Netizen 24 GBR: UK terror attacks: Review reveals what MI5 knew about Manchester, London Bridge and Westminster attackers

By On December 05, 2017

UK terror attacks: Review reveals what MI5 knew about Manchester, London Bridge and Westminster attackers

Security services missed opportunities to intercept the Manchester and London Bridge attackers, a report has found.

David Anderson QC, the former Independent Reviewer of Terrorism Legislation, made a total of 126 recommendations to MI5, police and the Government following the deaths of 36 victims this year.

His report provided new detail on the run-up to the atrocities in Westminster, Manchester and London Bridge. The following information has been declassified from internal reviews by MI5 and police.


Date: 22 March 2017

Victims: Five killed, 49 injured

Perpetrator: Khalid Masood, British, 52 (died at scene)

Masood was known to police after seven convictions for violent crime leading up to 2003, and MI5 for associating with extremi sts particularly between 2010 and 2012.

Summary: “No intelligence was being gathered on him and neither MI5 nor the police had any reason the anticipate the attack…you’re looking at someone who is such a long way from the top of anyone’s grid that frankly it’s a bit difficult to see how they would have been easily stopped, whatever agencies had done.”

Met Police announce that terror perpetrator Khalid Masood was born Adrian Russell


  • 2004: Masood appears for the first time on MI5 records after his number appeared on the contacts list of a member of a terrorist network aiming to launch bomb attacks in the UK.
  • 2009: Masood appears on the edge of investigation into jihadis attempting to join an al-Qaeda training camp in the Federally Administered Tribal Areas of Pakistan. Investigators wrongly believe Masood is an individual in Saudi Arabia facil itating travel.
  • 2010: He is discovered not to be the same person but an active investigation is launched identifying Masood as a subject of interest (SOI) assessed to be a national security threat. Weeks later, he was downgraded to a potential security threat.
  • 2012: Masood formally closed as an SOI following recommendation in internal review, joining 20,000 other former subjects.
  • 2012-2016: Masood appears intermittently as a contact of a number of SOIs, including some linked to Anjem Choudary’s banned al-Muhajiroun network in Luton and Crawley.
  • 2013: Masood ‘expresses contentment that violent actions such as the World Trade Center attacks attracted people to Islam’. Neither his contacts nor those comments were considered to reach the threshold for re-opening an investigation.
  • April 2016: In searches discovered after his attack, Masood researches violent attacks, knives, Isis and vehicle types.
  • December 2016 - March 2017: Masood informs family he is considering working overseas, but his job and visa applications fail. He sells his car and makes efforts to say goodbye to relatives.
  • 9 March 2017: Masood buys two carving knives from Tesco in Birmingham, and on the same day sends himself an email with the subject line “Retaliation”.
  • 15 March: He had created a document entitled “Jihad in the Quran and Sunnah”, with his photograph on the front page and multiple extracts from the Quran that could be claimed to be supportive of jihad and martyrdom.
  • 16 March: He collects the Hyundai Tucson used in the attack.
  • 19 March: Masood conducts reconnaissance of Westminster Bridge in person and online and browses YouTube for videos relating to terrorism and suicide attacks).
  • 22 March: Minutes before launching the attack, Masood shares his document with numerous WhatsApp contacts, which was soon sent onwards via iMessage and SMS.

I n pictures: Westminster attack

  • 9 show all

In pictures: Westminster attack

  • 1/9

    An air ambulance lands after gunfire sounds were heard close to the Palace of Westminster in London

  • 2/9

    MPs wait until the si tuation is under control in Westminster. 'The alleged assailant was shot by armed police,' David Lidington, leader of the House of Commons, told the house.

  • 3/9

    Crowds gather in Westminster after shooting incident, which police are treating as terror attack

  • 4/9

    Police were also called to an incident on Westminster Bridge nearby

  • 5/9

    Early reports indicate the car, which mounted the pavement on Westminster Bridge and mowed into around a dozen people, was the same vehicle which then rammed into th e railings of the Palace of Westminster, just around the corner

  • 6/9

    Security sources described the suspected assailant as a middle-aged Asian man, who is understood to have left the car before attacking a police officer with a seven-to-eight inch knife

  • 7/9

    Police have asked people to avoid the immediate area to allow emergency services to deal with the ongoing incident

  • 8/9

    One woman has died and a number of others, including the police officer, have been hurt, according to a junior doctor at St Thomas&# 039; Hospital

  • 9/9

    At least three gun shots were heard by those inside Westminster, and proceedings in the House of Commons have been suspended


Date: 22 May 2017

Victims: 22 killed, 500 injured

Perpetrator: Salman Abedi, British, 23 (died at scene)

Abedi was known to police for links with the Rusholme Crips gang but his criminal record was limited reprimands for theft and receiving stolen goods in 2012, and an assault on a girl at college which was dealt with by “restorative justice”. He was known to MI5 from 2014 but the investigation was closed and he was deemed low-risk.

Summary: “Although Abedi had not given police or MI5 any reason to be highly suspicious of him, they still got very close…information came their way which was assessed from which - with the benefit of hindsight - the wrong conclusions were drawn. Had people understood it in a different way, I think an investigation would have been opened into Abedi, and who knows what it would have found."

Manchester bomber Salman Abedi's cousins speak out


  • 2011 onwards: Abedi makes numerous trips to Libya with his family after his parents returned to live there during the civil war that saw Muammar Gaddafi toppled and killed.
  • 2014: MI5 starts active investigation in the belief Abedi could be individual seen acting suspiciously with another SOI. Although he knew the SOI in question, he turned out not to have been the individual seen with him, and his record was closed in July 2014. Abedi was classed as low residual risk.
  • 2015: Another investigation opened over supposed contact with an Isis figure in Libya, “but he was closed as an SOI on the same day when it transpired that any contact was not direct”.
  • 2015-2017: Although he remained a closed SOI until the day of the attack, Abedi continued to be referenced from time to time in intelligence gathered for other purposes. On two separate occasions in the months prior to the attack, intelligence was received and assessed not to relate to terrorism but “to possible non-nefarious activity or to criminality”. In retrospect, the intelligence can be seen to have been highly relevant to the planned attack.
  • April 2017: Abedi and his brother Hashem leave Manchester for Libya. Abedi returns to the UK four days before his attack, with subsequent investigations showing he made the “core purchases” for his suicide bomb and manufactured it at various properties around Manchester during the period.
  • May 2017: Abed i was among a small number of the 20,000 SOIs that data analysis showed merited further examination. A meeting assessing him was due to take place on 31 May but he attacked nine days before.

Manchester explosion in pictures

  • 37 show all

Manchester explosion in pictures

  • 1/37

    People running down stairs as they attempt to exit the Manchester Arena after a blast, where U.S. singer Ariana Grande had been performing, in Manchester

  • 2/37

    Helpers attend to people inside the Manchester Arena after a suspected suicide bomber detonated an explosive device at the end of an Ariana Grande concert, killing 22 people

  • 3/37

    Armed officers guard outside a hotel near the Manchester Arena following reports of an explosion, in Manchester, Britain

  • 4/37

    Police officers are seen outside the Manchester Arena, where U.S. singer Ariana Grande had been performing, in Manchester, northern England

  • 5/37

  • 6/37

  • 7/37

  • 8/37

  • 9/37

    Police and fans close to the Manchester Arena, after reports of an explosion

  • 10/37

    There have been reports of explosions at Manchester Arena where Ariana Grande had performed

  • 11/37

    Police deploy at scene of explosion in Manchester, England, at a concert in Manchester Arena

  • 12/37

    Police stand by a cordoned off street close to the Manchester Arena

  • 13/37

    Police deploy at scene of explosion in Manchester, England

  • 14/37

    Police deploy at scene of a reported explosion during a concert in Manchester, England, on May 23, 2017. British police said early May 23 there were "a number of confirmed fatalities" after reports of at least one explosion during a pop concert by US singer Ariana Grande. Ambulances were seen rushing to the Manchester Arena venue and police added in a statement that people should avoid the area

  • 15/37

    An ambulance drives away from the Manchester Arena, where U.S. singer Ariana Grande had been performing, in Manchester

  • 16/37

    Police escort members of the public from the Manchester Arena in Manchester, England.

  • 17/37

    A woman sits in the street in a blanket near the Manchester Arena as police guard the area following reports of an explosion, in Manchester, Britain

  • 18/37

    Two wome n wrapped in thermal blankets stand near the Manchester Arena, where US singer Ariana Grande had been performing, in Manchester

  • 19/37

    A Royal Logistic Corps (RLC) bomb disposal robot is unloaded outside the Manchester Arena following reports of an explosion, in Manchester. At least 19 people have been confirmed dead and others 50 were injured, authorities said. It is being treated as a terrorist incident until police know otherwise

  • 20/37

    A Royal Logistic Corps (RLC) bomb disposal robot is unloaded outside the Manchester Arena following reports of an explosion, in Manchester

  • 21/37

    Members of the public receive treatment from emergency service staff at Victoria Railway Station close to the Manchester Arena on May 23, 2017 in Manchester, England. There have been reports of explosions at Manchester Arena where Ariana Grande had performed this evening. Greater Manchester Police have have confirmed there are fatalities and warned people to stay away from the area

  • 22/37

    Armed police after a suspected terrorist attack at the Manchester Arena at the end of a concert by US star Ariana Grande left 19 dead

  • 23/37

    Emergency services arrive close to the Manchester Arena i n Manchester

  • 24/37

    An amoured police vehicle patrols near Manchester Arena in Manchester

  • 25/37

    A man carries a young girl on his shoulders near Victoria station in Manchester

  • 26/37

    Police officers stand at the Miller Street and Corporation Street Crossroads, in front of the Manchester Arena in Manchester, England

  • 27/37

    Police block a road nea r to the Manchester Arena in central Manchester, England

  • 28/37

    Armed police patrol near Victoria station in Manchester, northwest England. Twenty two people have been killed and dozens injured after a suspected suicide bomber targeted fans leaving a concert of US singer Ariana Grande in Manchester

  • 29/37

    Police forensic officers leave the Manchester Arena as they investigate the scene of an explosion in Manchester

  • 30/37

    A forensic officer collects evidence on a walkway between Victoria station and Manch ester Arena following a deadly terror attack in Manchester,

  • 31/37

    A woman and a young girl wearing a t-shirt of US singer Ariana Grande talks to police near Manchester Arena following a deadly terror attack in Manchester,

  • 32/37

  • 33/37

    Mayor of Greater Manchester Andy Burnham and Manchester City Council Leader Sir Richard Leese speak to the media outside Manchester Town Hall after a suicide bomber killed 22 people, including children, as an explosion tore through fans leaving a pop concert in Manchester

  • 34/37

    The media gather behind a police cordon in Manchester

  • 35/37

    Flowers left close to the Manchester Arena, the morning after a suicide bomber killed 22 people, including children, as an explosion tore through fans leaving a pop concert in Manchester

  • 36/37

    Ariana Grande concert attendees Karen Moore and her daughter Molly Steed, aged 14, from Derby, leave the Park Inn where they were given refuge after last night's explosion at Manchester Arena

  • 37/37

    Signs saying 'We love Manchester' are displayed in a window in Manchester, England

London Bridge

Date: 3 June 2017

Victims: Eight killed, 48 injured

Perpetrators: Khuram Butt, British, 27; Youssef Zaghba, Moroccan-Italian, 22; Rachid Redouane, Moroccan, 30 (all died at scene)

Butt was under live investigation as the principal subject of an MI5 operation opened in mid-2015 following information suggesting he wanted to commit a terror attack in the UK. Redouane was known for immigration offences but had no police or terror record. Zaghba had no criminal record but was known to European authorities after telling Italian police he wanted to be a terrorist. He was not investigated by MI5.

Summary: “With Butt what you had was a man who was under active investigation from MI5, who did probably around the end of 2016 team up with his two co-conspirators, and yet MI5 and the police between them were not able to identify what they were actually planning.”

“Butt displayed strong operational security and much remains unknown, even today, about the mindset of the three conspirators and the planning of the attack.”

London Bridge attack ringleader 'tried to hire 7.5 tonne lorry'


  • 2005: Butt is granted British citizenship after moving to the UK from Pakistan as a child with his parents, who were granted asylum.
  • 2008-2010: Butt receives cautions for criminal offences.
  • 2009: Redouane seeks asylum in the UK under the false identity of a Libyan national and is refused, seeing him reported to immigration officials.
  • June 2012: R edouane stopped and arrested in Scotland under his false Libyan name while trying to travel to Northern Ireland by boat. Because removals to Libya had been suspended on humanitarian grounds, he was released from detention in Larne with conditions to reside in Dagenham and report 20 to immigration authorities. He absconded and was not traced.
  • 2012-2015: After going to school and college in London he works as an office manager with a subsidiary of KFC, marrying a friend’s sister in 2013.The couple had a son born in October 2014 and a daughter born in May 2017, less than a month before the London Bridge attack.
  • 2015: Butt makes a pilgrimage to Mecca and “expresses frequent aspirations to travel from late in the year, including to Syria, but never again left England”. MI5’s Operation Hawthorn starts, seeing Butt put under surveillance over suspected attack planning.
  • 2015: Redouane moves in with his Irish wife in Dublin and successfully applies for a n EEA Family Permit and EEA residence card, sponsored by his wife. At the time of the attack Redouane was living legally in the UK under his Moroccan identity.
  • June 2015: Zaghba starts working legally in the UK.
  • September 2015: A potential lone actor triage assessment concluded that Butt represented a medium risk “due to his strong intent but weak capability”. Over the coming months there was no further indication of attack planning and Butt appeared to be disengaging from al-Muhajiroun. MI5 believed his focus was moving towards overseas travel, including potentially to Syria to fight with Isis or to another Arabic-speaking country to learn the language.
  • January 2016: Butt is shown among a group of Islamists linked to al-Muhajiroun praying towards an Isis flag in Channel 4 television documentary The Jihadis Next Door. The police and prosecutors deemed that no criminal offences had been committed.
  • February-April 2016: Operation Hawthorn is suspended “because of resourcing constraints” following Isis’ Paris attacks.
  • March 2016: During a stop at Bologna Airport in Italy, Zaghba tells officials he is travelling to Turkey as a “terrorist”, but quickly changes the word to “tourist”. Further investigation in Italy reveals he had expressed an interest in travelling to Syria to join Isis and practice the “Real Islam”. On 23 March 2016, Italian authorities place Zaghba on the EU-wide SIS II warning list, potentially bringing him to the attention of the UK at the border - but under a marker identifying him as subject to checks for serious crime, not a national security risk.
  • Spring 2016: Butt shows further aspirations travel to the Middle East and/or Africa and raise money for it “but no longer any indication that travel would be for extremist purposes”. MI5 decides not to prevent him leaving the country.
  • July 2016: Butt assaults a moderate imam and member of the counter-ext remism group Quilliam but the victim did not press charges in time for the case to be taken forward. Butt re-engages with al-Muhajiroun and increases operational security to evade security forces.
  • September 2016: Operation Hawthorn downgraded to a lower threat category.
  • October 2016: Butt arrested for fraud and granted bail. He was never told the decision was taken not to prosecute.
  • December 2016: Relationships between between Redouane, Butt and Zaghba and Butt start at the Ummah Fitness Centre in Ilford.
  • January 2017: Zaghba enters the UK for the final time.
  • Early 2017: Butt works at the Ummah Fitness Centre and develops links with extremist associates including Redouane. He teachers Quran class to young member alongside Zaghba.
  • MI5 and police attempt to disrupt the teaching over radicalisation concerns.
  • 7 March 2017: Butt and Redouane meet at the Ummah Fitness Centre, possibly as part of an attempt by Butt to acquire a firearm.
  • MI5 receives strands of intelligence regarding a Moroccan male named “Rashid” believed to be a peripheral and social associate of Butt but he the figure not identified as Redouane until after the attack.
  • 21 March 2017: A day before the Westminster attack, the investigation into Butt is suspended for a second time “due to resourcing constraints brought on by a large number of higher-priority investigations”.
  • April 2017: With Operation Hawthorn still suspended, MI5 downgrades Butt’s holding code from one that indicated he was likely to pose a threat to national security to one that indicated it was merely “likely”. “MI5 noted his continued extremist rhetoric but also uncertainty about whether he posed a threat to national security”.
  • May 2017: Operation Hawthorn is re-opened to consider whether the threat needed continued investigation or could be closed to put resources elsewhere. A second lone actor triage assessment concluded that the risk posed by Butt had moved from “medium to unresolved” and further investigation was needed. It remained an active investigation until the attack.
  • MI5 surveillance never identified Zaghba as Butt or threats, or revealed their attack planning.
  • 3 June 2017: CCTV footage from Butt’s home address on the evening of the attack shows him getting into a white van hired earlier in the day with a large red holdall. Two males accompanied him, with one carrying chairs - perhaps to support a cover story that they were moving furniture.

London Bridge Terror Attack

  • 15 show all

London Bridge Terror Attack

  • 1/15

    Armed police on Borough High Street as police are dealing with a "major incident" at London Bridge

  • 2/15

    Armed Police talk to members of the public outside London Bridge Hospital as police are dealing with a "major incident" at London Bridge

  • 3/15

    Police Officers outside the Barrowboy and Banker Public House on Borough High Street as police are dealing with a "major incident" at London Bridge

  • 4/15

    Armed police on Borough High Street as police deal with a 'major incident' at London Bridge

  • 5/15

    Emergency services near the scene of the incident

  • 6/15

    People run down Borough High Street as police are dealing with a "major incident" at London Bridge

  • 7/15

    Emergency services arrive at the scene near Borough market at London Bridge

  • 8/15

    Emergency personnel on London Bridge as police are dealing with a "major incident" at London Bridge

  • 9/15

    Police sniffer dogs on London Bridge as police are dealing with a "major incident" at London Bridge

  • 10/15

    A second helicopter lands on London Bridge as police are responding to three incidents in the capital, amid reports that a vehicle collided with pedestrians on London Bridge, Scotland Yard said. Officers are dealing with reports of stabbings in Borough Market, where armed officers attended and shots were fired. They are also at an incident in the Vauxhall area

  • 11/15

    Police attend to an incident on London Bridge in London

  • 12/15

    Police attend to an incident on London Bridge in London, Britain

  • 13/15

    A police officer escorts members of the public to safety at London Bridge

  • 14/15

    Police attend to an incident on London Bridge in London, Britain

  • 15/15

    Police attend to an incident near London Bridge in London, Britain

Finsbury Park

Date: 19 June 2017

Victims: One killed, 10 injured

Alleged perpetrator: Darren Osborne, British, 47


Osborne has been arreste d and charged with murder. His trial is due to start in January, meaning no in-depth findings could be released in the Anderson report because they could prejudice the case.

He is alleged to have acted alone and he was not known to MI5. Police had no intelligence to suggest that he was going to commit the alleged attack.

  • More about:
  • Isis
  • Terrorism
  • terror attacks
  • London Bridge attack
  • Manchester attack
  • finsbury park attack
  • Westminster attack
  • Rachid Redouane
  • Khuram Butt
  • Youssef Zaghba
  • Khalid Masood
  • Salman Abedi
  • Darren Osborne
  • MI5
Reuse contentSource: Google News

« Prev Post
Next Post »