The Leading News & Information Service For The Facilities, Workplace & Built Environment Community

London, Manchester Could Have Been Stopped. Different Actions - More Arrests

08 December 2017 | Updated 01 January 1970

Attacks in London and Manchester between March and June 2017

The UK is facing an intense threat from terrorism according to all that commented on the publication of the Anderson report on the terrorist attacks of March to June 2017 - this week ending December 8.

The threat according to David Anderson QC himself is multi-dimensional, evolving rapidly and operating at a scale and pace we have not seen before.

"This has been tragically demonstrated in the attacks this year, resulting in the senseless loss of 36 lives and injuries to many more," he said in a publication speech and within his foreword.

"Terrible events like these and the shift in the threat means we must continually challenge ourselves and adapt what we do."


Operational Improvement Review

Anderson's report comes after MI5 and various Police bodies commissioned internal Operational Improvement Reviews (OIR). The reviews considered what was known before the attacks, how processes operated and the implications for counter terrorism to work in the future.

Anderson was asked by the Home Secretary to provide independent assurance of the reviews. He confirmed:

  • MI5 and the Police have together thwarted 22 plots in the last four years, 9 of which have been stopped since March 2017.
  • There are currently well over 500 counter terrorism investigations, involving more than 3,000 subjects of interest – along with a growing pool of more than 20,000 individuals who have previously been the subject of terrorism investigations. These investigations cover the full range of terrorist activity, from attack planning to activity that supports or facilitates terrorism – but a significant proportion involve potential attack planning threats.

Anderson notes in his report: 'intelligence is always imperfect and counter terrorism work requires tough professional judgements. Although we work to keep the country safe, the reality of the terrorist threat means that we will not stop every attack'.

And that of course was the case.


Three of six know to authorities

Three of the six attackers were on MI5’s radar, either as an active subject of interest (Khuram Butt - London Bridge) or as closed subjects of interest (Khalid Masood –Westminster, Salman Abedi - Manchester).

There were four attacks under review including the Finsbury Park mosque attack in addition to the one in Manchester and two in other parts of London.

Anderson notes the impact of the first three attacks was increased by the fact that they came at the end of a long period in which Islamist terrorism had taken multiple lives in neighbouring countries such as France, Belgium and Germany but had not enjoyed equivalent success in Britain. tThe Joint Terrorism Analysis Centre has kept the UK's security status at SEVERE since August 2014, (apart for two brief rises to CRITICAL to coincide with the Manchester attack  and the incident at Parsons Green tube station - which was not under Review - nor was the killing of MP Jo Cox) indicating that Islamist terrorist attacks in the UK are 'highly likely'.

The five perpetrators of the Westminster, Manchester

and London Bridge attacks had similar profiles to those responsible for the 269 Islamist-related terrorist offences in the UK between 1998-2015.

Three were British (Masood, Abedi, Butt); one was a convert to Islam (Masood); three resided in London and one in North West England. At least one (Butt) had direct links to a proscribed terrorist organisation.


Khalid Masood (Westminster)

Khalid Masood, though previously known both to the police (for offences of violence prior to 2003) and to MI5 (for association with extremists, particularly between 2010 and 2012) was a closed Subject Of Interest (SOI) at the time of his attack.

No intelligence was being gathered on him and neither MI5 nor the police had any reason to anticipate the attack.

Masood was born Adrian Russell Elms in 1964 and grew up in Kent. He also used the surname Ajao. In 2005 he changed his name to Khalid Masood, having converted to Islam some years earlier. He had two children from a relationship in the 1990s and two others from his second marriage, in 2007.

In 2005-06 and again in 2008-09 he taught English in Saudi Arabia. He lived variously in Eastbourne, Crawley and Luton, before settling in Birmingham in 2012.

Prior to the attack in Westminster on 22 March 2017, both the police and MI5 had some limited (and largely historic) knowledge of him. The majority of intelligence held on Khalid Masood was crime-related. He was convicted seven times between 1983 and 2003 for offences ranging from criminal damage to possession of an offensive weapon, threatening behavior, assault occasioning actual bodily harm, assault on police and unlawful wounding (a stabbing in the face with a flick knife). It is believed that while serving a two-year prison sentence for the latter offence, imposed in July 2000, he converted to Islam. From 2003 Masood is believed to have been involved in drug dealing, racketeering and enforcement but was not ever rearrested.

The first trace of Khalid Masood in MI5 records dates to April 2004, when a telephone number later associated with him appeared in the contacts list of an SOI...that subject eventually was held in an MI5 and police operation that investigated and subsequently disrupted a UK based terrorist network that aimed to produce and use home-made explosives. Masood appears to have had no direct connection with that plot.



Masood had researched violent attacks, knives, Daesh and vehicle types online as early as April 2016. On 9 March 2017, he purchased two Sabatier carving knives from Tesco in Birmingham and on the same day sent himself an email with the subject line 'Retaliation'.

On 15 March he was in possession of a document entitled 'Jihadin the Quran and Sunnah' and extracts from the Quran that could be claimed to be supportive of jihad and martyrdom.

Having made a down-payment on 8 March, he collected on 16 March the Hyundai Tucson that was used in the attack. On 19 March, Masood conducted reconnaissance of Westminster Bridge in person and online and browsed YouTube for videos relating to terrorism. A few minutes before the attack on 22 March, Masood shared his Jihad document with numerous WhatsApp contacts.


Salman Abedi (Manchester)

Like Khalid Masood (but 30 years younger), Salman Abedi was a closed SOI at the time of his attack and so not under active investigation.

MI5 nonetheless came by intelligence in the months before the attack which, had its true significance been properly understood, would have caused an investigation into him to be opened.

Salman Abedi was also identified by a separate data-washing exercise as falling within the small number of closed SOIs who most merited further consideration. Abedi was born in Manchester in 1994, to parents who had been granted asylum after fleeing the Gaddafi regime in Libya. He was the second of sixchildren, the third being his brother Hashem who is currently in detention in Libya and the subject of an extradition request.

Abedi’s criminal record is limited to reprimands for theft and receiving stolen goods in 2012, and an assault on a female while at college which was dealt with by restorative justice.

Abedi was again opened as an SOI in October 2015, on the basis of his supposed contact with a Daesh figure in Libya, but he was closed as an SOI on the same day when it transpired that any contact was not direct.


Khuram Butt (London Bridge)

Khuram Butt, uniquely among the protagonists in the attacks under review, was a live SOI, under active investigation at the time of his attack. He was the principal subject of an MI5 investigation - Operation Hawthorn opened in mid-2015 following information suggesting that he aspired to conduct an attack in the UK. Coverage of various kinds was put in place over a period of almost two years. Though it continued to varying degrees until the day of the attack, it did not reveal the plans of Butt and his two co-conspirators.

Butt was born in Pakistan in 1990. His family moved to England in 1998, claiming asylum based on political oppression: they were given indefinite leave to remain in 2004. Khuram Butt was given British citizenship in 2005.

He was schooled in Forest Gate, East London, and attended a local sixth form college. Between 2012 and 2015 he worked as an office manager with a subsidiary of KFC. In 2013 he married the sister of a friend. The couple had a son born in October 2014 and a daughter born in May 2017, less than a month before the London Bridge attack.

Butt made a pilgrimage to Mecca in February 2015.

He had no criminal convictions. but in January 2016, he was identified posing with a Daesh flag in the Channel 4

television documentary, 'The Jihadis Next Door'. The police reviewed the documentary and deemed that no criminal offences had been committed, a judgement subsequently endorsed by the Crown Prosecution Service.

While under investigation by MI5, Butt was arrested for fraud in October 2016 and granted bail. He had not yet been told by 3 June 2017, the date of the attack, that on 1 June the decision had been taken not to prosecute him.

Butt had been designated as MEDIUM risk due to his strong intent but weak capability.

Butt however according to the Anderson report, displayed strong operational ability.

Much remains unknown, even today, about the mindset of the three conspirators and the planning of the attack.


Rachid Redouane (London Bridge)

Rachid Redouane first came to the notice of the UK authorities in 2009, when he sought asylum under the false identity of a Libyan national. Asylum was refused and appeal rights exhausted. He last reported to immigration officials in April 2011, after which he was considered an absconder.

He was stopped and arrested in June 2012, again under a Libyan name, by Police Scotland as he attempted to travel to Northern Ireland by boat. At the time removals to Libya had been suspended on humanitarian grounds, so he was released from detention in Larne with conditions to reside in Dagenham and report to immigration authorities. His details were added to the Police National Computer in line with normal absconder procedures but he was never tracked down by those in that chain.

Redouane was not investigated by MI5 or the police prior to the London Bridge attack. Before the attack, MI5 had received a number of strands of intelligence regarding a Moroccan male named 'Rashid' who was assessed by MI5 to be a peripheral and social associate of Khuram Butt.


Youssef Zaghba (London Bridge)

DWP records show that Zaghba had been working legally in the UK since 30 June 2015. He last entered the UK on 12 January 2017. He is believed to have been single with no dependents. Post-incident reporting shows that during a stop at Bologna Airport in Italy in March 2016, Zaghba had said that he was travelling to Turkey as a 'terrorist' but quickly changed that to 'tourist'. Further investigation in Italy revealed that he had expressed an interest in travelling to Syria to join Daesh and practice the 'real Islam'. On 23 March 2016, the Italian authorities placed Youssef Zaghba on the SIS II warning list, thereby potentially bringing him to the attention of the UK authorities.


Darren Osborne (Finsbury Park)

Osborne will be the subject of criminal proceedings. An extradition request to the Libyan authorities has also been made for Hashem Abedi, the brother of Salman Abedi (Manchester), with a view to his facing trial in England. It has been deemed that information or comment that could prejudice future trials should not be published.


Information withheld

As the Intelligence and Security Committee of Parliament (ISC) had  stated in its 2014 report following the murder of Fusilier Lee Rigby, there are some matters which cannot be include in a public report, since to do so would either be illegal or would severely damage Security Agencies’ ability to protect the UK.


Andrew Parker, the Director General of MI5 said: “Throughout its history MI5 has had to adapt and change to keep pace with a fast-moving world, to stay ahead of the country’s adversaries. We have done this before and continue to do it today, in response to the unprecedented threat from international terrorism.

"I welcome David Anderson QC’s independent assurance of our reviews and we are committed to implementing the recommendations we identified. As I said in October, we and our partner agencies used the harsh light of hindsight under independent challenge to ensure we squeezed every drop of learning out of these dreadful events.

"The growth in the number of dangerous individuals who have been radicalised is a major issue for us. We will be redoubling our efforts in enforcement activity both to disrupt and confront the threat and to safeguard the vulnerable from radicalisation.”



Help from the private sector

The UK’s Policing lead for Protective Security, Deputy Assistant Commissioner Lucy D’Orsi, has called for private companies and the commercial sector to buy-in to a ‘Protect Duty’ and work with police and partners to help to keep the public safe.

Addressing policing and government officials from around the world at an event in London last week, D’Orsi stressed the importance for the commercial sector to start factoring protective security measures into event planning and new infrastructure projects at the earliest possible stage.

She said: "Methodologies to protect our cities from the increasing terrorist threat are constantly evolving, to ensure that we are prepared to effectively respond and recover from attacks. We in policing will rightly lead on this vital wor, but there is always a limit to what we can do and I believe that our colleagues in the private sector also have an important part to play."


Strengthen agencies

David Anderson QC’s report endorses several recommendations that MI5 and Police believe will further strengthen processes in counter terrorism work. Many of these build upon existing improvements already underway at the time of the attacks. The main areas of focus are:

  • Exploiting data: the OIR recommends steps to strengthen further our ability to detect engagement in terrorism-related activities, including detecting re-engagement by former subjects of interest in terrorism investigations.
  • Multi-agency engagement: the OIR recommends going beyond existing relationships to enable the widest range of partners to be engaged in managing the risk of renewed engagement in terrorist-related activity as part of a whole of Government counter terrorism response. This includes specifically a new commitment by MI5 to allow knowledge derived from intelligence to be shared more widely beyond intelligence circles.
  • Increased role for the Joint Terrorism Analysis Centre (JTAC) and MI5 in domestic extremism: the OIR proposes to bring equivalence of processes between the current approach to domestic extremist threats (such as right wing threats) and Islamist terrorism, by strengthening threat assessment processes and joint working between CT policing and MI5 where there are potential terrorist threats in this area.

Finally, the OIR recommends a number of technical changes to improve existing operational counter terrorism processes. These cover processes such as information management and the handling of intelligence.


Theresa May plot

Naa’imur Zakariyah Rahman, aged 20, has been accused of plotting a bomb and knife attack on Downing Street - and with a view to killing the Prime Minister. Mohammad Aqib Imran is co-accused.

They appeared at Westminster magistrates court on Wednesday 19. They only confirmed their names, ages, addresses and nationalities. Rahman said he was Bangladeshi-British; Imran, a British-Pakistani

The next hearing will be December 20 at the Old Bailey.

The charges read as follows:

Naa’imur Zakariyah Rahman - within the jurisdiction of the Central Criminal Court with the intention of committing acts of terrorism engaged in conduct in preparation for giving effect to that intention, contrary to section 5(1)(a) and (3) Terrorism Act 2006.

Within the jurisdiction of the Central Criminal Court with the intention of assisting Mohammad Aqib Imran to commit acts of terrorism engaged in conduct in preparation for giving effect to his intention of committing acts of terrorism, contrary to section 5(1)(b) and (3) Terrorism Act 2006.

Mohammed Aqib Imran - within the jurisdiction of the Central Criminal Court with the intention of committing acts of terrorism engaged in conduct in preparation for giving effect to that intention, contrary to section 5(1)(a) and (3) Terrorism Act 2006.

The men were arrested by officers from the Met’s Counter Terrorism Command on Tuesday, 28 November.


More arrests

Officers from the Met's Counter Terrorism Command have arrested four people as part of an investigation into terrorist fundraising.

Two 17-year-old boys, a 38-yea -old woman and a 50-year old woman were arrested on Thursday, 7 December on suspicion of terrorist fundraising, terrorist money laundering and fraud offences.

They were detained under the Police and Criminal Evidence Act (PACE) and are all currently in police custody at a south London police station.

Officers are carrying out searches at three addresses across north London.

Two people who were arrested on Tuesday, 5 December in south-east London have been released on police bail to a date in late December.

Officers from the Met's Counter Terrorism Command, supported by armed officers, executed a search warrant at an address south-east London, where they arrested a 21-year-old man. A 27-year-old woman was also arrested as part of the same investigation after she was stopped by police in a vehicle in a nearby street.

Both were arrested on suspicion of offences under the Explosive Substances Act, 1883.

Picture: David Anderson QC 

Article written by Brian Shillibeer | Published 08 December 2017


Related Tags

Related Articles

Free Training To Help Protect The UK

An award-winning counter terrorism training course is now available to the public for the first time and police want you to sign up and sign up your colleagues to help...

 Read Full Article
London Bridge Attack - Condolence Book Open

A book of condolence has opened at Guildhall Art Gallery on Monday December 2 (a vigil was also held in Guildhall Yard at 11:00am) people to express their sympathies...

 Read Full Article
Murder In the Cathedral - Bomber Caught Planning Attack

Last week (ending Nov 8) saw the official terrorism threat level in the UK lowered to 'Substantial' - meaning an attack is likely. Within days, a woman who...

 Read Full Article
SCaN - See, Check and Notify Training FREE

The See, Check and Notify free security training package empowers staff to help protect your organisation from a range of threats say NaCTSO and the Centre for the...

 Read Full Article
What Is The Terror Threat Level And Why

The threat to the UK (England, Wales, Scotland and Northern Ireland) from terrorism now stands at 'Substantial'. The threat to Northern Ireland from Northern...

 Read Full Article
Security Boss Guilty Of 22 Counts Of Fraud

​A security boss has been found guilty of defrauding security operatives deployed at Heathrow and Tesco. Meanwhile the SIA has carried out a licence check blitz and two...

 Read Full Article
Security Guard Jailed For Terrorism Plans

A security guard who downloaded manuals on how to make bombs using lightbulbs and tennis balls has been jailed for two years and two months. In a separate case, a man was...

 Read Full Article
Parliament Panic - Parking Ticket Fans Protest Flames

Tuesday October 1 saw a man douse himself in petrol outside Parliament and try to set himself alight in protest at a parking ticket. The Met has said the biggest terror...

 Read Full Article
'IRA' Claim Parcel Bomb Responsibility In Correctly Coded Call

A claim has allegedly been made on behalf of the ‘IRA’ for the parcel bombs that were delivered to premises in the UK - using a recognised codeword. A call...

 Read Full Article
London And Glasgow Parcel Bombs Linked To Ireland

The Met Police Counter Terrorism Command’s investigation into three improvised explosive devices at addresses in London on March 5 is ongoing. The incidents are...

 Read Full Article