Expectations of what can be achieved when lessons are sought on improving counter terrorism must be realistic, writes Dr Samantha Newbery, reader in International Security at the University of Salford
Twenty-two terror plots were foiled in the UK between March 2017 and September 2019. But not all terror attacks are stopped: 2017 saw attacks take place in Westminster, Manchester, London Bridge and Finsbury Park. After an attack, commendable efforts are made to identify lessons for the emergency services, MI5 and other organisations involved with counter terrorism. Nine reviews into the 2017 attacks were carried out by MI5 and Counter Terrorism Policing. Yet when changes are found to be necessary, implementing those changes is not as straightforward as might be hoped: lessons might be overlooked and therefore not identified at all; implementing lessons can take time; and constraints on resources constitutes a challenge that must be taken into account. Expectations of what can be achieved when lessons are sought, and when efforts are made to implement those lessons, must be realistic.
Identifying and acting on lessons
At the time of the Manchester Arena attack of May 2017, perpetrator Salman Abedi was not one of MI5’s 3,000 active Subjects of Interest (SOI). He was not, therefore, being monitored. Abedi had briefly been an SOI in 2014 and again in 2015 but was classified as no longer posing a threat. David Anderson QC, formerly the UK’s Independent Reviewer of Terrorism Legislation, concluded in his report on the 2017 attacks that when Abedi travelled to Libya in mid-April 2017, MI5 ought to have initiated the procedure to have him arrested under the Terrorism Act 2000 on his return to the UK.
MI5 went on to acknowledge the need to be more alert to ‘closed’ SOIs re-emerging as threats when, in June 2019, they introduced ‘tripwires’ designed to provide warning when any of their 20,000 closed SOIs are at risk of becoming more of a threat, such as if they become unemployed. In the face of the continued threat from terrorism, this change, although undoubtedly worthwhile, seems to have been implemented slowly. Whether the change was made within a reasonable period of time is difficult to judge without more information.
Improving the way that organisations and their personnel communicate with one another is a change that is likely to take time. Expectations concerning timescales must be realistic. As Anderson noted, the sharing of intelligence between MI5 and the police is envied around the world. Intelligence sharing is crucial, as intelligence work involves combining many small pieces to form an inevitably incomplete picture. That doesn’t mean to say no improvements can be made: indeed, the chief coroner’s 2019 report into the London Bridge attacks praised ongoing efforts to improve communication and co-working between MI5 and the police. Differences in organisational culture and the difficulty of establishing robust communications procedures are just two of the challenges that organisations face when seeking to improve coordination.
As well as the need for the police and MI5 to share intelligence that might help prevent an attack, there must be robust procedures for responding to an attack in a coordinated fashion. The value of having effective systems in place to call on Authorised Firearms Officers (AFOs), for example, was demonstrated during the London Bridge attack when armed police arrived within eight minutes and shot the three attackers who were wearing what turned out to be fake suicide vests. Within thirteen minutes of the attack in Manchester fourteen AFOs had arrived. Coordination with neighbouring police forces and the military allowed for a total of 106 AFOs to arrive in Greater Manchester within the hour. These officers carried out vital duties by searching the Arena and providing protection to other responders. This swift deployment was a success and illustrates that there are times when positive lessons can, and should, be identified.
Training exercises
Counter terrorism exercises are a key part of training. Exercise SOCRATES, for instance, was a successful suicide bombing and marauding terrorist firearm attack simulation at Manchester Airport held just weeks before the Arena attack. When the Greater Manchester NHS Partnership Mass Casualty Plan had to be used, it was fresh in the minds of the exercise’s participants as a result of that simulation. Reviews of exercises must identify positive lessons such as these, as well as any necessary improvements. The Kerslake Review of 2018 into the preparedness for and response to the Manchester Arena attack found that problems with the call-out procedures through which support from the military is requested had been identified during exercises.
Sadly, these problems had not yet been solved, with the effect that when the Force Duty Officer phoned the military around twenty minutes after the bombing, he was put on hold for four minutes, diverting his attention from other urgent tasks. Simply identifying areas ripe for improvement is not enough: these improvements should be implemented as promptly as possible. When that doesn’t happen, explanations should be sought.
Weaknesses in communications and procedures delayed the Greater Manchester Fire and Rescue Service’s deployment to the Manchester Arena. The stretchers they had that were suited to the rapid extraction of casualties were not, therefore, immediately available, though Anderson is careful to note that it was not within the remit of his review to determine what difference this might have made. Questions should be asked about why these weaknesses weren’t identified and rectified after Exercise Winchester Accord, a counter-terrorism simulation at a shopping centre in Manchester in May 2016. This highlights the danger that lessons are not always identified when they should be, whether that be after an exercise or after an attack.
Resources
A particular challenge when considering how to improve the collection of intelligence is resources. Monitoring CCTV cameras, for instance, requires a great deal of manpower. As the case of Khuram Butt, one of the London Bridge attackers suggests, more resources can help prevent attacks. He was under active investigation as an SOI at the time, yet this did not expose the plans for the attack. This is not entirely surprising, as intelligence has its limits. It is not always the case that all the relevant intelligence needed to prevent an attack is collected. If it is collected, it must also be analysed, disseminated and acted upon in time. An MI5 officer told the June 2019 inquest for the London Bridge attack victims that despite its size, MI5 did not have the resources to have Butt under surveillance on the day of the attack. Yet at that point in time MI5’s work on SOIs and closed SOIs was already at an unprecedented level.
Resource constraints do not always frustrate intelligence work. Informers have been proved to be valuable. For instance, the extreme right-wing terrorist group National Action’s plot to kill MP Rosie Cooper was foiled by a whistleblower who turned against the group and passed information to Hope not Hate, who in turn passed it to the police. Informers act in this way at great risk to themselves, as their exposure as informers can lead to their deaths at the hands of those they inform on. Members of the community can also provide valuable intelligence, however, as was the case when Hisham Muhammad’s landlord reported seeing knives, a soldering iron and wires in his home. Muhammad has since been charged with engaging in conduct in preparation for acts of terrorism. Obtaining intelligence from the public in this way requires few resources, other than those invested in campaigns designed to encourage the public to provide this kind of information, such as Counter Terrorism Policing’s ‘Action Counters Terrorism’ (ACT).
Conclusion
Successful communication within and between organisations, well-planned training exercises, the timely sharing of intelligence, and access to sources of intelligence are just some of the diverse requirements for effective counter terrorism. They should also be evaluated, both by the organisations concerned and by independent reviewers. These evaluations should identify what has gone well in addition to what might be improved, and prompt efforts should be made to roll-out the required changes. However, while there may be times when criticisms of slow progress are justified, there may be others when expectations should be adjusted to become more realistic.
Main source at Counter Terror Business
https://counterterrorbusiness.com/features/learning-lessons-improving-counter-terrorism
