The approach taken to the threat from Libya in 2017
Security Service officers gave evidence during the closed hearing that they were well aware of the contents of the 2010 Joint Terrorism Analysis Centre (JTAC) report on the Muslim community in Manchester. As I stated in Part 22, the 2010 JTAC report noted concerns about risks arising within the Libyan South Manchester community, alongside others, and a specific risk that the younger generation might become more attracted to Al‑Qaeda influenced global extremism as they lost the nationalist focus of their parents.
In open evidence, Witness J stated that the 2010 JTAC report was:
“… a really useful baseline document that CT Police [Counter Terrorism Policing] and MI5 [the Security Service] and others had access to. It was a comprehensive, at that time, assessment of a range of extremism, terrorist and criminality issues in Manchester. It would have informed, at that time, the teams who were engaged in work in Manchester and elsewhere, but beyond that it wouldn’t have been something that would have been looked at day-to-day in terms of how we then conducted our investigative strategies.”49
Witness J stated during the closed hearing that, by 2017, he would not have expected Security Service investigators still to be very familiar with the specific report, but rather they would be expected to consider more up‑to‑date documents and assessments. Witness J went on to state that he was not aware of any JTAC document produced after 2010 which considered the same issues.
DCS Scally stated during the closed hearing that CTPNW regularly created reports specific to the area they were responsible for which covered similar information and issues to those set out in the 2010 JTAC report.
In the years leading up to 2017, a lot of the Security Service’s attention was on individuals looking to travel to Syria and ways to prevent them from doing so. One of the Security Service witnesses commented during the closed hearing on the fact that most of the individuals who had travelled from Manchester had long‑term plans to stay overseas in areas in which fighting was taking place. Many were known to have died in combat. As a result, there were not many known returnees. Throughout the UK, including in Manchester, there were instances of returnees who the Security Service had not seen leave. This was a potential threat.
It is entirely understandable that the Security Service viewed some returnees from Syria as a greater threat to national security than equivalent returnees from Libya at that time. However, the focus on Syria meant that both the Security Service and CTPNW underestimated the risk from Libya in 2017.
To have ‘run the intelligence machine’ to investigate every person returning from Libya would have been impractical at that time, according to the Security Service witnesses, because there were legitimate reasons to visit Libya. It was necessary, for practical reasons as well as other reasons, for there to be some particular indicators that would cause the fact of somebody’s return from Libya to be treated with concern by the Security Service.
One Security Service witness stated that it felt “slightly uncomfortable” having to apply this approach in practice. A senior Security Service witness stated that it was a “relief” to have a clearly defined policy which was “easier to follow”. Witness J’s evidence in the closed hearing was that, while he could understand how uncomfortable it could be for investigators, these were judgements the Security Service has to make across the world in relation to conflict zones. Such judgements are necessary in order to focus the Security Service efforts and finite resources on activity that constitutes terrorism.
The threshold that the Security Service applied when deciding whether to investigate any returnee from Libya was, in my view, too high and amounted to a risky position. This was particularly so against the backdrop of the careful assessment of JTAC in 2010, which identified a danger of radicalisation of young members of the Libyan community in Manchester.
I accept that some threshold was required that would allow for the exercise of discretion on the part of Security Service investigators as to the extent to which they should investigate each returnee. The problem was that the threshold selected by the Security Service was insufficiently nuanced.
I accept that the possibility of an attack in the UK from those who had been fighting in Libya was not entirely unforeseen by the Security Service and Counter Terrorism Policing in 2017. However, in open evidence, Assistant Commissioner Basu accurately described the effect of the Manchester Arena Attack as a “wake-up call” to how serious a threat it was.50
The Security Service and Counter Terrorism Policing should learn from the situation in Libya and take precautions in relation to the threat to UK national security from individuals who have been involved in fighting overseas in future.
Security Service issues
All Security Service teams across the country were under increasing pressure leading up to 2017, with 2017 particularly showing an increase in priority operations, as well as an increase in the number of Leads which the Service had to address. During that time, it became more commonplace for teams to report that they were under pressure or needed help from other teams to manage their workload.
From January 2016, there were recognised to be particular pressures within the North West, with the workload in Manchester increasing very quickly and to a very substantial extent. The Security Service had to make hard decisions about where it was to focus its resources, and Witness J recognised that that was unacceptable, notwithstanding that it was still able to provide resources to priority investigations.
In his open evidence, Witness J stated:
“I think we saw, in the years leading up to 2017, a pace of threat that MI5 hadn’t experienced before and then we saw another step change during 2017 … The scale was unprecedented in terms of the number of current investigations and the overall number of Subjects of Interest.”51
Between May 2013 and July 2019, the Security Service and police disrupted 27 major Islamist extremist terrorist plots. In addition to those, from March 2017 five right‑ and left‑wing terrorist plots were disrupted.52
Witness J went on to state, in his open evidence, that at the time of the Attack, the Security Service was running about 500 investigations into individuals or groups associated with Islamist terrorism. At that time, the Security Service had around 3,000 active Subjects of Interest.53
A Security Service officer within the North West team described during the closed hearing how, in 2017, that team was “struggling to cope” and that with the amount of time taken up by priority investigations, it was difficult to find space for Leads or incoming intelligence on closed Subjects of Interest. S/he recalled talking to her/his manager before the Attack about a worry that “something inevitably would happen at some point”.
A senior Security Service officer broadly agreed, noting that it was the “level of threat and the expectation that something would happen” that s/he remembered from that period in 2017, because the North West team, like those around the country, went from having a lot of investigations that were “very aspirational and very preliminary” to having “late notice or we had a very partial view of something that could turn out to be significant”.
Witness J was clear during the closed hearing that resource pressure did not have an impact on decisions which were made in relation to SA and that there was no relevant decision point where “resource pressure led to us failing to consider a piece of intelligence properly or make an evidence- based judgment because our attention was elsewhere and because we got the prioritisation wrong”.
I accept Witness J’s analysis. The Inquiry’s careful exploration of the key decisions in relation to SA has not revealed any point at which pressure on resources was a reason for a missed opportunity. The only way in which resource pressure may have had some bearing is indirect, in that it appears to have been at least one factor behind the Security Service’s approach to the threat from Libya, and the focus only on those who fitted particular criteria. It is possible that the pressure of threat from Syria was one reason for the under‑estimation of the risk posed by returnees from Libya.
The Counter Terrorism Policing–Security Service relationship
It was clear from the evidence I heard that the Security Service and Counter Terrorism Policing have a close partnership and that there is every intention from both organisations to work together as smoothly and effectively as possible. In his open evidence, Witness J stated:
“[F]rom my experience, we have a fantastically strong relationship and partnership and we work very well together, but that doesn’t stop us two organisations continually searching for ways to work more closely and better together.”54
Despite this, in the course of the Inquiry’s investigation, several examples of communication failures have been found, only some of which are summarised in Volume 3 (open).
These problems appeared to me to emerge from the systems used by the Security Service and Counter Terrorism Policing to communicate with each other. Both the Security Service and Counter Terrorism Policing accepted in their closed closing statements that there were difficulties with the current systems and were receptive to recommendations that might assist in reducing or resolving these difficulties. The general view of witnesses was that matters had improved already, since the Attack. However, there is undoubtedly still more that can be done, and I will make some recommendations that I hope will assist.