Theme: This Paper looks at the UK’s domestic intelligence system’s response to 9/11 and offers some preliminary comments on the implications of the 7/7 attacks in London.
Summary: This paper discusses intelligence and domestic counter-terrorism in the UK, post 9/11, with an emphasis on intelligence-led counter-terrorism. It also offers a tentative, initial analysis of the implications of the 7 July London bombings, where there is a presumption of a lack of prior intelligence.
Analysis: Introduction
The significance of intelligence in counter-terrorism stems from three main drivers: (1) its role in pre-emption and disruption of terrorist activity; (2) its role in post-incident investigations; and (3) its contribution to preventive/protective security measures. This discussion will focus mainly on intelligence and domestic counter-terrorism in the UK, post 9/11, where the emphasis is on intelligence-led counter-terrorism. The paper also offers a tentative, initial analysis of the implications of the London bombings of 7 July 2005 where there is a presumption of a lack of prior intelligence.
The paper will not consider the intense UK debate about intelligence and the evidence for an Iraqi WMD programme, as that has limited relevance to a discussion on intelligence relating to terrorist suspects or facilities within UK national territory because these can be subjected to direct surveillance and investigative actions.
In April 2004 the government accepted the proposal, from the CT agencies, that the UK’s international counter-terrorism policy (‘Contest’) should focus on four areas:
(1) Prevention – addressing underlying causes of terrorism here and overseas. That means, among other things, ensuring that Muslim citizens enjoy the full protection of the law and are able to participate to the full in British society.
(2) Pursuit – using intelligence effectively to disrupt and apprehend the terrorists. The UK has increased joint working and intelligence-sharing between governments and law enforcement agencies across the world. At home, the government aims to make UK borders more secure, to make identity theft harder and to curb terrorist access to financial sources.
(3) Protection – ensuring that reasonable security precautions, including those needed to meet a CBRN threat, are in place, ranging from physical measures at airports to establishing Counter-Terrorism Security Advisers (CTSAs) in each police force.
(4) Preparedness – making sure that the UK has the people and resources in place to respond effectively to the consequences of a terrorist attack.(details from Sir David Omand, Intelligence and Security Coordinator, Speech to RUSI, 1/7/04).
The UK intelligence services obviously have key roles under Pursuit and Prevention.
However, the limitations on the role of intelligence in counter-terrorism need to be carefully understood and the following examples will illustrate this point. With regard to 9/11, US intelligence agencies had received some relevant information pre 9/11 but either failed to appreciate its significance or failed to share it. When the British government deployed 400 troops to Heathrow, in an alert in February 2003, because of intelligence indicating a possible attack, Prime Minister Tony Blair was later to comment over the deployment of troops that ‘… to this day we don’t know if it was correct and we foiled it or if it was wrong’ (The Times, 29/3/04). However, the intelligence source was regarded as a strong one and the counter-terrorism policy priority was to protect the public. The attack on Madrid in March 2004 was a large scale multi-location attack without any apparent prior signs of terrorist activity but with some relevant intelligence available but not fully shared. One expert has commented on terrorism intelligence that ‘… the bull’s eye of this intelligence target –an individual terrorist plot– lacks the size and signatures of most other targets, from nuclear weapons programs to political instability…’ and that ‘… intelligence specific to terrorist plots is often unattainable’ (P. Pillar, in A.K. Cronin & J.M. Lendes, (eds), Attacking Terrorism – Elements of a Grand Strategy, Georgetown UP, Washington DC, p.115-139).
It would appear that the quote above can also be applied to the London bombings of 7 July 2005. Those attacks are a stark reminder of the inherent problems of counter-terrorism intelligence. For any kind of pre-emptive or prevention action there must exist at least one of the following: some form of target or time-specific threat, a person or persons whose activity has ‘suspicious’ characteristics (perhaps purchases of IED-related components) or communications intercept data.
On the current information in the press, the London attacks were clearly pre-planned, time series-linked and involved a small ‘cell’ of perhaps four or more people. The locations of the attacks effectively closed off road and underground transport in London’s central travel Zone One. The attacks also disrupted train routes into London’s main-line stations. Obviously, the UK’s CT agencies had already considered the G8 Summit period as a natural target time for international terrorists and CT resources were heavily deployed around Gleneagles in Scotland. London itself has long been accepted by the CT authorities as a natural ‘iconic’ target for terrorists, as evidenced by earlier IRA-related bombings in the capital and therefore it was already the subject of higher visibility policing, intensive counter-hostile surveillance measures, intelligence monitoring of suspect persons, as well as enhanced protective and preventive security measures. However, without any apparent target or time-specific intelligence, it is hard to see what other mitigating actions might have been taken. This Paper looks at the UK domestic intelligence system’s response to 9/11 and offers some preliminary comments on the implications of the 7/7 attacks in London.
Britain’s Domestic Intelligence System
Until the passing of the 1994 Intelligence Services Act the UK’s intelligence and security services existed in a kind of ‘limbo’ where the Government refused to allow open discussion of their functions, despite a history going back to the early twentieth century. Britain’s intelligence ‘community’ can be described as a layered, pyramidal structure. In the top layer are the Security Service (MI5, domestic counter-terrorism, counter-espionage and some assistance with countering serious and organised crime), the Secret Intelligence Service (MI6, foreign intelligence), Government Communications Head Quarters (GCHQ, elint and sigint) and the Defence Intelligence Staff (DIS, military intelligence including aspects of counter-terrorism). The Security Service is assisted, in the first level, by the intelligence-gathering work of the Special Branch of the Metropolitan Police in London. New Guidelines on the work of the Special Branches were issued in March 2004 and these make it clear that counter terrorism remained the key priority for Special Branch and that all intelligence about terrorism obtained by Special Branch was provided to the Security Service, as the lead agency. Furthermore, the Security Service sets the priorities for the gathering of counter terrorist and other national security intelligence by Special Branch.
In the second layer are the provincial police Special Branches and other agencies, for instance, Customs & Excise and the Immigration and Nationality Department. All the police Special Branches provide what is called the ‘golden thread’ linking the public duty to assist the police with the counter-terrorism process. The provincial police forces’ Special Branches have been ‘pooling’ their resources through the development of Regional Intelligence Cells to enhance their effectiveness, post 9/11, particularly in regard to increasing the flow of information from local areas. This regionalisation of capacity within the police will work alongside a limited level of routine regional deployment of MI5 assets. The connections between anti-terrorist work and tackling serious and organised crime, in those cases where terrorists support their activities from the proceeds of crime, will be strengthened by the recent appointment of former-MI5 head Sir Stephen Lander as Chairman of the Service Authority for the Serious and Organised Crime Agency (SOCA), which is being established. SOCA will take over the functions of the National Criminal Intelligence Service (NCIS), the National Crime Squad (NCS), the Customs & Excise Investigations Division (this service is now known as HM Revenue & Customs) and several small national specialist crime units.
Feeding into both the first and second layers are a number of specialist agencies such as the Transport Ministry’s Transportation Security Directorate (TRANSEC) and the Office for Civil Nuclear Security. The CBRN threat has also led to a number of other specialists becoming involved in this second layer. For example, health service personnel concerned with epidemiology and toxins in the Health Protection Agency.
The most significant development in the analytical element of the UK’s management of terrorism was the establishment in June 2003 of JTAC (the Joint Terrorism Analysis Centre). JTAC operates under the authority of the Director General MI5 and it represents a specific move to break down institutional barriers between intelligence agencies by the processes of co-locating the analysts from all the intelligence agencies and other specialist agencies thus creating a new shared identity through JTAC membership. JTAC’s remit is to provide long-term studies of international terrorism, for instance on the suicide bomber problem and immediate assessments of current threats. The Government conceives of JTAC as the UK’s centre of excellence and expertise on the threat from international terrorism and by the Autumn of 2003 JTAC was dealing with an average of 100 pieces of threat intelligence world-wide every week.
The direct usability of intelligence in relation to response requirements is a very variable factor. Obviously, if terrorist groups provide, as did the IRA, coded threats giving some timing and location details or if similar details are provided from suspects, then emergency services can be fairly specific in their response strategies. However, as CIA Director George Tenet said to the Independent Commission in America, there were many indications of a major terrorist attack pre 9/11 but the warnings were ‘…maddeningly short on actionable details’(The Times, 25/3/04). In the case of the interception and search of the MV Nisha, in December 2001, for suspect dangerous bio-weapon substances off the Isle of Wight by British police and military personnel, the intelligence was not ‘ship specific’ but the Nisha was the only vessel that happened to have a route background and time of arrival into UK waters that fitted in with the limited intelligence available. The decision to intercept was based upon the priority given to ensuring public safety by pre-emptive action, wherever possible. As Prime Minister Blair said ‘… even if the possibility of such a threat is remote we act’(BBC TV news extract and interview with SIO on the Nisha case).
It is obvious from the many accounts in the press of circumstances leading to arrests and from court evidence that the sigint work of GCHQ, MI5 and MI6 is making a major contribution to disruption and dismantling operations against those suspected of terrorist offences. However, older, traditional methods of penetration and the management of human intelligence sources are also being used although of course one cannot expect to find confirmed details of these. However, Home Secretary Charles Clarke did note that, relating to arrests and detentions of terrorist suspects, ‘… in many of these issues intelligence is brought not through intercept, not through phone tapping, but by the existence of individuals within organisations we are talking about who are giving information about what is taking place’ (evidence to Parliamentary Committee, January 2005).
Post-9/11, the Security Service has also become far more publicly visible through its role in providing preventive/protective security advice to the wider industrial and commercial sector as well as to the general public. This role is fulfilled, first, through the Security-Service run National Security Advisory Centre which is linked to a national network of police Counter-Terrorism Advisers. Secondly, the role is fulfilled by the unprecedented step of the Security Service having its own publicly accessible website (www.mi5.gov.uk).
CT Intelligence and the implications of the 7/7 London Bombings
The UK’s CT agencies often refer to the valuable co-operation received from EU member states, such as Spain, the US and other countries in tracking the movements of suspect individuals. However, before 7/7, MI5 was already raising the problem of the ‘clean terrorist’, like the recently convicted (February-March 2005) would-be suicide bomber Saajid Badat, who was a British national with no criminal record and apparently living an exemplary life. Indeed, the UK’s oversight Intelligence and Security Committee reported, in April 2005, that the ‘… need to address the threat from these individuals is the primary reason why the Security Service is currently expanding significantly’ (2004-05 Annual Report of the Intelligence and Security Committee, April 2005). Overall, MI5 will be devoting 69% of its Net Resource Requirement to CT. Of this 69%, 49% will be directed at international terrorism and 21% against Irish terrorism. Moreover, the Joint Working Initiative between the security and intelligence services is designed to maximise the efficient use of the resources of all these services. The JWI is backed up by the SCOPE initiative to produce ‘… a secure web-base information system… (between) … the UK’s ten main producers and consumers of intelligence’ (Ibid).
Thus, one could argue that, on the disruption aspect of the use of intelligence, the UK was probably already doing as much as it could, given that there is a lead time for the recruitment and training of new personnel. With reference to the protective security aspect of intelligence work, NSAC and other bodies such as the Home Office Scientific Branch (HOSB) do examine the utility of a range of counter measures, such as body scanning devices and substance detection systems. However, their viability in a multi-site, rapid mass transit system, like the London Underground, is a matter of debate, although no doubt such measures will be looked at afresh in the aftermath of the recent attacks.
Conclusions: It has been noted that counter-terrorism intelligence’s ‘… most important and direct value is in providing pre-emptive tactical warning of a terrorist action (but)… this may not result in immediately observable action such as arresting terrorists or capturing their materiel’ (M. Herman, Intelligence and National Security, 18 (4), 2003, p. 42). This comment is fully consistent with the current emphasis in the UK of the primacy given to the use of intelligence for the protection of the public by disrupting the activities of terrorists even if this reduces the evidence gathering opportunities for court purposes. Up to 7/7 the UK’s CT agencies had managed to achieve a number of significant intelligence-led disruptions in the area of international terrorism, as was demonstrated by the conviction in April 2005 of Kamel Bourgass in the rycin case.
At this early date, reflection on the intelligence implications of 7/7 must necessarily be of a tentative nature although it would appear that no disruption usable intelligence was available. If these bombers are in fact persons with previously clean records in the sense of not having come to the notice of the intelligence agencies in any capacity, then the decision that MI5 had already taken to try through all means, including humint, to gain more information from within the community, is the correct one, in the longer term. If, however, the bombers are later identified as persons already known to be part of a network with al-Qaeda links, then different kinds of questions will arise concerning possible intelligence gaps on their movements, modus operandi or issues related to, perhaps, border and immigration controls.
Professor Frank Gregory
Jean Monnet Chair in European Political Integration, School of Social Sciences, University of Southampton