This blog expresses recommendations and ideas for the security serivces based on my reading of the ISC report dated 25th November 2014
This is an analysis of the Intelligence and Security Committees report to Parliament on the murder of Lee Rigby. I include some ideas taken from ‘A Death in Woolwich: The Lone-Actor Terrorist Threat in the UK’’ by Raffaelo Pantucci but the majority of the recommendations I make are solely my own appraisal on what may go some way to improving the service the intelligence community provide or at most reiterate or improve on the recommendations of the committee
One issue that has arisen from this report is that MI5 must be able to continue processing, what is at the time, low priority investigations while there is a sudden spike in, or focus on high priority investigations. One way to do this is to allocate low priority investigations to specially designated Low Priority Case Load Officers. (LOPCLO’s). These officers should be ring-fenced to their work and could steadily go about liaising with social media companies, ISP’s, Police Forces, and CT teams. When Adebolajos case officer was moved from his/her work to join an IOC, He/She was not moved back nor was anyone drafted in to take over this low priority case load. Giving an officer an account of say 15-20 low priority subjects may stop them from being moved away without the work being covered. (Incidentally this officer should have been put back in late 2008 when the IOC operation was ended). The report identifies that IOC’s need to be self-sufficient and sustainable. As Theresa May said to the enquiry, any extra money that went to the intelligence services would go on high priority cases and not low priority cases, I therefore recommend a IOC bank of staff spread out across the services including within the police force if necessary that can be called on when IOC’s are necessary. The initial day to day general low priority work load can be spread across the LOPCLO’s up to and account of say 15-20 and then the IOC bank staff can be dispersed across the organisation as supporting staff with no ownership over work. When an IOC incident occurs this will then not cause pressure due to lack of staff rather work quality will rise when the IOC is not in action. This may also lead to IOC bank staff being used more proactively rather than reactively as they small short term operations can be planned using the time of the IOC bank. Where these actors are believed to be in a small network one LOPCLO’s could look after the group, provided it is no more than 15-20, and then observe them as a group AND as individuals. Support from the bank staff would help freak occurrences such as a LOPCLOS having a group of 15-20 and also having to see them on a individual basis.
To tackle the ‘cumulative’ issue the report raises. I propose these LOPCLO’s adopt a ‘4 counts and you’re in’ policy where on being involved in the periphery of 4 operations/investigations the subject is escalated to a higher priority staff member with fewer people on their account. Adebolajo would have been escalated after Op ASH, Op BEECH, Op CEDAR and Op DOGWOOD from 2008 to November 2012. The time between these investigations before escalation to higher priority is no longer an issue as as Pantucci remains us in his article for RUSI, the British Aleppo prison bomber had been dormant for 20 years before flying to Syria. ‘4 counts and you’re in’ would go some way to answering concern (0) of the committee have in the report on intelligence services not having a cumulative strategy. Once escalated subjects can be moved across, sideways but never down. Moving sideways in medium priority could mean being adopted by Police or a specially designated officer focussing on historical medium priority subjects.
It may now, after Lee Rigby’s murder, be easier to identify the new category of terrorist or person of interest that has arisen. Adebowale had mental health issues and had been a victim of knife crime crime when he was younger (Pantucci, 2014) and therefore may present new variables in identifying the new category of terrorist the ‘self-starter’. These three categories, self starter, lone wolf and organised terrorist and their identifiers need to be defined and explained better. This may be a start in relation to the new difficulties in identifying individuals and not networks of terrorists. The report does say MI5 did not consider the suspects mental health issues, but this may have helped realise that Adebolajo was at risk of self-starter act rather that organised acts of terror. The MI5 behavioural team may be able to help in this regard and a low priority case load officer could liaise check HNS records, PNC records and forward to Behavioural teams for analysis. LOPCLO’s work would be issued by the Triage teams and give work dependant on who has the space on their account. This new system will probably mean more people being monitored by better managing people this should not present an issue. Remember 1000 low priority people could be managed by 70 LOPCLO’s including managers, this does not include supporting IOC bank staff. If the mean cost of paying and training a LOPCLO is £50,000 a year this would mean in total the LOPCLO’s department would cost £350,000 per year. This would present good value for protecting national security.
Disruption strategies such as road tax offences and minor drug use can also be done by the LOPCLO’s by virtue of the fact they have time to liaise with police and the courts. This may even have the added benefit of suspects being annoyed at local neighbourhood police for being petty and not suspicious of intelligence agencies monitoring them. This interaction between local police and the suspects will feed back into the local knowledge collection I will discuss below. LOPCLO’s could even have access to local police ITC systems such as RMS (the ITC system for Hampshire Police) to monitor subjects on their account themselves in case they are involved in occurrences, as witnesses or suspects. Training on this system which is used by 80% of UK forces would only take an a few days and could be done in blocks of 5-10 from the LOPCLO departments. This would go some way to answering concern (M) in the report. This way there would be no lag in reporting and LOPCLO’s could manage effectively.
The report also highlights the need for more local knowledge and human intelligence on individuals rather than networks and organised groups. To this end there may therefore be a time to include PCSO’s and local Neighbourhood Policing Teams in submitting this local intelligence on individuals. Perhaps more training and encouragement for them would be useful. Please also remember that this needs to happen nationally as the threat is national not just a threat to London. Attacks in Glasgow carry just as much weight as in the capital.
The report is also concerned with the failure of social media to spot and refer persons of interest to authorities. I propose that given the amazing success of CEOP, where I have worked myself, in identifying people who are a risk to children, they should work with ISP’s, social media companies and the intelligence agencies in developing a strategy in improving the success rate in identifying terrorists who use the web in the UK to discuss attacks or radicalise themselves and others. CEOP could also advise MI6 and GCHQ on how to deal with ‘Inspire Magazine’ that promotes and advises on lone wolf acts. MI5 have said that use of this magazine does not in itself warrant notice. I recommend that consistence use of ‘Inspire Magazine’ now does warrant further investigation even if just at the LOPCLO’s level. The viewing of this literature can be seen as having a cumulative effect and consistent viewing may be the same as appearing consistently in the periphery of investigations. LOPLCO’s would be able to cross reference consistent viewing of ‘Inspire’ with NHS records and advice from behavioural teams for assessment on their threat as an individual not as part of a network.
Further to this, CEOP should be able to help with its skills of engaging with criminals online through experience from their own operations. Magazines like ‘Inspire’ and the forums including Facebook and twitter cannot always be removed. Servers can be hard to locate or just appear again hours later on another server (See Darryl Howlett work on Cyber Security in Homeland Security (2007) by Paul Wilkinson) Instead CEOP should help GCHQ train ‘Engagers’ and try and converse with suspects online and try and gain information. This will develop information and if ‘Engagers’ arose suspicion it would cast doubt over the site or magazine. This propaganda may be worthwhile and could even be used to recruit human intelligence and educate malleable minds. Information from Engagers such as ID of the online actor can be passed to Triage teams for allocating to the LOPCLO’s who look after this individual or allocate this new subject. This could be a joint venture between GCHQ and RICU, the Research Information Communication Unit. Relations between social media such as Facebook also need to be better. Facebook should be notifying the police when they close an account for terrorism related activity. As Simon Hughes MP says on the today programme on 26th November 2014 ‘Facebook should have passed on details but is under no obligation to do so’’ Before legislature change, CEOP should be asked to provide training and advise on how to build successful warning systems and build relationships. This will not be creeping state surveillance as it will be merely using existing departments and working relationships more effectively.
Operation AMAZON showed us that there was some excellent project and cooperative work between police and intelligence services. This team work is good as it shares the burden of the work. The only issue of the example given is that the collaboration was in relation to networks of terrorists not individuals. The increased input of local neighbourhood teams and PCSO’s will help in this regard. Op Dogwood was essentially an investigation into Adebolojo as a member of a network or organised group and did not concern itself with him as an individual. As he became less of a risk as a member of a group he dropped off the radar. Instead we now know he was going through the two year process of becoming a self-starter actor. Had the investigation been concerned with the behaviour of the individual we may have been able to identify this. A dedicated LOPCLO may have been able to identify this as he/she could have seen this evolution from group to lone actor/self-starter.
Whatever concerns over civil liberties and rights to move freely there may have been when Adebolajo went to Kenya in November 2010 he should have been flagged as having left the UK. Given he had been involved in Op ASH and Project AMAZON, the joint intelligence and police operation, he should have been flagged as travelling to Kenya, this would have been proportionate if a list of ‘of concern’ countries were listed and on travelling to these counties by biometric passport a notification appears to notify MI5. I mention this in case he had not been arrested by Kenyan police. This lesson needs to be learned for similar individuals and known individuals going to and eventually returning from Syria and engaging in hard to detect lone wolf acts like Adebolajo was. These ‘of concern countries’ would be Turkey and typical entry states to the Syria region. If there is an issue with civil liberties and privacy then perhaps Kenyan/Turkish immigration can helpfully and kindly provide lists of persons entering Kenya and Turkey so negating UK monitoring processes. This way UK intelligence services are working with Kenyan or Turkish law not UK law on civil liberties.
In relation to the reports criticism of SIS, the report mentions that SIS thought the Kenyans were dealing with Adebolajo and ‘had it pretty well taped’’ SIS had also asked for assurances on the British citizens welfare and it is hard to see what more SIS could do. Rather than being ‘passive’ SIS were respecting Kenyan policing sovereignty and not assuming control in some post-colonial way. When accusations were received they were forwarded to the FCO and any delay or passivity should be levelled at them.
The four month gap on Adebolajo’s return may have been reduced by a number of measures. Firstly, the LOPCLO could have been allocated Adebolajo after his Port Stop interview and after being able to personally take a face to face hand over from the police officer doing the Port Stop interview could monitor Adebolajo the individual as part of his or her case load. This officer could have expedited the 4 month gap between Adebolajos return from Kenya and Op BEECH some in April the next year.
Although the intelligence services quite rightly refuse to disclose whether Adebolajo was approached to be a human intelligence source. If this did not happen it should have. The approach should have been made during, before or after the Port Stop interview phase where ground work in Kenya and en route home would have been useful.
The report seems to have issue with the time some incidents and occurrences have taken. This does seem to have caused issues. While the request for intrusive surveillance on Adebowale that had only just been authorised hours before Lee Rigby’s murder may not have yielded any results, the principle is of issue as next time, if there is a next time it may be an issue. I recommend maximum time frames for actions to be defined and prescribed as organisational targets. DIGNIT teams could have deadlines in investigations like police forces have in updates in recording crimes, updating victims and closing files. This in the police is supervised by review by a Sgt or Inspector depending on the crime. These deadlines should be short for small chunks of work not a long deadlines for full completion. For instance, DIGNIT have short deadlines for accepting work, allocating work, beginning work, then updating work etc…
The most concerning issue on the time delay is in fact something that has not been raised. This is the delay between the investigators request for intrusive surveillance and it being sent to the lawyers for approval. This was between the 26th April and 30th April 2013. A weekend. MI5 case work must be a 24 hour business. Shift work is a must with staff picking up where others have left off. A request like this should not be dependent on a weekend to get done. A skeleton staff could cover over nights and weekends and this could even be covered by a designated acting review manager in any of the organisations regional officers when docs are emailed over to them or visible on a common use ITC system. An reviewing solicitor could also be available over weekends and evening so that if amendments need to be made they appear on the case officers desk on Monday morning not a week later.
Dates on documents also have been an issue, although probably an issue for the enquiry and not MI5. Documents created on an ITC system should be automatically populated with a date/author and time. Any documents that require undated documents or documents dated with a different date for espionage purposes can be done with written authorisation by a supervisor via emal on a seperate designated computer and printer.
Although the run up to the Olympic Games were an issue it should not have been. Will Jennings work on Mega events which can be found here http://www.lse.ac.uk/researchAndExpertise/units/CARR/pdf/DPs/Disspaper71.pdf discusses issues of disease and infrastructure meltdown which could be adopted as points to deal with chemical attacks (such as Sarin in Tokyo, 1995) and attacks on infrastructure to coincide with terror attacks (Howlett, 2007). The work points to many solutions and would be good starting point for dealing with forthcoming events.What other events will the UK hold that may infringe on MI5’s ability to deal with its work load. The Rugby World Cup 2015, Notting Hill Carnival? Measures to deal with this need to be put in place. At least with IOC bank staff, LOPCLO’s work would not be affected.
One area where I would make one final recommendation is conclusion E) the status of a terrorist group or extremist group in the UK now has no bearing on possibility of lone wolf attack. Previously the status of a terrorist organisation had a bearing as the better ones would have better organisation and discipline and be able to mount an attack. Now with lone actors peripheral exposure to a small group of amatuers could encourage or provide a tipping point to act according to acts learned in ‘Inspire Magazine’ beware in ordering these terror groups in relation to importance as it may have little bearing on probability of lone wolf/self-starter attacks.
Recommendation
• 70 LOPCLO’s to monitor low priority subjects and work proactively with their accounts
• Closer working with CEOP and local police officers
• IOC bank staff
• 24/7 coverage
• Better prepare for future mega events
Alexander Dawson 