Report into the London Terrorist Attacks on 7 July 2005:Section 2

The Government’s counter-terrorism strategy 11. Since 2002, Government work to counter Islamist terrorism has taken place under the Government’s counter-terrorism strategy, known as CONTEST. This strategy has brought together the work of all departments (including that of the intelligence and security Agencies) under one aim: “to reduce the risk from international terrorism so that people can go about their business freely and with confidence”. 12. The strategy divides work between that seeking to reduce the threat of an attack and that to reduce the UK’s vulnerability to an attack. Reducing the threat includes workstreams to PREVENT terrorism by reducing the number of individuals inspired to support Islamist terrorism or become terrorists, and work to PURSUE terrorists and those who assist them in order to disrupt potential attacks. Reducing vulnerability involves workstreams to PROTECT potential targets (buildings, for example) in the UK and abroad and to PREPARE for the consequences of an attack through resilience and contingency planning. The overall work programme is referred to as the ‘four P’ framework. How the intelligence and security Agencies contribute 13. The Security Service, the SIS and GCHQ contribute to each of the four workstreams as follows: l PREVENT – draws on Agency work on the causes of radicalisation for extremists and terrorists; l PURSUE – involves Agency-led work on developing appropriate levels of capability to disrupt and bring to justice terrorist networks; l PROTECT – encompasses the Agencies’ work to provide protective security advice, from both physical and electronic attack; and l PREPARE – includes Agency input to risk assessments that underpin the resilience and response capabilities being developed. Counter-terrorist intelligence 14. The acquisition of counter-terrorist intelligence by each of the three Agencies is critical to achieving success across each of these four strands and critical to the successful disruption of terrorist activity in the UK. The Security Service has primary responsibility under statute for the protection of national security against 5 threats, including terrorism. The SIS and GCHQ support the Security Service in this through the provision of intelligence from abroad. Intelligence on terrorist activity in the UK may come, for example, from communications between terrorists intercepted by GCHQ, from agents controlled by the SIS inside terrorist cells or networks overseas (connected back to the UK), from foreign liaison services,3 from physical surveillance by the Security Service or the police of terrorist or extremist activity in the UK, or from agents run by them within those networks in the UK. 15. Intelligence gathering in relation to CONTEST is driven through the JIC ‘Requirements and Priorities’ process. The JIC is the Committee of Agency heads and senior officials from Government departments responsible for providing Ministers and officials with intelligence assessments (known as JIC papers) on issues of national interest in the security, defence and foreign affairs fields. It is also responsible for the annual provision of a statement of the UK’s Requirements and Priorities for secret intelligence collection, analysis and assessment. This statement sets out regional and thematic requirements under headings such as ‘Islamist Terrorist Networks’, ‘Global Energy Markets and Security of Energy Supplies’ and ‘Weapons of Mass Destruction’, which are then prioritised to reflect which issues are of greatest concern and which require the greatest intelligence effort. The system currently has seven bands of priority, with Band 1 being the highest and Band 7 the lowest (for which intelligence will be collected on an ‘opportunity only’ basis). 16. JTAC is the body that pulls together all the available intelligence on the Islamist threat, analyses it and produces short-term assessments of the level of threat and longer-term assessments of terrorist networks, capabilities and trends. JTAC was established in June 2003 as part of the Government’s response to the growing terrorist threat. It is the only ‘single issue’ assessment body within the intelligence community. The nature and limitations of intelligence 17. In previous reports the Committee has commented on the nature and limitations of intelligence. Secret intelligence is information which has to be obtained covertly rather than from open sources or diplomatic reporting. Lord Butler’s Review of Intelligence on Weapons of Mass Destruction stated that: The most important limitation on intelligence is its incompleteness. Much ingenuity and effort is spent on making secret information difficult to acquire and hard to analyse… it is often, when first acquired, sporadic and patchy, and even after analysis may still be at best inferential.4 6 3 Liaison services are foreign services which are in liaison with British intelligence and security services. 4 HC 898, paragraph 49. 18. In its 2003–2004 Annual Report this Committee noted that: The Agencies cannot know everything about everyone, nor can they intercept and read every communication (which in any event would be a gross violation of human rights). There will always be gaps in the Agencies’ knowledge.5 Any consideration of whether or not the July bombings could have been prevented must bear these factors in mind. 19. The Director General of the Security Service has said that intelligence rarely tells you all you want to know: Often difficult decisions need to be made on the basis of intelligence which is fragmentary and difficult to interpret. In sum, some is gold, some dross and all of it requires validation, analysis and assessment. When it is gold it shines and illuminates, saves lives, protects nations and informs policy. When identified as dross it needs to be rejected: that may take some confidence. At the end of the day it requires people of integrity not only to collect it but also to prioritise, sift, judge and use it.6 Security Service investigations 20. An investigation is the process by which intelligence collection resources and analysis are directed to develop these fragmentary pieces of information into a picture of activity, identity, intentions and location. The picture that emerges is rarely complete and the investigative process then involves seeking further information and analysis, to make the picture clearer. 21. The volume of intelligence received on terrorist activity can be overwhelming, and difficult decisions have to be made as to what priority to accord a particular piece of intelligence and whether that piece or another lead should be pursued in more depth.7 Intensive ‘round the clock’ coverage of a single target can require up to and around *** organisation staff. An intensive operation, for example into imminent attack planning, can consume almost half of the Security Service’s operational and investigative resources. Intelligence officers therefore have to make difficult professional judgements as to where finite resources should be allocated and focus on those targets that appear to pose the most immediate threat to life. 7 5 Cm 6240, paragraph 19. 6 Dame Eliza Manningham-Buller – Speech to the Dutch Security Service at the Ridderzaal, Binnenhof, The Hague, Netherlands, 1 September 2005. For further details see www.mi5.gov.uk 7 For example, JTAC receives around 1,000 pieces of intelligence per week. 22. In 2001, at around the time of 9/11, the Security Service knew of approximately 250 primary investigative targets in the UK.8 By July 2004 this had risen to over 500, of which only about *** could be investigated, and only *** intensively. By July 2005 the number of primary investigative targets in the UK had risen to around 800, only about *** % of which the Service was able to cover. Even then the degree of coverage on the most essential subjects was far from complete. 23. In order to help prioritise investigative effort, assessments are made as to what category targets fall into. Prior to July these categories were ‘Essential’, ‘Desirable’ and ‘Other’:9 l Essential – an individual who is likely to be directly involved in, or have knowledge of, plans for terrorist activity, or an individual who may have knowledge of terrorist activity; l Desirable – an individual who is associated with individuals who are directly involved in, or have knowledge of, plans for terrorist activity or who is raising money for terrorism or who is in jail and would be an essential target if at large; and l Other – an individual who may be associated with individuals who are directly involved in, or have knowledge of, plans for terrorist activity. 24. The Security Service works in the UK with the police to develop its investigations leading to disruptions of plots, arrests and convictions. In making investigative decisions the Security Service recognises, partly because of the resources available, that it has to be selective and that it has to bear risks. Proportionality is also taken into account in the decision-making process: consideration is given to what degree of intrusion is proportionate on the basis of the available intelligence. Targets move between investigative tiers as new information of activities and intentions is received, and cases and priorities are regularly reviewed to ensure that resources are appropriately allocated. The threat from Islamist terrorism prior to July 25. Prior to July 2005 UK interests had been targeted successfully by Islamist terrorists, most notably in November 2003 in the Al Qaida-associated car bomb attack on the British Consulate and HSBC in Istanbul. British citizens had also been the victims of Islamist terrorist attacks in the United States on 11 September 2001, Bali on 12 October 2002 and Madrid on 11 March 2004. The bombings on 7 July 2005 were the first successful Islamist terrorist attacks in the UK. 8 8 Relating to international terrorism. 9 In the light of the July events these categories have since been changed (see paragraph 116). 26. Since 9/11 the Government and the intelligence and security Agencies have continued to warn of the high level of threat to the UK from Islamist terrorism. In a speech in his Sedgefield constituency on 5 March 2004, the Prime Minister warned of the continuing global threat from terrorism. He said: It is monstrously premature to think the threat has passed. The risk remains in the balance here and abroad. These days decisions about it come thick and fast, and while they are not always of the same magnitude they are hardly trivial. Let me give you an example. A short while ago, during the war, we received specific intelligence warning of a major attack on Heathrow.10 27. On 6 August 2004 the Home Secretary issued a statement on the terrorist threat to the UK in which he said: I have made clear repeatedly that there is a continuing threat to the UK, which has remained high for some time. We are maintaining a state of readiness and taking every feasible precautionary measure to protect British citizens, both here and abroad, consistent with the level of threat. The Prevention of Terrorism Bill was published in February 2005 as part of the Government’s continuing efforts against the threat. It received Royal Assent in March 2005.11 28. At around the same time the Security Service website warned: The most significant threat to the UK and to UK interests overseas comes from Al Qaida and associated networks. The threat to the UK remains real and serious. … We know that both British and foreign nationals belonging to Al Qaida cells and associated networks are currently present throughout the UK, that they are supporting the activities of terrorist groups, and that in some cases they are engaged in planning, or attempting to carry out, terrorist attacks.12 The limits of coverage of the threat 29. The possibility that attacks could be being planned without detection by the Agencies had been acknowledged prior to July. The previous Metropolitan Police Commissioner (Lord Stevens) was widely reported to believe that it was not a matter of ‘if’ an attack would occur, but ‘when’. In 2003, the Director General of the Security Service warned that: 9 10 www.number-10.gov.uk 11 The Anti-terrorism, Crime and Security Act was also passed in 2001 following the 9/11 terrorist attacks in the US. On 12 October 2005, following the events of July 2005, the Terrorism Bill was introduced to Parliament. 12 www.mi5.gov.uk …the nature of counter-terrorism is to get ahead of the game to stop, frustrate or otherwise prevent terrorist activity. That is the primary goal but the reality is that we can never stop all such attacks and no security intelligence organisation in the world could do so. An attack may get through our defences…13 30. As attacks against the UK have been mounted and successfully disrupted in the period since 9/11, the intelligence community’s understanding of the scale of the threat against the UK has advanced. The Chief of the Assessments Staff told the Committee: I think the more we learned over this period of several years, the more we began to realise the limits of what we knew, and I think that remains the case.14 The fear of unidentified attack planning intensified following the attacks in Madrid in March 2004 as they showed that terrorist networks could engage in unseen operational activity despite even intensive investigative efforts. In June 2005 the JIC judged that Western states could not be confident of identifying preparations for attacks, and that there would probably be a successful attack of some sort in the UK in the next five years. 10 13 Dame Eliza Manningham-Buller – lecture at the City of London Police headquarters on 16 October 2003. 14 Oral evidence – Tim Dowse, 13 December 2005. ==SECTION 3: THE 7 JULY ATTACKS: WAS ANY INTELLIGENCE MISSED OR OVERLOOKED?== 31. Against this background the Committee has taken detailed evidence on what was known about the attackers and the plans for an attack prior to 7 July 2005, with a view in particular to identifying whether anything was missed or overlooked by the Agencies which might have prevented the attacks. Not all of the detail of which we are aware can be included at this time for legal reasons. 32. We have not sought to investigate in detail (though we set out some background below) who the group were, how they became radicalised, or how they planned and executed the attacks. This goes beyond our remit to cover the work of the intelligence and security Agencies and, in this context, what they knew about the 7 July group.We understand that these areas will be covered in more detail by the Home Office’s ‘Official Account’, announced by the Home Secretary in December 2005. Background 33. The 7 July bombers have been identified as Mohammed Siddeque Khan (30), Hasib Hussein (18), Shazad Tanweer (22), and Jermaine Lindsay (19). All apart from Jermaine Lindsay were British nationals of Pakistani origin, born and brought up in the UK, and at the time of the bombings based in West Yorkshire. Lindsay was a British national of West Indian origin, born in Jamaica and based in Aylesbury prior to the attacks. He was a convert to Islam. 34. On the day of the attacks the group assembled at Luton train station and travelled together to King’s Cross from where they dispersed to conduct their near simultaneous explosions. The first three explosions took place at around 0850 but the fourth device was not detonated until over an hour later. The fourth bomber, Hasib Hussein, stopped to buy batteries before boarding the bus – it is possible that this indicates he had difficulty setting off his device. 35. Post-incident forensic analysis has shown that the explosions were caused by home-made organic peroxide-based devices, packed into rucksacks. Organic peroxide explosive is dangerous to manufacture because of its instability but it does not require a great deal of expertise and can be made using readily available materials and domestic equipment. The devices were almost certainly detonated manually by the bombers themselves in intentional suicide attacks. Some small home-made devices were left in the car at Luton railway station although the reason for this is unclear. There is no apparent significance in the choice of 7 July as the date for the attacks and no indication that the G8 conference which was taking place at Gleneagles at the time was a factor. 11 Links and associates 36. Investigations since July have shown that the group was in contact with others involved in extremism in the UK, including a number of people who ÖÖÖ. There is no intelligence to indicate that there was a fifth or further bombers. 37. Siddeque Khan is now known to have visited Pakistan in 2003 and to have spent several months there with Shazad Tanweer between November 2004 and February 2005. It has not yet been established who they met in Pakistan, but it is assessed as likely that they had some contact with Al Qaida figures. 38. The extent to which the 7 July attacks were externally planned, directed or controlled by contacts in Pakistan or elsewhere remains unclear. The Agencies believe that some form of operational training is likely to have taken place while Khan and Tanweer were in Pakistan. Contacts in the run-up to the attacks suggest they may have had advice or direction from individuals there. Claims in the media that a ‘mastermind’ left the UK the day before the attacks reflect one strand of an investigation that was subsequently discounted by the intelligence and security Agencies. Attribution 39. Since the attacks various claims of responsibility have been made. Shortly afterwards a letter was posted on the internet claiming that the attacks were conducted by the ‘Secret Organisation of al-Qaida in Europe’. This claim was not assessed to be credible by the Agencies. On 1 September 2005 a video message from Siddeque Khan was aired on Al Jazeera in which he said: I and thousands like me are forsaking everything for what we believe. Our driving motivation doesn’t come from tangible commodities that this world has to offer. Our religion is Islam – obedience to the one true God, Allah, and following the footsteps of the final prophet and messenger Muhammad… Your democratically elected governments continuously perpetuate atrocities against my people all over the world. And your support of them makes you directly responsible, just as I am directly responsible for protecting and avenging my Muslim brothers and sisters. Until we feel security, you will be our targets. And until you stop the bombing, gassing, imprisonment and torture of my people we will not stop this fight.We are at war and I am a soldier. 40. The video message went on to praise Osama Bin Laden and Ayman al-Zawaheri as heroes, although no indication was given that the attacks had been directed by them. Ayman al-Zawaheri appeared on the same tape in a separate recording and praised the ‘blessed battle’ which had transferred to the ‘enemy’s land’. In a later videotaped message, aired on Al Jazeera on 19 September, 12 al-Zawaheri claimed responsibility for the attacks. We have been told by the Agencies that this claim is not supported by any firm evidence. The degree of Al Qaida involvement both in terms of support and control remains under investigation. Identification 41. Documents recovered from the scenes of the attacks on 7 July gave an indication of the possible identities of the four men involved. Once these were confirmed, the Security Service and the other Agencies initiated reviews of their records to establish whether they had come across any of the individuals before 7 July, whether they had had any prior intelligence of the attacks, or whether the attacks made the meaning of any existing intelligence clearer. Links between the 7 July and 21 July groups 42. Due to sub judice rules this Report does not cover the 21 July events in detail. We can, however, report that the Agencies currently have no evidence of direct links between the 7 July attacks and those involved and the incidents on 21 July. What the intelligence and security Agencies knew of the attackers and the plans for attack prior to July 43. We have been told in evidence that none of the individuals involved in the 7 July group had been identified (that is, named and listed) as potential terrorist threats prior to July. We have also been told that there was no warning from intelligence (including foreign intelligence) of the plans to attack the London transport network on 7 July 2005. Plans for an attack 44. There was much media speculation following the attacks and various claims were made that prior warning had been given.We have been assured by the Agencies that there was no prior warning of the attacks that took place from any source, including from foreign intelligence services.We have looked in detail into claims that the Saudi Arabian authorities warned the British Agencies about the attacks. We found that some information was passed to the Agencies about possible terrorist planning for an attack in the UK. It was examined by the Agencies who concluded that the plan was not credible. That information has been given to us: it is materially different from what actually occurred on 7 July and clearly not relevant to these attacks. 13 The attackers 45. Having reviewed its records once details of the bombers came to light, the Security Service did find, however, that it had come across two members of the 7 July group before on the peripheries of other investigations. These were Siddeque Khan and Shazad Tanweer. GCHQ and SIS had not come across any members of the group. 46. In the comprehensive review of intelligence records that it conducted, the Security Service found that it had on record a telephone number which it was only possible to identify after the attacks as belonging to Jermaine Lindsay. They also had on record a telephone number registered to a ‘Siddeque Khan’ and details of contacts between that number and an individual who had been under Security Service investigation in 2003. A review of related surveillance data showed that Siddeque Khan and Shazad Tanweer had been among a group of men who had held meetings with others under Security Service investigation in 2004. 47. We asked the Security Service whether, having looked back at the intelligence that existed, more attention should have been paid to Siddeque Khan and Shazad Tanweer at the time, or whether there were any clues about their future intentions to conduct terrorist attacks. In relation to the contacts in 2003, the Security Service said it was apparent that meetings were being planned but that there was no information as to the purpose of the proposed meetings. There was (and still is) no evidence that they were connected to planning terrorist acts. The individual under investigation was not himself an ‘Essential’ target and there was no reason for his contacts, which we now know to have been with Siddeque Khan, to have been identified as exceptional or worthy of further investigation above other priorities. 48. As for the meetings in 2004, we found that they were covered by the Security Service as part of an important and substantial ongoing investigation. Siddeque Khan and Shazad Tanweer were among a number of unidentified men at the meetings. The Security Service did not seek to investigate or identify them at the time although we have been told that it would probably have been possible to do so had the decision been taken. The judgement was made (correctly with hindsight) that they were peripheral to the main investigation and there was no intelligence to suggest they were interested in planning an attack against the UK. Intelligence at the time suggested that their focus was training and insurgency operations in Pakistan and schemes to defraud financial institutions. As such, there was no reason to divert resources away from other higher priorities, which included investigations into attack planning against the UK. 49. Once resources became available, an investigation was launched by the Security Service into over *** unidentified contacts who had come to light on the periphery 14 of the earlier (2004) investigation. This included, among others, the unidentified men who we now know to have been Siddeque Khan and Shazad Tanweer. However, resources were soon diverted again to higher priorities. Further attempts were made to return to the men involved in the meetings in 2004 as resources became available. Some of them were subsequently identified and categorised as ‘Essential’, ‘Desirable’ or ‘Other’ targets and more intensive investigations were conducted. Only limited additional attempts were made to identify the men we now know to have been Siddeque Khan and Shazad Tanweer, and to find out more about their activities. They were not categorised as investigative targets because, on the basis of the available intelligence, there was no reason to suggest they should be investigated above other more pressing priorities at the time. Detainee reporting 50. It has become clear since 7 July that Siddeque Khan was also referred to in reporting by detainees (from outside the UK) in early 2004. This reporting referred to men from the UK known only by pseudonyms who had travelled to Pakistan in 2003 and sought meetings with Al Qaida figures. The Security Service sought at the time to establish the true identities of the men but without success. In the aftermath of the 7 July attacks, Siddeque Khan was identified by one of the detainees (having seen a press photograph) as one of the men referred to in the detainee reporting. It is now known that Siddeque Khan travelled to Pakistan in 2003 and spent time there with Shazad Tanweer from November 2004 to February 2005. 51. We have been told that as part of the investigation into the unidentified men at the meetings mentioned earlier (paragraph 49) photographs were circulated to some foreign intelligence services and foreign detaining authorities in an attempt to see if anything more about the individuals was known. A photograph of Siddeque Khan was shown to one of the detainees who had provided the earlier information, but without positive result. 52. As far as the Security Service is able to tell from records to date, this photograph was not sent or shown to the detainee who later identified Siddeque Khan. Had it been, and had the detainee been able to identify Khan as one of the subjects of the earlier report, it is possible that the Security Service might have allocated more effort to identifying and investigating him prior to July. While this was a missed opportunity, there is no guarantee that the detainee would have identified him from the photograph, particularly given its very poor quality. There is also no guarantee that had the detainee identified him significantly greater resources would have been put into pursuing him, particularly given the other investigative priorities around at that time, which included the disruption of known plots to attack the UK. 15 Source report 53. A report from another source has also recently come to light. This report was passed to the Security Service in February 2005. It stated that a man named ‘***’ had travelled to Afghanistan in the late 1990s/early 2000s with another man named ‘Imran’ and that both held extremist views. The Security Service and police undertook some further investigation into the two men at the time, without significant result. After the 7 July attacks the source identified ‘***’ as Siddeque Khan. Summary and conclusion 54. It has become clear since the July attacks that Siddeque Khan was the subject of reporting of which the Security Service was aware prior to July 2005. However, his true identity was not revealed in this reporting and it was only after the 7 July attacks that the Security Service was able to identify Khan as the subject of the reports. 55. It is also clear that, prior to the 7 July attacks, the Security Service had come across Siddeque Khan and Shazad Tanweer on the peripheries of other surveillance and investigative operations. At that time their identities were unknown to the Security Service and there was no appreciation of their subsequent significance. As there were more pressing priorities at the time, including the need to disrupt known plans to attack the UK, it was decided not to investigate them further or seek to identify them. When resources became available, attempts were made to find out more about these two and other peripheral contacts, but these resources were soon diverted back to what were considered to be higher investigative priorities. 56. It is possible that the chances of identifying attack planning and of preventing the 7 July attacks might have been greater had different investigative decisions been taken in 2003–2005. Nonetheless, we conclude that, in light of the other priority investigations being conducted and the limitations on Security Service resources, the decisions not to give greater investigative priority to these two individuals were understandable. 57. In reaching this conclusion we have been struck by the sheer scale of the problem that our intelligence and security Agencies face and their comparatively small capacity to cover it. The Agencies had to reassess their capacity to cope as a result of the July attacks – an issue that we will consider in more detail in Sections 5 and 6. 16
 * Security Service surveillance staff out of a total of around *** surveillance staff,