Manchester attack: The next steps for police and MI5

The UK has not seen a bomb attack like the Manchester outrage since 2005 for three simple reasons:

1. It takes some expertise, which is difficult to come by without help.

2. It requires a lot of planning and preparation, both of which increase the chances that MI5 and other agencies will discover what is going on.

3. Individuals who are sufficiently organised to put the first two together and determined enough to see the plan through to its awful conclusion are very rare.

• Manchester explosion: Latest updates

• Eyewitnesses tell of blast horror

• What we know so far

• General election campaigning suspended

For more than a decade, the BBC Home Affairs Unit has monitored every single terrorist incident, attempted or failed, that has made it into the public domain.

Quite simply, most of the people we have seen dragged through the courts are not capable of this kind of incident.

Many aspire to "martyrdom" and talk about building bombs.

But they are either, to be frank, too stupid and disorganised to turn their fantasies into reality or, alternatively, they get caught because they don't know how to cover their tracks.

Most jihadists discount a bomb attack at the early stages: they realise that it's too difficult to pull off.

They might accidentally kill themselves while making the device.

Their purchasing patterns might raise suspicions in a local pharmacy or, online, prompt GCHQ to have a closer look at their digital life.

They may turn to someone else for help who, unbeknown to both, is already on the MI5 radar.

And so, as the 2013 killing of Fusilier Lee Rigby showed - exactly four years before the Manchester attack - most aspiring attackers opt for a different course.

Vehicles and knives became the weapons of choice.

We saw it in 2014 when a London man planned a knife attack to coincide with the annual act of remembrance.

We saw it again with the Khalid Masood Westminster attack.

Khalid Masood was shot at the scene of the Westminster attack

But while knives and vehicles - and to a lesser extent guns - have featured in recent terrorism plots, there are people who still want to build bombs to attack crowded places.

Just recently, the younger brother of the man in the Remembrance Sunday incident pleaded guilty to trying to find bomb-making help - and one of his potential targets was an Elton John concert.

So the big question for investigators is given that bomb-making requires expertise, how did the attacker, 22-year-old Salman Abedi, get hold of such a device?

As Tuesday dawned, there were three possibilities:

• He was taught how to make it

• He taught himself

• He was provided with the device by someone else

Sophisticated devices

If Abedi was taught, this could point to someone who has returned from so-called Islamic State territory in Syria and Iraq or another jiahdist theatre, such as Libya, where his father is from.

The militants have constructed devices involving the type of DIY shrapnel of metal nuts that has been reported from the scene at the Manchester Arena.

Al-Qaeda and its offshoots have deployed those devices too. Reaching those camps is a harder journey to make - but don't rule it out.

Twenty-two people, including children, have been killed and 59 injured in the attack

Either way, these are sophisticated devices, particularly if made to a well-known recipe that is circulated among extremists.

It takes engineering skill. Sometimes the process of making a bomb can't easily be hidden. For instance, the 7/7 devices contained a chemical that bleached the hair of one of the bomb-makers. The fumes can kill plants.

So if Abedi taught himself, how did he go about it in complete secrecy?

Such an outcome would demonstrate how difficult it is to learn about a threat if the individual is acting entirely alone and taking exceptionally well planned precautions to avoid surveillance.

It's not hard to find bomb-making plans online - don't go looking, it's an offence to possess this information - but many of them are useless.

So, again, the attacker would have spent some time thinking and planning this - and that reduces the likelihood that he was acting entirely alone.

The third scenario is the worst-possible because it would point to an active bomb-making technician on the loose in the UK.

Someone who is completely beneath the security services radar.

Someone who has found ways of reaching out to potential recruits without compromising themselves.

Someone who could strike again.

That, of course, is quite a worrying prospect - but by the end of Tuesday, security chiefs could not rule it out. So they had no choice but to raise the official "threat level", published by MI5, to the maximum level of "critical".

That means an attack may be imminent. Nobody can say for sure because the intelligence business involves glimpsing at things in the shadows, hints and suspicions.

It's less of a jigsaw with missing pieces, it's more like an impressionist's picture: one can only ever see part of what's going on.

Vital intelligence

So, this is very much a manhunt for helpers - even though nobody may know for sure at this stage who, if anyone, they are actually hunting.

Forensic teams are now working at the site

The police know the identity of the attacker - this was a very early breakthrough. It took days back in 2005 for the police to be sure who carried out the London attacks.

So as the hours progress, inside Thames House, the home of MI5, and its regional units, a large post-incident operation will be under way. Officers, supported by GCHQ and where necessary counterparts in foreign agencies, will be examining any piece of intelligence to build up a greater sense of the attacker, his life and those around him.

The North West Counter Terrorism Unit, a joint team of MI5 and police officers, will be looking at anything it can glean from the attacker's own devices. Search teams will identify addresses to search - two have already been raided.

Experts from the national Forensic Explosives Laboratory in Kent will begin the astonishingly difficult work of recovering the remains of the device so they can reconstruct it. These scientists have performed this task on every bomb recovered in modern times.

What they find may, in time, yield vital intelligence - such as the origins of the bomb recipe or its technical construction.

Those details will in turn create new leads - perhaps linking the attacker to a specific group in a specific location: the British and US armed forces also recover remains of bombs overseas for analysis.

It may take months for the full picture to emerge.

But first things first: the race to work out if this killer was a lone wolf or part of a cell that's still out there.