Witness X was initially the corporate witness for the Security Service and, in that capacity, provided an open witness statement. For good reason, Witness X was subsequently unable to give evidence and their witness statement was adopted by Witness J. That statement set out that on two separate occasions in the months prior to the Attack, intelligence was received by the Security Service, the significance of which was not fully appreciated at the time. I shall refer to these as ‘Piece of Intelligence 1’ and ‘Piece of Intelligence 2’.
In his open evidence, Witness J stated the following regarding Piece of Intelligence 1 and Piece of Intelligence 2:
“At the time, it [both pieces of intelligence] was assessed to relate not to terrorism but to possible non-nefarious activity or to non-terrorist criminality on the part of [SA].”
This phrase was used by Lord Anderson in his independent assessment of the Post‑Attack Reviews. In an interview aired by the BBC in a Panorama programme broadcast in 2022, Lord Anderson said:
“MI5 [the Security Service] admitted to me at least two things they got wrong. And the first thing was that when, early in 2017, they received intelligence and they interpreted it as to do probably with drugs or organised crime and not something to do with terrorism or national security.”
Having heard from those witnesses who handled Piece of Intelligence 1 and Piece of Intelligence 2, I do not consider that these statements present an accurate picture.
In the case of Piece of Intelligence 1, Witness C was the person who first considered it. S/he had wondered, at the time, whether it might have some national security significance that merited further investigation, and decided it needed to be reported on. What s/he found difficult was assessing the significance of the intelligence. In the case of Piece of Intelligence 2, all three of those who handled this intelligence (Witness A, Witness B and Witness C) recognised, at the time, that taken together with Piece of Intelligence 1, it was of potential national security concern, at least to some degree.
In this context, the references to ‘national security significance’ and ‘national security concern’ mean potential terrorist activity.
Sharing of intelligence
Neither Piece of Intelligence 1 nor Piece of Intelligence 2 was shared by the Security Service with CTPNW. Piece of Intelligence 1 should have been shared. The fact that Piece of Intelligence 1 was not shared is of concern to me.
However, I do not regard the failure to share Piece of Intelligence 1 to be of causative significance. It is a further example of a communication breakdown between the Security Service and CTPNW. That said, it was for the Security Service to lead the response to Piece of Intelligence 1. Consequently, it is highly unlikely that, had Piece of Intelligence 1 been shared with CTPNW, the mere act of sharing would have led to any different outcome.
Piece of Intelligence 1
Evidence was given to the effect that, if the Security Service were to receive Piece of Intelligence 1 today, based on current policy it is likely that SA would be opened as a low‑level Lead. The opening of such a Lead would have led to the making of low‑level investigative enquiries, in conjunction with the police.
Two of the Security Service witnesses, Witness A and Witness B, were of the view that if further context had been provided in the report on Piece of Intelligence 1, this might have led to further investigative steps being taken at the time.
Speaking at a general level, and not in specific reference to either piece of intelligence, Witness J stated that “it is acceptable for different investigators to arrive at different judgements”.
I accept that Witness C, who first assessed Piece of Intelligence 1, was genuinely seeking to pass on what s/he considered to be useful. However, in my view, s/he should have provided further context. Had Witness C done so, it is likely that further low‑level investigative steps would have been taken in relation to SA at that time. Witness C’s assessment of Piece of Intelligence 1 at the time was that it might have some national security significance.
It is not possible to say whether or not the investigative steps that are likely to have been taken arising from Piece of Intelligence 1, with further context from Witness C, would have revealed SA’s plot. There is a material possibility that it would have led to the Security Service and/or CTPNW learning more about SA’s activities. It is important to stress, though, that in my view it is unlikely that the investigative steps arising from Piece of Intelligence 1 with further context would have uncovered the plot.
If further investigative steps arising from Piece of Intelligence 1 had increased the information the Security Service and/or CTPNW had about SA, then this would have increased the overall prospect that the Attack would have been prevented by reason of Piece of Intelligence 2.
Piece of Intelligence 2
Witness C was also the Security Service officer who first assessed Piece of Intelligence 2. Witness C gave compelling evidence that when s/he assessed Piece of Intelligence 2 s/he had in mind the possibility of activity of pressing national security concern. In my view, s/he was right to. Given that Witness C had that in mind, s/he should have discussed it with other Security Service officers straight away. Moreover, s/he should have written the report on the same day, but in fact did not do so. In the context of national security, if there is a need to do something it is usually necessary to do it promptly.
Witness J and the Security Service, in its closing statement, supported the approach Witness C took in terms of the timing of her/his report on Piece of Intelligence 2.
I disagree with Witness J and the Security Service’s assessment of the timings of Witness C’s actions. In my view, Witness C did not provide a report on Piece of Intelligence 2 as promptly as s/he should have.
Further, Witness A and Witness B were also of the view that, if further context had been provided in the report on Piece of Intelligence 2 and received prior to 22nd May 2017, this might have led to further investigative steps being taken. In my view Witness C’s report on Piece of Intelligence 2 did not contain sufficient context.
Witness C’s failure to report on Piece of Intelligence 2 more fully is not likely to have made any difference, because Witness A and Witness B did, in fact, bear in mind the possibility of activity of pressing national security concern when they assessed Witness C’s report on Piece of Intelligence 2.
As a result, Witness A and Witness B acted promptly in response to Witness C’s report on Piece of Intelligence 2. The prompt reaction of Witness A and Witness B to Witness C’s report on Piece of Intelligence 2 provides strong support, in my view, for the conclusion I have reached that Witness C should have provided the report sooner than s/he did.
The delay in providing the report led to the missing of an opportunity to take a potentially important investigative action: Witness A said that such an investigative action would have provided an opportunity to gather intelligence on SA.
Based on everything the Security Service knew or should have known, I am satisfied that such an investigative action would have been a proportionate and justified step to take. This should have happened.
If the investigative action I have identified had been taken, it is impossible to say on the balance of probabilities what the consequences would have been. Although I accept that SA demonstrated some security consciousness and that this might have affected the efficacy of the investigative action that I have identified, there was the real possibility that it would have produced actionable intelligence.
It is not possible to say with any degree of certainty what would have happened had the investigative action been taken. All I am able to say is that it could have given rise to information which meant that SA’s return to the UK on 18th May 2017 would have been treated extremely seriously by the Security Service.
This could have led to SA being followed to the Nissan Micra which contained the explosive. As I set out in Part 23, there are a number of features of SA’s behaviour before and following his arrival into Manchester Airport on 18th May 2017 which indicate he was taking precautions against being detected. Having considered the CCTV evidence showing how SA behaved around the Nissan Micra on 18th May 2017, I find that, in the event that Security Service officers had successfully followed SA to the Nissan Micra, the Attack might have been prevented.
It could have led to him being port stopped under Schedule 7 of the Terrorism Act 2000 at Manchester Airport on his return. It is also possible that a stop may have had a deterrent effect or led to investigative steps. I accept Witness J’s conclusion, as endorsed by the Inquiry’s expert on preventability, that it is unlikely SA would have been found to have incriminating material on him when he passed through the airport on 18th May 2017. However, as I found in Part 23, there is a possibility that he had the switch for the bomb on him at that time.
It is not possible to know whether SA would have said something revealing to interviewing officers if he had been port stopped, or what the psychological effect on him of being stopped would have been. As the Inquiry’s expert on preventability pointed out, it is impossible to say whether an overt and disruptive step such as a port stop would have had a dissuasive effect. It might have, or SA might have been irrevocably set on his course: being stopped and released might simply have emboldened him further.
When pressed, the Inquiry’s expert on preventability agreed that, given what is known of SA and his actions in the four days between returning to the UK and carrying out the Attack, the possibility of dissuasion was “pretty low”. The chances of a port stop on 18th May 2017 disrupting the Attack may have been low, but I consider they cannot be discounted altogether.
In my view, Piece of Intelligence 2 gave rise to the real possibility of obtaining information that might have led to actions which prevented the Attack. We cannot know what would have happened, but there is at least the material possibility that opportunities to intervene were missed.