Guided by the UK Government’s national security strategy, and pursuant to the Security Service Act 1989, one of the responsibilities of the Security Service is to counter threats to national security from terrorism. A further responsibility is to act in support of the activities of police services and other law enforcement agencies in the prevention and detection of serious crime.
While the Security Service and Counter Terrorism Policing have different roles and expertise, they work very closely together in pursuit of the common goal of countering the terrorism threat in the UK. This is predominantly through the national Counter Terrorism Policing network, Metropolitan Police Service and Police Service of Northern Ireland. The role of Counter Terrorism Policing includes gathering intelligence and evidence to help prevent, disrupt and prosecute terrorist activities, and carrying out arrests and other executive action. Responsibility for investigating activity that is not of national security concern lies with the policing networks outside Counter Terrorism Policing.
The Security Service has its largest station in London and also has regional stations, including one covering Greater Manchester. This North‑West regional station works very closely with NWCTU, as it was called in 2017, which is now CTPNW. For convenience, I will refer to this organisation as CTPNW from this point onwards.
Key terms
Witness J gave open evidence in respect of some of the Security Service’s investigative processes and operational tools, giving relatively high‑level summaries and explanations of the terms which I use later in this Part.
One such key term is ‘Subject of Interest’. A Subject of Interest is someone who is investigated because they are suspected of being a threat to national security. For each Subject of Interest, the Security Service creates a Key Information Store record. Such a record, which is electronic, can be created before a person of interest has become fully identified.13
A ‘Lead’ is the term used to describe all intelligence or information that is not linked to an ongoing investigation that, following initial assessment, suggests activities requiring investigation by the Security Service and Counter Terrorism Policing.14
A ‘Trace’ is the term used to describe a check that is run across the Security Service’s databases to establish whether the Security Service holds adverse information or to check whether an individual is known to the Security Service already.15
When opened, a Lead results in a Lead development investigation. If an investigation reaches a certain threshold of prioritisation, it is opened as a priority investigation. Such operations are graded on a scale from P4 (the lowest) to P1 (the highest). The definition of a P4 investigation given by Witness J is that it is for individuals, such as released terrorist prisoners, who have previously posed a serious threat to national security and where there is judged to be a risk of re‑engagement. The prioritisation grading informs, but does not dictate, the resources that are allocated to that investigation at a given time.16
Each active Subject of Interest record has an assigned lead investigator, responsible for reviewing incoming intelligence and maintaining the record. When Witness J gave evidence in October 2021, he stated that there were approximately 3,000 Subjects of Interest in active investigations,17 who were either associated with the Security Service priority investigations or who had come to the Security Service’s attention as part of a Lead generated through new intelligence that is not part of an investigation.
The number of ‘closed’ Subjects of Interest, who have been Subjects of Interest in priority investigations since 2009, but who are no longer the subject of active investigations, exceeded 40,000 as at November 2021.
Subjects of Interest within most investigations are prioritised according to the ‘Tier’ assigned to them. The Tier reflects the importance of Subjects of Interest within that investigation at any one time. The Security Service defines the three Tiers as follows.
‘Tier 1’ refers to the main targets of an investigation. Tier 1 Subjects of Interest will likely be involved in all aspects of the activities under investigation.
‘Tier 2’ refers to Subjects of Interest who are key contacts of the main targets. Tier 2 Subjects of Interest will likely be involved in a significant portion of the activities under investigation.
‘Tier 3’ refers to a Subject of Interest who is a contact of a Tier 1 and/or Tier 2 Subject of Interest. Tier 3 Subjects of Interest are likely to be involved only in marginal aspects of the activities under investigation. Not every person who is a contact of a Tier 1 or Tier 2 Subject of Interest is made a Tier 3 Subject of Interest; there is an element of investigator judgement involved in deciding whether a particular contact should be a Tier 3 Subject of Interest.18
Closed Subjects of Interest
Subjects of Interest are closed when they no longer meet the threshold for investigation, such as where it is assessed that they are not, or are no longer, engaged in activity of national security concern. The closure process is not precisely the same now as it was at the time of the Attack, but the broad principles of risk assessment remain unchanged.19
The closure process requires the investigator to consider and assess the residual risk that the closed Subject of Interest poses. Where there has been police involvement in the relevant operation or investigation, this assessment is completed in conjunction with a police colleague.
The assessment of residual risk of a closed Subject of Interest is considered by reference to the likelihood of re‑engagement by the Subject of Interest, and the potential impact if that re‑engagement occurs. This leads to an assessment of whether the Subject of Interest, when closed, will pose ‘High’, ‘Medium’, ‘Low’ or ‘No’ risk.20
Where a Subject of Interest was under investigation by Counter Terrorism Policing, the Security Service would be asked to assist with the provision of relevant intelligence which could help direct the investigation. The police Senior Investigating Officer would expect to know all key intelligence developments, save where this could not be shared because of the sensitivity of the information or the source. In such a situation, the Security Service would retain responsibility for covert investigations.