London attack: Why terror threat level downgraded to severe from critical

Attack suggests this was a bolt-from-the-blue attack as security services had no inkling of threat

It’s a depressingly familiar story. Terror on the streets of London, almost two weeks after the Manchester bombing. This time, a speeding van hit pedestrians on London Bridge before three assailants, wearing fake suicide vests, jumped out, stabbing members of public enjoying a Saturday night in nearby Borough Market.

They killed at least seven people and injured another 48, including four police officers. The three attackers were shot dead at the scene by armed officers.

The response of London’s emergency services has been commendable. In just eight minutes, armed officers had arrived on the scene and stopped further attacks, while other emergency services were in place to treat the injured. In a statement, London’s mayor, Sadiq Khan, thanked them for their efforts.

The UK prime minister, Theresa May, said that Britain was experiencing a new wave of “brutal terror”, warning that defeating extremism has become “one of the great challenges of our time”.

The attack came soon after the terrorism threat level had been downgraded from critical to severe. That the threat level had been changed so soon after the Manchester bombing has raised questions. The levels are independently set by the Joint Terrorism Analysis Centre (JTAC), housed in MI5’s headquarters at Thames House, London. JTAC reviews all intelligence relevant to international terrorism, at home and overseas, coordinating the activities of major government departments and agencies.

Following the Manchester attack, JTAC increased the threat level to critical (meaning an attack is expected imminently) as part of concerns over whether the bomber Salman Abedi was acting alone or as part of a wider network.

Greater Manchester Police are holding 11 men in connection with the Manchester attack and another six people have been released without charge. Once police were confident that Abedi’s associates had been arrested – and the risk of a secondary attack had receded – the levels were lowered to severe (meaning an attack is highly likely) where they had been since August 2014. Only on two other occasions – in 2006, following the disruption of a plot to blow up transatlantic airliners, and 2007 after an attack on Glasgow airport – was the threat level at critical.

The fact that the threat levels were lowered suggests that this was a bolt-from-the-blue attack – security services had no inkling of the particular threat. Contrary to popular perceptions that intelligence and security agencies are all-seeing and all-knowing, surprise is frequent. Since 2013, MI5 has disrupted a total of 18 plots, including five since March 2017. The scale of the threat is “unparalleled”.

Recent attacks have also been worryingly diverse in nature. The Manchester Arena attack showed complexity. Abedi was able to plan, build and detonate an improvised explosive device. The London attacks were relatively crude by comparison, with the attackers using knives and a van. There was evidently a degree of coordination – there were three attackers – but the low-tech nature of the attack is a serious concern.

Highly sophisticated attacks, relying on a network of jihadists are easier to detect. Buying weapons, bomb-making equipment and coordinating activities generate “chatter” for the police and intelligence agencies to detect. Attacks using knives and vehicles are harder to anticipate.

Evading the authorities

MI5 is greatly concerned about attacks of this kind. In 2013, the director general, Andrew Parker, warned of surprise, unsophisticated attacks in the UK.

Monitoring the range of possible threats is also a significant conundrum. Since the 7/7 London bombings, when 52 people were killed across London’s public transport system in 2005, the domestic threat has been well known. Currently, MI5 is running 500 active investigations out of a potential 3,000 terrorist suspects. Security sources recently suggested that as many as 23,000 people had been “subjects of interest” to MI5 as a possible terrorist threat in the past. These figures won’t take into account a number of Islamic State sympathisers who are yet to come to MI5’s attention.

It remains to be seen whether the London attackers were – as with Abedi – on MI5’s radar, though arrests have taken place in Barking, East London, in connection with the investigation.

In the wake of the attack, May pointed to a bellicose response. Military action against IS targets in Syria, new measures to combat extremism at home and a coordinated response between internet companies and governments to challenge online extremism were raised. “We cannot and must not pretend that things can continue as they are”, she said. “Things need to change”.

Whether a decisive shift in UK counter-terrorism policy is needed or not is certainly open to debate, but the problems facing Britain’s security services in tracking and preventing such attacks as we have seen in recent weeks remain the same.

Dan Lomas, Programme Leader, MA Intelligence and Security Studies, University of Salford

This article was originally published on The Conversation. Read the original article.