Between March and June 2017, London and Manchester experienced four attacks in which men used vehicles, knives and explosives to kill and maim members of the public.
Tourists, revellers, worshippers, a police officer and children attending a concert were all targeted.
A total of 36 innocent people were killed in the attacks, and almost 200 more were injured.
David Anderson QC, a former terrorism law reviewer, was asked by the Home Secretary to audit internal MI5 and police reviews, and published his 61-page report on Wednesday (December 5).
The attacks occurred at Westminster Bridge (five fatalities), Manchester Arena ( 22 fatalities ), London Bridge (eight fatalities) and Finsbury Park (one fatality).
Terrorism in the news
The first three attacks were carried out by Islamist terrorists.
The report says Khalid Masood (Westminster) and Salman Abedi (Manchester) had both been “subjects of interest” and Khuram Butt (part of the London Bridge plot) “remained under active investigation”.
It continued: “Substantial and appropriate coverage was in place around key individuals, and mechanisms designed to assess risk were working as intended.
“MI5 and counter-terrorism policing got a great deal right; particularly in the case of Manchester, they could have succeeded had the cards fallen differently.”
“In retrospect, the intelligence can be seen to have been highly relevant to the planned attack.”
The Parsons Green attack in September was not covered by the review.
Here, getwestlondon will pick out some of the key points raised in the report.
Keep up to date with the latest news in west London via the free getwestlondon app.
You can even set it to receive push notifications for all the breaking news in your area
Available to download from the App Store or Google Play for Android now.
Time to call it a day
That just about rounds up our coverage.
Thanks for your time, and have a good evening.
London Bridge attack: MI5 conclusions and recommendations
The review team concluded that the investigation into Khuram Butt was run well and that the decisions taken in the investigation were sound in the light of what was known at the time. A number of areas of good practice were highlighted.”
Though a number of learning points were once again identified, the review team concluded that none of the points identified resulted in missed opportunities to detect and prevent the attack.”
Manchester attack: MI5 conclusions and recommendations
The decision to close the SOI on Salman Abedi was sound on the basis of the information available at the time, Mr Anderson says. But he continued:
It was also noted that despite his status as a closed SOI, an opportunity was missed by MI5 to place Salman Abedi on ports action following his travel to Libya in April 2017. This would have triggered an alert when he returned shortly before the attack, which could have enabled him to be questioned and searched at the airport by CT Policing under Schedule 7 to the Terrorism Act 2000.”
A number of learning points and recommendations were identified, he added.
Westminster attack: MI5 conclusions and recommendations
The review team concluded that actions taken in relation to the threat posed by Khalid Masood, including the decision to close him as an SOI, were sound on the basis of the information available at the time.
It identified, however, a number of learning points and areas where MI5’s policies and processes should be amended.
MI5 and CT policing post attack reviews
In relation to the first three attacks, MI5 and the police each produced their own reports. Because of the nature of the investigations in question, the majority of the material relates to MI5 rather than CT Policing.
“In relation to the Finsbury Park attack, there is only a CT Policing report because Darren Osborne was unknown to MI5.”
Its purpose was to:
- Identify what was known about the attackers and alleged co-conspirators prior to each attack
- Review assessments, actions and decisions made prior to each attack in relation to intelligence held on the attackers and co-conspirators
- Identify and review contextual information that may have had a bearing on actions and decisions made
- Identify learning points arising out of each case
Finsbury Park attack
The report says police had no intelligence to suggest that Darren Osborne was going to commit the attack, and that MI5 had no intelligence on him.
Due to an impending trial, Mr Anderson opts to say little more about Osborne.
Butt MI5 history
“From mid-2015 until the date of the attack, Butt was the principal subject of Operation HAWTHORN, an MI5 investigation which was opened following information suggesting that he aspired to conduct an attack in the UK.”
It was later concluded that Butt represented a medium risk due to his strong intent but weak capability. It emerged in early 2017 that he was teaching a Qur’an class to young people at Ummah Fitness Centre. Concerned that he would use that opportunity to radicalise, MI5 and police worked together to try to identify and disrupt this activity. Information is also provided on the two other men who carried out the London Bridge attack.
London Bridge attacks
The attacks were carried out by Khuram Butt, Rachid Redouane and Youssef Zaghba.
Butt was born in Pakistan in 1990 and moved to England in 1998, before being granted British citizenship in in 2005. He was a live SOI, under active investigation at the time of his attack. He had no criminal convictions but in January 2016 was identified posing with a Daesh flag in the Channel 4 television documentary The Jihadis Next Door.
Opportunity missed?
A process devised by MI5 to identify activity of renewed intelligence interest conducted by closed SOIs identified Salman Abedi as one of a small number of individuals, out of a total of more than 20,000 closed SOIs, who merited further examination.
A meeting arranged before the attack was due to take place on May 31, nine days after he carried out the bombing at Manchester Arena.
MI5 history
Abedi was opened and closed as an SOI on a couple of occasions.
Although he remained a closed SOI until the day of the attack, Salman Abedi continued to be referenced from time to time in intelligence gathered for other purposes. On two separate occasions in the months prior to the attack, intelligence was received by MI5 whose significance was not fully appreciated at the time.
It was assessed at the time to relate not to terrorism but to possible nonnefarious activity or to criminality on the part of Salman Abedi.
In retrospect, the intelligence can be seen to have been highly relevant to the planned attack.”
Police history
“Salman Abedi’s criminal record is limited to reprimands for theft and receiving stolen goods in 2012, and an assault on a female while at college which was dealt with by restorative justice.”
Abedi personal life
He was born in Manchester in 1994, to parents who had been granted asylum after fleeing the Gaddafi regime in Libya. He was the second of six children, the third being his brother Hashem who is currently in detention in Libya and the subject of an extradition request.
Given the possibility of a trial nothing more is said of Hashem or the pre-attack phase.
Manchester attack
Salman Abedi was also a closed SOI. But Mr Anderson writes:
MI5 nonetheless came by intelligence in the months before the attack which, had its true significance been properly understood, would have caused an investigation into him to be opened.
“It is unknowable whether such an investigation would have allowed Abedi’s plans to be pre-empted and thwarted: MI5 assesses that it would not.”
MI5 conclusions and recommendations
The review team concluded that actions taken in relation to the threat posed by Khalid Masood, including the decision to close him as an SOI, were sound on the basis of the information available at the time. It identified, however, a number of learning points and areas where MI5’s policies and processes should be amended.”
Reconnaissance
On March 19, Masood conducted reconnaissance of Westminster Bridge in person and online, and browsed YouTube for videos relating to terrorism (including suicide attacks). Further similar browsing was noted over a variety of dates.”
Masood: Post-attack intelligence
He researched violent attacks, knives, Daesh and vehicle types online as early as April 2016 He bought two Sabatier carving knives from a Tesco in Birmingham on March 9, and on the same day sent himself an email with the subject line “Retaliation”.
He was also in possession of a document entitled “Jihad in the Quran and Sunnah”, with his photograph on the front page and multiple extracts from the Quran that could be claimed to be supportive of jihad and martyrdom.
Having made a down-payment on March 8, he collected on March 16 the Hyundai Tucson that was used in the attack.
Active investigation
Masood had been the subject of active investigation by MI5 between February 2010 and October 2012. At the time of the attack he was a closed SOI.
Known to police and MI5
Prior to the attack in Westminster, both the police and MI5 had some limited (and largely historic) knowledge of him.
Significant crime-related intelligence from Sussex Police databases between 2000 and 2003 also details Masood’s involvement in drug dealing, racketeering and enforcement.
His final release from prison (from a six-month sentence for possession of an offensive weapon) was in 2003, when he was 38.
Since that time, there is no record of him committing any criminal offence.
A closer look at Khalid Masood
He was born Adrian Russell Elms in 1964, and grew up in Kent. He changed his name in 2005 having converted to Islam some years earlier.
“Khalid Masood, though previously known both to the police (for offences of violence prior to 2003) and to MI5 (for association with extremists, particularly between 2010 and 2012) was a closed subject of interest (SOI) at the time of his attack. No intelligence was being gathered on him, and neither MI5 nor the police had any reason to anticipate the attack.”
Extreme right wing threat
Police told Mr Anderson instances of extreme right wing (XRW) attack-planning over the 12 months to October 2017, including the construction of viable explosive devices and the acquisition of firearms.
He was told there were individuals who were assessed to have both the knowledge and the resources to carry out their desired activities but “the known level of attack-planning was however very much lower from the XRW than from Islamists” he said.
He goes on to say:
It was not possible to quantify the number of thwarted XRW terrorist attacks since October 2013, in part because of uncertainty as to whether a lone actor was actually planning an attack and, if so, whether it would have crossed the threshold from hate crime to terrorism.”
West London pair foiled
Among the thwarted jihadists highlighted by Mr Anderson were Tarik Hassane, from Ladbroke Grove, and Suhaib Majeed, from Marylebone, who were part of a four-man group jailed. They planned drive-by shootings on mopeds and researched key locations in Shepherd’s Bush and White City.
Lessons to be learned
Mr Anderson says lessons should be learned from attacks that were thwarted and those which were not. He says:
It is important to take the right lessons from attacks that the authorities are unable to stop. But anyone doing so needs to have in mind also the recent successes of MI5 and the police in averting terrorist attacks. A full picture of what needs to be done comes from knowing what worked, as well as what did not.”
Essential facts:
Finsbury Park A Citroen Relay van hired in Cardiff some days earlier drove into a crowd of worshippers outside Finsbury Park Islamic Centre shortly after midnight on June 19. Makram Ali, who had been taken ill and was lying on the ground, was struck by the vehicle and died soon afterwards. Ten other people received hospital treatment for injuries. Darren Osborne, 47, was arrested and has been charged with murder.
Essential facts: London Bridge
On the evening of Saturday 3 June, three men (27-year-old Briton Khuram Butt, 30-year old Moroccan Rachid Redouane and 22-year old Italian/Moroccan Youssef Zaghba) drove a Renault Master van, locally hired earlier that day, into pedestrians on London Bridge, killing two people.
“Abandoning unused a store of Molotov cocktails and wearing dummy suicide vests, they then left the van armed with large knives, which they used on an apparently random basis to kill six more people in nearby Borough Market and in the vicinity of Borough High Street. Armed police arrived within eight minutes and shot them dead. A total of 11 people were killed, and 45 required hospital treatment.”
Essential facts: Manchester
On the evening of Monday 22 May, 22-year-old British-born Salman Abedi detonated an explosive charge in the foyer of the Manchester Arena, at the end of a concert attended by thousands of children. Abedi was killed in the explosion along with 22 innocent people, 10 of them aged under 20 and the youngest, Saffie Roussos, a girl of eight. A further 116 people required hospital treatment.”
Essential facts: Westminster
On the afternoon of Wednesday 22 March, 52-year old British-born Khalid Masood drove a Hyundai Tucson SUV, hired in Birmingham a few days earlier, into pedestrians who were crossing Westminster Bridge, London.
Three were killed at the time and 32 were admitted to hospital, where one died later and several others were treated for life-changing injuries. Masood then took two carving knives out of the vehicle and fatally stabbed PC Keith Palmer where he was on duty outside the Houses of Parliament.
Masood was shot by armed police and died of his injuries. The entire incident lasted around 90 seconds.”
'Might have been averted'
“It is conceivable that the Manchester attack in particular might have been averted had the cards fallen differently.”
On MI5’s radar
Three of the six attackers were on MI5’s radar, either as an active subject of interest (Khuram Butt at London Bridge) or as closed subjects of interest (Khalid Masood at Westminster and Salman Abedi at Manchester).”
Counter-terrorism success, and a warning...
MI5 and CT Policing have thwarted 20 Islamist terrorist plots in the past four years, resulting in 10 life sentences from the seven plots that have so far come to trial. But in a free society and against a worsening threat background, it is not realistic to expect everything to be stopped.”
What is the report?
This report, finalised on November 2 this year, is an unclassified independent assessment of nine classified internal reviews, stretching to 1150 pages and conducted by MI5 and Counter-Terrorism Policing. It gives a comprehensive account of the handling of intelligence prior to the attacks of March-June at Westminster, Manchester, London Bridge and Finsbury Park.
