UK terror attacks: Review reveals what MI5 knew about Manchester, London Bridge and Westminster attackers
Security services missed opportunities to intercept the Manchester and London Bridge attackers, a report has found.
David Anderson QC, the former Independent Reviewer of Terrorism Legislation, made a total of 126 recommendations to MI5, police and the Government following the deaths of 36 victims this year.
His report provided new detail on the run-up to the atrocities in Westminster, Manchester and London Bridge. The following information has been declassified from internal reviews by MI5 and police.
Date: 22 March 2017
Victims: Five killed, 49 injured
Perpetrator: Khalid Masood, British, 52 (died at scene)
Masood was known to police after seven convictions for violent crime leading up to 2003, and MI5 for associating with extremi sts particularly between 2010 and 2012.
Summary: âNo intelligence was being gathered on him and neither MI5 nor the police had any reason the anticipate the attackâ¦youâre looking at someone who is such a long way from the top of anyoneâs grid that frankly itâs a bit difficult to see how they would have been easily stopped, whatever agencies had done.âMet Police announce that terror perpetrator Khalid Masood was born Adrian Russell
- 2004: Masood appears for the first time on MI5 records after his number appeared on the contacts list of a member of a terrorist network aiming to launch bomb attacks in the UK.
- 2009: Masood appears on the edge of investigation into jihadis attempting to join an al-Qaeda training camp in the Federally Administered Tribal Areas of Pakistan. Investigators wrongly believe Masood is an individual in Saudi Arabia facil itating travel.
- 2010: He is discovered not to be the same person but an active investigation is launched identifying Masood as a subject of interest (SOI) assessed to be a national security threat. Weeks later, he was downgraded to a potential security threat.
- 2012: Masood formally closed as an SOI following recommendation in internal review, joining 20,000 other former subjects.
- 2012-2016: Masood appears intermittently as a contact of a number of SOIs, including some linked to Anjem Choudaryâs banned al-Muhajiroun network in Luton and Crawley.
- 2013: Masood âexpresses contentment that violent actions such as the World Trade Center attacks attracted people to Islamâ. Neither his contacts nor those comments were considered to reach the threshold for re-opening an investigation.
- April 2016: In searches discovered after his attack, Masood researches violent attacks, knives, Isis and vehicle types.
- December 2016 - March 2017: Masood informs family he is considering working overseas, but his job and visa applications fail. He sells his car and makes efforts to say goodbye to relatives.
- 9 March 2017: Masood buys two carving knives from Tesco in Birmingham, and on the same day sends himself an email with the subject line âRetaliationâ.
- 15 March: He had created a document entitled âJihad in the Quran and Sunnahâ, with his photograph on the front page and multiple extracts from the Quran that could be claimed to be supportive of jihad and martyrdom.
- 16 March: He collects the Hyundai Tucson used in the attack.
- 19 March: Masood conducts reconnaissance of Westminster Bridge in person and online and browses YouTube for videos relating to terrorism and suicide attacks).
- 22 March: Minutes before launching the attack, Masood shares his document with numerous WhatsApp contacts, which was soon sent onwards via iMessage and SMS.
I n pictures: Westminster attack
- 9 show all
In pictures: Westminster attack
An air ambulance lands after gunfire sounds were heard close to the Palace of Westminster in London
MPs wait until the si tuation is under control in Westminster. 'The alleged assailant was shot by armed police,' David Lidington, leader of the House of Commons, told the house.
Crowds gather in Westminster after shooting incident, which police are treating as terror attack
Police were also called to an incident on Westminster Bridge nearby
Early reports indicate the car, which mounted the pavement on Westminster Bridge and mowed into around a dozen people, was the same vehicle which then rammed into th e railings of the Palace of Westminster, just around the corner
Security sources described the suspected assailant as a middle-aged Asian man, who is understood to have left the car before attacking a police officer with a seven-to-eight inch knife
Police have asked people to avoid the immediate area to allow emergency services to deal with the ongoing incident
One woman has died and a number of others, including the police officer, have been hurt, according to a junior doctor at St Thomas 039; Hospital
At least three gun shots were heard by those inside Westminster, and proceedings in the House of Commons have been suspended
Date: 22 May 2017
Victims: 22 killed, 500 injured
Perpetrator: Salman Abedi, British, 23 (died at scene)
Abedi was known to police for links with the Rusholme Crips gang but his criminal record was limited reprimands for theft and receiving stolen goods in 2012, and an assault on a girl at college which was dealt with by ârestorative justiceâ. He was known to MI5 from 2014 but the investigation was closed and he was deemed low-risk.
Summary: âAlthough Abedi had not given police or MI5 any reason to be highly suspicious of him, they still got very closeâ¦information came their way which was assessed from which - with the benefit of hindsight - the wrong conclusions were drawn. Had people understood it in a different way, I think an investigation would have been opened into Abedi, and who knows what it would have found."Manchester bomber Salman Abedi's cousins speak out
- 2011 onwards: Abedi makes numerous trips to Libya with his family after his parents returned to live there during the civil war that saw Muammar Gaddafi toppled and killed.
- 2014: MI5 starts active investigation in the belief Abedi could be individual seen acting suspiciously with another SOI. Although he knew the SOI in question, he turned out not to have been the individual seen with him, and his record was closed in July 2014. Abedi was classed as low residual risk.
- 2015: Another investigation opened over supposed contact with an Isis figure in Libya, âbut he was closed as an SOI on the same day when it transpired that any contact was not directâ.
- 2015-2017: Although he remained a closed SOI until the day of the attack, Abedi continued to be referenced from time to time in intelligence gathered for other purposes. On two separate occasions in the months prior to the attack, intelligence was received and assessed not to relate to terrorism but âto possible non-nefarious activity or to criminalityâ. In retrospect, the intelligence can be seen to have been highly relevant to the planned attack.
- April 2017: Abedi and his brother Hashem leave Manchester for Libya. Abedi returns to the UK four days before his attack, with subsequent investigations showing he made the âcore purchasesâ for his suicide bomb and manufactured it at various properties around Manchester during the period.
- May 2017: Abed i was among a small number of the 20,000 SOIs that data analysis showed merited further examination. A meeting assessing him was due to take place on 31 May but he attacked nine days before.
Manchester explosion in pictures
- 37 show all
Manchester explosion in pictures
People running down stairs as they attempt to exit the Manchester Arena after a blast, where U.S. singer Ariana Grande had been performing, in Manchester
Helpers attend to people inside the Manchester Arena after a suspected suicide bomber detonated an explosive device at the end of an Ariana Grande concert, killing 22 people
Armed officers guard outside a hotel near the Manchester Arena following reports of an explosion, in Manchester, Britain
Police officers are seen outside the Manchester Arena, where U.S. singer Ariana Grande had been performing, in Manchester, northern England
Police and fans close to the Manchester Arena, after reports of an explosion
There have been reports of explosions at Manchester Arena where Ariana Grande had performed
Police deploy at scene of explosion in Manchester, England, at a concert in Manchester Arena
Police stand by a cordoned off street close to the Manchester Arena
Police deploy at scene of explosion in Manchester, England
Police deploy at scene of a reported explosion during a concert in Manchester, England, on May 23, 2017. British police said early May 23 there were "a number of confirmed fatalities" after reports of at least one explosion during a pop concert by US singer Ariana Grande. Ambulances were seen rushing to the Manchester Arena venue and police added in a statement that people should avoid the area
An ambulance drives away from the Manchester Arena, where U.S. singer Ariana Grande had been performing, in Manchester
Police escort members of the public from the Manchester Arena in Manchester, England.
A woman sits in the street in a blanket near the Manchester Arena as police guard the area following reports of an explosion, in Manchester, Britain
Two wome n wrapped in thermal blankets stand near the Manchester Arena, where US singer Ariana Grande had been performing, in Manchester
A Royal Logistic Corps (RLC) bomb disposal robot is unloaded outside the Manchester Arena following reports of an explosion, in Manchester. At least 19 people have been confirmed dead and others 50 were injured, authorities said. It is being treated as a terrorist incident until police know otherwise
A Royal Logistic Corps (RLC) bomb disposal robot is unloaded outside the Manchester Arena following reports of an explosion, in Manchester
Members of the public receive treatment from emergency service staff at Victoria Railway Station close to the Manchester Arena on May 23, 2017 in Manchester, England. There have been reports of explosions at Manchester Arena where Ariana Grande had performed this evening. Greater Manchester Police have have confirmed there are fatalities and warned people to stay away from the area
Armed police after a suspected terrorist attack at the Manchester Arena at the end of a concert by US star Ariana Grande left 19 dead
Emergency services arrive close to the Manchester Arena i n Manchester
An amoured police vehicle patrols near Manchester Arena in Manchester
A man carries a young girl on his shoulders near Victoria station in Manchester
Police officers stand at the Miller Street and Corporation Street Crossroads, in front of the Manchester Arena in Manchester, England
Police block a road nea r to the Manchester Arena in central Manchester, England
Armed police patrol near Victoria station in Manchester, northwest England. Twenty two people have been killed and dozens injured after a suspected suicide bomber targeted fans leaving a concert of US singer Ariana Grande in Manchester
Police forensic officers leave the Manchester Arena as they investigate the scene of an explosion in Manchester
A forensic officer collects evidence on a walkway between Victoria station and Manch ester Arena following a deadly terror attack in Manchester,
A woman and a young girl wearing a t-shirt of US singer Ariana Grande talks to police near Manchester Arena following a deadly terror attack in Manchester,
Mayor of Greater Manchester Andy Burnham and Manchester City Council Leader Sir Richard Leese speak to the media outside Manchester Town Hall after a suicide bomber killed 22 people, including children, as an explosion tore through fans leaving a pop concert in Manchester
The media gather behind a police cordon in Manchester
Flowers left close to the Manchester Arena, the morning after a suicide bomber killed 22 people, including children, as an explosion tore through fans leaving a pop concert in Manchester
Ariana Grande concert attendees Karen Moore and her daughter Molly Steed, aged 14, from Derby, leave the Park Inn where they were given refuge after last night's explosion at Manchester Arena
Signs saying 'We love Manchester' are displayed in a window in Manchester, England
Date: 3 June 2017
Victims: Eight killed, 48 injured
Perpetrators: Khuram Butt, British, 27; Youssef Zaghba, Moroccan-Italian, 22; Rachid Redouane, Moroccan, 30 (all died at scene)
Butt was under live investigation as the principal subject of an MI5 operation opened in mid-2015 following information suggesting he wanted to commit a terror attack in the UK. Redouane was known for immigration offences but had no police or terror record. Zaghba had no criminal record but was known to European authorities after telling Italian police he wanted to be a terrorist. He was not investigated by MI5.
Summary: âWith Butt what you had was a man who was under active investigation from MI5, who did probably around the end of 2016 team up with his two co-conspirators, and yet MI5 and the police between them were not able to identify what they were actually planning.â
âButt displayed strong operational security and much remains unknown, even today, about the mindset of the three conspirators and the planning of the attack.âLondon Bridge attack ringleader 'tried to hire 7.5 tonne lorry'
- 2005: Butt is granted British citizenship after moving to the UK from Pakistan as a child with his parents, who were granted asylum.
- 2008-2010: Butt receives cautions for criminal offences.
- 2009: Redouane seeks asylum in the UK under the false identity of a Libyan national and is refused, seeing him reported to immigration officials.
- June 2012: R edouane stopped and arrested in Scotland under his false Libyan name while trying to travel to Northern Ireland by boat. Because removals to Libya had been suspended on humanitarian grounds, he was released from detention in Larne with conditions to reside in Dagenham and report 20 to immigration authorities. He absconded and was not traced.
- 2012-2015: After going to school and college in London he works as an office manager with a subsidiary of KFC, marrying a friendâs sister in 2013.The couple had a son born in October 2014 and a daughter born in May 2017, less than a month before the London Bridge attack.
- 2015: Butt makes a pilgrimage to Mecca and âexpresses frequent aspirations to travel from late in the year, including to Syria, but never again left Englandâ. MI5âs Operation Hawthorn starts, seeing Butt put under surveillance over suspected attack planning.
- 2015: Redouane moves in with his Irish wife in Dublin and successfully applies for a n EEA Family Permit and EEA residence card, sponsored by his wife. At the time of the attack Redouane was living legally in the UK under his Moroccan identity.
- June 2015: Zaghba starts working legally in the UK.
- September 2015: A potential lone actor triage assessment concluded that Butt represented a medium risk âdue to his strong intent but weak capabilityâ. Over the coming months there was no further indication of attack planning and Butt appeared to be disengaging from al-Muhajiroun. MI5 believed his focus was moving towards overseas travel, including potentially to Syria to fight with Isis or to another Arabic-speaking country to learn the language.
- January 2016: Butt is shown among a group of Islamists linked to al-Muhajiroun praying towards an Isis flag in Channel 4 television documentary The Jihadis Next Door. The police and prosecutors deemed that no criminal offences had been committed.
- February-April 2016: Operation Hawthorn is suspended âbecause of resourcing constraintsâ following Isisâ Paris attacks.
- March 2016: During a stop at Bologna Airport in Italy, Zaghba tells officials he is travelling to Turkey as a âterroristâ, but quickly changes the word to âtouristâ. Further investigation in Italy reveals he had expressed an interest in travelling to Syria to join Isis and practice the âReal Islamâ. On 23 March 2016, Italian authorities place Zaghba on the EU-wide SIS II warning list, potentially bringing him to the attention of the UK at the border - but under a marker identifying him as subject to checks for serious crime, not a national security risk.
- Spring 2016: Butt shows further aspirations travel to the Middle East and/or Africa and raise money for it âbut no longer any indication that travel would be for extremist purposesâ. MI5 decides not to prevent him leaving the country.
- July 2016: Butt assaults a moderate imam and member of the counter-ext remism group Quilliam but the victim did not press charges in time for the case to be taken forward. Butt re-engages with al-Muhajiroun and increases operational security to evade security forces.
- September 2016: Operation Hawthorn downgraded to a lower threat category.
- October 2016: Butt arrested for fraud and granted bail. He was never told the decision was taken not to prosecute.
- December 2016: Relationships between between Redouane, Butt and Zaghba and Butt start at the Ummah Fitness Centre in Ilford.
- January 2017: Zaghba enters the UK for the final time.
- Early 2017: Butt works at the Ummah Fitness Centre and develops links with extremist associates including Redouane. He teachers Quran class to young member alongside Zaghba.
- MI5 and police attempt to disrupt the teaching over radicalisation concerns.
- 7 March 2017: Butt and Redouane meet at the Ummah Fitness Centre, possibly as part of an attempt by Butt to acquire a firearm.
- MI5 receives strands of intelligence regarding a Moroccan male named âRashidâ believed to be a peripheral and social associate of Butt but he the figure not identified as Redouane until after the attack.
- 21 March 2017: A day before the Westminster attack, the investigation into Butt is suspended for a second time âdue to resourcing constraints brought on by a large number of higher-priority investigationsâ.
- April 2017: With Operation Hawthorn still suspended, MI5 downgrades Buttâs holding code from one that indicated he was likely to pose a threat to national security to one that indicated it was merely âlikelyâ. âMI5 noted his continued extremist rhetoric but also uncertainty about whether he posed a threat to national securityâ.
- May 2017: Operation Hawthorn is re-opened to consider whether the threat needed continued investigation or could be closed to put resources elsewhere. A second lone actor triage assessment concluded that the risk posed by Butt had moved from âmedium to unresolvedâ and further investigation was needed. It remained an active investigation until the attack.
- MI5 surveillance never identified Zaghba as Butt or threats, or revealed their attack planning.
- 3 June 2017: CCTV footage from Buttâs home address on the evening of the attack shows him getting into a white van hired earlier in the day with a large red holdall. Two males accompanied him, with one carrying chairs - perhaps to support a cover story that they were moving furniture.
London Bridge Terror Attack
- 15 show all
London Bridge Terror Attack
Armed police on Borough High Street as police are dealing with a "major incident" at London Bridge
Armed Police talk to members of the public outside London Bridge Hospital as police are dealing with a "major incident" at London Bridge
Police Officers outside the Barrowboy and Banker Public House on Borough High Street as police are dealing with a "major incident" at London Bridge
Armed police on Borough High Street as police deal with a 'major incident' at London Bridge
Emergency services near the scene of the incident
People run down Borough High Street as police are dealing with a "major incident" at London Bridge
Emergency services arrive at the scene near Borough market at London Bridge
Emergency personnel on London Bridge as police are dealing with a "major incident" at London Bridge
Police sniffer dogs on London Bridge as police are dealing with a "major incident" at London Bridge
A second helicopter lands on London Bridge as police are responding to three incidents in the capital, amid reports that a vehicle collided with pedestrians on London Bridge, Scotland Yard said. Officers are dealing with reports of stabbings in Borough Market, where armed officers attended and shots were fired. They are also at an incident in the Vauxhall area
Police attend to an incident on London Bridge in London
Police attend to an incident on London Bridge in London, Britain
A police officer escorts members of the public to safety at London Bridge
Police attend to an incident on London Bridge in London, Britain
Police attend to an incident near London Bridge in London, Britain
Date: 19 June 2017
Victims: One killed, 10 injured
Alleged perpetrator: Darren Osborne, British, 47(Facebook/SWNS)
Osborne has been arreste d and charged with murder. His trial is due to start in January, meaning no in-depth findings could be released in the Anderson report because they could prejudice the case.
He is alleged to have acted alone and he was not known to MI5. Police had no intelligence to suggest that he was going to commit the alleged attack.
- More about:
- terror attacks
- London Bridge attack
- Manchester attack
- finsbury park attack
- Westminster attack
- Rachid Redouane
- Khuram Butt
- Youssef Zaghba
- Khalid Masood
- Salman Abedi
- Darren Osborne