Counterterrorism in the United Kingdom Module III: The UK’s Counterterrorism Structure and the Pursuit of Terrorists
PAUL JONATHAN SMITH CENTER FOR HOMELAND DEFENSE AND SECURITY DEPT. OF NATIONAL SECURITY AFFAIRS NAVAL POSTGRADUATE SCHOOL
Slide 1 Opening Credits
Music
Slide 2 Counterterrorism in the UK: Module III: Counterterrorism Structure and the Pursuit of Terrorists
By Paul Jonathan Smith
Slide 3 Domestic Counterterrorism Structure
PURSUE is the fourth and final strand of CONTEST, the UK’s national counterterrorism policy.
The British domestic counterterrorism structure is comprised of four elements:
1. The British Security Service (MI5): MI5 is the UK’s domestic security agency, which coordinates the collection and assessment of all UK domestic counterterrorism intelligence.
2. The Special Branches in each UK police force: These officers work in close cooperation with MI5 to collect counterterrorism intelligence within their local force area.
3. The Metropolitan Police Service Counter Terrorism Command: This unit, based in New Scotland Yard, coordinates the national police response to counterterrorism intelligence and supervises the collection of evidence for charging suspected terrorists.
4. The Crown Prosecution Service: This is the legal branch of experienced lawyers, called barristers, which receives counterterrorism evidence from police and represents the Crown in the prosecution of terrorists. Most counterterrorism cases are tried at the Central Criminal Court, commonly known as Old Bailey, in London.
This structure relies on a clear understanding of each organisation’s role, a well-rehearsed interagency system that facilitates the appropriate handling of counterterrorism intelligence to generate compelling evidence, and a legal system that delivers successful convictions and protects sensitive operational sources and techniques, without losing “the hearts and minds” of the Muslim population.
Of course, operational tensions can occur at the personal level during an investigation, but the respective organisations recognise that success relies on interdependency.
Slide 4 Inter Agency Cooperation
The importance of interagency cooperation is continually affirmed. According to Jonathan Evans, Director General of MI5, “The Security Service has many partners. But none is more crucial than the police. The police collect intelligence beside us, help convert it into evidence for court, and face the dangers of arresting individuals who have no concern for their own lives or the lives of others. The term “partnership” is often misused, but UK counterterrorism in the 21st Century is a true partnership between the Security Service and the police. It is only by the two organisations working seamlessly together that we can truly be effective in the fight against terrorism.”
Slide 5 The British Secret Service
MI5 is the UK’s domestic security service, as opposed to the Secret Intelligence Service (MI6), which is the UK’s overseas intelligence collection organisation.
MI5 was established in 1909. The Security Service has a long history of counterespionage experience, which includes the threat from Germany before World War I, Communism in the 1920-30’s, Germany again during World War II, and Communism once more throughout the Cold War.
MI5’s counterterrorism experience began in 1972, when the Security Service assumed responsibility for countering Provisional Irish Republican Army (PIRA) activity in Europe. This expanded in 1991 when, following a PIRA mortar attack on No. 10 Downing Street, MI5 accepted lead responsibility for collecting counterterrorism intelligence against the PIRA on the UK mainland. The Royal Ulster Constabulary retained that responsibility within Northern Ireland until October 10, 2007, when it was transferred to MI5.
MI5 officers have no powers of arrest. This means every counterterrorism case must involve the police if executive action is to be taken. In addition, MI5 officers are not armed, with the exception of a small number of officers who are armed for self-protection during operations in Northern Ireland.
Slide 6 The Role of the Security Service
The role of MI5 is defined in UK law. According to the Security Service Act 1989, “The function of the Service shall be the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means. It shall also be the function of the Service to safeguard the economic well-being of the United Kingdom against threats posed by the actions or intentions of persons outside the British Islands. It shall also be the function of the Service to act in support of the activities of police forces, the National Criminal Intelligence Service, the National Crime Squad and other law enforcement agencies in the prevention and detection of serious crime.”
The AQ attacks in London on 7/7 2005 resulted in the Security Service concentrating its resources against the threat from International Terrorism. Consequently, whilst it retains the legal right to do so, currently the Security Service does not actively investigate serious crime in the UK. That function is now carried out by the Serious and Organised Crime Agency (SOCA), which was formed in 2006 from the amalgamation of the National Criminal Intelligence Service, the National Crime Squad - both mentioned in the Security Service Act of 1989 - and the investigative elements of Her Majesty's Customs and Excise. There are close links between the Security Service and SOCA and intelligence and cases are regularly passed between the two - depending on whether terrorism or simply serious crime is the motivation of the suspects being investigated.
While the role of MI5, as described by the Security Service Act is extensive, the objectives of MI5 are specific. Consequently the Service is organised according to function:
• Counterterrorism: To frustrate terrorism – both International and Irish Republican. The latter remains a significant problem in Northern Ireland, as small dissident Republican groups have rejected the Peace Process and have continued the terrorist campaign.
• Counterintelligence: To prevent foreign intelligence operations in the UK.
• Counterproliferation: To frustrate procurement by depriving countries of WMD materials, technology, or expertise.
• Protective Security: To protect the confidentiality, integrity, and availability of Government information and assets, as well as the effective operation of Critical National Infrastructure.
Countersubversion: To identify and counter new or emerging threats from the extreme Right or Left.
Slide 7 How Does MI5 Operate?
MI5 operates in a unique fashion, known as the “Desk Officer System,” which includes collecting and disseminating intelligence, investigating and assessing threats, working with others to counter threats, and advising on protection.
The Desk Officer is responsible for the investigation of a single target or a group of targets and works in teams alongside other officers responsible for related targets. Consequently, MI5 consists of a series of teams looking at a variety of counterterrorism, counterintelligence, counterproliferation, and countersubversive targets. All utilise the same approach.
All sources, including MI5, the police, and the UK intelligence community, send all available intelligence concerning a particular target to the designated Desk Officer. He becomes the expert on that target and can therefore best determine the threat it represents.
The Desk Officer clearly identifies intelligence gaps and can request source-handling, surveillance, interception, eavesdropping, data exploitation, and liaison operations to improve the intelligence coverage of his target. MI5 management determines the allocation of these resources based on threat. The Desk Officer is an “aggressive investigator”, rather than an analyst.
Once assigned by the Desk Officer, specialist MI5 officers carry out source-handling, surveillance, interception, and eavesdropping operations. Intelligence generated during such operations is then relayed to the Desk. The Desk Officer also remains in constant contact with the Special Branch police officer in the area where the target resides, and their partnership progresses the investigation.
If the investigation reveals a terrorist threat to life or property, MI5 management alerts Counter Terrorism Command, and if necessary, a full covert 24/7 operation is mounted. The Desk Officer then becomes a key member of the Forward Intelligence Cell, where he monitors and assesses all incoming intelligence.
When arrests are made, the Desk Officer provides critical tactical advice to the police Firearms Teams. He also provides interview advice to the police, who will question the suspects in custody, and further assesses recovered intelligence to identify additional threats.
The Desk Officer then develops any remaining intelligence leads following the operation.
Slide 8 MI5 Response to 9/11 and 7/7
The development of a significant Al-Qaeda threat in the UK is a major challenge for MI5. The Security Service response is multi-faceted and has thus far included:
• Recruiting HUMINT sources across the target communities; • Rapidly increasing the size of the Service from 2,500 to 4,000. By 2011, MI5 was twice the size it was in 2001. Currently, 55% of staff members are under age 40, and about 50% are women; • Embedding Secret Intelligence Service and Government Communication Headquarters officers in all of MI5’s International Terrorism teams; • Opening 8 Regional Offices, which provide immediate support to the local Special Branches in the Region; • Opening an operating base near Manchester, so surveillance and technical teams are closer to target areas and can respond to threats more quickly; and Developing close counterterrorism liaison relationships with international partners through the Secret Intelligence Service – particularly with the US intelligence community.
Slide 9 Special Branches within UK Police
The Special Branches are MI5’s domestic partners in collecting national security intelligence. There are 56 police forces in the UK, and each is mandated by the Home Office to maintain a Special Branch (SB). Directed by MI5, SB officers gather intelligence in support of national security investigations and are granted security vetting up to the Top Secret level to ensure their complete participation. Officers receive significant counterterrorism training from MI5. In addition, SB officers are positioned at all major airports and sea ports in the UK to facilitate national security related operations in those locations.
Slide 10 Contribution of the Special Branches
The Special Branches are indispensable to the UK counterterrorism effort. They provide:
• Local policing expertise with personal knowledge of the area to assist MI5 investigations and operations;
• A conduit to a local network of HUMINT sources, both in the target community and amongst the population at large, who can report possible terrorist activity;
• A conduit to the rest of the local police force, including Fraud Squads, Vice Squads, and Stolen Vehicle Squads, which may discover counterterrorism leads in the course of their normal policing duties; and
• Local contingency counterterrorism planning in the event that a local threat becomes serious enough to require a major covert counterterrorism operation in the police force area.
There are presently around 6000 Special Branch policemen in the UK.
Slide 11 Metropolitan Police Service CTC
Another element of PURSUE is the Metropolitan Police Service Counter Terrorism Command (CTC). London’s Special Branch and the Anti Terrorist Branch were consolidated under this one Command on October 2, 2006. The new CTC combined intelligence analysis and development, previously functions of the Special Branch, with counterterrorism investigative and operational support activity, formerly conducted by the Anti Terrorist Branch.
In addition, CTC is responsible for collecting evidence in a counterterrorism investigation. Officers carry out crime scene examinations after an attack, conduct subsequent interviews with suspects, and search suspects’ property for physical evidence. Over the last 30 years, they have become experts in counterterrorism investigation at home and overseas.
CTC is also known as SO15, an internal Metropolitan Police Service (MPS) designation, reflecting the fact that it is one of a number of Specialist Operations branches within the MPS.
Slide 12 The Role of CTC
As listed on the Metropolitan Police Service website, CTC responsibilities include:
1. Bringing justice to those engaged in terrorist, domestic extremist and related offences.
2. Providing a proactive and reactive response to terrorist offences.
3. Supporting the National Co-ordinator of Terrorist Investigations outside London.
4. Gathering and exploiting intelligence on terrorism and extremism in London.
5. Assessing, analysing and developing intelligence to drive operational activity.
6. Engaging in partnerships with London’s communities, in order to understand their concerns and to provide reassurance and support where needed.
7. Providing specialist security advice and services internally and externally.
8. Providing an Explosive Ordinance Disposal (EOD) and Chemical, Biological, Radiological, and Nuclear (CBRN) capability in London.
9. Assisting the British Security Service and Secret Intelligence Service in fulfilling their roles.
10. Being the police’s single point of contact for international partners in counterterrorism. 11. Assisting in the protection of British interests overseas and the investigation of attacks against those interests.
To fulfill this role nationally, CTC now has four Regional Offices, which are collocated with MI5 Regional Offices and manned by CTC and local officers. The CTC Regional Offices provide immediate support to local forces in counterterrorism investigations.
Slide 13 The National Co-ordinator of Terrorist Investigations
The course of a successful counterterrorism investigation in the UK begins with MI5 and the Special Branches uncovering a plot while acquiring and assessing covert intelligence. They then consult the Metropolitan Police Counter Terrorism Command (CTC), which is led by a Deputy Assistant Commissioner. This officer is also appointed the National Co- ordinator of Terrorist Investigations. In this role he ensures appropriate operational coordination between the UK police forces involved and supervises the preparation of the evidential case against the suspects. Based on public threat or intelligence considerations, such as source protection, the National Co-ordinator determines if police executive action is required. If so, CTC and Crown Prosecution Service execute a successful arrest and subsequent prosecution, while MI5 and the Special Branches continue to gather intelligence revealed during the evidential investigation and court case. Depending on threat assessment, the duration of a major covert terrorist investigation may vary considerably. Some have lasted up to 6-8 weeks; others, just several days.
Slide 14 The Organization of a Major Covert Terrorist Investigation
Major covert terrorist investigations are organized according to three primary functions: Government Strategy, Operational Command, and Tactical Command.
Government Strategy is orchestrated at Cabinet Office Briefing Rooms (COBR), a government coordination facility activated during national emergencies or crises. COBR is chaired by the Home Secretary, or the Prime Minister in the event that there is a major terrorist threat. Meetings are attended by other Government Ministers, the National Co- ordinator, the MI5 Director General, and representatives of the UK intelligence community. The frequency of COBR meetings depends entirely on the operational situation, but they typically occur daily in the latter stages of an operation.
COBR is tasked with:
• Providing high-level interface between political, law enforcement, and intelligence community members during major counterterrorism investigations;
• Coordinating Government Strategy;
• Ensuring appropriate inter-ministry cooperation; and
• Briefing the Prime Minister on developing counterterrorism situations.
COBR dictates strategy, but does not command the operation in detail.
Operational Command is conducted by the Executive Liaison Group (ELG).
ELG is chaired by the National Co-ordinator, and meetings are attended by MI5 officers, responsible for briefing the group on the operation’s current intelligence situation and assessing possible developments; the CTC senior investigating officer, responsible for gathering evidence to charge suspects once arrested; and senior regional police force commanders, in whose area the operation is mounted. The frequency of ELG meetings depends on the pace of the investigation, but they may occur 2-3 times daily in the latter stages of a major operation.
ELG is tasked with:
• Providing operational command, thus dictating the investigation strategy;
• Ensuring appropriate coordination between intelligence and evidential interests;
• Delegating operational authority as necessary; and
• Considering community outreach and press related issues.
During a major covert investigation, MI5 also opens the Security Service Intelligence Operations Centre (SSIOC) for 24/7 operation in their headquarters, Thames House. SSIOC coordinates the collection, assessment, secure dissemination, exploitation, and tasking of all secret intelligence, from all sources, to appropriately brief COBR and ELG and to pass intelligence downward to the Joint Operational Team.
Tactical Command is conducted by the Joint Operational Team (JOT), deployed at the police headquarters of the force in whose area the operation is running.
JOT is chaired by the CTC Investigating Officer, responsible for ordering arrests, evidential interviews, and searches of suspects. The local police Special Branch manager directs the Counterterrorism Police Operations Room, which controls police and MI5 surveillance teams covering the terrorist suspects up until their arrest. The MI5 manager directs the Forward Intelligence Cell (FIC), which is staffed by MI5 Desk Officers and local Special Branch officers. FIC is collocated with the Counterterrorism Police Operations Room and receives all incoming intelligence from the SSIOC, while also monitoring the terrorists’ movements 24/7. FIC can therefore provide immediate intelligence assessment regarding threat development. Sensitive intelligence material received by FIC may be legally protected from subsequent disclosure in court. JOT meets formally at least twice daily; however, because the Counterterrorism Police Operations Room and Forward Intelligence Cell are open 24/7, there is continuous informal contact between JOT members.
JOT is tasked with:
• Delivering ELG strategy through police and MI5 operational resources; and
• Upon receiving delegated authority, initiating arrests if the situation suddenly deteriorates and an attack appears imminent.
This system is regularly exercised at all levels of government and with all police forces.
Slide 15 The Importance of Partnership (Again)
In addition to major covert terrorist investigations, continuous live operations are also conducted. However, the same system is effective. In a speech on April 24, 2007, Peter Clarke, Deputy Assistant Commissioner and National Co-ordinator of Terrorist Investigations, emphasized, “There can be no doubt that the most important change in counterterrorism in the United Kingdom in recent years has been the development of the relationship between the police and the Security Service. It is no exaggeration to say that the joint working between the police and MI5 has become recognised as a beacon of good practice. Colleagues from across the globe, in law enforcement and intelligence, look to the United Kingdom as a model and many of them are, quite frankly, envious.”
Even so, the UK is not complacent and fully expects future terrorist attacks, as many counterterrorism challenges remain:
• Government community outreach to reduce radicalisation, improvements in intelligence collection, the recruitment and training of new MI5 and police staff, and the development of “upstream” intelligence overseas will take too long to prevent further attacks.
• Al-Qaeda terrorists will become more professional and difficult to intercept due to publicity surrounding forthcoming counterterrorism prosecutions in UK courts.
• The decline in the world economy and strained relations between the West and Islamic populations will continue to generate domestic terrorism.
• The response of UK politicians, the press, and the public to more attacks may be less restrained and, consequently, could inflame the Islamic population and motivate additional terrorism.
Given these challenges, the principal question remains: Can MI5 and UK police successfully prevent Al-Qaeda terrorists from launching future attacks?
Slide 16 Closing Credits
Music