IN THE MATTER OF THE INQUIRY ARISING FROM THE DEATHS IN THE MANCHESTER ARENA BOMBING

CHAPTER 7 CLOSING SUBMISSIONS ON SHOWSEC'S BEHALF

Introduction 1. The nature and the scale of the atrocity that took place on 22 May 2017 - the loss of so many lives and the grievous and permanent damage done to the lives of many, many others - along with the task that the Home Secretary has set for the Chair requires (as Showsec understands) that the company's policies, procedures and its approach to the management of the crowd attending the concert and others should be very carefully examined both to determine whether there was anything it could have done to prevent or mitigate what happened and to ensure that lessons are learned for the future.

2. Where criticism is merited, then those parts of the first report may make for uncomfortable reading for the company. But Showsec - as its behaviour throughout this inquisitorial process has already demonstrated - is determined to react in a positive way. Neither the company nor its workforce will ever forget that Salman Abedi's attack resulted in the murder of 22 innocent people.

3. During these proceedings, the company and its directors have acted with conspicuous candour and openness. Where honest reflection has revealed shortcomings (as will inevitably be the case for every state and corporate entity involved in this Inquiry) Showsec has been prepared to acknowledge those failings and to address them. Against this and along with this Inquiry's obligation to provide the families with the thorough and fearless investigation they have called for, Showsec is also entitled to fairness. Fairness requiring not simply that its policies, procedures and actions be considered and judged in a way which is balanced but, crucially, in a manner which is also reflective of and proportionate to the role it played in the public areas of the City Room, the

1

INQ039377/1 INQ039377_0001 extent to which the company had counter-terrorism responsibilities and the position that it occupied in the hierarchy of security providers.

4. Primacy for securing the safety of the public in the City Room lay with the State and with the police. Showsec's role and its responsibility in terms of the security of the crowd entering and leaving the venue was subordinate to that of the State, the police and SMG. In particular, and as against the arrangements in place in May 2017, it was certainly not possible for Showsec's staff to have prevented an individual intent on carrying out a suicide attack from entering that part of the Victoria Station complex.

5. If Showsec is found wanting in any respect, then it submits that the Inquiry must also consider whether it fell short of recognised standards or whether in fact there were at the relevant time no, or insufficiently clear standards against which to judge its performance. It is argued, by way of example, that careful scrutiny of the available evidence shows that at the time of this attack there was a general lack of clarity how to compile a risk assessment that dealt with the risks of terrorism and that much of the available information was difficult to access. Further, despite the security experts referring to the availability of external advice, they were unable, when pressed, to identify where in 2017 this was to be found 1 and conceded that there were no standards in relation to counter-terrorism training at the time. 2 Nor, apparently, can either expert assist as to Showsec's standing amongst its competitors. Showsec understands the point made by the Chair that he intends to consider the standard of the training, but the company maintains that this can only be done fairly by giving some consideration as to whether there existed any contemporary standards that it failed to meet.3

6. That said, Showsec has accepted that there are areas in which it has fallen short, namely in its risk assessment and bag check procedures. However, it submits that neither of these flawed processes caused or contributed to either

1 43/137 /1-138/13 2 43/128/12-16 3 43/142/25-143/23 2

INQ039377/2 INQ039377_0002 the bombing or the extent of the casualties, nor were they reflective of a relaxed or complacent approach to security generally.

7. Showsec's position is that the evidence has established that it provided a well­ trained and experienced workforce to SMG on 22 May 2017. It was, in fact, a far more experienced workforce than its contractual obligations required or for which it was being paid. Showsec's training was not simply appropriate, it was thorough and consistent with the nature of the services it provided. Although Mohammed Agha may not have completed his training with the diligence Showsec was entitled to expect, Showsec's training did not stop with the induction module. The training was further supplemented and enhanced by briefings and experienced supervisors. The core message delivered via the training and briefings was the need for vigilance and prompt upward reporting. In this respect, Showsec's message to its staff was completely aligned with the national guidance.

8. In pointing out that its staff, including Mr. Agha and Kyle Lawler, were trained to know what to do when confronted by a suspicious individual, Showsec is not seeking to shift blame or to scapegoat. Why Mr. Agha and Mr. Lawler did not act in accordance with their training must be a matter for the Inquiry. Showsec's point is that if there were failures on the part of Mr. Agha and Mr. Lawler then this cannot be attributed to a lack of appropriate training.

9. Finally, whether or not there were failures on the part of Showsec and/or Mr. Agha and/or Mr. Lawler and/or SMG and/or the BTP, the fact remains (as the Chair acknowledged in his opening words at the beginning of this hearing) that Salman Abedi was plainly determined and entirely committed to killing himself and as many others as he could. Whilst his unchallenged presence at the mezzanine level raises important questions that the Inquiry will have to address, there can be little doubt that even had he been spoken to by a member of Showsec's staff or a police officer before egress, he would still have detonated his bomb. Whether the impact of that detonation might have resulted in fewer casualties is, to an extent, conjecture.

3

INQ039377/3 INQ039377_0003 The structure to the submissions which follow and some preliminary observations

The Terms of Reference, the Chapter 7 List of Key Issues and the IL T's Note of 30 November 2020 10. The Inquiry's main task in Chapter 7 has been to investigate Terms of Reference (TOR) 4, which is worth setting out in full here, providing as it does the over-arching structure for the relevant issues:

"i. The security provided/arranged by the owner and operator of the Arena venue, and those contracted by them to provide security, in particular the City Room's security arrangements.

ii. The security provided by relevant public/State organisations.

iii. The security provided by relevant private security providers.

iv. The planning, preparation, arrangements and communication (if any) between the above security providers prior to the attack, including (but not limited to) their roles and responsibilities for risk identification, person and bag-checking, and responding to a terrorist and/or mass casualty incident.

v. The adequacy of (a-d) (sic) above, including their compliance with relevant planning, preparation, policies, systems and practices.

vi. The impact, if any, of any inadequacies in the security arrangements, including whether any inadequacies contributed to the extent of the loss of life that occurred."

11. TOR 4, created at a very early stage in the life of this Inquiry is, necessarily, broad in terms of its design. But it is now supplemented by both the 17 Chapter 7 List of Key lssues, 4 against which Dr BaMaung and Colonel Latham gave

4 15/183/24-190/13 together with amendments from CPs set out in the ILT note of 24/11/20 INQ039038 4

INQ039377/4 INQ039377_0004 their evidence and the list of potential issues the CPs' are invited to focus upon in their closing submissions as set out in ILT's Note of 30 November 2020.

12. Before seeking to adopt a structure to these submissions which both seeks to address both the broad questions identified within the TOR but also those specific issues within the List of Key lssues/ILT's Note which touch upon Showsec's part in the security arrangements at the Arena, it may be helpful to set out some preliminary observations for the Chair's consideration.

Showsec's contractual and legal obligations 13. Consideration of the security arrangements at the Arena must begin with an analysis of what it was that any CP was obliged to do either contractually or pursuant to any statutory or common law duties. It follows that any assessment of Showsec's duties must start with its Stewarding Services Agreement with SMG, 5 which set out and defined the limits of its contractual obligations. In relation in particular to its statutory or common law duties the assessment must include what it was reasonable to expect a company in Showsec's position to do.

14. It is only once the scope and nature of Showsec's duties have been established that consideration can be given to whether the arrangements it had in place were adequate to discharge those duties. Showsec has accepted that there were inadequacies in its risk assessment process. However, the Inquiry will need to consider whether as a whole the security arrangements, which included not only the risk assessment but also the training, briefing and the employment of experienced staff, were adequate or not. If the Inquiry concludes that a part of the security arrangements was inadequate, it will need to consider whether that inadequacy had any causative impact on the events of 22 May. Again, by way of example, Showsec has conceded that non-SIA staff were performing bag checks. And whilst this is a SIA licensable activity and certainly not a trivial matter, it had (for reasons expanded upon below) no impact on either what occurred or the extent of the loss of life that was suffered.

5 INQ012126 5

INQ039377/5 INQ039377_0005 Applicable standards and available information in 2017 15. In our introductory remarks we have already advanced the submission that in evaluating and judging Showsec's actions, policies and procedures, fairness demands that the Inquiry has regard to the standards that prevailed and the information that was publicly available to Showsec in 2017. This does not in any way preclude criticism of those actions, policies and procedures but it allows for any criticism to be set within a proper context.

16. As an example, when considering and judging the actions and responses of Showsec and others in 2017 and before, it is crucial to have in mind that not only had the national threat level remained "Severe" from August 2014 to May 2017, but also that the threat level in the UK has never been below "Substantial". Tom Bailey correctly identified that the response for both levels is the precisely the same, namely "Heightened", 6 defined as "Additional (from baseline) and sustainable protective security measures reflecting the broad nature of the threat combined with the specific business and geographical vulnerabilities and judgements on acceptable risk. "7 Therefore, during the relevant period, there was no change in the national threat level that in and of itself would have required Showsec to review or change its policies and procedures. However, there were of course terrorist incidents during the period 2014 - 2017, the Bataclan and Stade de France attacks in Paris in November 2015 perhaps being the most significant. The evidence has shown that Showsec responded quickly and appropriately to those events. 8

17. Showsec has been critical of the approach of the security experts in a number of respects and expresses a concern whether they have truly understood their duties both to the Inquiry and the CPs. It could not, sensibly, be said that Colonel Latham and Dr BaMaung do not have considerable expertise in security matters. However, the role of an expert witness encompasses far more than that. Neither had any expertise in crowd management and both accepted that they had not considered Showsec's performance in the wider context of

6 33/26/22-25 7 INQ032115/55 - 56 8 INQ034698, INQ034688 6

INQ039377/6 INQ039377_0006 prevailing industry standards. 9 Further, Colonel Latham appeared to regard his own regime at the 02 as the gold standard from which other policies and procedures could be judged. Not only was he plainly wrong as to that, but his stance in this regard is the clearest of indications that he has failed to understand the role of the expert in proceedings of this sort. Furthermore, and despite their protestations to the contrary, there are clear examples - in particular in relation to hostile reconnaissance, as set out at §§81-83 below - of the experts applying a considerable measure of impermissible hindsight to their analysis and conclusions.

Hindsight 18. As to hindsight, Showsec accepts that the Inquiry is entitled to look at the situation that prevailed in 2017 from the perspective of 2021 and that that necessarily involves an element of hindsight. That, however, is very different from criticising those in 2017 who did not and perhaps could not have appreciated then what has become or seems obvious now. At the conclusion of the Opening Submissions the Chair stated:

"I have been encouraged not to use hindsight when deciding whether the correct decisions were made on 22 May by those who were caught up in events, both before and after the explosion. My present position is that it would be unfair to use hindsight when making assessments of their actions in that situation. As far as I can, I shall try and put myself in the position of the person whose actions I am considering and the situation in which they were. But in addition to making those assessments, I have the job of making recommendations as to how things might change in the future to try and minimise the risk of a similar event happening ... and, if it does, how to minimise the consequences. In arriving at appropriate recommendations, it is not only inevitable but necessary that I should look at these events with the benefit of hindsight. "10

9 43/125/10-14, 43/126/19-22 10 13/170/25-171/16

7

INQ039377/7 INQ039377_0007 19. Showsec endorses this approach with the caveat that it should extend to events not just on the night of 22 May but also to the period leading up to it.

20. As we have been encouraged to do by way of I LT's Note of 30 November 2020, the submissions to come are divided by way of the following chapters, which themselves are sub-divided according to themes in an effort to ensure we have addressed not just the overarching TOR 4 issues but also those more detailed and specific questions as these touch upon Showsec's position which are to be found in the List of Key lssues/ILT's Note.

(i) Chapter 1 - Showsec's role at the Manchester Arena, which includes the questions: whether that involved the provision of specialist counter­ terrorism services; and the assertion of profit before safety (§§21-35 below).

(ii) Chapter 2 - the adequacy of the risk assessment, the best way in which to assess risk and the difficulties in this regard confronting a company in Showsec's position in 2017 (§§36-40 below).

(iii) Chapter 3 - the searching of those attending events at the Arena (§§41- 43 below).

(iv) Chapter 4 - patrolling or searching of the mezzanine floor in the City Room and the nature and adequacy of the pre-egress checks (§§44-46 below).

(v) Chapter 5 - the training of Showsec's staff, how Showsec's training module compares both with pre 2017 and contemporary standards, briefings and the experience of Showsec's staff (§§47-69 below).

(vi) Chapter 6 - the evidence of Mohammed Agha and Kyle Lawler and the evidence of Colonel Latham in respect of inadequate supervision (§§70- 79 below).

8

INQ039377/8 INQ039377_0008 (vii) Chapter 7 - missed opportunities both in the days before the attack and on 22 May 2017 (§§80-95 below).

(viii) Chapter 8 - recommendations for the future to include Martyn's Law and the Protect Duty, a centralised counter-terrorism library, involvement of the crowd management in the CTSA/PSIA process, membership of the SIA Approved Contractor Scheme (§§96-102 below).

Chapter 1 - Showsec's role at the Manchester Arena and the question whether that involved the provision of specialist counter-terrorism services, and the assertion of profit before safetv

The nature of Showsec's role at the Arena 21. In order to determine whether any inadequacies in the security arrangements constituted a failure, it is necessary first to establish and delineate Showsec's role and responsibilities.

22. Primacy for combating the risks of a terrorist attack lies with the State and is exercised through its security and police services. It is these organisations that have access to both expertise, information and resources far in excess of those available to a crowd management and event security company. The role of the police in overseeing the security arrangements at the Arena - whether that which was actually performed by BTP or that which ought to have been performed by GMP with their greater counter-terrorism experience and resources and who, there are strong grounds for arguing, should have taken responsibility for this major venue - has hardly been touched upon in Chapter 7. The security experts have almost entirely ignored the part the public might have expected the police to play before, during and after events such as the Ariana Grande concert and the role of the security services has yet to be explored. But the evidence has shown, and BTP has conceded this, significant failures in the manner in which BTP delivered its counter-terrorism function.

23. Instead, the focus, at least thus far in the Inquiry, for securing the safety of the crowd attending events at the Arena has been upon SMG and Showsec. In due

9

INQ039377/9 INQ039377_0009 course, the Inquiry will have to consider whether both the public, and indeed these two companies, are entitled to expect rather more in terms of ownership from the State's agencies in respect of the responsibility for the safety of those attending events and those employed by SMG and Showsec in the areas surrounding a venue such as the Manchester Arena.

24. There appears now to be no issue that in general terms and along with the police, it was SMG (as the occupier and operator) who had responsibility for security in the City Room. On event days, it discharged that responsibility through its sub-contractor, Showsec. It was not, however, Showsec who had or had been encouraged to have, any sort of formal relationship with GMP's CTSA or the BTP.

25. As is set out both in the Agreement and in Showsec's Opening Note, Showsec was contracted to provide crowd management and event security services to SMG. 11 Counter-terrorism was not a specified service in the schedule to the agreement although, as part of its wide-ranging duties (and as the company had plainly recognised) in providing "stewarding and event services" Showsec was required to identify the threats to attendees at the Arena associated with terrorism, plan to mitigate those risks and then to implement that plan.

26. Over and above its contractual duties, Showsec shared both with SMG and the police, statutory duties to its staff and certain members of the public under sees. 2 and 3 of the Health and Safety at Work etc Act 1974 (HSWA). That Showsec owed a duty under HSWA sec. 3 to members of the public queuing to get inside the Arena, inside the Arena and leaving the Arena appears clear. However, the extent to which that duty extends to preventing an act of terrorism rather than dealing with, or seeking to mitigate, the consequences of such an act is less easy to define. Nor is it by any means clear that it was Showsec who owed any protection type duty to members of the public who were not attending an event, whether they were in the City Room to meet those who had attended an event or whether they were passing through.

11 INQ012126 and INQ035495/6-9 §§4.1-4.23 10

INQ039377/10 INQ039377_0010 27. The topic of paying for special police services has been before the higher courts on a number of occasions recently in relation particularly to the policing of football matches. 12 The difference between where the Arena is located and a football club is that the Arena sat in an area to which at the time the public had unrestricted access, whether they were attending the Arena or not. Those people who were not attending the Arena but the Go-Karting centre or who were passing through to or from the station or car park were entitled to be protected by the police in the exercise of their functions to protect the public and detect and deter crime.

Did Showsec's role include the provision of specialist counter-terrorism services? 28. In opening Showsec's position in the Inquiry, 13 we said: "there are limits to what could and can reasonably be expected of Showsec's staff (or indeed any other company offering crowd management services) when at work, particularly in areas such as the City Room, with its special challenges . . . Put shortly, what we would suggest was reasonable to expect of the company, was that its staff had been sufficiently well-trained to enable them to identify any individual behaving suspiciously in the City Room and to remain vigilant when managing the crowds attending events at the Arena. Vigilance to include keeping an eye out for possible instances of hostile reconnaissance, suspicious behaviour and anything else which might present as a risk to concertgoers. And where there were concerns, that those concerns would be escalated promptly to the Event Control Room for the SMG management figures there to assess and, where appropriate, to inform the police. But ... that role did not extend any further than that or to those functions which are the preserve of the police or other counter-terrorism specialists, such as conducting counter-terrorism sweeps, confronting possible suicide bombers or anything of that sort. That was not what

12 See Leeds United Football Club v Chief Constable of West Yorkshire Police [2014] QB 168 and Ipswich Town Football Club Company Ltd v Chief Constable of Suffolk Constabulary [2017] EWCA Civ 1484 13 §§17-19 of Showsec's Oral Opening Submissions, 12/59/5-60/5 11

INQ039377/11 INQ039377_0011 Showsec had been asked to provide by SMG, it does not fall reasonably to flow from the services it was contracted to provide and more to the point, its staff, inevitably ... would lack any of the skills or experience required to execute tasks of that sort."

29. The written and oral evidence of Mark Harding14 and Mark Logan, 15 the statement of Simon Battersby who delivered a presentation with Mr Logan at the NAA/EAA event in April 2016 and undertook the stewarding audit16, the lack of any relevant contractual terms, the fact that any training Showsec provided on the topic of counter-terrorism was entirely based on publicly available material and the fact that after the bombing SMG sought specialist advice from Guidepost Solutions all goes to demonstrate that Showsec was not - as was submitted - offering, purporting to offer, or providing specialist counter­ terrorism services.17

30. Further, Dr BaMaung, in agreeing that there were other companies employing ex-service personnel that did provide specialist counter-terrorism services and which in recent years had become more prevalent, said, "I don't believe it's [Showsec] a company that markets itself as having significant counter-terrorism expertise at all."18 The views expressed by Miriam Stone and James Allen as to Showsec's purported expertise in this area were not reasonably held and we would invite the Chair to reject them.

31. Whilst there is a crossover between the concepts of crowd management, security, and counter-terrorism these concepts are still distinct. Crowd management as the name suggests deals with the management of groups of people into, within and from an event. Event security is concerned with preventing either people or items from entering a venue and other SIA licensable activity such as access control to back of house and stage areas. Counter-terrorism is a highly specialised area, traditionally falling within the

14 INQ034720/3 §12, 311159/2-8, 190/5-9, 32/13517-8 15 INQ035984/2 §7, 39/8/2-8, 12-20, 35/13-18 16 INQ035986 17 See, by way of example, the evidence of Tom Bailey 33/17/15-1817, 18/12-18, 24/5-14 18 43179/9-80/20 12

INQ039377/12 INQ039377_0012 remit of the police and security services. 19 This distinction was accepted with some qualification by Dr BaMaung.20

32. More generally, when dealing with security providers at the 02 and in response to a direct question from the Chair as to whether crowd management

21 companies were "security specialists in the CT specialised way" , Colonel Latham expressed the view they were "crowd safety people first and I felt that I was, without being disrespectful to them ... teaching them terrorism. "22 Whether or not the Inquiry accepts the totality of his evidence, and there is good reason why it should not, this passage perhaps gives a true reflection of the capabilities and experience of the crowd management and event security industry in 2017 in relation to counter-terrorism.

In performing its role did Showsec put profit before safety? 33. Every business will seek to maximise revenue and minimise cost. This is far removed from putting profit before safety, which in this case would involve a decision not to perform a particular task or to implement a particular policy on the grounds of cost, in the knowledge that by doing so safety was being compromised. To prove such a serious allegation requires cogent evidence.

34. Contrary to the assertions made by some CPs, Showsec is not a large company generating high profits. On a proper analysis of the evidence, it was plainly not in Showsec's economic interest to agree with SMG to supply too few staff generally or fewer SIA licensed staff than were required effectively to perform Showsec's obligations. SMG paid Showsec per member of staff supplied and at a higher rate for SIA licensed staff. Therefore, the more staff, and the more qualified staff, employed by SMG, the greater the profit to Showsec.23 As for the numbers of staff, these were imposed upon Showsec by SMG.

19 INQ039132/6-7 §§31-33 20 43/85/17-86/2 21 43/106/3-8 22 43/106/9-12 23 INQ037041/2-3 §§ 6-10 statement of Mark Harding 13

INQ039377/13 INQ039377_0013 35. Putting to one side the cold economic arguments, the Inquiry has had the benefit of seeing the evidence of the directors Mark Harding and Mark Logan, the Regional Manager Tom Bailey and the Head of Security of the night, Tom Rigby. Showsec is plainly a well-established company run by experienced, thoughtful and highly motivated individuals. Nothing in their evidence or the manner in which they gave their evidence even begins to justify an allegation of putting people at risk for the sake of profit. These were serious allegations and again as a matter of fairness, they should be roundly and explicitly rejected.

Chapter 2 - The adequacy of the Risk Assessment, the best way in which to assess risk and the difficulties in this regard confronting a company in Showsec's position in 2017.

36. Whilst it was, of course, for SMG to assess the risk to those attending at the venue, in its Opening Statement24 and in its schedule of responses to the criticisms of the experts, 25 Showsec accepted the inadequacy of the Manchester Arena Risk Assessment I NQ001477. Without in any sense seeking to detract from this concession, we would suggest that the Inquiry should acknowledge - for the reasons set out in more detail at Appendix A below (§ 103-115) - the following:

(i) In 2017, there was little or no guidance available to a company in Showsec's position as to how to compile a counter-terrorism risk assessment. The author of the risk assessment, Tom Rigby, gave evidence that he had completed an IOSH course on the assessment of risk from a health and safety perspective, but this course did not include any counter-terrorism element.26

(ii) The information that was available to the industry was to be found in a variety of locations, not all of which were immediately obvious or accessible.

24 INQ035495/4 §l.24(ii) 25 INQ035905 26 34/161120-16217 14

INQ039377/14 INQ039377_0014 (iii) Even now there is confusion as to the best way to construct a risk assessment and the issues to this day that remain unidentified or unresolved include: whether the risk of a terrorist attack should fall to be addressed as part of health and safety risk assessment or as a wholly distinct issue; to what extent, if at all, the threat level should feed into the assessment of risk; and how likelihood should be calculated, if it should be calculated at all.

Showsec's position in respect of the risk assessment by way of summary 37. It is accepted as a general statement of principle that a risk assessment cannot be a static document and must be flexible enough to deal with new threats and/or changed circumstances. In practice, however, and as set out above, the threat level in 2017 had not changed since August 2014 and nor had the identified terrorist methodologies. Showsec's response to the Bataclan and Stade de France attacks involved immediately contacting senior management to ensure that they reviewed policies and procedures with their clients, 27 updating its staff via mailshot in which they were reminded of:

" ... the importance of being vigilant at all times and making sure you listen to instructions given out in briefings is heightened in such circumstances. Please remember that the counter-terrorism module on our e-Learning platform is always open if you wish to refresh the key points in it. '28

38. No evidence has been adduced to show where a company in Showsec's position could have gone in 2017 in order to obtain the necessary expertise to construct a risk assessment that focused on the risks of terrorism or as to whether such expertise was readily available in 2017. 29 The information available referred, sometimes in the same document, to likelihood both in terms of the likelihood of an attack occurring and the likelihood of a successful attack

27 INQ034698 28 INQ034688 29 See Appendix A generally 15

INQ039377/15 INQ039377_0015 given current security measures. 30 In short, the available guidance lacked both clarity and consistency.

39. Further, Showsec maintains that the flaws in the risk assessment were not causative and that the risk assessment should not be looked at in isolation. Consideration will, no doubt, be given to other documentation such as the Counter-Terrorism Awareness Document31 (produced in response to the attacks in France), which Tom Rigby said was intended "to dovetail into ... the other risk assessment"32 and, in particular, the training and briefings given to the staff along with the evidence of the security experts as set out in the final report that staff had been trained to identify and report suspicious activity. 33

40. Finally, there is no evidence that Showsec's risk assessment influenced SMG's choice of either control measures or staffing numbers.

Chapter 3 - the searching of those attending events at the Arena 41. The search procedure for this particular event, namely profiling and random searching, along with the numbers of stewards and SIA licensed staff were imposed upon Showsec by SMG.

42. Showsec has accepted that bag checks at ingress, a licensable activity, were being carried out by non-SIA licensed staff. 34 Whether there were insufficient SIA licensed staff to carry out this activity will be for SMG address.

43. What, however, is clear is that any such failing was not causative because Salman Abedi made no attempt to enter the Arena at ingress or at all. He would, of course, have been unlikely to have appreciated the difference between licensable and non-licensable activity and it may be argued that he plainly had been deterred after his hostile reconnaissance from attempting entry.

30 PAS 127 INQ032108/ll, 13 31 INQ012031 32 34/156/14-15 33 INQ035611/28 §§ 53, 378-379 §§ 870-874 34 INQ035495/4 §124(i) and INQ035905 16

INQ039377/16 INQ039377_0016 Chapter 4 - the patrolling or searching of the mezzanine floor and the nature and adequacy of the pre-egress checks

44. Showsec does not accept that at any stage it had agreed to provide or had been instructed to provide the patrols that SMG Europe had contracted to provide pursuant to the Facilities Management Agreement. Neither the contract nor the evidence could possibly justify such a conclusion.

45. The evidence reveals a clear difference between the two companies as to the extent of Showsec's responsibility for checking the mezzanine level pre-egress. Showsec staff, correctly, did not regard the mezzanine as an egress route because the mezzanine afforded no means of exit from the City Room. Whatever assumptions SMG had made, there is no evidence other than the pre-egress sheet itself that SMG ever directed Showsec to patrol the mezzanine. No SMG witness spoke of giving that as an instruction. Further, Colonel Latham was of the opinion that SMG had a responsibility to ensure that the work they expected to be done was in fact being carried out35 and in answer to questions from the Chair he said that would not have expected SMG to be ignorant of the fact that for a considerable period of time Showsec staff were simply checking from the bottom of the stairs. 36

46. In terms of a causative failing, even if Showsec staff had understood that SMG required the mezzanine floor to be inspected pre-egress, the visit to that level would not have taken place until at some point between 22:00 and 22:15. By this time Salman Abedi was already in place and the numbers waiting to collect concertgoers had already grown. The terrible reality is that, even if confronted by Showsec's staff, he would still have detonated the device and loss of life would certainly have followed.

35 42/142/2-12 36 43/238/9-19 17

INQ039377/17 INQ039377_0017 Chapter 5 - the training of Showsec's staff. how Showsec's training module compares both with 2017 and contemporary standards, briefings and the experience of Showsec 's staff.

Training 47. The company's position in respect of training can be made shortly. Showsec does not accept that its training (developed through Derby University) was inadequate when considered in the round and certainly not by 2017 standards. Showsec has adduced unchallenged evidence of the significant time and money it has invested in training. 37 In his evidence, Mark Harding (an individual of considerable experience in this field) said that he was aware of no other company in the industry that provides the level of training Showsec does. 38

48. What did arise during the course of the Chapter 7 evidence was the issue whether Showsec had the capacity to monitor whether staff seeking work with the company had completed, appropriately, the compulsory training it required of applicants. Before Mr. Agha's evidence, Mr. Harding had not understood that its University provided software package had that capability. It was in order to check Mr. Agha's evidence that Mr. Agha had not spent the time he ought to have done on the counter-terrorism module that Mr. Harding sought help from the service provider confirming the time spent completion of the relevant module. 39 Mr. Agha's ability to defeat Showsec's clear efforts to ensure its workforce were properly trained was then rather seized upon by a number of the parties to the Inquiry.

49. Two points fall to be made. First, the evidence shows the need for extreme caution in interpreting the data, which has had to be recreated to show what may have been available at any given point in time and reveals only the time spent on the last occasion a staff member accessed the material. 40 Second, the Chair will remember the difficulty Colonel Latham experienced in answering the question how he assured himself that his staff (whether sub-contracted or sub-

37 INQ034720/4-5 §§20-22, INQ035987/3-4 §§10-14, INQ037041/3 §10, 6-8 §§28-34 38 32/146/10-147/8 39 32/27/15-28/14 40 INQ037083 and INQ037084 18

INQ039377/18 INQ039377_0018 sub-contracted staff) at the 02 were sufficiently trained. 41 In short, he relied on the contractors and his monitoring of the contract to ensure that the staff (whether contracted or sub-contracted), had been appropriately trained. In reality even leaders in this area of the training of its workforce, as Showsec plainly are, had not in 2017 (in common with Colonel Latham) recognised that it might be possible to monitor compliance with on-line training expectation.

50. As for training delivered by way of on-line courses, there can be, in reality, no sensible criticism made of Showsec given that the present ACT Awareness course is only available online. Mr. Harding, during the course of his evidence, has also set out the compelling reasons, which include the geographical spread of the work, its part-time and seasonal nature etc., why it is not open to Showsec to offer extensive classroom training to those applying for stewarding positions. 42

51. In terms of refresher training, Showsec encouraged its staff to visit its e­ Learning platform. Again, given the casual nature of the workforce etc., it is simply not practicable to make classroom-based refresher training mandatory. Counter-terrorism is also but one of a number of important topics (when regard is had to the sheer variety of events for which the company provides crowd management services) that could be the focus of refresher training, along with topics such as ingress and egress, fire safety or emerging risks etc., topics every bit as important to the safety and management of large crowds at a venue such as the Arena. 43 Showsec's solution involved inviting the staff to visit the platform and to read the updates they were sent and by way of carrying out thorough and detailed briefings at every event, a topic dealt with at §§59-69 below.

52. In order to meet the mis-placed criticism of the security experts to be found in the various iterations of their reports, Mr. Harding has set out at some length how the counter-terrorism element of the training provided by Showsec in 2017 compared with the SIA Door Supervisor training provided by Highfield Training,

41 43/99/15-102/17 42 INQ037041/3-5 §§ 11-21 43 INQ037041/9-11 §§ 41-51 19

INQ039377/19 INQ039377_0019 the NVQ that is taken by those who wish to work as stewards at sports grounds and the current ACT programme. 44 Below, by way of a short summary - the detailed analysis is to be found at Appendix Bat 114-147 - is an examination of both the training and the guidance that was and is available to companies such as Showsec:

(i) The Green (the 61h edition of which came into force after the attack) and Purple Guides (which does not list counter-terrorism as any part of a crowd management stewards duties) contained very limited counter­ terrorism information beyond references to NaCTSO/CPNI guidance both before and after the attack. 45

(ii) The NVQ undertaken by stewards at sports venues contained no specific element of counter-terrorism training.

(iii) Of the 550 slides used during the SIA training course only 17 (some of which are duplicates) contain references to counter-terrorism and there is nothing within these that is not dealt with in Showsec's module.

(iv) Two pieces of NaCTSO guidance have featured heavily in the evidence, NaCTSO Guidance for Bars, Pubs and Nightclubs46 and NaCTSO Guidance for Arenas and Stadia47 and one of the main threads running through the various pieces of NaCTSO guidance is the importance of vigilance and upward reporting. The Arena guidance also drew emphasis to the phrase, "Hil/sborough ... taught us a critical lesson. Safety must always have priority over security". Although Showsec has been criticised for its focus on Chemical, Biological and Radiological attacks, the NaCTSO guidance also spent substantially longer on mail handling, information security and CBR attacks than PBIED attacks; 48

44 INQ035987/6-8 §§19-29 45 INQ038803 (Green Guide); INQ020210-19 (extracts from the Purple Guide) 461NQ032115 47 INQ020147 48 INQ032115/23 - 26; these references are all from the Bars and Clubs Guidance; however, they are in every important respect identical to the Stadia and Arenas Guidance 20

INQ039377/20 INQ039377_0020 and even the sections in the NaCTSO guidance on PBI ED deal substantially with vehicle borne attacks; 49 The hostile reconnaissance

sections direct the reader to Fairway and Eyes Wide Open50, both of which were included in the Showsec CTE module and the guidance

deals with See Tell Act, the forerunner to Run Hide Tell51 , dealt with in the Showsec CTE module;

(v) The importance of vigilance and upward reporting was also stressed in the Griffin training that Showsec's staff attended.

(vi) Showsec's CTE module in 2017 compares favourably with the current ACT Awareness training.

53. Against the more detailed analysis to be found in Appendix B, Showsec submits that its training was at least equivalent to the nationally available guidance and material and in some cases far superior to it. The limited references to counter­ terrorism in the Green and Purple Guides, the NVQ qualification, the SIA training and, to an extent, the BTP's training reflect the fact that counter­ terrorism is but a part of what the target audience of these courses needed to know. Counter-terrorism, by contrast, formed a significant proportion of Showsec's mandatory training.

54. Showsec recognises that any training can be improved and has sought to do so, for example by providing more written information in relation to hostile reconnaissance. 52 But that is not to say that the training was inadequate in 2017.

55. In short, Showsec argues that its CTE module extracted pertinent material from the publicly available guidance and made it accessible and relevant to its staff. Some of the criticisms, for example with regards to layout, are little more than

49 INQ032115/39 50 INQ032115/47 - 49 51 INQ032115/52 - 53 52 INQ012105/l 79-181 21

INQ039377/21 INQ039377_0021 nit-picking or criticism for criticism' sake. Others are inconsistent: Showsec is criticised for providing too much text on the one hand53 , but then, on the other, for not including text on the topic of hostile reconnaissance in addition to the Fairway and Eyes Wide Open videos. 54 More importantly, Dr BaMaung was unable to identify where Showsec could have gone in 2017 in order to obtain the necessary expertise. 55

56. Further, the fact that staff were expected to complete training unpaid before their first shift was not out of kilter with industry practice. 56 Although Colonel Latham made suggestions as to how the quality of training could be assured, 57 it was clear from his answers later that whilst he trusted his contractors to provide appropriately trained staff, he was not in a position himself to check the extent to which the sub-contracted staff (or sub-sub-contracted staff) had been trained and nor did these staff necessarily complete any venue specific training before their first shift.58

57. Dr BaMaung agreed that the two things he would hope that a workforce such as Showsec's had been taught were vigilance and reporting. 59 He agreed it would be unfair to judge Showsec without reference to contemporary standards, 60 although he had no evidence as to what those standards might have been. 61 Colonel Latham also accepted that Showsec required SIA licence holders who wished to work for Showsec both to undergo the CTE module and venue familiarisation.62

58. Nor should Showsec's counter-terrorism training be seen in isolation. The requirement to be vigilant and to report upward was stressed throughout Showsec's training. Mr. Harding has identified a number of areas where

53 43/134/2-17 54 43/135/10-17 55 43/137/2-138/9 56 411142/9-144/6 57 411143/23-145/8 58 43/99/15-103/12 59 43/108/14-109 /12 60 43/126/19-22 61 43/125/10-14 62 43/111110 22

INQ039377/22 INQ039377_0022 Showsec staff were encouraged to be vigilant and to report upwards in a non­ terrorist context, for example, reporting accidents, issues at ingress or crowd related issues generally, gas leaks. 63 In short, vigilance and reporting were part of Showsec's culture.

Briefings and the experience of Showsec's staff 59. As well as online training and that on the ground, Showsec staff received briefings at every event they attended. The Head of Security briefed the supervisors who themselves went on to brief the staff. Jonathan Lavery, a former policeman of 30 years' experience who has not worked for Showsec for several years and who was not reticent in expressing views about the shortcomings of the industry generally, described the briefings given by Tom Rigby, who was Head of Security on the night, as "always thorough, always in­ depth, knew the subject matter back to front. There wasn't really anything that he didn't cover. "64 He agreed that Tom Rigby always dealt with counter­ terrorism and did so appropriately and well. 65 The keystone was vigilance and he then witnessed the supervisors briefing this to their staff. 66

60. Tom Rigby had worked for Showsec since 2007 and he had been a Head of Security since 2015; he had held an SIA Door Supervisor licence for ten years and a Public Space Surveillance Licence; he had completed Showsec's CTE module and attended Showsec's Management Development Programme, Griffin and Argus training and table top exercises. 67 He always gave a counter­ terrorism briefing to supervisors, whether or not it was the topic of the day, which included looking out for suspicious characters, reporting mechanisms, Run Hide Tell and HOT and which was intended to be disseminated by the supervisors to the staff. 68 The briefing room itself had counter-terrorism

literature on the walls. 69

63 INQ037041/14 § 63 and INQ012105/ll, 15, 17, 25, 29, 30, 35, 64, 67-68, 86 and 103 64 17/134/23-25 65 17/135/5- 7 66 17/135/12-14, 136/24-137/6 67 34/112/21-11517 68 34/136/3-137/14, see also Bailey 33/52/25-53/6 69 34/137/3-9 23

INQ039377/23 INQ039377_0023 61. On 22 May 2017, Showsec provided SMG with an extremely experienced bank of its own staff who collectively had received 18,000 briefings at the Arena alone. 70 This stands in contrast to the position at the 02, where Colonel Latham can have had no means of knowing either how well trained or experienced the crowd management workforce was. As against the 17 supervisors and managerial staff SMG had ordered and paid for, Showsec provided a workforce that was significantly overqualified, namely 33 supervisors and managerial level staff who had an average age of 37 and average service of seven years. 71 The overall ratio of supervisors to staff was just under 1:5.

62. The evidence demonstrates that this training and experience was regularly put into practice as the Security Experts concluded in their finalised report. 72 "Showsec security staff in and around the City Room were sufficiently trained for them to know that they should report suspicious activity and to know how to do so". 73 Subsequently, Dr BaMaung and Colonel Latham have sought to resile from their conclusions on the basis that they had been persuaded to a change of position by the evidence of Mr. Agha. This is dealt with below at §72 below.

63. Showsec submits the evidence set out immediately below clearly establishes that its staff at ground level were appropriately trained to recognise and react to hostile reconnaissance and suspicious behaviour.

64. Brandon Couper-Phillips stated that before he started work with Showsec he

was trained to identify suspicious behaviour/activity74, namely "suspicious people in terms of hostile reconnaissance and suspicious packages that could have been left by someone else. "75 The phrase "hostile reconnaissance" meant "someone with hostile intent taking pictures or generally scouting out area

before attack"76. Stewards were told to look out for "hostile reconnaissance, people who don't fit in with general crowd or carrying bags that could not be

70 INQ034720/7 §27 71 INQ037041/6 §24 and p8 §37 72 INQ035611/365-374 §§835-860 73 Ibid §871 74 17/189/2-4 75 17/190/14-16 76 17/190/22-23 24

INQ039377/24 INQ039377_0024 taken into venue. "77 He would also have been concerned or suspicious about someone wearing bulky clothing. 78 Generally, the threat level was mentioned in briefings. 79 On 21 May 2017, the briefing lasted 10 - 15 minutes; although he could not remember whether the phrase counter-terrorism was expressly used, 'Tilt was: make sure you're looking out for suspicious activity, in that sort of capacity. "80 If he saw something suspicious, he would write it on back of briefing sheet and make staff aware so it could be pushed up the chain of command. 81 It was expected that staff would go and talk to an individual who was behaving suspiciously. He had been told to approach them, and if after conversation he thought person was suspicious, he would report it either to a radio holder or a supervisor. 82

65. David Middleton had been told by the Heads of Security at the various venues where he worked what the threat level was. 83 At the Arena he was briefed on every occasion as to the threat level. 84 He had received Griffin training on more

than one occasion85, had seen Eyes Wide Open many times86 and received refresher training annually. 87 The training in relation to hostile reconnaissance included what to look out for: people loitering in areas you would not expect, looking for/taking photos of camera positions/doors or things inside the arena, anything that made one think "why is he doing that". 88 If someone was seen to be staring at a queue, staff would observe them. 89 There was no doubt that everyone at work on 22 May knew to report immediately any suspicious individual/character. 90 Staff were briefed on what to look out for, what to do if someone was suspicious i.e. to talk to the person and find a reason to call a supervisor over such as an excuse that the scanner was not working; they were

77 17/203/21-23 78 17/227/8-12 79 17/190/24-191110 80 17/19017-9 81 17/192/21-24 82 17/194/12-195/17 83 19/4/14-6/1 84 19/617-7/2 85 19/17/13 -1917 86 19/24/2-6 87 19/42/20-25 88 19/35/4-10 89 19/40/8-4111 90 19/211/18-212/3 25

INQ039377/25 INQ039377_0025 told to be careful how they approached suspicious individuals and that the supervisor would then deal with the situation. 91 At the stewards briefing he told them the level of the threat was severe, but didn't say what that meant in terms of how they performed their duties. 92 In terms of profiling, he would have said "anything that you're not happy with I need to know. "93 The reason he mentioned suspicious characters and/or behaviour at briefing was to make sure staff were aware of counter-terrorism at all times. 94 Mr. Middleton regarded himself as a strict but approachable supervisor. 95 He would always finish his briefing as follows: "if there is anything you do not understand, tell me now before we open them doors"96 and "Does anyone have any questions? If there is anything you do not understand tell me. If you are embarrassed to tell me, tell me in private. "97

66. Daniel Perry had completed Showsec's Management Development Programme at Derby University, SIA accreditation as Door Supervisor, Showsec's CTE module and Griffin training. 98 Since he joined Showsec it was drilled into him to report suspicious behaviour to the nearest radio holder or supervisor. 99 As Access Control, he would search anyone who refused a bag check or who had a large bag or who was wearing inappropriately bulky clothing. 100 As a steward, he had been told to monitor suspicious behaviour such as a person loitering in areas they should not be, taking interest in CCTV cameras, inappropriate clothing for the day, or taking an unnatural interest in things. 101 Counter-terrorism was covered in every briefing even if not on briefing sheet. 102 People were told to report if they saw anybody suspicious. The briefing would run through anything to look out for, suspicious behaviour, keeping eyes out for people; it would touch on threat and indicate if there was any

91 INQ035472/4 §10 and 19/218/20-219/8 92 19/69/1-6 93 19/69/12-13 94 19/220/17 95 19/7017-17 96 19/148/16-17 97 19/169/13-16 98 23/13/20-15/22 99 23/16/16-21 lOO 23/19/8-15 101 23/35/25-3617 102 23/41121 26

INQ039377/26 INQ039377_0026 intelligence/threat to event. 103 Counter-terrorism featured in briefings in May 2017 as the briefing topic.104

67. Robert Atkinson was a steward who, given that he had not worked for Showsec since 2017, did not remember the details of the briefings he received. 105 On 22 May 2017 he was stationed with Lawler who was both SIA trained and a radio holder; had he seen a suspicious character he would have reported it to Lawler. 106 Had he reported a matter to a supervisor it would have been welcomed. 107

68. By 22 May 2017 Jordan Beak had undergone counter-terrorism training with a former employer at Manchester Airport108 and had completed Showsec's CTE module, which included the identification of suspicious people, SIA accreditation and enhanced search training. 109 He had also completed Showsec's supervisor course. 110 The national terror threat level was brought up in most, if not all, briefings, both the supervisor and steward briefings. 111 It was explained that an attack was highly likely in the UK but not at the particular event. This meant they were told that there was a need to "always be on look­ out for potentially suspicious behaviour or people acting odd or whatever. "112 He had been taught that if he saw someone suspicious in the City Room, he might walk over and engage them in conversation while waiting for direction from control room_ 113

69. As well as the oral evidence summarised above, the Inquiry has received the written evidence of Showsec staff members Saeed in relation to a report of

103 23/22/2-11, 14/18-24 104 23176/9-11 and INQ035887-91 inclusive 105 23/122/3-123/8 106 23/87/21-89/4 107 23/89/16 108 23/130/4-9 109 23/131114-134/10 llO 23/134/11-21 111 23/136/11-16, 136/17-137/9 112 23/138/6-10 113 23/157/12-158/10 27

INQ039377/27 INQ039377_0027 suspicious behaviour on 20 May 2017 and Bostock, Donaghy and Hewitson on 22 May 2017. 114

Chapter 6 - the evidence of Mohammed Agha and Kvle Lawler and the evidence of Colonel Latham in respect of inadequate supervision

70. The evidence of both Mohammed Agha and Kyle Lawler present difficult problems for the Inquiry, perhaps for different reasons. Either Mr. Agha quite deliberately spent as little time as possible on his training for Showsec, which he accepted included materials that were capable of informing him about the terrorist threat, 115 or he is not telling the truth about this and in doing so is misguidedly trying to minimise his responsibility. He certainly did not inform Showsec of the deficiencies in his SIA training such as they may have been.

71. Whichever version is true, his own evidence demonstrates that he knew that his role involved looking out for suspicious people, whom he would identify by their demeanour or if they were doing anything out of the ordinary. 116 If he became aware of something suspicious, he knew he was to escalate the matter to a radio holder or a supervisor. 117 This may not be surprising given his experience, namely 69 shifts in total, of which over 30 were at the Arena, 118 and his acceptance that he was a highly experienced steward. 119

72. Contrary to the oral evidence Colonel Latham's gave, 120 it was only Mr. Agha who said that he had to ask a colleague what he was supposed to do having been assigned to guard the Grey Doors. 121 In fact, the colleague, Dimitar Arabadzhiev has made no mention of such a conversation. 122 Reference has already been made to Mr. Middleton's practice at the end of his briefings of asking those in his charge if there was anything that they did not understand

114 Saeed INQ011914, Bostock INQ011810, Donaghy INQ011955, Hewitson INQ011877 115 24/63/23-64/11 116 24/22/9-17 117 24/39/8-12 118 INQ034705 and 24/3/20-4/2 119 24/52/6 120 43/150/8-23 121 24/13/14-15/18 122 INQ011827 statement ofDimitar Arabadzhiev 28

INQ039377/28 INQ039377_0028 then they should speak to him, which Mr. Lawler confirmed happened on 22 May 2017. This passage of Colonel Latham's evidence, in which he purports to come to a factual finding based on a misstatement of the evidence, is but one example that underlines, we submit, the care that needs to be taken before accepting the evidence of an expert witness who appears not to have a proper understanding of his role.

73. As far as supervision and contact with other members of staff is concerned, Mr. Agha was relieved by Jordan Beak at 19:31, spoke to Mr. Lawler at 19:44 and 20: 38, and left his post to speak to Showsec supervisor Donald Barrett at 20:30. 123 He was approached by and spoke to an unknown member of Showsec's staff at 21: 11, who appears to have relieved him to allow him to go for a toilet break. 124 In the hour before detonation there was a radio holder in the City Room for all but two minutes. 125 It follows that Colonel Latham's comments about lack of supervision cannot withstand an accurate summary of the evidence. 126 However, Colonel Latham did say that whilst with hindsight it may have been better for Mr. Agha to have had a radio, there were good reasons the supply of radios is limited including the need to limit chatter. 127

74. As for Kyle Lawler, he started working for Showsec when he was 16 and he was 18 by the night of the attack. 128 He has frankly accepted that the trauma of the incident has had a significant effect on him and his ability to recall precisely what happened. 129 He gave, however, a clear and a plainly accurate account of the training he had received.

75. Early on in his Showsec career, Mr. Lawler understood the sort of behaviours that would raise suspicions, namely avoiding eye contact, fidgeting, sweating, taking in the CCTV cameras, asking staff random questions, not fitting the demographic of an event, being inappropriately dressed for the season or

123 24/67/15-73/22 and SOE INQ032038/ll-16, 18, 20, 22 124 24176/8-22 and SOE INQ032038/26-28 125 INQ0359873/3 § 9 126 43/14617-19 127 42/27/15-28/15 128 25/8/1-3, 9/1-2 129 INQ035670/l §4 and 25/6/10-24 29

INQ039377/29 INQ039377_0029 weather, carrying a large bag and he certainly knew what to look out for by 22 May 2017. 130 In summary, he would look to see whether a particular person was consistent with what should be happening in this particular environment. 131 During the induction visit to the Arena on 6 May 2015, Tom Rigby had said that if staff saw someone suspicious, the protocol was to inform control either directly if they had a radio or indirectly through a radio holder. 132 Mr. Lawler would make his observations, get the detail through to control so that they could find him on the CCTV and then give him advice. 133 As a result of his training he understood the HOT procedure in respect of suspicious items. 134

76. Mr. Lawler's SIA training was delivered by Showsec in a classroom in January 2017. He recalled that the counter-terrorism part was a long, detailed, interactive session lasting a minimum of a couple of hours. It covered past terrorist attacks, looking at what might be considered suspicious and what to do in the event of finding someone or something suspicious. Eyes Wide Open was shown. 135

77. During the supervisor briefings, Mr. Lawler said counter-terrorism was always mentioned or touched upon. 136 Sometimes it was generic and went over, for example, the HOT procedure but on other occasions it was more detailed. 137 The threat level was covered in briefings. 138 He considered that the training he had received from Showsec was adequate to deal with a situation where a suspicious person had been drawn to his attention.139

78. On 22 May 2017, Mr. Middleton had not briefed the threat level but did go through the HOT procedure. 140 It was the first time Mr. Lawler had worked on

130 25/2114-23/3, 25/10-22 131 25/26/8-12 132 25/19/6-20/6 133 25/2717-15 134 25/23/10-21 135 25/37/11-21 136 25/39/22-40/5 137 25/40/8-20 138 25/4113-24 139 25/43/11-16 140 25170/15-71/3 30

INQ039377/30 INQ039377_0030 the bridge so after Mr. Middleton asked if everyone knew what they were doing, he approached Mr. Middleton to ask about his role, which Mr. Middleton then explained. 141

79. Against this body of evidence there can be no dispute but that both Mr. Agha and Mr. Lawler were appropriately trained, and both knew precisely what they should do if confronted by an individual whose behaviour had given rise to suspicion. Each had undertaken SIA training in 2017 (Mr. Agha in April1 42 and

Mr. Lawler in January of that year143). The Chair should reject both Mr. Agha's evidence that he had not understood what his role on the Grey Doors was and Colonel Latham's evidence that he was inadequately supervised.

Chapter 7 - missed opportunities both in the davs before the attack and on 22 Mav2017

80. Showsec accepts there was a missed opportunity when Mr. Agha failed to follow his training and briefings and to escalate as a matter of urgency the concerns of a member of the public to the Event Control Room. Further, if his statements are accurate, it appears that Mr. Lawler also missed another opportunity at approximately 22:23 when Mr. Agha directed his attention to the bomber. The evidence has shown that this was not the result of inadequate training in either case.

The hostile reconnaissance prior to the attack on 22 May 81. Showsec submits that the evidence of the Security Experts in relation to the chances of Salman Abedi being identified as he conducted hostile reconnaissance between 18 and 21 May is wholly unrealistic and tainted with hindsight. By way of example, Salman Abedi walked past Mr. Lavery, a former police officer with 30 years' experience, on 18 May and stood near him while he watched the queue for no more than 40 seconds. 144 This was the same day that Mr. Lavery followed and reported a man he believed was involved in hostile

141 25/72/6-73/11 142 INQ034703 143 INQ035760/5 §31 144 SOE INQ031275/43 31

INQ039377/31 INQ039377_0031 reconnaissance. On 21 May, Salman Abedi can be seen to go briefly to the mezzanine. The fact that he is a young man wearing a hat cannot possibly make him suspicious, nor is there any reason to regard him as being any more suspicious than the man who was standing at the foot of the J D Williams stairs for the entire period Salman Abedi was in the City Room.145

Missed opportunities on the night including the use of CCTV 82. On 22 May the experts noted that Salman Abedi had started to enter the City Room at 18:34 but had then turned about, possibly, so it was suggested, as a result of seeing BTP officers. 146 It is wholly unrealistic to expect either a CCTV operator or indeed a member of Showsec staff at ingress to notice Salman Abedi as he approached the doors, to notice that within a matter of seconds he appears to have changed his mind, to notice the presence of BTP officers and to link the two events. Mr O'Connor QC's cross-examination of Colonel Latham on whether it reasonably could be said that Salman Abedi should have stood out as suspicious as he walked towards the City Room demonstrated fully the dangers of hindsight.147

83. At its highest it might be said that if someone monitoring the CCTV had noticed Salman Abedi on one of his visits to the City Room when he was wearing his rucksack, they might have been suspicious and called for further investigation. However, the Inquiry has heard just how many CCTV screens there were and certainly so far as the Event Control Room was concerned the focus was on the movement of the crowd.

84. The distinction Colonel Latham sought to draw between the position of the BTP officers at 20:48 and Showsec staff at 20:51 is another example of the unreality of his evidence and of evidence verging on the unfair. 148 Nothing had changed in those three minutes. The railway station, as a transport hub, was just as much a target as the Arena. Nobody could have sensibly suggested that the

145 SOE INQ020163/52-57 146 SOE020160/50-51 147 43/21517-228/23 148 43/160/3-162/25 32

INQ039377/32 INQ039377_0032 BTP officers should have found Salman Abedi suspicious when he walked past them, and Colonel Latham should not have expressed any other view about the Showsec staff.

85. It will for the Chair to make factual findings as to whether Mr Agha was or was not trying to contact Mr. Middleton after his conversation with witness A but on the assumption that he was, then the issue becomes one of how hard he tried 149 rather than whether or not he knew what to do.

" ... I was just thinking like what's he up to, what does he have in his bag ... my first concern was just getting it reported because I'm not aware of what the situation is ... there's nothing clear in my head what it can be, so I need to get it reported. "150

86. Mr. Middleton has accepted that he told Mr. Agha he was not to leave the doors unless they were covered by another member of staff, but that Mr. Agha would be expected to contact a radio holder even if that meant shouting. 151 This is in fact advice consistent with the guidance to be found in the Purple Guide which states under the heading "Conduct of Stewards", "Ensure that stewards

understand that they should not leave their place without permission. "152. Earlier in the evening, Mr. Agha had in fact left his position in order to speak to Mr. Barrett. He accepted that he could leave his position in the event of an emergency, although after he had spoken to witness A, he did not regard the situation as falling within that category. 153 After failing to attract Mr. Middleton's attention, he did attract the attention of a radio holder, Mr. Lawler, by shouting his name, waving him over and leaving his position. 154

87. In fairness to Mr. Agha, it is difficult now to get a sense of the degree of urgency with which witness A approached him. According to Mr. Agha, witness A

149 24/40/12-43/17 150 24/91117-23 151 Middleton 19/5717-59/2, 18115-9 152 INQ020211/15 at 13.99 153 24/101123-102/6 154 24/44/10-13, 18-23, and see also SOE INQ032038/44, 48-51 for Mohammed Agha leaving his position 33

INQ039377/33 INQ039377_0033 "wasn't .. .panicked or anything like that ... he just said it in like an ordinary way. "155 Mr. Agha accepted that he had not directed witness A to Mr. Middleton who was standing a relatively short distance away. 156

88. Much has been made of the disquiet felt by members of the public when they saw Salman Abedi. But again, in fairness to Mr. Agha and Mr. Lawler, it is important not to lose sight of the fact that the only person to have actually expressed any concern to a member of staff was witness A. His partner, witness B, thought Salman Abedi looked dodgy but they had seen a lot of dodgy characters that night. She thought he was selling merchandise. 157 There were a lot of people in the vicinity selling merchandise. 158 She was questioned carefully by Mr Greaney QC and her final position was that she might have thought he was more serious than a merchandiser, but she could not say what that might have been. 159 Witness A had not told her he thought Salman Abedi might be a bomber.160

89. As for the other witnesses, Neil Hatfield gave evidence that his first thought on seeing Salman Abedi was that he was a suicide bomber. 161 That position is substantially undermined by his failure, whilst waiting to collect four children, to alert anybody to that fear and the evidence which shows that Messrs. Middleton, Beak and Perry were in the City Room during this period and would have been visible to him from the mezzanine level. Neither did he suggest that his children should leave the Arena via another exit, even though his wife was then on the telephone to them.162

90. Martin McGuffie almost fell over Salman Abedi. He did not regard him as suspicious. 163 Although there are references to the bomber hiding or being hidden these represented his thoughts after the incident. 164

155 24/33/6-9 156 24/102/1 7-103/21 157 22/58/19-23/1 158 22/64/8-10 159 22/69/4-8 160 22/69/12-15 161 211112/24-113/2 162 211114/3-6, 116/15-23 163 22/152/1-2 164 22/156/20-157/16

34

INQ039377/34 INQ039377_0034 91. William Drysdale and Julie Merchant were involved in the anti-bootlegging operation. 165 Mr Drysdale thought Salman Abedi was praying, which he did not find suspicious. 166 The fact that he was in possession of a rucksack was not of concern because he was in an area above a railway station. 167 Mr Drysdale is also a trained close protection officer who is used to looking out for suspicious characters or those who may pose a threat. Nothing that he saw made him think Salman Abedi posed a danger to the public. 168 Ms Merchant thought that he was a "crank". 169

92. After witness A had expressed his concern to Mr. Agha he then left the City Room for a period of six minutes, leaving witness B behind. If this is an indication of the level of concern witness A expressed, then that may explain Mr. Agha's desultory effort to attract the attention of others and the manner in which he in turn communicated any disquiet to Mr. Lawler. Certainly, Mr. Lawler's actions as seen on the CCTV footage when leaving the City Room are not those of someone who believed that something so terrible was about to occur.

93. After Mr. Middleton was shown the CCTV footage of Mohammed Agha apparently trying to contact him, he said Mr. Agha could have either walked over or shouted to him. 170 Had he been informed of Salman Abedi's presence and the concerns from the public he would have radioed control. 171 Neither had Mr. Perry seen Mr. Agha trying to attract their attention and he would have expected him to come over. Mr. Beak was unaware of Mr. Agha's efforts to make contact and he would also have expected him to raise his voice. 172

165 20/6/17-20 166 20/25/5-18 167 20/26/17-21 168 20/50/3-51/6 169 20/94/5-95/8 170 Middleton 19/120/4-121111 171 Ibid 19/122/5 172 Perry 23/25/23-27/25, Beak 23/172/2-14 35

INQ039377/35 INQ039377_0035 94. Mr. Lawler was the only witness to suggest there was any problem with radios. 173 However, his evidence is that after he left the City Room, he cannot recall trying to use the radio. 174 At egress there would be a call over the radios to maintain radio silence unless it was urgent. 175 Neither Mr. Perry nor Mr. Beak ever had such an issue. 176 According to Mr. Atkinson, Mr. Lawler made no mention of any conversation with Mr. Agha when he re-joined him and neither did he seem anxious. He was not trying to make calls on his radio, although he may have been fiddling with the "press to talk" button. 177 The fact that, after speaking to Mr. Agha and returning to his position on the bridge, Mr. Lawler sent three people back into the City Room at 22:29 is a further indication that he was not overly concerned about what he had been told or had seen 178: As he put it, "It suggests that I wasn't concerned about what I'd witnessed. "179 And there is also body language as can be seen from the CCTV footage. 180

95. In summary, the evidence demonstrates that Showsec' staff including Mr. Agha and Mr. Lawler were properly trained and knew what to do. Both had recently completed or should have completed SIA training. As the Chair has already pointed out, and Colonel Latham appeared to accept this, the fact that an opportunity was missed cannot of itself lead to the conclusion that the person who missed it lacked training.181

Chapter 8 - recommendations for the future

Martyn's Law and the Protect Duty 96. Showsec supports the adoption of both Martyn's Law and a Protect Duty. It is involved in making representations concerning the detail of any future Protect

173 Middleton 19/95/1-3, 22-23, 97/8-10 174 Lawler25/13 l/2-12 175 Middleton 19/216/24-25 176 Perry 23/30/2-7, Beak 23/165/11-17 177 Atkinson 23/101111-103/18, 107/16-108/3, 118/3-5 178 Lawler 25/132/14-134/5 and SOE INQ033776/52-55 179 25/134/10-11 18° CCTV INQ100003/l from 1minute30 seconds in, 25/134/22-138/1 181 43/153/18-25 36

INQ039377/36 INQ039377_0036 Duty through the UK Crowd Management Association. UKCMA's submission deserves close consideration.1s2

A centralised counter-terrorism library 97. Showsec has already noted and supported the evidence given by DAC D'Orsi in this respect and has highlighted many of the difficulties the lack of a centralised library can cause.

The involvement of third party crowd management and/or security contractors in the CTSA/PSIA process 98. Showsec supports greater involvement in the process. Venues should also be under an obligation to share relevant licensing and risk assessment documents and security and counter-terrorism information with third party event security providers.

99. Consideration should be given to whether the current CTSA system should be overhauled so that in the future CTSAs do provide an audit function. There are undoubtedly resource implications in such an approach but the reality is that the police and security professionals are those best placed to monitor the efficacy of counter-terrorism measures.

100. In particular, there should be greater involvement of CTSAs and/or CT SecCos in the coordination of security in Grey Space.

An enhanced role for the SIA 101. Membership of the SIA's Approved Contractor Scheme should be mandatory. All security businesses should be licensed by the SIA. There should be no distinction between in-house and external security. The aim of these recommendations is to ensure that universal standards are applied.

Guidance

182 INQ039129 37

INQ039377/37 INQ039377_0037 102. There should be clear and prescriptive guidance issued to companies engaged in offering crowd management and event security services in terms of counter­ terrorism expectation in relation both to events generally but, in particular, grey spaces.

Jonathan Laidlaw QC Christopher Gillespie 12 January 2021

Appendix A (Chapter 2, Risk assessments: see the summary at §§36-40 above)

In 2017 there was little or no guidance available to a company in Showsec's position as to how to compile a counter-terrorism risk assessment. 103. None of the documents whether from NaCTSO, CPNI or any other source that have been scrutinised during Chapter 7, as will be seen from the analysis below, has identified whether or to what extent the same risk assessment can or should encompass both terrorism related and non-terrorism related risks.

The information which was available to industry was to be found in a variety of locations. not all of which were immediately obvious or accessible. 104. In 2017 there was no clear publicly available guidance as to how to construct a risk assessment that focused on terrorism. The Green and Purple Guides referred to the guidance issued by NaCTSO and CPNI. None of the NaCTSO guidance documents provide this information. Instead, these refer to the CPNI document "Protecting against Terrorism". 183 This in itself, Showsec submits, reveals an example of a pattern whereby one document directs the reader to another, which as will be seen may itself refer the reader elsewhere again.

105. "Protecting against Terrorism" poses the question, "In short, how likely is it that

the business or its staff could be the direct target of a premeditated attack?"184, to which the answer in the vast majority of cases is going to be "Not very likely

183 INQ038799 mentioned at INQ020147/64 and INQ032115/64 184 INQ038799/9 38

INQ039377/38 INQ039377_0038 at all", and later states, 'The RA process involves making logical assumptions about the likelihood of a threat and its potential impact should current security measures fail to protect w: 185 which is a reflection of the traditional health and safety approach.

106. The risks identified in this document range from a bomb in or near the main entrance, a suspect package received through the post, an employee using access to sell confidential information, the introduction of an IT virus to petty theft. 186 However, there is nothing concerning the six most common forms of attack such as VBIED, PBIED, MFTA and so on. The identification of impact includes not only injuries and fatalities, but also financial losses, impacts on productivity, reputation and client confidence. The document purports to signpost further guidance on conducting risk assessments. 187

107. Therefore, to find the information the starting point was a NaCTSO guidance document, which then directs the reader to this CPNI document, which in turn leads on to other CPNI documents. Those documents are in fact of limited relevance, given that one is "Risk assessment for personnel security", which focuses on the risks posed by employees188 and the second, Operational Requirements", 189 (a 2018 update) contains a further reference to yet another CPNI document entitled, "Principles of risk assessment", which itself requires a log on and password to access and, therefore, is not publicly accessible.

108. The Security Experts have referred extensively to "PAS 127 Checkpoint Security Screening of People and Their Belongings Guide"190 both in the context of risk assessments and search regimes. 191 There is no doubt that this is an important document and, further, that neither SMG nor Showsec were aware of it, notwithstanding the fact that it dates from 2014. Certainly, there is no evidence of CTSA Upham drawing SMG's attention to PAS 127. In terms of

185 INQ038799/13 186 INQ038799/13 187 Ibid p14 188 INQ038798/3 189 INQ038797/5 190 INQ032108 191 INQ032612/72-85 §§ 195-228 39

INQ039377/39 INQ039377_0039 its content, it provides useful guidance on checkpoints and searches but it also deals with how risk is to be assessed. 192

109. DAC D'Orsi gave evidence as to NaCTSO's aim to have all relevant information on a single IT platform, 193 which Showsec fully supports. PAS 127 was not on either the NaCTSO or CPNI websites and even its title does not necessarily suggest that it is CT specific. It is an example of a document that would only be found if the searcher knew what to look for, but not otherwise.

110. In fact, PAS 127 is not produced by NaCTSO or CPNI but by BSI, the British Standards Institution, which is not a body that is primarily focused on CT and there are over 50,000 standards, books and related publications in the BSI shop. Browsing by subject, there is nothing specific to CT although there are general categories of Risk, Security and Health and Safety.

111. At the bottom of the first column at p 7 of PAS 127194 there is yet another example of being sent to the website of a different organisation, in this case the Institute of Risk Management, where in order to access any publications one needs to be a member of the Institute.

Even today confusion remains as to the best way to construct a risk assessment 112. As to the assessment of risk, traditionally it is assessed by giving both likelihood and impact numerical values, which are then multiplied. The Purple Guide

195 refers to risk as "the product of probability and impact" , in other words a mathematical calculation. The Chair has pointed out the inadequacy of this method when assessing the risk of terrorism because the likelihood of a terrorist attack occurring in any given location may be minimal but, should it take place, the impact may be huge. 196 Colonel Latham's evidence on this point was inconsistent. At times he spoke of material risk, which did not focus on the likelihood of an event occurring and a model of "threat, vulnerability, impact". 197

192 INQ032108/13 - 15 193 40/93/17-97/2 194 INQ032108/13 195 INQ020219/9 196 15/127/3-25 197 15177 /22-79/2 40

INQ039377/40 INQ039377_0040 However, his initial answer to the Chair's query above referred to a mathematical computation of likelihood:

"Sir, one of the things that I would expect to be considered would be likelihood and any risk assessment mechanisms would look at likelihood and come up with a mathematical computation as to whether something was judged to be impossible, unlikely, likely, highly likely or something similar on a sliding scale. Many risk assessments would make that sort of assessment. 198

113. However, even PAS 127document refers to the likelihood of a risk eventuating. It is suggested that organisations should pose the following question: "How likely is this organisation, operating at locations A, B and C, to be vulnerable to an attack or incident utilizing threat items X, Y and Z and what would be the impact of a successful attack?"199 It has already been noted that this is not a helpful way of looking at risk and that the Chair's preferred approach is to consider "material risk". In other parts of the document, the question is posed somewhat differently, "Consider the likelihood of a successful attack'7200 and "the likelihood of a successful attack should be considered for different threat scenarios explicitly taking into account existing security measures. "201 The fundamental point is that the document should be clear and unambiguous. There is nothing in it that clearly and unambiguously states that the risks of terrorism should be assessed differently from other risks or sets out how likelihood should be measured.

114. Colonel Latham was also to say that the risk assessment should be compiled by somebody with:

"the necessary knowledge and experience to conduct robust risk assessments and [who] can defend those risk assessments and, if that isn't the case, then the organisation should seek expert advice or should

198 15/128/1-7 199 INQ032108/13 200 INQ032108/ll 201 INQ032108/13 at 4.2.1 (b) 41

INQ039377/41 INQ039377_0041 seek appropriate training to put them in a position where they can conduct an effective and robust risk assessment. "202

115. There are a number of difficulties with Colonel Latham's evidence: it is not clear whether terrorism can or should fit within a standard risk assessment; no one has provided an example of a suitable risk assessment; there is no evidence of any available training on the topic of risk assessments in 2017 or where such training or advice would be found.

Appendix B (Chapter 5, Training: see the summary at §§47-69 above)

The Green Guide 116. The 6th edition of the Green Guide ("Guide to Safety at Sports Grounds")203 that came into force in 2018 after the Arena attack contains very limited references to terrorism. From the presentations that preceded publication, which set out the key changes and highlights by chapter, 204 it is clear that prior to this edition there had been little or no reference to terrorism at all.

117. Of the thirty slides in the presentation, 205 only four slides deal with counter­ terrorism and then only briefly: p 6 contains an "Overview''; p 8 sets out nine "New themes", of which one is "CT overlay"; on p11 under the heading "Management - responsibility and planning for safety" twelve topics are listed including CT advice and at p12 "Management" four topics are listed with counter-terrorism being dealt with as a subset of one of those topics, "Training".

118. There is also a longer presentation of fifty-three slides. 206 The Manchester Arena attack is specifically mentioned at p 8. At p9 the counter-terrorism issues are highlighted in red because they are new. In addition to the slides covered in the other presentation referred to above, there are also references to a counter-terrorism plan at p 19 and to a counter-terrorism and security overlay

202 15/122/23-123/5 203 INQ038803 204 INQ038802/2 205 INQ038802 206 INQ038804 42

INQ039377/42 INQ039377_0042 on p 20, which mentions the "need for security overlays not to compromise spectator safety" (picking up comment in NaCTSO guidance).

119. The new Guide, which runs to 316 pages, 207 itself summarises the differences briefly and mainly in context of egress and evacuation. 208

The Purple Guide 120. Nine extracts of the Purple Guide to Health & Safety at Events comprising 2018 amendments to the previous edition have been disclosed on Magnum. 209 Notwithstanding the fact that these amendments were made following the Arena bombing, there are very few references to terrorism. The sixteen page section entitled "Crowd Management'210 contains a single reference, under the heading "Legislation and Guidance", to NaCTSO's "Counter-Terrorism Protective Security Advice for Major Events". 211 Thereafter, in this section there is a reference under the heading "Show Stop" to internal and external threats to life; of the three external threats two are listed as "bomb threat" and "chemical incident". 212

121. It may be of significance that this part of the Purple Guide does not list counter­ terrorism as any part of a crowd management steward's duties. 213 Further, the training and qualifications referred to do not include specific counter-terrorism training, 214 nor does the risk of terrorism feature as one of the suggested matters to be considered for a risk assessment.215

122. Again, the thirty-five page section entitled "Contingency and Emergency Planning" contains very limited references to terrorism. 216 A continuing threat from terrorism is identified along with threats from cybercrime and the

207 INQ038802/6 208 INQ038803/285 209 INQ020210 - INQ020219 210 INQ020211 211 INQ020211/2 212 INQ020211/11 at 13. 73 - 13. 74 213 INQ020211/13 at 13.90 214 INQ020211/13 at 13.92 215 INQ020211/14 at 13.94-13.95 216 INQ020219

43

INQ039377/43 INQ039377_0043 weather; 217 under the heading "Business Continuity" terrorism is mentioned in the context of how a business can survive the disruption caused by a terrorist attack; 218 a reference is included to NaCTSO guidance. 219

123. The section states that it may be necessary to review security measures, for example by increasing the level of searching, in the event of an increased threat of terrorist activity at a particular venue, whether resulting from a specific threat to the event, general threats or incidents elsewhere; if the threat level changes so should the response; both the threat and response levels are set out in this section. 220 The section then refers the reader to the guidance and advice provided by NaCTSO and CPNI and on the ground by CTSAs. It is recommended all staff have counter-terrorism training on annual basis. 221 Project Griffin is mentioned in the context of the vetting of staff. 222 Mitigation measures must not increase risk with more likelihood and impact and, therefore, should not increase crowd crush risk, decrease evacuation times or increase a crowd situation due to counter-terrorism measures. 223

Level 2 NVQ Certificate in Spectator Safety 124. This is the nationally recognised qualification that allows a steward to work at a sporting event or venue as many Showsec stewards do. The material underlying the qualification is set out as exhibit MH/1 to Mark Harding's last statement.224 It is notable that there is no element of counter-terrorism training even though a steward could be working at iconic sporting venues, which have capacities in the tens of thousands. Therefore, in terms of counter-terrorism, Showsec's stewards who had to complete Showsec's CTE module before they could start work would have been far better trained than if they had simply completed the NVQ (which a steward would have 12 months to complete).

217 INQ020219/2 218 INQ020219/4 219 INQ020219/9 220 INQ020219/10 221 INQ020219/10 222 INQ020219/l 7 223 INQ020219/26 224 INQ035987/12 - 22 44

INQ039377/44 INQ039377_0044 The SIA Door Supervisor Course 125. Tony Holyland dealt with the SIA Door Supervisor Course in general terms. 225 Mark Harding has produced an example of SIA training from the relevant period. 226 Of the 550 slides that are utilised during the course, which lasts a week, counter-terrorism is dealt with in only seventeen, some of which are duplicates. This particular example of an accredited course was provided by Highfield Training who are highly regarded and provide the current ACT Awareness course.

126. The training is designed for those who wish to be SIA licence holders who carry out security functions. Therefore, one would expect perhaps more detailed and extensive counter-terrorism training than that undertaken by a steward. In fact, there is nothing in these slides that is not dealt with in Showsec's CTE module.

127. As with Showsec's training the key messages in the SIA training are the importance of vigilance and upward reporting. 227 Whereas Showsec's CTE module contained links to Fairway and Eyes Wide Open, 228 this SIA module includes references to Griffin, Argus and Fairway. 229

NaCTSO Guidance 128. Two pieces of NaCTSO guidance have featured heavily in the evidence, NaCTSO Guidance for Bars, Pubs and Nightclubs230 and NaCTSO Guidance for Arenas and Stadia. 231 Showsec does not repeat here what it has already submitted on the topic of risk assessments and how they are dealt with in these documents. In this section it is intended to demonstrate that Showsec did follow the guidance appropriately in the training it gave to its staff.

225 INQ029576/14-16 §§ 38-39 226 INQ035987/26 - 43 227 INQ035987/30, 31, 32 228 INQ012048/l, 14 229 INQ035987/39 230INQ032115 231 INQ020147

45

INQ039377/45 INQ039377_0045 129. The Arenas Guidance contains the following:

"It is accepted that there is no such concept as absolute safety or absolute security in combating the threat of terrorism but it is possible through the use of this guidance to reduce the risk to as low as reasonably possible"232

"Hilsborough ... taught us a critical lesson. Safety must always have

priority over security. "233

"Remember, TERRORISM IS A CRIME. Many of the security precautions typically used to deter criminals are also effective against terrorists"234

130. Both documents stress the importance of vigilance and reporting. 'The vigilance of your staff (including stewards, cleaning, maintenance and event day staff) is essential to your protective measures. "235 Staff must have confidence to report suspicions, knowing that reports, even false alarms, are taken seriously. Training is stated to be particularly important. 236

131. In the Bars and Clubs Guidance, the role of Door Supervisors, which in the context of the Arena means SIA licensed staff, is set out pp 33 - 34. Again, the touchstone is vigilance and upward reporting to Head Door Supervisor who will then risk assess the appropriate response.

132. Both the Bars and Clubs and Arenas and Stadia Guidance contained more written material on the issue of hostile reconnaissance than Showsec's CTE module. 237 However, Showsec's module covered all the same material by embedding links to both Eyes Wide Open and Operation Fairway.

232 INQ020147/7 233 INQ020147/8 234 INQ020147/11 235 INQ020147/15, INQ032115/17 236 INQ020147/16, INQ032115/17 237 INQ020147/49-51, INQ032511/47-49, INQ012048/l, 14 46

INQ039377/46 INQ039377_0046 133. In light of the security experts' criticisms of the amount of space given to Chemical, Biological and Radiological (CBR) attacks in Showsec's training, it is worth considering the emphasis given to the various methods of attack in the Guidance. PBI ED or suicide attacks are given a page in each document. 238 By way of contrast, CBR attacks take up three and four pages respectively in the Guidance. 239 Similarly, information security also takes up four times as much space as PBIEDs. 240 It is notable that in dealing with PBIEDs the first three bullet points deal with vehicles and preventing vehicle access. The page, which was transposed to Showsec's CTE module, concludes with the words, 'There is no definitive physical profile for a suicide bomber, so remain vigilant and report anyone suspicious to the police."

Griffin 134. Showsec staff attended Griffin training241 and in some cases on more than one occasion depending on who was organising it. Casual staff did not attend the training but those who had a supervisory role did. Showsec submits that the level of detail in the Griffin presentations was in excess of what was required for someone performing a stewarding function.

135. Various Griffin presentations have been disclosed on Magnum.242 In April 2017243 the training comprised an introduction to counter terrorism; the current threat; identifying and responding to suspicious behaviour; identifying and dealing with bombs (IED) and suspicious items; bomb threats; responding to a firearms and weapons attack; document awareness; finally, drones.

136. Of particular relevance are the slides dealing with how to respond to suspicious behaviour, which advise the participant of the importance of reporting suspicious behaviour at the earliest opportunity and what information the police

238 INQ020147/45, INQ032115/39 239 INQ020147/25-27, INQ032115/23-26 240 INQ020147/37-40, INQ032115/42-45 241 See for example INQ001524 242 INQ037069, INQ037070, INQ037074 243 INQ037074/5 47

INQ039377/47 INQ039377_0047 are likely to require; 244 the playing of the Eyes Wide Open video245; the identification of PBI ED as a method of attack. 246

Argus 137. Although Argus training dealt with issues such as hostile reconnaissance the main focus of the training was what to do in the event of an attack taking place. 247

ACT Awareness 138. In assessing the adequacy of Showsec's CTE module it is worth considering the current ACT Awareness course, which of course post-dates the attacks that took place in 2017 and which is produced by those who are professional security experts.

139. There are currently two types of ACT training: that which can be taken by individuals on their own and that which can be taken through an organisation or company. Each takes no more than forty-five minutes to complete. At the conclusion of the course, the participant can download a certificate to prove that they have completed it. In general terms, Showsec submits there is little difference between its CTE module and the ACT course, although of course the ACT Awareness course looks considerably more professional.

140. By way of summary and comparison with Showsec's CTE module, Module 1 of the ACT course that can be taken by individuals contains an "Introduction to Terrorism", which introduces the concepts of Selection, Planning, Training, Attack and Exploit; know the threat level; and, ACT equals Action Counters Terrorism. In order to progress the module finishes with two very simple questions: What is the most attractive target? What does ACT stand for?

141. In module 2 there is a section on identifying security vulnerabilities including, "How confident are you that you could identify vulnerabilities at work?" A

244 INQ037074/31, 35, 36, 37 245 INQ037074/33 246 INQ037074/50, 57, 58 247See for example INQ035527

48

INQ039377/48 INQ039377_0048 number of scenarios are shown including an unattended bag, insecure work items, a suspicious person walking past an unlocked computer and a fire extinguisher being used to prop open a door. Part of the module shows a receptionist failing to challenge a visitor or asking another visitor to remove their crash helmet. There is a single question to complete the module: "What might be best way to challenge someone?", the answer to which is "May I help you?"

142. Module 3 deals with hostile reconnaissance. Basic definitions of hostile person and hostile reconnaissance are given with descriptions of motive. The course participant drags various descriptions into boxes marked "hostile" and "hostile reconnaissance". Sources of hostile reconnaissance are set out including online maps. The concept of See Check Notify (SCAN) is introduced. Examples are given of identifying suspicious behaviour such as people trying to remain out of view, taking covert photos, attempting to gain entry to restricted area or, concealing objects on themselves. Two hotel based scenarios are shown, the first of which involves a hotel guest reporting something to a receptionist, the second of which involves the receptionist noticing something. The participant is given a choice of what information to include in a report. Wrong choices include what was the weather like and how the incident made the participant feel. The concept of "Deny, Detect, Deter" is introduced and there are links to the CPNI website and Eyes Wide Open. There are three very simple questions to finish: "What are 3 Ds? What does suspicious behaviour aka hostile reconnaissance refer to?" (This is potentially open to criticism for conflating the concepts of suspicious behaviour and hostile reconnaissance.) "How can you detect suspicious behaviour/hostile reconnaissance?" A number of answers are given and the actual answer is, "All the above".

143. Module 4 deals with how to identify and deal with a suspicious item and introduces the HOT principles. Another video scenario is shown involving a train station. The need to act immediately is stressed. The 4 Cs are set out: "Confirm, Clear, Communicate, Control." There is one question at the conclusion of the module: "What are the four Cs?"

49

INQ039377/49 INQ039377_0049 144. Module 5 deals with the Run Hide Tell (RHT) concept in the context of a firearms and weapons attack. An eyewitness account of Tunisia beach shooting is included. Again the module concludes with two very simple questions: "When hiding during gun attack what is one action you should take? When should you use RHT?" It should be noted that RHT replaced See, Tell, Act. Therefore, as at the time of the bombing, both the NaCTSO guidance on Pubs and Clubs and on Arenas and Stadia were out of date referring as they did to See, Tell, Act. In contrast, Showsec's CTE module dealt with RHT. 248 It was not until after the attack that NaCTSO's Crowded Places Guidance, which came out in June 2017, referred to RHT.249

145. Module 6 contained a summary and supporting materials. There is a link to Eyes Wide Open. The course undertaken by Mark Harding contained an additional module, "What to do in the event of a bomb threat. "250

146. It is notable that in this version of the course there was no mention of PBIED. This is not a criticism. It simply demonstrates that there may be more than one way of presenting and explaining important information to a general audience. In the event of some future attack, it will be possible to unpick the ACT Awareness training for flaws and/or missing material. Whether that would be a fair and balanced approach is another matter.

BTP 147. The Inquiry has heard little of BTP's counter-terrorism training. However, it comprised only two days of a twenty-week course251 and a further interactive course that does not appear to have been mandatory.252

2481NQ012048/10 2491NQ019231/60 250 INQ035987/6 § 21 and see INQ037072 251 36/44/18-24 252 36/46/24-47/22 50

INQ039377/50 INQ039377_0050