Learning lessons: improving counter terrorism
Expectations of what can be achieved when lessons are sought on improving counter terrorism must be realistic, writes Dr Samantha Newbery, reader in International Security at the University of Salford
Twenty-two terror plots were foiled in the UK between March 2017 and September 2019. But not all terror attacks are stopped: 2017 saw attacks take place in Westminster, Manchester, London Bridge and Finsbury Park. After an attack, commendable efforts are made to identify lessons for the emergency services, MI5 and other organisations involved with counter terrorism. Nine reviews into the 2017 attacks were carried out by MI5 and Counter Terrorism Policing. Yet when changes are found to be necessary, implementing those changes is not as straightforward as might be hoped: lessons might be overlooked and therefore not identified at all; implementing lessons can take time; and constraints on resources constitutes a challenge that must be taken into account. Expectations of what can be achieved when lessons are sought, and when efforts are made to implement those lessons, must be realistic.
Identifying and acting on lessons
At the time of the Manchester Arena attack of May 2017, perpetrator Salman Abedi was not one of MI5’s 3,000 active Subjects of Interest (SOI). He was not, therefore, being monitored. Abedi had briefly been an SOI in 2014 and again in 2015 but was classified as no longer posing a threat. David Anderson QC, formerly the UK’s Independent Reviewer of Terrorism Legislation, concluded in his report on the 2017 attacks that when Abedi travelled to Libya in mid-April 2017, MI5 ought to have initiated the procedure to have him arrested under the Terrorism Act 2000 on his return to the UK.
MI5 went on to acknowledge the need to be more alert to ‘closed’ SOIs re-emerging as threats when, in June 2019, they introduced ‘tripwires’ designed to provide warning when any of their 20,000 closed SOIs are at risk of becoming more of a threat, such as if they become unemployed. In the face of the continued threat from terrorism, this change, although undoubtedly worthwhile, seems to have been implemented slowly. Whether the change was made within a reasonable period of time is difficult to judge without more information.
Improving the way that organisations and their personnel communicate with one another is a change that is likely to take time. Expectations concerning timescales must be realistic. As Anderson noted, the sharing of intelligence between MI5 and the police is envied around the world. Intelligence sharing is crucial, as intelligence work involves combining many small pieces to form an inevitably incomplete picture. That doesn’t mean to say no improvements can be made: indeed, the chief coroner’s 2019 report into the London Bridge attacks praised ongoing efforts to improve communication and co-working between MI5 and the police. Differences in organisational culture and the difficulty of establishing robust communications procedures are just two of the challenges that organisations face when seeking to improve coordination.
As well as the need for the police and MI5 to share intelligence that might help prevent an attack, there must be robust procedures for responding to an attack in a coordinated fashion. The value of having effective systems in place to call on Authorised Firearms Officers (AFOs), for example, was demonstrated during the London Bridge attack when armed police arrived within eight minutes and shot the three attackers who were wearing what turned out to be fake suicide vests. Within thirteen minutes of the attack in Manchester fourteen AFOs had arrived. Coordination with neighbouring police forces and the military allowed for a total of 106 AFOs to arrive in Greater Manchester within the hour. These officers carried out vital duties by searching the Arena and providing protection to other responders. This swift deployment was a success and illustrates that there are times when positive lessons can, and should, be identified.