Manchester attack: The bewildering complexity of a terror inquiry

The investigation into Manchester bomber Salman Abedi's connections has already branched out in multiple directions, and the whole nature of tracking people before they commit an act of terror is bewilderingly complex.

It could be over in hours - or it could take weeks.

That's how unknowable an acute counter-terrorism investigation can be for MI5 and the police.

While there is a sense that there has been significant headway in the last 24 hours, we should be careful about reading too much, too soon, into how long it will take Greater Manchester Police and their colleagues to be sure they have dealt with every single possible lead after Monday's events.

In recent years, we've got a greater understanding of how the more secretive end of these massive operations play out.

At any one time, MI5 is handling in the region of 500 active investigations involving 3,000 "SOIs" - "subjects of interest" in security world jargon.

What kind of resources does MI5 have to throw at those targets? There are around 4,000 people at MI5.

Quite obviously, they are not all trained in hiding in the bushes, so it would be fanciful in the extreme to think they are watching all 3,000 SOIs at the same time.

What we know about Manchester suspect

Manchester attack: The victims

And that means they must constantly prioritise and reprioritise. It is a pretty ruthless, and if they make the wrong call, potentially painful process.

The 7 July 2005 attack on London was earth-shattering for the security service.

During the eventual inquests, it emerged that between MI5 and West Yorkshire Police there had been six potential intelligence strands in which the ringleader had come on to the radar.

The service pledged to massively improve its systems. There was a huge reorganisation of itself and counter-terrorism policing to create powerful regional hubs that share intelligence like never before.

Mounting workload

Since 2013, 18 plots have been thwarted, Whitehall officials say. That's a better strike rate than some of our continental neighbours.

But as the workload mounts, as it has done thanks to Syria, so do the chances that something will be missed.

Every piece of intelligence that comes into the system - be it from a communications intercept, a public tip-off or another source - must be tested for links to ongoing investigations.

And since 2014, we have known how the security service prioritises those investigations thanks to an immensely detailed document published by the Intelligence and Security Committee.

Manchester is "Priority 1" in the MI5 jargon because there is "credible and actionable" intelligence of attack planning.

Further down the ladder come:

•Those planning to fight overseas

•Fundraisers, suspects training in the UK, and people involved in false documents

•People of concern who need to be further checked out

•People who were previously a threat with a risk of "re-engagement"

If security chiefs think there may be a bomb-maker on the loose - as is the case at the moment - they will be throwing everything at it.

Analysts, surveillance units and specialist teams - who deploy the bugs or secretly search property - are reassigned to which investigation needs them most.

The failed Glasgow attack of 2007 came despite a massive police manhunt

The benefits of such a robotic and systematic way of working are plain to see.

But along the way, a proportion of the investigations - and therefore the time of teams - will lead nowhere other than to confirm the intelligence was worthless.

Take this scenario: Someone calls in to say that Person X is saying scary things and buying hair bleach - a chemical that can be used to make a bomb.

A week later, and after an awful lot of effort, it turns out that Person X is opening a beauty salon and it was a malicious call from an embittered former partner. These are the day-to-day challenges of grading intelligence.

International dimension

Since the Manchester operation began on Monday it has sucked in more and more national counter-terrorism resources. It's taken on an international dimension because of the increasingly important link to Libya.

Each property search or seizure of a phone opens even more avenues of investigation for the North West Counter Terrorism Unit and colleagues.

Some of those avenues will become, in time, entirely separate investigations.

And each of these leads will need to be worked to a conclusion, one way or another.

Key question

And that brings us round to the big question yet to be fully answered in the Manchester investigation: was there a missed opportunity to apprehend Salman Abedi?

We know that the killer had been known in some shape or form to the authorities. Muslim community sources have told the BBC that they called the anti-terrorism hotline about his mindset.

And we know from official sources that Abedi had been one of a larger pool of "former" SOIs whose risk remained subject to review by MI5 and its partners.

Wherever he had started in the prioritisation system, he ended up right at the bottom of the list - someone they might need to review in the future if there was "credible" and "actionable" intelligence that he was re-engaging in terrorist-related activity.

But we don't know why he was downgraded - what investigators turned up and how, in the prioritisation system, he was deemed to be of insufficient interest.

Were those calls to the anti-terrorist hotline lacking the detail of credible and actionable intelligence? Did they come before or after he was put to one side?

Or was it just partial information? Too little to trigger a new probe when there were too many more pressing demands for attention?

The answer to that question is key.