In the course of the closed hearings, I summarised the issue at the heart of this part of my investigation as follows. An ordinary member of the public would be deeply concerned to find out that, some time before the Attack, the Security Service had information which transpired to be relevant to SA’s plan and yet took no action in response. That ordinary member of the public would be likely to think that something had gone wrong.
My aim is to consider whether something did go wrong. At all times I have borne in mind that the counter‑terrorism environment is complex and challenging.
I heard some of the evidence relevant to this part of my investigation during the open oral evidence hearings.
Witness J gave evidence during the open oral evidence hearings on behalf of the Security Service. Witness J has over 30 years’ experience as a Security Service officer. By May 2020, he was Acting Director General of Strategy for the Security Service. As at October 2021, Witness J was due to take up the role of Director in the counter‑terrorism business of the Security Service.9
Detective Chief Superintendent (DCS) Dominic Scally gave evidence on behalf of Counter Terrorism Policing North West (CTPNW) during the open oral evidence hearings. At the time of the Attack, DCS Scally was the Head of Intelligence for the North West Counter Terrorism Unit (NWCTU). In July 2017, he was promoted to the position of Regional Co‑ordinator for NWCTU. When NWCTU became CTPNW in April 2018, DCS Scally’s title became Head of CTPNW. He was still in that role when he gave evidence to the Inquiry.10
The police services which made up NWCTU were Greater Manchester, Cumbria, Lancashire, Merseyside and Cheshire.11
Detective Inspector (DI) Frank Morris and Detective Sergeant (DS) Paul Costello respectively gave open evidence as Senior Investigating Officer and Officer in the Case for Operation Oliban.
During the closed hearing I heard oral evidence from 14 witnesses over 10 days between 1st November 2021 and 18th November 2021. Five of those witnesses were from the Security Service, eight were from CTPNW. Each had given at least one witness statement prior to giving evidence.
I read witness statements from a further seven people, including some received after the closed hearing finished. I received a written report from two expert witnesses: one former Security Service officer and one former Counter Terrorism Policing officer, Scott Wilson. I heard oral evidence from the former Security Service officer (the Inquiry’s expert on preventability), which brought the total number of live witnesses to the 14 to which I have referred.
The Security Service and CTPNW provided closed written closing statements dated 4th March 2022 and 7th March 2022, respectively. These were supplemented by closed oral closing statements on 16th March 2022. Both organisations provided a further closed note in response to issues I raised during the oral closing statements.
I have adopted the same approach to the warning letter process in relation to the closed evidence as I did in relation to the open evidence.
In November 2022, the Inquiry Legal Team circulated a proposed gist of Volume 3 (closed) of my Report to the Security Service and Counter Terrorism Policing. In January 2023, I convened a closed submissions hearing. The purpose of this hearing was to consider submissions from the Inquiry Legal Team, the Security Service and Counter Terrorism Policing in relation to the extent to which material could be disclosed to the public without causing harm to national security. During that hearing, I applied the same scrutiny to the arguments presented to me as I did during the open evidence hearings. This Part is the result.
Advantages of the Inquiry’s approach
I have had at least three significant advantages over the previous investigations and reviews.
First, I have had more time. The Post‑Attack Reviews were quite properly carried out at a fast pace. This was so that urgent problems or gaps within the national security and counter‑terrorism systems were identified and remedied as soon as possible. The Post‑Attack Reviews are impressively detailed pieces of work given the circumstances in which they were written. Given the requirement for speed, it was inevitable that they would not be entirely comprehensive.
Second, I have had the opportunity to hear evidence from frontline officers who made key decisions at the relevant times. The Intelligence and Security Committee of Parliament heard evidence from senior Security Service and Counter Terrorism Policing officers, but not from those ‘on the ground’. Lord Anderson spent considerable time embedded in the Security Service and Counter Terrorism Policing during the process of the Post‑Attack Reviews and the compilation of his report. He did not interview the relevant personnel himself. The process and his role did not allow for him to do this.
Third, I have been provided with additional documents which, for various reasons, were not uncovered at the time of the Post‑Attack Reviews. They came to light as a result of further searches carried out in response to the Inquiry’s disclosure requests.
For all of these reasons, I am able to go further than Lord Anderson’s finding that it is conceivable that if the cards had fallen differently the Attack might have been averted.
Hearing from frontline officers
The Inquiry’s process has made clear the value of hearing from the actual officers involved in decisions at the time. Witness J and DCS Scally both provided clear and comprehensive witness statements in both open and closed on behalf of their respective organisations. I accept that they both did their best to assist the Inquiry. They provided answers to a large number of requests and questions from the Inquiry Legal Team on my behalf. I am satisfied that the Inquiry Legal Team has had the fullest possible co‑operation from both organisations.
However, notwithstanding that Witness J had taken time to understand the recollections of his more junior colleagues, he had to take an overall ‘system’ view and give retrospective explanation or justification for why actions were or were not taken or decisions made. No matter how well a witness who gives evidence on behalf of an organisation has been briefed, they may not helpfully be able to answer questions about what another person was thinking, or say what that person is likely to have done in a particular scenario.
The witnesses who gave direct factual evidence to me during the closed hearing were able to offer real insight into their thought processes at the time. On occasion, it became apparent that the Security Service’s corporate position did not reflect what those officers did, thought or would have done at the material time. Rather, the corporate position was more by way of a retrospective justification for the actions taken or not taken.
There is a lesson for future investigations. My experience reveals that the opportunity of using closed hearings to hear directly from the officers is a valuable one. It assisted me to get to the truth of what happened and, in the words of the former Director General of the Security Service, to “squeeze out every last drop of learning”.12
The principle of open justice is of fundamental importance to our society. Obviously, it is preferable for all evidence in any court proceedings to be heard in public. Where it is possible for an adequate investigation to be undertaken by receiving all relevant evidence in an open hearing, that should always be done. In some cases, this may be done satisfactorily through a single corporate witness. In others, the importance of hearing from frontline officers may be the factor that determines whether that issue is explored in open or closed hearings. Whether it makes a difference will be highly fact specific. The requirement for open justice following a closed hearing where individual witnesses are called should be met, where possible, through the use of gisting.
Avoiding ‘worst-case’ assessments
I understand and appreciate that the task of the Security Service and Counter Terrorism Policing is to use the tools and systems at their disposal to make assessments about who and what to investigate, and with what comparative level of priority, based on an inevitably partial and shifting intelligence picture. I recognise that my conclusions on this part of my investigation could have the unintended effect of encouraging a ‘worst‑case’ approach to the assessment of intelligence, whereby any and all information that might suggest a national security risk is escalated and treated as a priority.
The danger of such an approach is that finite resources will not be allocated to the place where they can make the most difference. I do not want the Security Service and Counter Terrorism Policing to adopt an ‘assume the worst’ approach to intelligence gathering or investigation.
The Security Service and Counter Terrorism Policing have many experienced practitioners who, with their colleagues, have built up over many years and thousands of cases a corporate store of knowledge. That knowledge relates to the kinds of situation, patterns of behaviour and history or profile of individuals that are likely to justify further action or investigation being taken. This helps to inform their officers when they have to make professional judgements about the likely level of risk contained in any particular piece of intelligence.
I hope that the conclusions I have reached in relation to the Attack, including those set out in greater detail in Volume 3 (closed), will be a contribution to that corporate store of knowledge. I hope that this can improve the accuracy of judgements that are made in future.