UK terror attacks: Review reveals what MI5 knew about Manchester, London Bridge and Westminster attackers

Report shows security services missed opportunities that could have prevented the Manchester attack

Khuram Butt, one of the perpetrators of the London Bridge attack, was among those under active investigation by MI5 (Channel 4)

Security services missed opportunities to intercept the Manchester and London Bridge attackers, a report has found.

David Anderson QC, the former Independent Reviewer of Terrorism Legislation, made a total of 126 recommendations to MI5, police and the Government following the deaths of 36 victims this year.

His report provided new detail on the run-up to the atrocities in Westminster, Manchester and London Bridge. The following information has been declassified from internal reviews by MI5 and police.

Westminster

Date: 22 March 2017

Victims: Five killed, 49 injured

Perpetrator: Khalid Masood, British, 52 (died at scene)

Masood was known to police after seven convictions for violent crime leading up to 2003, and to MI5 for associating with extremists, in particular between 2010 and 2012.

Summary: “No intelligence was being gathered on him and neither MI5 nor the police had any reason the anticipate the attack … you’re looking at someone who is such a long way from the top of anyone’s grid that frankly, it’s a bit difficult to see how they would have been easily stopped, whatever agencies had done.”

Timeline:

• 2004: Masood appears for the first time on MI5 records after his number appeared on the contacts list of a member of a terrorist network, that was aiming to launch bomb attacks in the UK.
• 2009: Masood appears on the edge of investigation into jihadis attempting to join an al-Qaeda training camp in the Federally Administered Tribal Areas of Pakistan. Investigators wrongly believe Masood is an individual in Saudi Arabia facilitating travel. 
• 2010: He is discovered not to be the same person, but an active investigation is launched identifying Masood as a subject of interest (SOI) assessed to be a national security threat. Weeks later, he was downgraded to a potential security threat.
• 2012: Masood formally closed as an SOI following recommendation in internal review, joining 20,000 other former subjects.
• 2012-2016: Masood appears intermittently as a contact of a number of SOIs, including some linked to Anjem Choudary’s banned al-Muhajiroun network in Luton and Crawley.
• 2013: Masood “expresses contentment that violent actions such as the World Trade Centre attacks attracted people to Islam”. Neither his contacts nor those comments were considered to reach the threshold for re-opening an investigation. 
• April 2016: (Discovered after his attack) Masood researches violent attacks, knives, Isis and vehicle types.
• December 2016 - March 2017: Masood informs family he is considering working overseas, but his job and visa applications fail. He sells his car and makes efforts to say goodbye to relatives.
• 9 March 2017: Masood buys two carving knives from Tesco in Birmingham, and on the same day sends himself an email with the subject line “Retaliation”. 
• 15 March: He had created a document entitled “Jihad in the Quran and Sunnah”, with his photograph on the front page and multiple extracts from the Quran that could be seen as supportive of jihad and martyrdom.  
• 16 March: He collects the Hyundai Tucson used in the attack.
• 19 March: Masood conducts reconnaissance of Westminster Bridge in person and online, and browses YouTube for videos relating to terrorism and suicide attacks. 
• 22 March: Minutes before launching the attack, Masood shares his document with numerous WhatsApp contacts, which was soon sent onwards via iMessage and SMS.

Manchester

Date: 22 May 2017

Victims: 22 killed, 500 injured

Perpetrator: Salman Abedi, British, 23 (died at scene)

Abedi was known to police for links with the Rusholme Crips gang, but his criminal record was limited to reprimands for theft and receiving stolen goods in 2012, and an assault on a girl at college which was dealt with by “restorative justice”. He was known to MI5 from 2014, but the investigation was closed and he was deemed low-risk.

Summary: “Although Abedi had not given police or MI5 any reason to be highly suspicious of him, they still got very close … information came their way which was assessed from which – with the benefit of hindsight – the wrong conclusions were drawn. Had people understood it in a different way, I think an investigation would have been opened into Abedi, and who knows what it would have found."

Timeline:

• 2011 onwards: Abedi makes numerous trips to Libya with his family, after his parents returned to live there during the civil war that saw Muammar Gaddafi toppled and killed.
• 2014: MI5 starts active investigation in the belief Abedi could be individual seen acting suspiciously with another SOI. Although he knew the SOI in question, he turned out not to have been the individual seen with him, and his record was closed in July 2014. Abedi was classed as low residual risk. 
• 2015: Another investigation opened over supposed contact with an Isis figure in Libya, “but he was closed as an SOI on the same day when it transpired that any contact was not direct”. 
• 2015-2017: Although he remained a closed SOI until the day of the attack, Abedi continued to be referenced from time to time in intelligence gathered for other purposes. On two separate occasions in the months prior to the attack, intelligence was received and assessed not to relate to terrorism, but “to possible non-nefarious activity or to criminality”. In retrospect, the intelligence can be seen to have been highly relevant to the planned attack. 
• April 2017: Abedi and his brother Hashem leave Manchester for Libya. Abedi returns to the UK four days before his attack, with subsequent investigations showing he made the “core purchases” for his suicide bomb and manufactured it at various properties around Manchester during the period.
• May 2017: Abedi was among a small number of the 20,000 SOIs that data analysis showed merited further examination. A meeting assessing him was due to take place on 31 May, but he attacked nine days before.

London Bridge

Date: 3 June 2017

Victims: Eight killed, 48 injured

Perpetrators: Khuram Butt, British, 27; Youssef Zaghba, Moroccan-Italian, 22; Rachid Redouane, Moroccan, 30 (all died at scene)

Butt was under live investigation as the principal subject of an MI5 operation opened in mid-2015, following information suggesting he wanted to commit a terror attack in the UK. Redouane was known for immigration offences but had no police or terror record. Zaghba had no criminal record but was known to European authorities after telling Italian police he wanted to be a terrorist. He was not investigated by MI5.

Summary: “With Butt what you had was a man who was under active investigation from MI5, who did probably around the end of 2016 team up with his two co-conspirators, and yet MI5 and the police between them were not able to identify what they were actually planning.

“Butt displayed strong operational security and much remains unknown, even today, about the mindset of the three conspirators and the planning of the attack.”

Timeline:

• 2005: Butt is granted British citizenship after moving to the UK from Pakistan as a child with his parents, who were granted asylum.
• 2008-2010: Butt receives cautions for criminal offences.
• 2009: Redouane seeks asylum in the UK under the false identity of a Libyan national and is refused, which sees him reported to immigration officials.
• June 2012: Redouane is stopped and arrested in Scotland under his false Libyan name while trying to travel to Northern Ireland by boat. Because removals to Libya had been suspended on humanitarian grounds, he was released from detention in Larne with conditions to reside in Dagenham and report to immigration authorities. He absconded and was not traced.
• 2012-2015: After going to school and college in London, he works as an office manager with a subsidiary of KFC, marrying a friend’s sister in 2013. The couple had a son in October 2014 and a daughter in May 2017, born less than a month before the London Bridge attack.
• 2015: Butt makes a pilgrimage to Mecca and “expresses frequent aspirations to travel from late in the year, including to Syria, but never again left England”. MI5’s Operation Hawthorn starts, seeing Butt put under surveillance over suspected attack planning.
• 2015: Redouane moves in with his Irish wife in Dublin and successfully applies for an EEA Family Permit and EEA residence card, sponsored by his wife. At the time of the attack, Redouane was living legally in the UK under his Moroccan identity.
• June 2015: Zaghba starts working legally in the UK.
• September 2015: A potential lone actor triage assessment concluded that Butt represented a medium risk “due to his strong intent but weak capability”. Over the coming months, there was no further indication of attack planning, and Butt appeared to be disengaging from al-Muhajiroun. MI5 believed his focus was moving towards overseas travel, including potentially to Syria to fight with Isis or to another Arabic-speaking country to learn the language.
• January 2016: Butt is shown among a group of Islamists linked to al-Muhajiroun praying towards an Isis flag in Channel 4 television documentary The Jihadis Next Door. The police and prosecutors deemed that no criminal offences had been committed.
• February-April 2016: Operation Hawthorn is suspended “because of resourcing constraints” following Isis’s Paris attacks.
• March 2016: During a stop at Bologna Airport in Italy, Zaghba tells officials he is travelling to Turkey as a “terrorist”, but quickly changes the word to “tourist”. Further investigation in Italy reveals he had expressed an interest in travelling to Syria to join Isis and practice the “Real Islam”. On 23 March 2016, Italian authorities place Zaghba on the EU-wide SIS II warning list, potentially bringing him to the attention of the UK at the border – but under a marker identifying him as subject to checks for serious crime, not a national security risk. 
• Spring 2016: Butt shows further aspirations travel to the Middle East and / or Africa and raises money for it, but there was “no longer any indication that travel would be for extremist purposes”. MI5 decides not to prevent him leaving the country.
• July 2016: Butt assaults a moderate imam and member of the counter-extremism group Quilliam, but the victim did not press charges in time for the case to be taken forward. Butt re-engages with al-Muhajiroun and increases operational security to evade security forces.
• September 2016: Operation Hawthorn downgraded to a lower threat category. 
• October 2016: Butt arrested for fraud and granted bail. He was never told the decision was taken not to prosecute.
• December 2016: Relationships between between Redouane, Butt and Zaghba and Butt start at the Ummah Fitness Centre in Ilford.
• January 2017: Zaghba enters the UK for the final time.
• Early 2017: Butt works at the Ummah Fitness Centre and develops links with extremist associates, including Redouane. He teachers Quran class to young members alongside Zaghba.
• MI5 and police attempt to disrupt the teaching over radicalisation concerns. 
• 7 March 2017: Butt and Redouane meet at the Ummah Fitness Centre, possibly as part of an attempt by Butt to acquire a firearm.
• MI5 receives strands of intelligence regarding a Moroccan male named “Rashid”, believed to be a peripheral and social associate of Butt, but the figure was not identified as Redouane until after the attack.
• 21 March 2017: A day before the Westminster attack, the investigation into Butt is suspended for a second time “due to resourcing constraints brought on by a large number of higher-priority investigations”. 
• April 2017: With Operation Hawthorn still suspended, MI5 downgrades Butt’s holding code from one that indicated he was likely to pose a threat to national security, to one that indicated it was merely “likely”. “MI5 noted his continued extremist rhetoric but also uncertainty about whether he posed a threat to national security.”
• May 2017: Operation Hawthorn is re-opened to consider whether the threat needed continued investigation, or could be closed to put resources elsewhere. A second lone actor triage assessment concluded that the risk posed by Butt had moved from “medium to unresolved” and further investigation was needed. It remained an active investigation until the attack.
• MI5 surveillance never identified Zaghba as Butt or threats, or revealed their attack planning.
• 3 June 2017: CCTV footage from Butt’s home address on the evening of the attack shows him getting into a white van hired earlier in the day with a large red holdall. Two males accompanied him, with one carrying chairs – perhaps to support a cover story that they were moving furniture. 

Finsbury Park

Date: 19 June 2017

Victims: One killed, 10 injured

Alleged perpetrator: Darren Osborne, British, 47

Darren Osborne has been found guilty (Facebook/SWNS)

Osborne has been arrested and charged with murder. His trial is due to start in January, meaning no indepth findings could be released in the Anderson report because they could prejudice the case.

He is alleged to have acted alone and he was not known to MI5. Police had no intelligence to suggest that he was going to commit the alleged attack.