How does MI5 track terror suspects and what is a 'subject of interest'?
Monday 3 February 2020 12:53, UK
Following terror attacks in the UK, MI5 will often state whether the suspected attacker was an active subject of interest to its investigative teams or if they were completely unknown to the agency.
While the full range of techniques it uses to track these people are necessarily secret, a number of successful attacks have exposed the agency's processes to outside scrutiny.
The following details are based on public information contained in reports into successful terror attacks, and an interview with a former MI5 surveillance officer.
As soon as the agency receives new intelligence a formal process is kicked off to triage that information and figure out what kind of priority the potential threat needs to receive.
The rise in the threat from Islamist terrorism in particular forced the agency to adopt this process in 2011.
The first thing that happens to this new intelligence is it is tested for links to existing investigations. If these links are found then it is forwarded to the team handling that investigation.
However, if there isn't a team at the agency currently looking into the threat which the intelligence suggests, then it goes through an assessment process.
If the material covers something which poses a sufficient risk to national security, if it is credible enough, and if there is a clear way forward to act based on what it says, then a new investigation may be launched.
Once a new investigation is launched then something called a "trace" is requested. This is a check across all of MI5's databases to figure out whether the agency holds any relevant information on the topic or the person being investigated.
A liaison trace could also be issued, a similar check but to or from a partner organisation - such as a foreign intelligence service - to determine if anything relevant is held in their databases.
Once an investigation is opened, it is given a priority rating according to the risk it carries:
Priority 1: Attack planning investigations are the most urgent investigations into individuals or networks where there is a credible and actionable bit of intelligence into an attack which is being planned.
Priority 2: Extremist activity covers a wider range of activities, including the intention to travel overseas to fight with an extremist group through to raising money for terror activities.
Priority 3: Uncorroborated intelligence investigations are lower down still, these require even more investigation to determine whether the potential terrorists pose a threat.
Priority 4: Re-engagement risk investigations are the lowest level investigations. These are usually into individuals who were previously known to pose a serious threat to national security but are judged to no longer be involved in those activities, for instance after being released from prison.
MI5 handles around 3,000 active subjects of interest (SOIs) at any one time, and the investigations into these people are given a priority rating.
The agency also holds roughly 20,000 files on so-called "closed SOIs" who have previously been investigated but are no longer considered to pose a threat.
The SOIs which MI5 is investigating are given priorities through the allocation of 'tiers' which can change through the course of an investigation:
Tier 1: Main targets of an investigation
Tier 2: The key contacts of the main targets
Tier 3: Contact of Tier 1 and Tier 2 targets
When an individual is described as an "active subject of interest" it is not always clear what tier they were allocated.
Sudesh Amman, the Streatham attacker, had recently been released from prison as had the 2019 London Bridge terror attacker Usman Khan, and Khuram Butt, one of the London Bridge attackers in 2017.
Khalid Masood, the Westminster Bridge attacker, and Salman Abedi, who detonated a bomb at Manchester Arena, were both considered closed subjects of interest by the police and MI5.
The two other London Bridge attackers in 2017 were not known to the authorities.
A former MI5 surveillance officer who was interviewed by Sky's defence and security correspondent Alistair Bunkall explained what these activities entailed. "If we'd been briefed on a target that we needed information from, we'd go and hunt them," he said.
"We'd go and find everything we can about them, we'd watch everything they do. Essentially, as soon they come onto our grid and we need to know all information about them, our surveillance teams, myself included, would go out there and find them and make sure we control everything they do."
On one operation, the operative was nearly kidnapped by the terrorists he was tracking: "This was something we'd never, ever seen before on UK soil, and it came very, very close to them putting me into a van and taking me to an address that we later searched with Special Branch, where they found plastic sheeting on the ground and a video camera and the flag and the butcher's knife. It was really down to the wire."
On another occasion, the surveillance officer was part of an MI5 team tracking a suspected Islamist terrorist. He sat outside a London mosque during evening prayers.
He said: "It was chucking it down and I was dressed as a tramp, pretending to ask for change, my own clothes soaked in my own urine to compliment that cover.
"There were more women worshippers that had left the mosque than had gone in, so I alerted the team that there was a possibility he had changed his appearance."
The suspect had changed into a burka and was pretending to be a woman. Following him, the MI5 team called in a Special Forces unit to arrest the terrorist. Two Range Rovers slammed into the suspect's car.
"As the team came in incredibly quick in the Range Rovers (and) dragged him out of the car, they found weapons and pipe bombs in the boot and his planned target was the very next day because this was all at night.
"To be waiting for a couple of coach loads of children returning from a trip to France and he was going to kill them, the teachers and the parents."