a top-secret world, that’s a cultural change, which is easy to call for out loud like this but really difficult to achieve.

CTC: We keep seeing TATP showing up in terrorist plotting. Is there more that could be done to stop that?

Basu: A few very obvious things need to be done. We need much more help from the private sector. Anyone who sells materials that could be used in this process needs to be engaged with, and we need to be much quicker at spotting suspicious purchasing activity. Same with the banking sector and suspicious transactions—all of which has been in place for some time, but we need to be much better at it. And we need to make sure that we remove anything that looks like bomb-making instruction from anywhere on the internet. The difficulty is that some of this stuff is O-level [type] chemistry experimentation^a that is available online and aimed at children and students. So some of it is not IS appearing online saying ‘this is how to blow people up.’ And so there is a danger is being disproportionate in what we take down and what we don’t. TATP is still dangerous, volatile, and difficult to make, but it is probably not as difficult as we thought it was. So you don’t need to be a chemical engineer to be able to do this kind of stuff.

CTC: When it comes to social media and its role in encouraging or directing terrorism, is there more, from the policing perspective, that you can do?

Basu: This is principally a role for intelligence agencies rather than police. What it does require, however, is close cooperation from social media companies. And where there isn’t cooperation, we need to consider coercive measures. Governments need to consider legislation. In reality, 2017 was a wake-up for the U.K. and for a lot of companies, not just in the CSP [communication service provider] space. It is about corporate social responsibility [for] how they protect their clients. I do not think it is acceptable anymore to say, “I’m defending free speech” if free speech involves blowing people up. The companies need to be in that space. There are positive signs that they are in that space. They’ve been in front of various hearings and political leaders. I’ve no doubt that they are listening, but they need to make sure their business models are effective in dealing with this now. They’ve got the brainpower, and they’ve got the resources, and they need to help.

CTC: Turning to the threat posed by the Extreme Right Wing (XRW) in the U.K. It has been discussed as an escalating problem for some time. Has it now crossed the threshold of being a national security threat?

Basu: It is too early to see how much it should be escalated. The threat assessment should be looked at by JTAC, and where we think there is a national security threat, then the security services should be involved. The far-right group National Action was the first time we saw anybody who was organized in the XRW space in a way that would represent a national security threat. Thankfully, it is nowhere near the same scale or problem as we’ve had from the IS-inspired or -directed [threat] or the AQ [threat] prior to that or the IRA threat prior to that. That is really something to be proud of in the U.K. culture and tradition that we don’t have this mass wave of extreme right wing. So far, we have seen people try to get on the back of that and not be incredibly successful. They are still relatively small, relatively disconnected, relatively disorganized groups.

My biggest concern about the extreme right wing, which is not a national security threat, is the Darren Osbornes^b of the world, the Thomas Mairs of the world [the murderer of Member of Parliament Jo Cox], and the lone actor with the mental health problems, depression, drugs, and the personal grievance who is acting alone. It is spotting people doing something like that which is very difficult.

The biggest concern for the country should [be] that violent Islamist extremism and violent right wing extremism will feed off each other. Islamophobia is something we have to be really clear about in policing: hate is hate. And we should be very, very robust and have a zero tolerance towards hate crime. And if we don’t do that, and Muslim communities are being stigmatized and attacked because of things a tiny minority of people are doing, I think we will create problems for ourselves. The Muslim community is going to be thinking that it is unfair and unjust. I think we don’t have parity at the moment in the way that we look at things. But we don’t have parity because at the moment, the scale of the threat is not the same. I do not want to wait for the scale of the threat to get to a point that something has to be done about it. You have seen a lot of the robust action we’ve taken against National Action, and that was because we were determined to stop this [from] becoming the next problem.

CTC: What about the policy side? The latest iteration of CONTEST [the U.K. counterterrorism strategy] is due out in a few months. What is your particular view on the “Prevent”^c pillar of the strategy?

Basu: Prevent is the hugely controversial part of the strategy. Government will not thank me for saying this, but an independent reviewer of Prevent, as suggested by David Anderson, would be a healthy thing. In fact, he would be excellent in the role. Prevent is, as a Prevent officer who used to work for me said, five percent of the budget but 85 percent of the conversation. Prevent is the most important pillar of the four pillar strategy.^d There is no doubt in my mind about it. We’re pretty good at Pursue; we’re pretty good at Prepare, as people have seen in our response. What needs to be better in Protect is the private sector, and I think there’s a big willingness, like there is with CSPs, to understand that they need to protect their customer base better. And whether that’s insider threats, cyber threats, or security guards [in] crowded places, there is an understanding that they need to invest more in that. But Prevent is the key.

There is still this hangover of toxicity around the Prevent campaign that we need to stop, because people need to understand that this about stopping people in the pre-criminal space ever getting anywhere near criminality. And Prevent needs to concentrate on how it does that. That cannot be a job for the police and security services. That has got to be a wider societal pillar. The more that policing and security service could withdraw from Prevent in order to focus Prevent work on problem solving within communities and getting communities to deal with it, the better in the long-term. There will always be a role for policing because we are a frontline. And here I don’t mean counterterrorism policing but the other 115,000 or so police officers who are in the frontline working together with communities. But actually the big responsibility is how do we get everyone else interested and involved and talking positively about some of the brilliant work that is going on.

Prevent, at the moment, is owned by the government, but I think it should be outside central government altogether. I think people who are running their local communities should be taking the lead. Local leaders around the country should be standing up and talking about this, not central government, security services, and counterterrorism police. Communities should be talking about protecting themselves from the grassroots up. When you see Prevent working on the ground brilliantly, that’s where it’s working, and largely unsung and un-talked about. Substantial community resilience is produced by that sort of work, and giving people that resilience is important and communities have to help each other do that. I would love to see a professional communications company say, as part of their social responsibility programming, “I’ll give free training to anybody from youth or whoever who wants to start a conversation around this.” That would be great. Rather than the government handing over a sum of money and then it becoming state sponsored with accusations of demonizing communities, it should be locally generated. We have gotten all of that messaging the wrong way around, it should be grassroots up.

Previously, this was not being done. But there are increasingly some phenomenal voices who’ve got real gravitas in their communities who are beginning to talk about the issues. The mayor of London, Sadiq Khan, is a really good example of that. He is not central government, he runs a city, and the protection of the city is his concern, he should be doing that, not MI5. Not the Cabinet, and the National Security Council and New Scotland Yard.

CTC: The threat picture we talked about is about a scattering of diffuse, random, isolated loners who latch onto ideologies, launching lone actor-style attacks. Have you seen any evidence in the attack planning of anything more substantial than that? Or is that really where the heart of the threat now sits? And is that where the threat picture going forward is going to be?

Basu: We will never eradicate the ambition [of extremists] to put a complicated network together to do a big, spectacular attack. The difficulty with that for a terrorist is that all that planning and all that preparation makes you very vulnerable. Where people aren’t vulnerable is when they are sitting in their bedrooms, using encrypted apps or not using any technology at all, and not having any contact with the outside world. Thomas Mair was a good example of that: no one spotted that happening because he was just a bit of an odd, loner, social misfit. No one saw any triggers that would be interpreted as leading him to that extreme level of violence. That is the bit that concerns me. We are seeing people who are vulnerable to suggestion, who have low-level mental health challenges, which probably don’t hit any clinical threshold. So even if they presented to the National Health Service, they would not look like they were someone of concern. It might be a low-level mental illness, but it’s a low-level mental illness with a lot of other red flag markers around it—for example a propensity towards violence. You can be seriously mentally ill and not violent. Nobody should ever stigmatize people with mental health, or put the two things together. But it is that kind of thing that concerns me most, and we are seeing more of that. And most disturbingly, very young and more female interest in violence.

That disturbs me and has got to have come from social media, if you think where kids get all of their information and how fast that they get it … and then how easy it is to go from—it’s a horrible expression—‘flash-to-bang,’ from having no understanding [of] what they are dealing with to a tiny, partial, ridiculous kind of notion of what religion or what violence, or what freedom of expression, or what these things mean because they picked it up in six-second soundbites on their phone. That malleability worries me a lot, and that concern seems to be being replayed around the world in my conversations with partner agencies across the European continent. So how we influence that younger, very vulnerable generation is going to be a key question. A revamped Prevent strategy is going to be a large part of the answer. CTC

Substantive Notes
[a] O-levels are exams students in the United Kingdom used to take at age 16.

[b] Darren Osborne is the recently convicted extreme right-wing terrorist who drove into a crowd outside the Finsbury Park mosque in June 2017.

[c] “Prevent” is the forward-looking aspect of the strategy that focuses on preventing individuals from being drawn to extremist ideas.

[d] The other three pillars are “Pursue,” “Prepare,” and “Protect.”

Citations
[1] Roger Baird, “Government has lost track of hundreds of British jihadi fighters,” International Business Times, January 5, 2018.

Britain on Alert: The Attacks in London and Manchester and the Evolving Threat

Posted: August 18, 2017 in CTC Sentinel
Tags: London Bridge attack, lone actors, lone wolves, terrorism, UK counter-terrorism, UK terrorism, westminster attack

It has been a busy day. Events in Barcelona are still a bit unclear, but it sounds like we are moving towards some resolution. In the meantime, catching up on posting latest contribution for the excellent West Point Combating Terrorism Center’s journal CTC Sentinel. Thanks to Paul for his excellent and patient editing. More to come on this topic invariably, and some more catch up to do after this week’s atrocities in Spain.

Britain on Alert: The Attacks in London and Manchester and the Evolving Threat

August 16, 2017

Author(s): Raffaello Pantucci

Abstract: After a respite from mass-casualty terrorism for more than a decade, thus far in 2017 the United Kingdom has suffered three such attacks and a higher tempo of jihadi terrorist plotting than ever before. Absent from the threat picture so far are any Paris-style plots in which the Islamic State has dispatched operatives to launch attacks in the United Kingdom. At this early stage of the investigations, it appears that the Westminster attacker had no contact with the Islamic State and that the Manchester and London Bridge attackers were at most loosely connected to the group. The current threat environment is mostly made up of individuals and smaller scattered cells planning lower-tech attacks with very short planning and operational cycles—sometimes remotely guided by the Islamic State—rather than cells trained and dispatched by the group. But this could change as more British Islamic State recruits return home. With over 20,000 British nationals and residents subject to counterterrorism investigations since 9/11, a growing number of ‘frustrated travelers,’ and a complex and unpredictable set of threats, the United Kingdom faces an unprecedented security challenge.

It has been a difficult year so far in the United Kingdom. After a period of relative stability, the United Kingdom has abruptly faced a period of deep political turmoil and a series of terrorist strikes that killed 36 people. While the full story around the terrorist plots that rocked the country during the first half of the year is not yet entirely clear—with multiple public and confidential reviews currently underway—the series of cases has led to deep introspection about how the United Kingdom manages the risk posed by the growing number of radicalized individuals at home. In July, Commissioner of the Metropolitan Police Cressida Dick stated that “since March this year, the [threat] tempo has changed. What we are seeing is now being described by the experts as a ‘shift’ in threat, not a spike.”1

This article argues this shift has to be understood as a permanent adjustment in the threat. There has been significant continuity in recent years in the nature of the threat faced by the United Kingdom, with a noticeable move away from large-scale plots to smaller scattered cells, with the tempo of plotting increasing noticeably. The article builds on a previous article in this publication in March 2016, which laid out the United Kingdom’s threat picture through analysis of a series of disrupted terror plots.2 The conclusion then was that “the public threat picture has been dominated by lone-actor plots”3 rather than more ambitious plots directed by the Islamic State like the Paris and Brussels attacks, an assessment that has not been challenged by the attacks in London and Manchester this year. Although only tentative conclusions can be made at this stage, the information that has come to light suggests these plots were significantly less ambitious and complex than some of the conspiracies seen in continental Europe and were carried out by men with at most loose connections to the Islamic State.

This article first outlines what is now known about the March 2017 Westminster Bridge attack, the May 2017 Manchester bombing, and the June 2017 attack on London Bridge and Borough Market. It then assesses what these attacks and other thwarted plots reveal about the broader threat picture in the United Kingdom and the challenges faced by security services.

The return of terrorism to the headlines in the United Kingdom this year was all too predictable. After a period of almost three years with the threat level at the second-highest level of ‘severe,’ British authorities had long warned that an attack was highly likely. Disruptions took place regularly. In early March 2017, the Metropolitan Police Service’s Assistant Commissioner for Specialist Operations Mark Rowley, who is also the National Police Chiefs’ Council (NPCC) lead for counterterrorism, stated that since the murder of Lee Rigby in May 2013, authorities had disrupted 13 terrorist plots. In defining the nature of the plots, Rowley stated “some of them have been more sophisticated [in their] planning looking to attack public spaces, or police offices or the military, not that dissimilar to some of the attacks we have seen in Belgium and France and elsewhere. There is a whole range from the simple to the complicated.”4 This built on comments by then-Prime Minister David Cameron in the wake of the Paris attacks of 2015 in which he stated that agencies had disrupted at least seven plots in the previous six months, “albeit attacks planned on a smaller scale.”5

The Westminster Bridge Attack
Notwithstanding this tempo of disruptions and public statements about the terrorist menace, Khalid Masood’s attack on Parliament on March 22, 2017, still shocked the British public. Using a Hyundai Tucson SUV rented in Birmingham a day earlier,6 Masood drove through the crowds of mostly tourists crossing Westminster Bridge at 2.40 PM. Hitting numerous pedestrians and knocking some into the river, he drove into the gates in front of the Houses of Parliament and then ran at a police officer standing guard, stabbing him with a knife. Masood was then shot dead by the close protection team of Defence Secretary Michael Fallon, who happened to be leaving Parliament at that moment.7

In the wake of the attack, which killed five people, authorities undertook a number of arrests near locations where Masood had lived, detaining 12 people in total. All were subsequently released.8 Born Adrian Russell Elms, Masood was a troubled 52-year-old who had lived an itinerant life, married three times, and had four children by two different women. He appears to have converted in prison while serving time for assault.9 He was twice incarcerated and arrested numerous other times for incidents involving attacking others. His case was of such concern to Sussex Police that in 2009, they filed a report highlighting the escalating nature of his violent behavior.10

In addition, Masood had featured in counterterrorism investigations. Prime Minister Theresa May confirmed that he had surfaced on the fringes of previous cases, stating “he was once investigated by MI5 in relation to concerns about violent extremism. He was a peripheral figure. The case is historic. He is not part of the current intelligence picture.”11 He was investigated after his telephone number was found among the contacts of a member of a cell of individuals from Luton who were jailed in 2013 for planning to bomb an Army barracks.12But he was not a priority of the investigation, and greater attention has been placed on his further radicalization more recently in Birmingham.13

Nevertheless, there has been little evidence produced that Masood was linked to any other co-conspirators or that he had conducted his assault with any external direction. He sent a WhatsApp message shortly before his assault reportedly stating his attack was a response to Western interventions in the Middle East, but the person he sent it to was cleared by authorities of any prior knowledge of the attack or culpability.14 A claim issued by the Islamic State in the wake of the attack was also dismissed as it showed no evidence of being anything but opportunistic. The group has praised Masood in subsequent publications, including quite specific incitement to people to emulate his attack, but the group has never demonstrated any access to information pertaining to him that was not already in the public domain. Authorities have concluded that Masood most likely acted alone and that the full extent of his motivations may never be known.15 As Neil Basu, NPCC’s senior national coordinator for counterterrorism, put it, while the police “found no evidence of an association with Islamic State or al-Qa`ida, there is clearly an interest in jihad.”16 While it is unlikely that Masood was completely isolated, the lack of any subsequent arrests or any charges issued as well as some fairly telling statements by police that his motivations may never be known highlights that, for authorities, the case is largely closed.

The Manchester Bombing
The contrast between the Westminster attack and the bombing exactly two months later on May 22 in Manchester by Salman Abedi is stark. Using a device that he appears to have constructed himself in Manchester using tools that are publicly available,17 Salman Abedi, a 22-year-old British national of Libyan descent, walked into a crowd of families and children as they left an Ariana Grande concert and detonated a well-built bomb made of TATP and packed with shrapnel.18 Killing himself and 22 others, Abedi’s attack immediately sparked something of a panic among U.K. authorities. Concerned about the sophisticated nature of the device and the fact that Abedi was a known figure with deep extremist contacts, counterterrorism agencies immediately feared that a bomb maker might be on the loose. A wide net was cast, and the terrorist threat level was raised by the Joint Terrorism Analysis Center (JTAC) to its highest level, ‘critical,’ meaning an “attack is expected imminently.”19

Emergency response vehicles parked outside the scene of the terror attack in Manchester, England, on May 23, 2017. (Paul Ellis/AFP/Getty Images)

Nevertheless, while over 20 arrests were carried out, no charges have been issued. In early July, Greater Manchester Police held a press conference at which they highlighted that while they believed Abedi may not have acted alone, he was not part of a larger network. “We don’t have evidence of a large network. We do, however, suspect others were either aware [of] or complicit in the knowledge of this attack … We do believe that there are other people potentially involved in this … further arrests are possible,” Detective Chief Superintendent Russ Jackson, head of the North-West Counter Terrorism Unit (NWCTU), stated. 20

Abedi is reported to have had significant connections in radical circles in Manchester. Many of Abedi’s links tie back to the community of young men from the city going to fight in Syria. He reportedly visited wheelchair-bound (following injuries sustained during his involvement in the 2011 uprising in Libya) Abdal Raouf Abdallah, another Libyan-British national, in jail a number of times in early 2017. Abdallah had been jailed for his role in facilitating the travel of others to Syria.21 He was also reportedly in close contact with Raphael Hostey, a prominent British Islamic State fighter from nearby in Manchester, who used the kunya Abu Qaqaa and was the sponsor for numerous Britons who joined the group.22

It is, however, Abedi’s links in Libya that have raised the most scrutiny. His father, Ramadan Abedi, a prominent onetime member of the now-defunct Libyan Islamic Fighting Group (LIFG), reportedly returned to fight—bringing his son Salman with him—in the revolution that overtook the country in 2011.23 A long-time and committed member of the LIFG, he was well-connected in the community around the jihadi group and was also reportedly seen in Bosnia a number of times during the civil war in that country in the 1990s.24

British authorities have made clear they wish to question Abedi’s brother Hashem.25 On May 24, 2017, the Special Deterrence Force, a Tripoli-based militia under the nominal control of the Interior Ministry, released a statement saying it had detained Abedi’s father and brother Hashem. The militia claimed that Hashem had confessed while in detention that both he and Salman were members of the Islamic State and that Hashem had admitted he had been in the United Kingdom during the planning phase of the attack, had been aware of the plot, and had been “constantly in touch” with his brother. Hashem also reportedly admitted to helping to purchase the bomb components. On May 25, a spokesperson for the militia stated on Libyan television that the two brothers had been in contact by phone just 15 minutes before the bombing.26 Questions remain over these confessions, including over whether they were made under duress. Hashem is still in Libya and has not been charged in the United Kingdom. Analysis of his social media accounts show he was in contact with Hostey’s brother.27

According to the Greater Manchester Police, the two Abedi brothers both left for Libya on April 15, with Salman returning to the United Kingdom on May 18, just four days before the bombing. It was the latest in a number of trips Abedi had made back and forth to Libya. Investigators believe bomb-making materials were obtained before the trip to Libya and stored in a car and that when Salman Abedi returned to Manchester, he purchased other materials for the device including nuts as shrapnel and quickly assembled the bomb.28 The high volatility of TATP—the quick speed at which it evaporates or sublimes and thus becomes useless as an explosive—meant he almost certainly made the explosive substance in the days between his return from Libya and the attack, sources told CNN.29

It remains unclear whether Abedi received training while in Libya. Abedi appeared to be single-mindedly focused on building the bomb when he returned to the United Kingdom, suggesting it is possible he received training or final instructions on his last trip.

Similar to Masood’s attack, the Islamic State issued a statement praising Abedi’s act, but it demonstrated no proof of any prior knowledge.30 Notwithstanding the alleged declarations by his brother to the Tripoli militia, had Salman been closely linked to the Islamic State in Libya, it would be surprising that he would not have recorded a martyrdom video and left it with the group, or least some photographic evidence showing his connections. At the same time, investigators continue to believe that he had some greater degree of links to terrorist groups abroad than Masood. However, the exact nature of these links remains unclear.

The London Bridge and Borough Market Attack
On June 3, 2017, less than two weeks after the Manchester bombing, London was struck once again. On a balmy evening, Khuram Butt, Rachid Redouane, and Youssef Zaghba drove a van they had rented earlier in the afternoon into the Saturday night crowds gathered near London Bridge. Ramming the van into a fence adjacent to the pavement near the end of the bridge, the trio then leapt out of the vehicle and started attacking passersby in the adjoining Borough Market area with long knives they had bound to their wrists with leather straps. They wore plastic bottles covered in black tape wrapped around their bodies to give the impression of wearing suicide vests and had a number of Molotov cocktails made up in the van.31 Within eight minutes of police receiving the call, armed response officers arrived and shot and killed the three men, though not before eight revelers had been killed and 48 injured.32

One of the attackers was almost immediately identified as a figure well-known to the security services. Butt, who authorities believe was the ringleader of the group, was a prominent and active member of the al Muhajiroun network of extremists that has been at the center of the United Kingdom’s violent Islamist terrorist threat for the past two decades. Butt himself had been repeatedly featured at the center of investigations and was most recently on bail for ‘low-level’ fraud for which he was not ultimately going to be prosecuted.33 More embarrassingly for British authorities, he had been featured in a widely viewed documentary called The Jihadis Next Door, which followed a number of prominent al Muhajiroun members, including Siddartha Dhar, also known as Abu Rumaysah (who fled to Syria with his family soon after filming and was believed to have become a new “Jihadi John” figure in Islamic State films34), as well as others who have been convicted of a variety of terrorism and extremism charges.35

The other two were less well known to British investigators, though it rapidly emerged that the Moroccan-Italian Zaghba had been flagged to British authorities through a European intelligence sharing system as someone of concern to Italian authorities after he was stopped at Bologna airport in March 2016 on his way to Turkey. Carrying a small bag, little money, a telephone with Islamic State videos on it, and a one-way ticket, he raised suspicions by telling authorities that he wanted to head to Syria.36 Nevertheless, he was released after being turned back. He subsequently traveled onto his native Morocco and then ultimately London, where he took on part-time work in the services industry.37 The third attacker, Redouane, appears to have led an equally peripatetic life, alternatively claiming to be Moroccan or Libyan and stating his birthdate was in 1986 and 1991 on different documents.38 He had married an Irish woman and had a child with her, who he appears to have visited at his estranged partner’s home in Barking the night prior to the attack after a lengthy hiatus.39

Planning for the event appears to have taken place over a two- to three-week period prior to the attack.40Police believe Redouane’s bedsit in Barking was the location where plotting occurred,41 though the men appear to have also congregated in a number of sporting locations, including an outdoor pool42 and a gym that was established by a pair of brothers who had previously been identified as being involved in al Muhajiroun activity.43

It remains unclear the degree to which the London Bridge attackers may have been directed by the Islamic State or any other extremist group, though the Islamic State did again claim the attack.44 Given Butt’s known association with individuals who have gone on to become prominent figures within the Islamic State, like Abu Rumaysah (who is still suspected to be at large and was featured in the same British television documentary), he would have had ample opportunities to establish contact with the group. Senior leadership figures within al Muhajiroun, like Anjem Choudary and Mizanur Rahman, have been prosecuted for supporting the Islamic State.45 Others like Abu Rahin Aziz,46 Shahan Choudhury,47 Mohammed Reza Haque,48 and Hamza Yaqub49have been publicly identified as having fled to join the group. Many others have tried going to Syria and been caught at various stages of their journeys. Given the close contact the group’s members maintain with those back in the United Kingdom even after they have gone over to Syria, it seems likely that Butt would have had at least some contact at some point with Islamic State operatives in Syria.

While the Islamic State’s immediate claim contained no information that was not already in the public domain, the group’s subsequent mention of the attack in the 10th edition of its magazine Rumiyah did offer battlefield names (kunyas) for the fighters, which had not been discussed in the public domain, identifying them as Abu Sadiq al-Britani, Abu Mujahid al-Britani, and Abu Yusuf al-Britani.50 The accuracy of this information is unclear, however, with it contrasting with Butt’s known kunya of Abu Zeitoun.

Observations on the Three Attacks
One key question for authorities is the degree to which the three cases were connected.51 Thus far, no evidence has been made public to show any level of connectivity, beyond the potential that the three plotters were somehow inspired in their timing by each other’s actions.a The available evidence suggests the attacks were carried out by individuals or small cells who, though possibly inspired by the Islamic State’s ideology, were either not connected to the group (Westminster) or only loosely connected (Manchester and London Bridge). There is no indication that the Westminster and London Bridge attackers trained overseas. In the London Bridge plot, at least two of the attackers, Butt52 and Zaghba, were frustrated travelers to Syria. In the Manchester plot, Abedi is known to have traveled to Libya a number of times (though the exact nature of these trips is complicated by his Libyan heritage). Abedi’s single-minded focus in constructing a device just a few days after returning from Libya suggests it is possible he traveled to Libya for the purpose of learning how to build a device.53 The New York Times, citing U.S. and European intelligence sources, reported Abedi met with members of Katiba al-Battar, a Libyan Islamic State brigade, at some point while in Libya and kept in touch with the group on trips back to the United Kingdom, but this has not been confirmed by British authorities.54Given that Abedi reportedly participated in fighting against Muammar Qaddafi, one possibility is he received bomb-making training while spending time with a militia group in Libya. There was some public speculation Abedi may have traveled to Syria as well, but this has not been substantiated.55 No evidence has yet surfaced of external direction, and it cannot be ruled out that Abedi learned to build the bomb off the internet given there is evidence he viewed various online videos on bomb making.56 But the relative sophistication and effectiveness of the device, and the trickiness of making TATP, points to the possibility of at least some bomb-making training or practice overseas.

Increased Tempo
In the wake of the Westminster attack, there was a noticeable uptick in the tempo of arrests being conducted by police disrupting active attack planning. In June, Commissioner Dick said about one person a day was being arrested in counterterrorism investigations.57 The reasons for this increase are not totally clear, but it is likely the result of both lower tolerance of risk by British authorities and a growing threat. In the first instance, a successful attack highlighting a failure in intelligence would change counterterrorism agencies’ perspectives on ongoing investigations, making them reconsider various subjects of concern. Second, police concerns of copycat attacks likely sped up arrests of subjects of interest who had been under surveillance for some time. A third likely reason is the increasing push and resonance of Islamic State messaging about individuals staying home to launch attacks. This is a phenomenon that has been obvious since Abu Muhammad al-Adnani’s speech in May 2016 in which he stated, “The smallest action you do in the heart of their land is dearer to us than the largest action by us, and more effective and more damaging to them … And if one of you wishes and tries hard to reach the Islamic State, then one of us wishes to be in your place to hurt the Crusaders.”58 As it has become harder to travel to Syria and the group has been losing territory, more supporters of the group in the United Kingdom are becoming frustrated travelers who are responding to this messaging.

British police thwarted five plots in between the Westminster Bridge and Manchester attacks.59 Just over a week after Masood’s attack, police in Birmingham arrested brother and sister Ummariyat Mirza and Zainub Mirza, who were accused of planning a beheading attack.60 Two weeks later, Ummariyat Mirza’s wife, Madihah Taheer, was arrested and charged with supporting her husband in his plot.61 At around the same time, police arrested a 17-year-old girl of Moroccan origin from London for allegedly plotting to launch some sort of attack under direction of a fighter from Coventry who was killed in April by a drone strike in Syria. The teenager, who cannot be named for legal reasons, was apparently married to the fighter through Skype and had sought to obtain guns and grenades to launch an attack in the United Kingdom under explicit direction from the Islamic State.62

Even more alarmingly, 27-year-old Khalid Ali was detained in Whitehall, a short month after Khalid Masood’s attack on Westminster, in a dramatic mid-afternoon swoop as he walked around with a bag full of knives and shortly after throwing his phone into the river. He was charged with bomb making linked to activity he undertook in Afghanistan years before, as well as the alleged plan he was in the midst of when he was arrested in Whitehall.63

The same day that Ali was detained along Whitehall, police in Willesden in northwest London and Kent undertook a series of raids, detaining six people in what they believed was another cell actively plotting attacks. The case was deemed of such concern that authorities stormed the premises using CS gas and guns. One woman was shot during the entry.64 The initial reporting indicated a cell of six were involved, including an individual who had been stopped in Turkey alongside two teenagers who were reportedly en route to Syria.65 In the end, however, the failed traveler was not charged, and three women (including a mother and daughter) were presented in court for allegedly planning an unspecified knife attack.66 Finally, five days prior to Abedi’s attack, police in East London arrested four men for planning an alleged car bomb and knife attack in central London reportedly inspired by Masood’s actions.67 The four men were arrested on May 17.b

This intense spate of arrests presaged the Manchester and London Bridge attacks and reflected a changed threat assessment by authorities as they sought to roll up a number of cells that had been under surveillance for some time. As noted above, in many cases, authorities feared that Masood’s abrupt success might stimulate others to emulate him—something that had been seen historically after successful attacks. The murder of Lee Rigby in May 2013 by two extremists linked to al Muhajiroun helped stimulate others to attack, including an extremist who the very next day attacked a French soldier patrolling in the La Defence area of Paris. More generally, the attack model deployed against Rigby is one that has become a template many British extremists seek to emulate, often themselves making direct reference to that 2013 attack.

Arrests have continued at a high rate in recent weeks. Three men were picked up on the day of the general election, June 8, with one charged on an unspecified plot. The 33-year-old man in question, Irfan Khan, was allegedly a long-time consumer of online radical material and had allegedly recently viewed material linked to the London Bridge attack when he was arrested, demonstrating the potential inspirational effect of that attack.68 Later in June, police in Birmingham arrested Tarik Chadlioui, a 43-year-old Moroccan cleric who was wanted on terrorism charges in Spain for being the spiritual leader of a cell supporting the Islamic State.69 One of his followers in Majorca is accused of planning a stabbing attack of pedestrians on the island.70

A Constant Threat
None of this, however, points to large-scale attack planning in the United Kingdom. While a number of the disruptions suggest plots approaching the scale of the London Bridge or Manchester attacks, there was little evidence presented in court of conspiracies with the capability to launch larger Paris-style assaults. Unlike disruptions on the continent in Europe, where cells in possession of automatic weapons and with clear evidence of individuals who have been to foreign battlefields are regularly disrupted, so far there is no evidence that has been made public of this model of plot in the United Kingdom.

More typical have been plots similar to that mounted by a cell of individuals from Birmingham who were planning a knife and bomb attack in the United Kingdom before their arrest in late 2016. Although the so-called “three Musketeers” behind this plot were potentially dangerous, and two had, five years previously, very briefly made it to a training camp in Pakistan, there was no evidence presented at the trial that their plot was directed from overseas; it emerged at trial that the conspirators joked about their inadequate skills, with one likened to one of the useless extremist characters from the film Four Lions, a satirical movie that pokes fun at some of more inept practices of British jihadis.c

The earliest disrupted plot linked to Syria, that of Erol Incedal, included accusations of a planned marauding gunman scenario with some direction from overseas.71 Incedal was cleared of these charges and ultimately convicted of possession of a bomb-making manual.72 But beyond this, the attack planning seen in the United Kingdom has been fairly consistently small cells or isolated individuals seeking to launch low-grade attacks on soft targets around the country. While there are often links to known extremists or networks, where there has been direction, it has been in the form of remote guidance by extremists based in Syria and Iraq.73

None of this is to say that authorities do not continue to see aspiration and intent by terrorist groups to launch more sophisticated plots in the United Kingdom. Thus far, however, the threat has mainly consisted of small-scale unsophisticated plots. While this suggests terrorist groups like the Islamic State have been facing difficulties in infiltrating directed cells into the United Kingdom, authorities are still confronted by a challenging threat picture and one that is in many ways more complicated with these scattered and disparate cells, which are difficult to track. Adding to the challenge is the unpredictability of individuals or small cells autonomously deciding to act using very low-tech methods and weapons, which makes it a very difficult to manage and prioritize threats accurately.

Managing Risk
The question of prioritization is the key issue at the heart of considerations about how to manage the current U.K. threat picture.d In all three of the cases featured in this article, attackers were known and had been investigated—to varying degrees—by authorities. In at least two cases, Abedi and Butt, they had been a focus of investigations, but no prosecutable case had materialized, leading investigators to move on to other cases that appeared to be of higher priority. With limited resources, such choices have to be made.

The volume of activity that U.K. security services are currently focused on was illustrated most clearly in the wake of the Manchester bombing when Security Minister Ben Wallace revealed on the BBC’s flagship Today program that authorities had 500 investigations underway, involving some 3,000 subjects of interest. In addition, he revealed, there were a further 20,000 former subjects of interest (i.e. former targets of counterterrorism investigations in the post-9/11 period) who remained of peripheral interest to the security services. The numbers have since grown even higher, according to British police. Butt, the London Bridge ringleader, was among the 3,000 current subjects of interest. But it was from the 20,000 considered to be only a residual risk that the Manchester and Westminster attackers had come.74 This larger pool includes individuals who have featured in investigations over the past almost two decades of counterterrorism cases in the United Kingdom. Some are individuals who were on the fringes of plots; others are those who have been charged, convicted, served their sentences, and are now free once again. However, due to their observed activity, they are not deemed to be current priorities and have therefore been relegated by security services who instead focus their attention on those who have been demonstrating a higher level of alarming activity or potential attack planning. Given limitations in security services resources, only about 3,000 individuals can be focused on, and while the others are not forgotten, they are allocated a lower prioritization.75

In the wake of the two London and Manchester attacks, questions are being raised about whether this prioritization has been accurately calibrated.76 After the London Bridge attack, Prime Minister May stressed police and the Security Service MI5 would be reviewing their methods and more generally “how the terror threat is evolving, the way that terrorism is breeding terrorism and the increased tempo of attacks … in a way we haven’t seen before.”77 It has been reported that after the Manchester bombings, Britain’s security services began reevaluating the risk level of individuals categorized as former subjects of interest. One idea reportedly under consideration is to create systems for counterterrorism agencies to share information about former subjects of interest with the broader police force, taking advantage of the general police’s greater numbers of eyes and ears inside local communities. “It’s that wider cohort [of 20,000] that we have to keep an eye on as well; to see if any of them that reactivate, so to speak, and become dangerous again,” Mark Rowley, head of National Counter Terrorism Policing, stated in an interview earlier this month. “We’re going to have to improve what we do, but it is going to take a whole system effect—not simply counter terrorist specialists and MI5, but local policing, councils, and the public—to be able to deal with something which is becoming more of a cultish movement and less of a small terrorist organisation.”78

The U.K. threat picture is populated with seemingly disparate cells of individuals or clusters who are in some cases receiving direction from abroad through encrypted applications or social media, but in many cases are made up of perpetrators, as Prime Minister May stated, “inspired to attack not only on the basis of carefully constructed plots after years of planning and training—and not even as lone attackers radicalized online—but by copying one another and often using the crudest of means of attack.”79 The fact that the United Kingdom is also grappling with a threat from right-wing and anti-Muslim extremism risks provoking the sort of social tensions the Islamic State has long hoped would boost its appeal in the West.

It is, of course, still early days in the investigations into the London Bridge and Manchester attacks. It is possible more will be uncovered to show their connectivity to wider networks and plots. The plotting activity observed so far in 2017 points to a deeply diffuse and complicated threat picture in the United Kingdom, which is causing security services to revisit their methodologies and leading to arrests at increasingly early stages of the attack cycle. This can complicate subsequent convictions, but it is an imperative at a time when many plots are being carried out through low-tech means already in most citizens’ possession—cars and knives—and at a time when the flash-to-bang in plots can be counted in days rather than years.

Atop this complex domestic picture is the potential threat posed by the growing number of British jihadis who are expected to be returning home from Syria and Iraq. Exact numbers are impossible to know, but with hundreds already back,e authorities are already bracing themselves for an even more challenging threat environment when these battle-hardened veterans and their families return. CTC

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI) and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists. Follow @raffpantucci

Substantive Notes
[a] This certainly seems to have been the case in the subsequent anti-Muslim terrorist attack launched by Darren Osborne, a 47-year-old who drove a van into the crowd outside Finsbury Park mosque on the morning of June 19, killing one. A long-troubled individual, Osborne was reported by neighbors to have been incensed by the London Bridge attack. No evidence has publicly surfaced that he was linked to extreme right groups. And it is suspected that Osborne may have intended to strike an al-Quds, pro-Palestine march through central London earlier in the day, but had been too late and chose the mosque instead. Osborne was reported to have been raving drunkenly at a local pub the night before the attack and to have been flagged to police as drunk and asleep in his vehicle later the same evening. Martin Evans, Ben Farmer, Hayley Dixon, and Hannah Furness, “Finsbury Park terror suspect ‘planned to attack’ Muslim march in London but was too late, it is claimed,” Telegraph, June 20, 2017.

[b] The four were charged on May 25. One was not charged with terror offenses but instead for seeking to “possess any firearm or imitation firearm with intent to cause fear of violence.” “Update: Four charged following Counter Terrorism investigation,” Metropolitan Police press release, May 25, 2017.

[c] The most disturbing aspect of the plot was that three of the plotters had been convicted and served time for previous terrorism offenses. Two of those convicted, Naweed Ali and Khobaib Hussain, had been previously arrested for going to training camps in Pakistan. They were also linked to a cell arrested in 2011 in Birmingham that was seeking to launch an al-Qa`ida-directed attack in the United Kingdom and helping others get to training camps in Pakistan. Mohibur Rahman, the third convicted “Musketeer,” had been previously convicted for possession of extremist material. He was initially arrested as part of a cell that pleaded guilty of plotting in 2010 to bomb the London Stock Exchange. The three “Musketeers” had met and re-radicalized during their prison sentences, raising questions around prison radicalization. “Operation Pitsford: The 11 men,” BBC News, April 26, 2013; “Terrorism gang jailed for plotting to blow up London Stock Exchange,” Telegraph, February 9, 2012; “Three Musketeers’ guilty of planning UK terror plot,” BBC News, August 2, 2017; Dominic Casciani, “Birmingham terror plot: Inside the sting that caught four jihadis,” BBC News, August 2, 2017.

[d] The issue of prioritization is also key in several other Western countries facing a significant threat, including the United States. For example, Orlando nightclub shooter Omar Mateen had been the subject of an FBI counterterrorism investigation, but the case was closed before he carried out the attack. Matt Apuzzo and Eric Lichtblau, “After FBI’s Enquiry into Omar Mateen, A Focus on What Else Could Be Done,” New York Times,June 14, 2016.

[e] While there are no official figures, most reports say that some half of the 850 U.K. nationals reported to have gone to Syria and Iraq have returned home. Martin Chulov, Jamie Grierson, and Jon Swaine, “ISIS faces exodus of foreign fighters as its ‘caliphate’ crumbles,” Guardian, April 26, 2017.

Citations
[1] Cressida Dick, “Commissioner gives key note speech at Mansion House,” MetPolice Blog, July 20, 2017.

[2] Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel9:3 (2016).

[3] Ibid.

[4] Matthew Weaver, “UK police have thwarted Paris-style terror plots, top officer says,” Guardian, March 6, 2017.

[5] Matt Dathan, “David Cameron to recruit 2,000 new spies amid claims UK foiled seven terror attacks in six months,” Independent, November 16, 2015.

[6] “Car used in Westminster terror attack was hired from Enterprise in Spring Hill,” Birmingham Updates, March 23, 2017.

[7] Ewan MacAskill, “Westminster attacker acted alone and motive may never be known, say police,” Guardian, March 25, 2017.

[8] Chris Johnston, “All 12 people arrested over Westminster attack released without charge,” Guardian, April 1, 2017.

[9] “Killer Khalid Masood left jail a Muslim, says childhood friend,” Press Association, March 25, 2017.

[10] Alice Ross, “Westminster attacker had record of increasingly violent attacks,” Guardian, May 15, 2017.

[11] Rowena Mason, “Theresa May’s statement – key extracts,” Guardian, March 23, 2017.

[12] “Four ‘planned to bomb Territorial Army base’ with toy car,” BBC News, April 15, 2013.

[13] Xantha Leatham and Omar Wahid, “Westminster terror attacker was radicalised in Birmingham in the past 12 months, sources claim,” Mail on Sunday, April 2, 2017.

[14] Kim Sengupta, “Last message left by Westminster attacker Khalid Masood uncovered by security agencies,” Independent, April 27, 2017.

[15] Vikram Dodd, “Westminster attack: Masood did act alone, police conclude,” Guardian, April 13, 2017.

[16] Robert Booth, “Westminster attacker Khalid Masood had interest in jihad, say police,” Guardian, March 27, 2017.

[17] Nick Hudson, “Manchester suicide attack: Abedi bought most bomb parts ‘himself,’” Policeprofessional.com, May 31, 2017.

[18] Paul Cruickshank, “London attack ringleader was under active investigation at time of assault,” CNN, June 8, 2017; C.J. Chivers, “Found at the Scene in Manchester: Shrapnel, a Backpack and a Battery,” New York Times, May 24, 2017.

[19] “Threat levels,” Security Service, MI5.

[20] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say,” Telegraph, July 6, 2017; Neal Keeling, “Police suspect others were involved in Manchester Arena attack – and may make further arrests,” Manchester Evening News, July 6, 2017.

[21] Joe Thomas, “Manchester Arena bomber visited terror convict in Liverpool prison,” Liverpool Echo, June 25, 2017.

[22] Andy Hughes, “Manchester suicide bomber Salman Abedi linked to key UK IS recruiter,” May 25, 2017.

[23] Nazia Parveen, “Bomber’s father fought against Gaddafi regime with ‘terrorist’ group,” Guardian, May 24, 2017; Jonathan Ungoed-Thomas and Dipesh Gadher, “Salman Abedi: the Manchester killer who was bloodied on the battlefields of Libya and brought evil back home,” Sunday Times, May 28, 2017.

[24] “Otac teroriste iz Mancestera bio kod mudzahedina u BiH,” Glas Srpske, May 31, 2017.

[25] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say.”

[26] Bel Trew, “Salman Abedi’s brother bought parts for Manchester bomb,” Times, June 9, 2017; “Manchester bomber’s brother and father arrested in Tripoli,” Libya Herald, May 24, 2017; Laura Smith-Spark and Hala Gorani, “Manchester suicide bomber spoke with brother 15 minutes before attack,” CNN, May 26, 2017.

[27] Josie Ensor, “Manchester bomber’s brother was ‘plotting attack on UN envoy in Libya,’” Telegraph, May 27, 2017.

[28] “Latest Statement from Detective Chief Superintendent Russ Jackson, Greater Manchester Police,” June 11, 2017. The statement is available at https://twitter.com/gmpolice/status/873926655059927041 and https://twitter.com/gmpolice/status/873926742553112578; Lizzie Dearden, “Salman Abedi travelled through Turkey and Germany four days before launching Manchester suicide attack,” Independent, May 25, 2017.

[29] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[30] SITE Intel Group, “#ISIS releases English-language version of claim for #Manchester bombing,” Twitter, May 23, 2017.

[31] “Terror ringleader ‘tried to hire 7.5 tonne lorry hours before London attack,’” ITV News, June 10, 2017.

[32] “London attack: What happened where in eight minutes of terror,” Sky News, June 5, 2017.

[33] Ralph Blackburn, “London Bridge terrorist Khuram Butt taught primary school children in Ilford,” Barking and Dagenham Post, August 2, 2017.

[34] Richard Kerbaj, “Jihadi Sid told sister: I’ll die for ISIS,” Sunday Times, January 10, 2016.

[35] “The Jihadis Next Door,” Channel 4; Vikram Dodd, Matthew Taylor, Alice Ross, and Jamie Grierson, “London Bridge attackers were regulars at Sunday afternoon pool sessions,” Guardian, June 7, 2017.

[36] Fiorenza Sarzanini, “L’Italia segnalo il killer di Londra fermato a Bologna per terrorismo,” Corriere della Sera, June 6, 2017.

[37] Ibid.

[38] “Update: London Bridge terror attack investigation,” Metropolitan Police press release, June 16, 2017.

[39] Sarah Knapton, Martin Evans, Nicola Harley, Harry Yorke, Ben Farmer, and Robert Mendick, “Khuram Butt, Rachid Redouane and Youssef Zaghba named: Everything we know about the London Bridge terrorists,” Telegraph, June 6, 2017.

[40] Paul Cruickshank and Nic Roberts, “London ringleader Khuram Butt was intensely investigated,” CNN, June 6, 2017.

[41] “Appeal for information on knives used in London Bridge terrorist attack,” Metropolitan Police Press Release, June 9, 2017.

[42] Dodd, Taylor, Ross, and Grierson.

[43] Neil Johnston, Georgie Keate, John Simpson, and Katie Gibbons, “Police were warned two years ago that gym was ‘training jihadists,’” Times, June 9, 2017.

[44] Francesca Gillet, “London attack: ISIS claims responsibility for London Bridge horror which left seven dead, Islamist State media agency confirms,” Evening Standard, June 4, 2017.

[45] Raffaello Pantucci, “Al-Muhajiroun’s European Recruiting Pipeline,” CTC Sentinel 8:8 (2015).

[46] Ruth Sherlock, “British man who joined Islamic State to skip bail ‘killed’ in Syria,” Telegraph, July 5, 2015.

[47] Dipesh Gadher, “Housing benefit funds family’s dash to ISIS,” Sunday Times, March 19, 2017.

[48] Josh Barrie, “The Giant: Second British extremist ‘identified in ISIS video,’” Independent, January 17, 2017.

[49] C vs. HM Treasury, before The Hon Mr Justice Cranston, judgment handed down August 5, 2016.

[50] Rumiyah 10, June 2017.

[51] “PM statement following London terror attack,” Downing Street press release, June 4, 2017.

[52] Damien Gayle and Jamie Grierson, “London attack: Khuram Butt’s family stopped him going to Syria, says cousin,” Guardian, June 8, 2017.

[53] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[54] Rukmini Callimachi, “Manchester Bomber met with ISIS unit in Libya, Officials say,” New York Times, June 3, 2017.

[55] Saim Saeed, “French interior minister: Salman Abedi had ‘proven’ links with Islamic State,” Politico, May 24, 2017.

[56] Fiona Hamilton and Alexi Mostrous, “Manchester Arena killer Salman Abedi used YouTube to build bomb,” Times, June 24, 2017.

[57] “London Bridge attack latest: Terrorists named as police say they were not under surveillance as they posed ‘low risk,’” Telegraph, June 6, 2017.

[58] Paul Cruickshank, “Orlando shooting follows ISIS call for U.S. Ramadan attacks,” CNN, June 13, 2016.

[59] “UK security services have thwarted five plots since March Westminster attack: source,” Reuters, May 25, 2017.

[60] Darren Campbell, “Two arrested in Alum Rock Road charged with multiple terror offences,” Birmingham Mail, April 5, 2017.

[61] Charlotte Paxton, “Birmingham wife of alleged extremist is charged with terror offenses,” Birmingham Mail, April 25, 2017.

[62] Vikram Dodd, “Teenage girl accused in court of plotting terror attack in UK,” Guardian, July 26, 2017.

[63] Martin Evans, “Westminster terror suspect appears in court charged with bomb making offences,” Telegraph, May 10, 2017.

[64] “Willsden shooting: Police foil ‘active terror plot,’” BBC News, April 28, 2017.

[65] Dipesh Gadher, Robin Henry, Rebecca Myers, and Luke Mintz, “Banned Saudi preacher link to raided ‘house of terror,’” Sunday Times, April 30, 2017.

[66] Danny Boyle, “Mother and daughter in terror plot case ordered to lift veils by magistrate who demands to see their eyes,” Telegraph, May 11, 2017.

[67] Steve Robson and Rachel Burnett, “Three men ‘plotted London terror attack involving car bomb driven through Westminster Bridge inspired by Khalid Masood atrocity,’” Mirror, May 27, 2017.

[68] “Man arrested in east London charged with terror offences,” Metropolitan Police press release, June 20, 2017, and “Terror suspect viewed London Bridge attack material before arrest,” Court News UK, June 21, 2017.

[69] Ben Farmer and James Badcock, “Birmingham counter-terror arrest: Alleged ‘spiritual leader’ of Majorca-based cell is held,” Telegraph, June 28, 2017.

[70] Fernando J. Perez, “Uno de los yihadistas detenidos en Mallorca planeo una ‘matanza’ en Inca,” El Pais, June 30, 2017.

[71] “Erol Incedal: terror accused enjoyed billionaire’s lifestyle secret trial files reveal,” Telegraph, December 11, 2015.

[72] Tom Whitehead, “Erol Incedal jailed for three-and-a-half years over bomb-making manual,” Telegraph, April 1, 2015.

[73] See Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel 9:3 (2016).

[74] “23,000 people have been ‘subjects of interest’ as scale of terror threat emerges after Manchester attack,” Telegraph, May 27, 2017; Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism,” Metropolitan Police, August 11, 2017.

[75] Dominic Casciani, “Manchester attack: The bewildering complexity of a terror inquiry,” BBC News, May 25, 2017; Sean O’Neill, “Spies gather to focus on biggest threats,” Times, June 8, 2017.

[76] Francis Elliott and Sean O’Neill, “May tells MI5 to ‘keep up’ with changing terror threat,” Times, June 5, 2017.

[77] Rowena Mason, “MI5 to review handling of London Bridge attack, says Theresa May,” Guardian, June 6, 2017.

[78] Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism.”

[79] “PM statement following London terror attack.”

What Policy Changes Are Needed after the Manchester Attack?

Posted: June 5, 2017 in Royal United Services Institute
Tags: counter-terrorism, Libya, Manchester, terrorism, UK counter-terrorism, UK terrorism

Trying to catch up on various recent posts, though am a bit behind, so apologies. A few longer pieces have landed now as well. In the short term, here is something for my institutional home RUSI about what policy ideas could be advanced to manage the long-term threat that the UK faces.

What Policy Changes Are Needed after the Manchester Attack?

Raffaello Pantucci
Commentary, 31 May 2017
UK Counter-terrorism, Tackling Extremism, Securing Britain, Terrorism

A week after the atrocity in Manchester, it is now possible to draw some preliminary conclusions: there clearly was a breakdown in the intelligence flow that led to suicide bomber Salman Abedi slipping through the net; there are enduring questions about the UK’s Prevent anti-terrorism strategy; and, finally, there are the weaknesses of ‘soft targets’ that such an attack invariably expose.

It is, of course, impossible, without full access to information, to properly understand exactly the nature of the intelligence breakdown that led to last week’s suicide attack on an Ariana Grande concert in Manchester.

Still the fact that the bomber, Salman Abedi, was flagged up to authorities a number of times, by locals in Manchester, was travelling back and forth to a country that is a warzone and came from a family with strong militant pedigrees all indicate – without the benefit of hindsight – that he was someone who should have attracted attention.

If, as suggested, he was someone who had featured in previous investigations but was sidelined in favour of what were deemed to be more menacing targets, then the attack in which 22 people were killed and dozens wounded highlights what for the intelligence services remains a perennial question: how do you determine who seems more menacing when resources are limited?

This is not only a difficult calibration to make, it is also not a way to remove someone from concerns altogether. For, as we have seen repeatedly, individuals will sometimes rise back out of this pool of downgraded threats to pose an immediate danger.

And the challenge is immense. According to Security Minister Ben Wallace, there are about 20,000 in this larger pool of people who are not seen as an immediate danger but who, like Abedi, can suddenly become one.

What can be done to manage this problem? Additional resources would help, as well as new technologies such as super computers using artificial intelligence to manage the challenge through data-crunching looking for particular patterns of behaviour. Another method is to continually challenge previous assessments about the security risks that certain individuals may pose, a determination which is bound to shift over time.

However, the principle of proportionality also has to be borne in mind: having lots of security forces chasing those individuals not only requires more resources than are currently available, but may also end up exacerbating the very problem that they are trying to manage.

Other, more extreme ideas have been advanced: internment or enhanced restrictive movement orders. The first proposal is so clearly counterproductive that it bears no consideration; internment in Northern Ireland during the early 1970s became part of the problem, rather than the solution to terrorism troubles.

The second proposal – house arrests – has greater value, except in that it does not necessarily reduce the burden on security officials. An individual who has been placed under house arrest is not actually being dealt with; rather, he or she is being put in a very publicly visible ‘holding pattern’.

Similarly, excluding people from the UK – either through passport denial or exclusion orders – is not actually dealing with the challenge; it simply postpones a determination, and pushes the individual on to another country to be dealt with.

A proportion of the work managing this pool of 20,000 ‘lower-grade’ suspects will come under the contentious Prevent strategy of counterterrorism activity. And this raises another strand of debate to emerge from the Manchester atrocity: how to reform Prevent.

One aspect that should be undertaken is to separate out the different strands of the strategy. The work of managing dangerous offenders or suspects clearly needs to stay attached to the security realm, possibly through the creation of a new specifically developed and tailored service, modelled on the probation service.

Combining probation, welfare, police and intelligence, the new agency could be staffed by individuals who are each managing a specific case-load of former offenders or suspects.

Each case will require a different sort of engagement, but this may provide a way of both keeping an eye on such cases while also focusing on trying to get them on a different path.

A version of the Channel programme, which provides early support to individuals who are at risk of being drawn into terrorism, could be used; this will be a way of providing an individually tailored ‘light touch’ over-watch.

But other parts of the Prevent that are focused on more forward-looking efforts to steer people away from radical paths before they get on to them, should instead be moved firmly out of the criminal space.

Prevent is intended to be about keeping people away from ever getting to terrorism, and this means, among other measures, actually keeping them out of the criminal justice arena. Consequently, it would seem imperative that these programmes are not handled by a security department such as the Home Office.

Finally, there are some very understandable questions about the fact that the bomber was able to walk his device into a crowded space and kill so many. Most arenas nowadays are heavily guarded and people are subject to bag checks on entry.

Clearly, some additional thought must be given to reviewing entry and exit points to such sites, with the usual difficulties of agreeing where to draw the ultimate line of the security cordon.

Much work has gone into managing security in crowded spaces: the lessons learned need to be applied more rigorously and around the entire country. Sports events or concerts that by their very nature aim to be open and accessible will continue to pose a potential problem.

It is unlikely that this will be the last terrorist attack the UK faces. Coming during an election cycle, however, this incident offers an occasion for both introspection and new ideas as future governments continue to confront the challenge.

Banner image: Armed police stand guard at Manchester Arena after Salman Abedi’s suicide bomb attack during a Ariana Grande gig. Courtesy of PA Images.

Raffaello Pantucci

Latest book

Email Subscription

Twitter

Published In

Where are you?

Archives