The day I tried to be an MI5 spook
- Published
MI5: A secret organisation that's not as secret as it once was
So there I was inside MI5's London's headquarters and under pressure to decide where I should send the last available undercover surveillance team.
And the more I agonised over which suspects they should follow, the harder it became for me to know if my decision was the right one.
Should I ask them to follow the bomb-maker to the airport, or a mystery group of campers?
My host, who shall be known as "David", needs an answer.
He's an MI5 officer who's spent 20 years thinking about how to manage these risks. Now I'm in his shoes.
Today we know more than ever about the security service's decision-making process - largely because of a series of official reports and hearings, such as the just-concluded inquests into the victims of the 2017 London Bridge attack.
Each inquiry into an domestic attack has raised questions about whether the perpetrator could have been stopped.
So how exactly does MI5 approach the risks? How do its officers decide who should be prioritised?
David, with special authorisation from MI5's director general, is putting me through a training exercise - call it MI5 kindergarten.
Every day, hundreds of pieces of new information reach MI5. And if that information is about someone new who is unconnected to an existing investigation, the "triage unit" must decide what to do with it.
We now know more about MI5's decision-making process - in part due to inquiries following attacks such as those in Manchester in 2017
As the officers in that unit assess the new material, they consider four factors:
Is there any potential terrorist activity in the report?
How credible and reliable is that information?
Can MI5 actually do anything with the intelligence that has come in?
Would it be necessary and proportionate - both legally and operationally - to act?
Find out more
Listen to Analysis: Understanding the risks of terrorism online or on BBC Sounds.
My training day begins with reports that all need to be "triaged". These are fictional but, David says, they're based on the type of information the service receives every day.
The first is from a new agent who says some men were talking on a shopping-centre balcony and saying: "It would be a great plan and they won't know what hit them."
David asks me to go through the tests he's just set out.
I wonder if I could look at every CCTV camera in the shopping centre going back, well, months. David is not impressed.
The information from the agent is so vague as to be unusable without further corroboration.
"If we were to pursue this bit of information, we would not have the resources to cover the most concerning UK-focused attack plots," he says.
"You have to make a judgement based on the intelligence in front of you."
'We've got a number'
A later report from a trusted informant is much easier to identify as something that can be worked with.
I'm told a man called Ibrahim is bragging about having returned from fighting with the self-styled Islamic State group in Syria.
He is impressing people who are listening to him. The agent has managed to get Ibrahim's phone number.
"We need to identify Ibrahim, surely?" I ask David. "We've got a number, so I presume you can do something?"
"Without going into great detail, we can do some initial checks on the telephone number," he says cryptically.
That phone check yields what looks like the full identity for the mysterious "Ibrahim". And that, in turn, leads me to more information.
MI5 admitted it had moved "too slowly" to establish how dangerous the Manchester Arena bomber was
Firstly, a check with the border records reveals Ibrahim has recently returned from Turkey - the most common route for IS recruits.
Secondly, we get a match from the police: Ibrahim has a record for violence.
Our agent then reports back to say Ibrahim appears to be raising funds for IS fighters.
Time to ask the police to swoop in and arrest him? No, says David.
"You would open a full investigation which would enable you to have access to more 'intrusive resources' like telephone intercept," says David.
That's MI5-speak for what used to be called tapping the phone. Today the powers are much broader to allow for the interception of all the modern communications we use.
MI5 has more than 650 live operations which are graded on a pyramid. The most concerning small number at the top have the most resources available to them. These are the people closest to staging an attack.
Ibrahim, David says, is in the second tier of risks because he may be a returned fighter who is fund-raising. So involved - but not yet attacking the UK.
Going back to the original four tests, I conclude that intercepting Ibrahim's phone is a good idea. But I've got to prove in paperwork that I've got an operational reason and a legal case to use that power - and it's the least intrusive thing I can do to get at the information we need.
As we listen in to Ibrahim's phone, we learn he's organising a weekend camp and the names of men who are joining him.
Separately, my agent reports that he or she has also heard about a "training" camp during which Ibrahim might be talking to someone obliquely referred to as "the big man overseas".
I've now got a red alert in my head. Can I get a surveillance team on Ibrahim now?
Guess what? More paperwork.
David tells me I have to bid for a surveillance team - the only problem is there is only one team still available.
He makes me switch roles. I now become the manager who has to decide who gets this last, valuable team.
There's my desire to find out more about Ibrahim's camp - but also a separate investigation into an established bomb-plotter.
MI5 was concerned about the Westminster Bridge attacker Khalid Masood 12 years before his attack
This very dangerous suspect is two months away from striking and investigators are, generally speaking, confident they understand his plan and how far he has got.
But the suspect is picking up someone from the airport. It sounds like a relative - but nobody knows for sure.
Which investigation should get the surveillance? The airport job, or the camping trip?
I decide the team should follow Ibrahim and his campers. I conclude we don't know enough about him or his plans - if indeed they exist.
In other words, I decide to take a calculated risk that there's more to be immediately learned about Ibrahim on that single day than about the bomb plotter.
David concurs. It was what many MI5 investigators would have done.
What if I am wrong?
I feel really uncomfortable having decided to live with the risk that the airport trip is more sinister than it seems.
David says an experienced investigator would be less worried - they would have a plan to find out who got picked up at the airport after it's happened.
I start to think I just want to follow everyone - the East German Stasi approach.
David raises an eyebrow and with dry understatement worthy of a John Le Carre novel, replies: "That's not a model that we follow, to be absolutely clear."
But does David go home feeling the same way as me? Worrying whether he has made the right choice?
"I can absolutely say that that's happened many, many, many times," he says.
"And I suspect that will never change because we have human beings in MI5 investigating other humans who are erratic and unpredictable. And we can never reduce risk to zero."