Could MI5 have stopped 2017's attacks?
- Published
A major review of whether MI5 could have stopped any of 2017's terrorism attacks has revealed details of opportunities that, had they been followed through, might have stopped two of them.
The report prepared by former terrorism laws watchdog David Anderson QC, external is a public version of a review by the intelligence and security establishment that runs to more than 1,000 pages.
Khalid Masood was shot at the scene of the Westminster attack
The Westminster Bridge attack, 22 March
Khalid Masood killed five people- four members of the public and PC Keith Palmer
On 9 March, Masood bought two carving knives in Birmingham and sent himself an email with the subject line "retaliation". The review says he had a document, with his photograph on the front page, that contained multiple religious quotes that are often used to justify violence.
A few minutes before the attack, Masood shared his Jihad document with contacts by WhatsApp and text message.
Now, we already knew that Masood had been investigated as a potential extremist in 2010 - but the first trace of him in MI5's systems dates back to April 2004. A telephone associated with him appeared in the contact list of an individual who was already part of a major investigation.
At the time, Masood was living in Crawley, West Sussex - and the town was the epicentre of the Operation Crevice investigation, external that smashed the then biggest terrorist plot in Britain.
Masood was designated as an MI5 "Subject of Interest" (SOI) - meaning someone it is trying to investigate - in 2010 after he was found to be an associate of people trying to get to an al-Qaeda training camp in Pakistan.
By the end of the year, investigators concluded he wasn't a threat and he was removed from the live SOIs list.
Over the next four years he intermittently popped up as a contact of people involved in the banned network once headed by the hate preacher Anjem Choudary.
Profile: Who was the Westminster Bridge attacker Khalid Masood?
Salman Abedi was born in Manchester on New Year's Eve 1994 to Libyan parents
The Manchester Arena attack, 22 May
Salman Abedi killed 22 people when he detonated a homemade bomb outside the Ariana Grande concert
Abedi was first actively investigated by MI5 in January 2014. He was thought to be an associate of a suspect - but was discounted by July when it turned out he was not the man investigators wanted.
In October 2015, he again became a subject of interest for a single day because it was thought, erroneously, that he was in direct contact with a member of the Islamic State group in Libya.
However, that's not the whole story.
The report says: "MI5 ... came by intelligence [on Abedi] in the months before the attack which, had its true significance been properly understood, would have caused an investigation into him to be opened."
Those two pieces of undisclosed intelligence were thought to relate to crime, rather than terrorism.
Was this a missed opportunity? MI5 concluded that the intelligence was insufficient. But Mr Anderson's review states: "It is conceivable that the Manchester attack... might have been averted had the cards fallen differently."
MI5 has conceded that it missed an opportunity to place Abedi on a port watch list - which would have meant he could have been questioned on his return from Libya, days before the attack.
There is another twist.
Before the the attack, analysts used a "data-washing" exercise to go through 20,000 closed cases to see if there were any leads they should follow up. Abedi was one of a "small number" of individuals whose name came up.
Mr Anderson says they were closing in on him - and MI5 had planned a meeting to discuss the names on the shortlist. That case conference was scheduled for nine days after Abedi became a mass murderer.
Khuram Butt, Rachid Redouane and Youssef Zaghba have been named as the London Bridge attackers
London Bridge and Borough Market attack: 3 June
Khuram Butt, Rachid Redouane and Youssef Zaghba killed eight people, before being shot dead by police
The most serious revelations of missed opportunities relate to Butt, the ringleader, because he was under "active investigation".
The probe opened in mid-2015 after the intelligence agencies received information that Butt aspired to carry out an attack in the UK. He was important enough to be watched over the coming two years.
MI5 uses a "triage system" to prioritise who needs the most monitoring. Suspects can go up and down the priority ladder, depending on whether other threats are more pressing.
Butt was two notches below the highest priority. That means he was thought to be involved in the steps linked to attack planning, such as training and fundraising. He was not a bit part player - he warranted his own investigation.
After a few months, he was downgraded a notch to "medium risk" because investigators concluded he did not have the capabilities.
MI5's prioritisation system explained
Priority 1: Investigations into individuals or networks where there is "credible and actionable intelligence" of significant or smaller scale attack planning
Priority 2: Investigations relating to individuals involved in travel overseas to join Jihad, fundraising, training and supply of false documents
Priority 3: Investigations or networks that require further action to determine whether they pose a threat
Priority 4: Those who had once posed a serious threat where there is a risk they may re-engage in extremist activity
Closed SOIs: The 20,000 closed cases of people no longer actively subject to investigation
Butt remained involved with known extremists-and MI5 believed he was thinking of going to Syria.
After the Bataclan attack in Paris, the active investigation into Butt was suspended for two months as officers were diverted onto more urgent operations. It was suspended for a second time the day before the Westminster attack. When it re-opened, Butt was further downgraded to an "unresolved" risk.
Throughout 2017, it now transpires, Butt was deepening his relationship with his co-conspirators, Youssef Zaghba and Rachid Redouane. MI5 now thinks that the three got together at a gym in east London - and that Zaghba may have helped Butt to teach Koranic classes to children at the same centre.
The report also reveals that MI5 had intelligence about a Moroccan called "Rashid" who was a friend of Butt's.
Finsbury Park: 19 June
One man dies after a van is driven at worshippers leaving a mosque
Mr Anderson's report says that MI5 held no intelligence that could have prevented the attack. Darren Osborne, the man alleged to have carried out this attack, is due to face trial for murder.
Could MI5 have stopped the attacks?
It says not - but Mr Anderson believes there were opportunities. Given the scale of terrorism-related activity since 2013 - when the Syria crisis gave a boost to recruitment in the UK - there is no doubt that the security service has been juggling a huge numbers of cases.
The real question is whether the manpower is matched with the right data tools and relationships with other bodies to stop more of the threats before it is too late.
Data analysis will play an increasingly important role in trying to spot individuals who may pose a threat after years of being quiet.
Perhaps the most important change to come is that MI5 may be told to share some of what it knows with other agencies - such as local councils - in the hope that people on the ground can provide the missing piece of information they need to disrupt a threat.
This raises huge cultural challenges for an organisation that necessarily operates below the radar.
Additional research: Daniel De Simone and BBC Home Affairs Unit
- Published5 December 2017
