Intelligence failure and the 7/7 bombers

Some of the main shortcomings of the United Kingdom's intelligence architecture were demonstrated by the intelligence failures surrounding the 7/7 bombings. Following the 7/7 terrorist attacks, it was publicly stated that the intelligence agencies had received no advance warning of the plot. The Prime Minster, Tony Blair, told the House of Commons that there was ‘no intelligence specific enough’ that could have enabled the police and intelligence services to prevent the attacks.Footnote ⁵ Similarly, the Intelligence and Security Committee was led to believe that ‘none of the individuals involved in the 7 July group had been identified (that is, named and listed) as potential terrorist threats prior to July’.Footnote ⁶ According to MI5, the perpetrators were simply ‘not on the radar’.Footnote ⁷ However, while it may be true that was no specific intelligence regarding the 7/7 plot, it seems that some of those involved in the attacks had in fact come to the attention of the UK intelligence community before. In the years prior to the attacks, it appears that a number of opportunities had been missed to develop the intelligence picture around the future suicide bombers.

Although their exact identities were not known at the time, some of the 7/7 bombers had previously been looked at by both the police and MI5. In 2003, two of the 7/7 suicide bombers, Shehzad Tanweer and Mohammad Siddique Khan, had been under limited surveillance as part of an operation investigating a terrorist cell in Crawley.Footnote ⁸ That same year a known terrorist suspect was identified making calls to a mobile phone registered to Siddique Khan.Footnote ⁹ In 2004, Khan was again monitored by intelligence agencies on at least four further occasions.Footnote ¹⁰ At one point, he was captured talking to Omar Khyam, who was at the centre of a plot to detonate a massive fertilizer bomb. Among the issues the two men discussed, were techniques of financial fraud and preparations for attending a training camp in Pakistan.Footnote ¹¹ In light of the available intelligence, MI5 made a risk assessment of Khan, but it was decided that he was only a peripheral figure in the Crawley network.Footnote ¹² In this context, he was considered to be a low intelligence priority in comparison to other suspects who had been actually been discussing terrorist attack planning.Footnote ¹³ At this point, MI5 decided to take no further action to develop intelligence regarding this supposed terrorist supporter. According to the Intelligence and Security Committee, it was judged that ‘there was no reason to divert resources away from other higher priorities, which included investigations into attack planning against the UK’.Footnote ¹⁴ Similarly, the police made little attempt clarify the identities and intentions of Khan and his associates, instead deciding to ‘await any further tasking’ from MI5.Footnote ¹⁵

This illustrates the first problem with the UK intelligence community – different institutional priorities and responsibilities encourage a disjointed and inconsistent approach to the investigation of terrorist suspects. It appears that Khan fell into the investigative gap between ‘national security threats’ and routine criminal activity. Significantly, the primary responsibility of MI5 is to gather intelligence on threats to national security and the organisation has no real interest in investigating lesser criminal offences, which is seen as a matter for the police. Apparently, the agency does not have enough manpower to pursue all of the significant investigative targets it has identified, never mind scrutinising individuals that are seemingly on the periphery of terrorist networks.Footnote ¹⁶ This has lead to a situation where MI5 has a relatively narrow focus on detecting and preventing specific terrorist attacks, rather than disrupting wider terrorist networks. According to a former member of the MI5, ‘the threshold for such investigations is therefore high and the number of investigations necessarily limited’.Footnote ¹⁷ Conversely, the police are often unwilling to devote attention to complex counter-terrorism cases, as this may pull resources away from their primary task of community policing. As a consequence, those involved in lesser criminal activities in support of terrorist groups, such as fundraising and other kinds of fraud, may not always receive adequate investigative attention. Clearly, this state of affairs is highly risky with regards to the contemporary terrorist threat, as we know that relatively low-level terrorist group supporters can quickly make the transition to operational activity.

Once MI5 had ruled out the option to conduct further directed operations on Mohammad Siddique Khan, it appears that there was no real attempt to further develop the intelligence picture around him. The main intelligence collection methods of MI5 involve intrusive techniques, such as directed surveillance operations and the bugging of private property. By their nature such activities are expensive and man-power intensive. They can produce valuable intelligence, but it comes at a premium cost. As a consequence, MI5 is understandably reluctant to squander its limited resources on what it considers to be relatively low-level intelligence targets. In this light, it is perhaps understandable that the internal risk assessment process within MI5 determined that further surveillance of Khan could not be justified when there were other higher priority cases. However, it is unclear whether other forms of intelligence gathering were ever considered or pursued as alternatives.

This highlights the second problem with the UK intelligence architecture – it fosters a narrow approach to intelligence gathering that is driven by techniques as opposed to targets. Even without recourse to expensive surveillance resources, it may have been possible to glean additional information about Khan that would have led to a reassessment of his importance. Various kinds of desk research could have revealed important things about his international travel, contacts and wider network of associates. Community intelligence appears to have been a particularly under used resource, which is unfortunate as it was apparently well known among locals that Khan had been meeting regularly with other radicals.Footnote ¹⁸ In addition, it is also unclear to what extent MI5 liaised with any foreign intelligence services to gain additional information on Mohammad Siddique Khan. More than one Al- Qaeda operative under custody in a foreign country has alleged that Khan had been attending overseas training camps and associating with leading terrorist planners since as far back as 2001.Footnote ¹⁹ Whilst such information may not have yielded clear evidence of a terrorist plot, a more rounded development of the intelligence picture regarding Khan may have led to a reassessment of his importance.

Crucially, in the years before the 7/7 attacks, various pieces of intelligence regarding some of the future bombers were being circulated within the counter-terrorism community. On a number of occasions intelligence was shared between MI5 and the police regarding a group of unknown individuals, including Mohammad Siddique Khan.Footnote ²⁰ However, the quality of this communication was often poor and there was no real depth to much of the information that was exchanged. In some cases limited amounts of information were provided without any broader context, making it difficult to assess the real level of risk posed by some individuals.Footnote ²¹ In other cases intelligence was simply not shared because it was not considered important enough.Footnote ²² Overall, no single agency had any real appreciation of the amount of information that existed within the intelligence community regarding Khan and his associates.

This demonstrates the third shortcoming of the United Kingdom's intelligence structure – institutional divisions serve as an impediment to effective intelligence sharing. Certainly, there are bound to be communication issues in any situation involving many different organisations. However, within the intelligence community these problems are exacerbated by the fact that each individual agency has their own separate IT systems and procedures for handling information. In a number of cases, attempts to develop intelligence seem to have been undermined by an inability to locate information stored in the myriad of different databases spread across the intelligence community. Crucial links were not made between individuals, phone numbers, locations and vehicles because intelligence analysts were unable to access information readily. On a number of occasions, different ways of spelling of the name ‘Siddique’ seem to have confounded intelligence enquiries.Footnote ²³ It is likely that at least some of these problems could have been avoided if a more joined up intelligence system had been in place across the different agencies.

Ultimately, no intelligence agency or police force took ownership of Khan as a potential terrorist threat. As a result of surveillance operations, intelligence agencies had a photograph of his appearance, his car registration number and details of his home address. Yet despite these significant leads, there was no focused effort on identifying exactly who he was or precisely what he was involved in. If the police and MI5 had co-operated more closely and integrated their intelligence more effectively, then they may very well discovered additional useful intelligence or possibly even evidence of criminal behaviour. Therefore, although there was no intelligence failure in terms of failing to act on specific information regarding the 7/7 plot, there was certainly a broader failure of the counter-terrorism community to exploit intelligence. Clear opportunities were missed to develop the intelligence picture around a group of terrorist supporters that had known links to an operational terrorist cell.

Developing a national counter-terrorism network

Following the 7/7 terrorist attacks, there was a recognition within government that their established counter-terrorism strategy was not appropriate for dealing with the emerging terrorist threat. It became apparent that a ‘fire-fighting’ approach, based on tracking high-level targets and preventing large-scale attacks was unsuitable and left too much vulnerability to smaller scale operations.Footnote ²⁴ There was a realisation that counter-terrorism agencies needed to take action against a much wider range of terrorist targets and intervene far earlier in the process of radicalisation, recruitment and attack planning. This would in turn necessitate improved intelligence activity at a local level and enhanced co-operation between individual counter-terrorism agencies. The Home Secretary, John Reid, observed that ‘one of the lessons of 7/7 was that we needed more co-ordination’.Footnote ²⁵ In line with this thinking, the government moved towards the creation of a national counter-terrorism network consisting of a number of ‘regional counter-terrorism hubs’.Footnote ²⁶ In 2008, the Home Office made clear that:

In support of this process, since 2005 MI5 has been expanding and accelerating its process of regionalisation across the United Kingdom.Footnote ²⁸ This has lead to the creation of six regional MI5 stations in England covering the North East, North West, Midlands, East, South East, and Southern regions. In addition, there has been the launch of three new stations in Northern Ireland, Scotland and Wales.Footnote ²⁹ Alongside the creation of the regional stations, there has also been the development of a ‘Northern Operational Centre’ to provide additional support for surveillance operations outside of London. By 2011, it is predicted that around one quarter of MI5 staff will be based outside of London.Footnote ³⁰ The main focus of this expansion is to support the government's counter-terrorism strategy by working with regional partners to develop the local intelligence picture.

In parallel to the expansion of MI5, the police have taken steps to institute a ‘national structure for counter terrorism policing’.Footnote ³¹ The Association of Chief Police Officers has stated that this comprises ‘a structure that is built on the existing grass roots foundations of the police service’ and which is ‘interconnected and interoperable’.Footnote ³² In October 2006, the Metropolitan Police merged its previously separate Anti-Terrorist Branch and Special Branch into a unified ‘Counter Terrorism Command’, also known as ‘Special Operations 15’ (SO15). The creation of this organisation brought together available intelligence, investigative and operational resources under a combined structure.Footnote ³³ On a day-to-day basis, the main responsibility of the Counter Terrorism Command is to collect intelligence on terrorist threats to London and to support the investigation of terrorist offences in other parts of United Kingdom.

In addition, a number of ‘Counter Terrorism Units’ (CTUs) have been set up across England with the purpose of providing ‘co-ordination and specialist support to police across the country’.Footnote ³⁴ At present, there are four Counter Terrorism Units located within England. They cover the North East region led by West Yorkshire Police, the North West region led by Greater Manchester Police, the West Midlands region led by the West Midlands Police, and the South East region led by Thames Valley Police. In other parts of the United Kingdom, there has been the creation of a ‘Major Crime and Terrorism Investigation Unit’ in Scotland and a ‘Welsh Extremism and Counter Terrorism Unit’ in Wales. The formation of the Counter Terrorism Units essentially saw the merging of Special Branch Officers from large police forces with additional personnel, including surveillance operatives, intelligence analysts, interpreters, forensic specialists and high-tech investigators. It is expected that once they are fully staffed, each CTU will have approximately 260 permanent members of staff.Footnote ³⁵ The Counter Terrorism Units are charged with both reactive and a proactive role – investigating offences that have been committed whilst also gathering intelligence to prevent future terrorist attacks. Much of the operational work of the CTUs is ‘self-generated’ and comes as a result of their own leads and lines of inquiry, although they also act on information from partner agencies.Footnote ³⁶

At the force level, individual Special Branches still remain active. However, in terms of their counter-terrorism role, they have seen many of their analytical and specialist roles transferred to regional CTUs. Consequently, they are now more focused on gathering intelligence from local communities. To support this, there has been a significant expansion of dedicated ‘Community Intelligence Officers’. These personnel operate at the Borough or Divisional level and have the responsibility of developing links to the local community, gathering relevant information and identifying potential intelligence sources.Footnote ³⁷ In addition, there is an increased emphasis on the collection of counter-terrorism intelligence by all police officers under the auspices of project ‘Rich Picture’.Footnote ³⁸

Alongside these structural reforms there has also been the creation a number of analytical ‘fusion centres’, with the aim of facilitating better co-operation and co-ordination between the different counter-terrorism agencies. Peter Gill has observed that such institutions ‘combine the analytical resources of otherwise separate agencies on a targeted problem or person’.Footnote ³⁹ Perhaps the most well-known example of a ‘fusion centre’ is the Joint Terrorism Analysis Centre (JTAC), which was created in June 2003 and brought together personnel from the intelligence agencies and the police, along with representatives from other relevant government departments. Bradley Bamford has described it as the ‘most significant structural development within the intelligence community to date’.Footnote ⁴⁰ More recently we have seen the expansion of fusion centres at a local level with the collocation of personnel from the new Counter Terrorism Units and the regional branches of MI5. In addition, there has been an increase in the number of GCHQ staff on secondment to other agencies, some of whom are embedded in counter-terrorism teams to provide specialist support for investigations.Footnote ⁴¹ As a result, the police and intelligence agencies are apparently now working closer together than ever before. Indeed, according to the Chief Constable of Greater Manchester Police, it is no longer possible to tell ‘who's the cop […] who's the spook’.Footnote ⁴²

How successful have the reforms been?

The creation of a national structure for counter terrorism policing and the regionalisation of MI5 have apparently led to a significant improvement in the level of co-operation and co-ordination between counter-terrorism agencies. The Home Office Minister, Tony McNulty has claimed that ‘the national structure has significantly increased the ability of the police to gather intelligence and evidence against terrorists and to disrupt them and their activities’.Footnote ⁴³ Indeed, according to some observers there in no longer a lack of co-operation between the police and the intelligence services. The former head of the Counter Terrorism Command, Peter Clarke, has commented that: ‘It is sometimes frustrating to hear and read the same tired old comments about MI5 and the police not working together. That is out of date. It is wrong, and is a lie that deserves to be well and truly nailed.’Footnote ⁴⁴

While the initiatives since 2005 should be welcomed, there are some indications that the development of a national counter-terrorism network has not been an unqualified success. Despite recent efforts, a number of terrorists have managed breach the United Kingdom's counter terrorism defences and conduct terrorist attacks. In the same way that counter-terrorism agencies failed to uncover the terrorist plots of the ‘shoe bomber’ Richard Reid, the 7/7 suicide bombers and the attempted 21/7 bombers, they have been similarly unable to disrupt a number of recent terrorist attacks. For example, it has come to light that MI5 had previously come across the members of the terrorist cell that conducted the attempted bombings of the ‘Tiger Tiger’ nightclub in London and Glasgow International Airport during 2007.Footnote ⁴⁵ In a similar fashion, MI5 had some prior knowledge of Nicky Reilly, who attempted to detonate an improvised explosive device in an Essex restaurant during 2008.Footnote ⁴⁶ Crucially, although information regarding these individuals seems to have been recorded on various databases, it appears that none of them had been the subject of further intelligence development.

Some commentators have suggested that a lack of resources can explain why intelligence agencies have not been able to disrupt every recent terrorist plot. In 2007, the Director General of MI5 stated that ‘my main concern has been, and still is, we do not have enough people to do the job’.Footnote ⁴⁷ In a similar manner, the Director of GCHQ has voiced concerns that ‘we were spreading ourselves too thin […] we do not have enough CT resources’.Footnote ⁴⁸ It is often argued that the reality of finite surveillance capabilities means that targets have to be prioritised and that it will never be possible to examine every potential suspect in detail. The current Director General of MI5, Jonathan Evans, has remarked that:

Whilst we should certainly be sympathetic to the resourcing issues faced by the intelligence agencies, it is important to recognise that there are additional challenges that also need to be addressed. The recent expansion of the intelligence agencies and the introduction of a new national counter-terrorism structure will not be successful unless the reforms are accompanied by a similar commitment to improved ways of working. Bradley Bamford argues that: ‘To achieve greater effectiveness in identifying and disrupting international terrorist networks, the UK's current approach necessarily requires an unprecedented level of inter-agency co-operation and, most importantly, information sharing.’Footnote ⁵⁰

In many ways, these new inter-organisational networks demand a different approach to communication that makes traditional intelligence agencies somewhat uncomfortable. As Ronald Deibert has pointed out ‘network intelligence is non-hierarchical, open and distributed rather than hierarchical, secretive and compartmentalized’.Footnote ⁵¹ This kind of unimpeded approach to communication presents a unique risk for intelligence agencies, as they have a clear duty to safeguard their information. Indeed, it is fair to say that the idea of an open and accessible network goes against many of the fundamental principles and practices of the intelligence world.

In reality, the creation of a national counter-terrorism network continues to be undermined by many of the same old problems associated with intelligence sharing. Beyond the rhetoric of joint working and co-operation, the traditional bureaucratic structures and the arcane practices of the intelligence community still hamper the development of effective intelligence networks. At the root of the problem is the division of the collection and analysis of intelligence between so many different agencies. This is not a new problem and has constantly plagued counter-terrorism co-operation since the days of fighting the Provisional IRA. As the former Assistant Commissioner for Special Operations, Andy Hayman, has succinctly remarked, ‘the way that the counter-terrorism effort in Britain is organised is a mess’.Footnote ⁵² Unfortunately, creating formal channels of communication between different agencies under the guise of a ‘counter-terrorism network’ is not enough to solve the problem alone. Within some parts of the UK intelligence community there still remains a cultural aversion to intelligence sharing, the absence of integrated IT systems, and a lack of operational co-ordination. Unless these areas are addressed, the new national counter-terrorism network is destined to under-perform and future intelligence failures are inevitable.

The first problem that confronts the developing a national counter-terrorism network is the dissemination of intelligence. In many cases, individual intelligence agencies feel unable to share intelligence due to concerns about security and secrecy.Footnote ⁵³ Despite national guidelines, on a practical level intelligence agencies often have different standards surrounding the safeguarding and use of intelligence and this creates a certain degree of mistrust and misunderstanding between them. Richard J. Aldrich draws our attention to the persistence of ‘highly compartmentalized national intelligence gathering’.Footnote ⁵⁴ This is especially the case in terms of handling informants and running agents, where there are legitimate concerns about protecting the safety of assets. Although it is also applicable to surveillance operations and the interception of communications, where there is a reluctance to endanger ongoing efforts by revealing techniques and sources.

Such problems of dissemination have not been solved by recent reforms. Despite a closer working relationship between intelligence agencies and the police, the fundamentally different nature of their roles and responsibilities means there are often concerns about sharing operational intelligence. While the police are responsible for taking ‘executive action’ against terrorist suspects, by making arrests and conducting counter-terrorism investigations, the intelligence agencies are primarily focused on intelligence gathering and other forms of ‘covert operational counter-terrorist activity’.Footnote ⁵⁵ The fact that much police activity is overt and subject to legal scrutiny at trial, means that other intelligence agencies can sometimes be reluctant to share intelligence, for fear that that their activities will come to light and endanger future operations. As Richard J. Aldrich observes, ‘source-protection is such a firmly established convention that it is unlikely to change’.Footnote ⁵⁶ This means that important intelligence will not always make its way to an incident room or cross the desk of a local unit investigating a terrorist suspect. Ultimately, different organisational cultures and practices regarding the handling and use of intelligence continue to create significant barriers to effective intelligence sharing.

The second challenge faced by the development of a national counter-terrorism network is the integration of information. Separate agencies often hold important pieces of the intelligence jigsaw, but they are not always brought together in an effective way. In many instances, intelligence assessments are produced by individual agencies ‘as per their own analytical interests and requirements’ and are only really integrated at a strategic level by the Joint Intelligence Committee.Footnote ⁵⁷ At a tactical level, it is often difficult for an intelligence analyst working in one organisation to search for relevant information in a different agency. Instead, they are reliant on making requests for information that may not always be processed in a timely or accurate manner. Unfortunately, sometimes intelligence agencies do not understand the importance of the information they hold or appreciate that it could be relevant to their partners. As a result, Peter Gill points out that ‘information may just locate in voids where no agency has an immediate interest or adequate resources to analyse or otherwise deal with it’.Footnote ⁵⁸

The inaccessibility of data continues to undermine intelligence sharing between different counter-terrorism units. There are a myriad of different IT systems across the intelligence community that are either incompatible or unconnected to those in other agencies. The government has attempted to address some of these problems through the introduction of ‘SCOPE’ – an inter-agency IT system that supports intelligence sharing within the intelligence community. However, the second phase of the project entitled ‘SCOPE 2’, which would have seen a further development of the system and its roll out across other government departments, looks to have been either abandoned or significantly scaled back due to technical and financial problems.Footnote ⁵⁹ There has been a similar lack of progress in harmonising policing intelligence systems.Footnote ⁶⁰ In 2004, the Bichard Inquiry found major deficiencies with IT infrastructure of the police, observing that ‘there is still no common IT system for managing criminal intelligence’.Footnote ⁶¹ In the realm of police counter-terrorism intelligence, the ‘National Special Branch Intelligence System’ is only capable of providing a vertical link between the police and MI5 and cannot facilitate horizontal intelligence sharing between individual police forces.Footnote ⁶² In an attempt to address some of these problems, the Government has been pursuing project ‘IMPACT’ and the development of a ‘Police National Database’ to facilitate improved intelligence sharing. However, many of the key features of this programme have still not been delivered and it is unclear whether the finished product will meet the actual needs of its users. Unfortunately, it appears that many of the individual databases and information stores held within the intelligence community will remain inaccessible beyond their immediate users.

The third obstacle in the way of developing an effective national counter-terrorism network is the joint-tasking and co-ordination of intelligence activity. Often, individual intelligence agencies have their own separate institutional priorities that are not necessarily compatible with those of their partners.Footnote ⁶³ As a result, they can be reluctant to surrender their resources to common tasking process, meaning that intelligence operations are not always aligned. Michael Herman observes that ‘vertical authority and prerogatives create tensions between immediate institutional interests and the broader common good; common interests compete with turf dominance’.Footnote ⁶⁴ In particular, the maintenance of fairly rigid institutional boundaries between ‘foreign’ and ‘domestic’ intelligence agencies, and ‘collection’ and ‘analysis’ bodies, often frustrates the emergence of a co-ordinated intelligence response.Footnote ⁶⁵ Consequently, we are sometimes left with a disjointed approach, where intelligence assets are hoarded to purse the particular priorities of individual agencies.

The presence of divergent institutional priorities still poses a problem for the intelligence community as a whole. Garry Hindle argues that ‘it is not merely a case of spending more, but introducing efficiencies and connectivity to raise capability – a massively more difficult proposition than increasing budgets’.Footnote ⁶⁶ Perhaps the clearest example of such divergent priorities is that the main intelligence agencies are primarily concerned with combating national security threats, whereas the police service is expected to combat a much wider range of criminal activity. This can often lead to a conflict of interest between using resources to achieve criminal convictions, versus deploying assets to support covert intelligence activities. Within the police service itself, there are often competing priorities between individual police forces and the Counter Terrorism Command in London.Footnote ⁶⁷ This situation is further aggravated by the fact that each of the intelligence agencies and police forces operate their own separate tasking and co-ordination process, which complicates the leverage of resources across the wider intelligence community. In addition, there are also problems of budgetary control and the funding of counter-terrorism activities. For example, despite central government funding, many national counter-terrorism operations still rely on the support of individual police forces and police authorities, who can often be reluctant to divert resources away from other local priorities.Footnote ⁶⁸ Ultimately, this continued influence of different institutional priorities still presents a significant challenge for the implementation of a co-ordinated national counter-terrorism structure.