The Defence of the Realm

by Christopher Andrew

  She would be a first-rate choice to lead the Service over the next three years or so. She had immense credibility both in the Service and externally. She had the confidence and understanding of the issues facing the Service to lead it well. The Panel agreed to suggest that a three-year contract would keep open the possibility of appointing someone else with different skills at the end of that period if, for instance, a more strategic view of the Service’s role were needed at that stage.19

  The panel’s assessment of Manningham-Buller was well balanced. Her leadership qualities and intelligence judgement are generally regarded by those who know her, inside and outside the Service, as outstanding. She was not, however, an original strategic thinker. Manningham-Buller said of herself at the end of her period as DG: ‘I’m not myself a great generator of fantastic ideas, but I’m good at catching the mood of the moment.’20 When it became clear in 2003 that the threat from Al Qaida had been underestimated and that Britain was directly threatened by home-grown terrorists, Manningham-Buller caught the mood of the moment once again, abandoned any ambition of remaining Miss Continuity and opted decisively for change.21 At the end of her three-year term as DG, she was renewed for another two years.

  The first serious UK-based Islamist plot uncovered by the Security Service and the police during Manningham-Buller’s term as DG was a conspiracy by North African extremists to use lethal poisons – chiefly ricin.22 A trail of petty fraud and false identity documents led to the discovery at Thetford, in the heart of rural Norfolk, of recipes written in Arabic (beginning ‘In the Name of God the Merciful, the Compassionate’) for ricin and other poisons. That led in turn to the discovery on 5 January 2003 of castor-oil beans, the raw material for ricin, in north London at a house in Wood Green. During arrests in Manchester, Detective Constable Stephen Oake was stabbed to death by Kamel Bourgass, an Algerian Islamist. Bourgass was later sentenced to twenty-two years’ imprisonment for Oake’s murder and to seventeen years for conspiracy to create a public nuisance by use of poisons and explosives. But the available evidence was insufficient to prove the involvement of any other North African extremist in what became known as the ‘ricin plot’.23

  The first evidence of a major Islamist conspiracy to bomb British targets in the UK was uncovered as a result of Operation CREVICE, which began with the investigation in the spring of 2003 of a group based in London and Luton which was believed to be supplying money and equipment to Al Qaida fighters and affiliates in Pakistan and Afghanistan. Investigation revealed that most members of the network were second-generation British citizens of Pakistani origin. In the summer of 2003 some of the network travelled to Pakistan for weapons and explosives training. Following their return to Britain, intelligence accumulated that some members of the group had begun planning attacks in the UK – the first since 9/11 by British-based extremists linked to Al Qaida.24 One of the most important intelligence leads, Jonathan Evans recalls, was a tip-off from a member of the public.25 CREVICE became the largest counter-terrorist operation yet undertaken by either the Security Service or the police. In early February 2004 intelligence indicated that the network had become ‘operationally active’ and that a bomb attack was being prepared. For the next seven weeks the Security Service Emergency Room operated twenty-four hours a day and 34,000 hours of surveillance were logged.26 The CREVICE plotters were discovered to be planning attacks against nightclubs, pubs and shopping centres which were intended to cause mass casualties. All the key suspects were arrested at the end of March before they were ready to begin a bombing campaign.27 On 1 April, for the first time in Security Service history, the DG was invited to a meeting of the full cabinet, at which Tony Blair congratulated the Service on a ‘fantastic job’. The cabinet applauded.28 Though the CREVICE trial was delayed, five British Islamists were later sentenced to life imprisonment for terrorist offences.29

  The growing threat of Islamist terrorist attacks and the diffuse nature of intelligence on it persuaded Security Service top management during 2003 that continued expansion, though essential, was not sufficient. There must also be a step-change in the way that intelligence was collected and assessed.30 The decision was taken, for the first time since the RSLOs of the Second World War,31 to set up regional offices – initially at undisclosed locations in the Midlands, North-east, North-west, South, East and Scotland, later also in Wales and the South-east. As well as bringing the Service closer to the regional centres of extremist activity, the new offices also improved collaboration with local police forces. The Intelligence and Security Committee (ISC) later declared itself ‘impressed by the speed at which the regionalisation programme has been carried out and the clear benefits it has brought’.32 Changes in intelligence assessment were equally radical. In June 2003 the Joint Terrorism Analysis Centre (JTAC) was set up in Thames House as ‘the UK’s national centre for the assessment of international terrorism’, with representatives of around a dozen government departments and agencies concerned with various aspects of counter-terrorism.33 It was also responsible for issuing threat warnings and assessing the threat level, initially on a seven-point scale (later simplified) going from ‘Negligible’ to ‘Critical’ (attack ‘expected imminently’).34 In addition to collaborating closely with G Branch, the head of JTAC was accountable to the DG as well as to an oversight board of senior customers across Whitehall. The DG reported on it to the JIC. During its first nine months JTAC processed more than 25,000 items of intelligence and issued over 3,000 reports. Manningham-Buller reported that ‘Formal customer feedback shows high levels of satisfaction.’35 The ISC agreed. JTAC staff, however, sometimes complained that they were in danger of becoming a ‘tourist site’, with ministers from friendly countries around the world anxious to see for themselves how it functioned.

  One aspect of the step-change in counter-terrorism was the reorganization of protective security. In 2001 the Security Service had taken the lead role in founding the interdepartmental National Infrastructure Security Co-ordination Centre (NISCC), designed to give advice on protection against e-threats. Its early successes included timely warnings of the ‘I love you’ and ‘Kournikova’ viruses.36 The NISCC set up its own website and developed contacts among journalists and businesses, who were aware of its connection with the Security Service.37 The increase in the Islamist terrorist threat against British targets refocused attention on more traditional forms of protective security. In 2004 the Service set up the National Security Advice Centre (NSAC) to give advice on how ‘to reduce the risk of a terrorist attack, or to limit the damage terrorism might cause’.38 With information on the NSAC posted on the new Security Service website, inaugurated in April 2004, the aim was to ‘extend the provision of advice to new audiences outside the CNI [Critical National Infrastructure], including local government, small and medium-sized businesses and the general public’.39 The work of NISCC and NSAC, however, was inadequately co-ordinated. Both developed separate systems to deliver their information electronically to their users – despite the fact that the users were frequently the same.40 The problem was resolved in 2007 by merging the two organizations to form the interdepartmental Centre for the Protection of the National Infrastructure (CPNI), which used resources and expertise from a number of government departments and agencies. Its website declared: ‘Our advice aims to reduce the vulnerability of the national infrastructure to terrorism and other threats, keeping the UK’s essential services (delivered by the communications, emergency services, energy, finance, food, government, health, transport and water sectors) safer.’41

  Despite changes in the Service and mounting pressure of work, a Staff Opinion Survey in May 2003, conducted once again by an outside consultant, found morale even higher than three years earlier – probably due to strong belief in the Service’s role and its ability to make a difference.42 The main source of dissatisfaction was pay. Fifty-four per cent thought their pay compared unfavourably with that of the police and only 44 per cent (up 5 per cent since 2000) believed they received a
fair salary. Though not an issue inquired into by staff surveys, there was also minor irritation among some staff at the growing inroads made into the Service’s vocabulary by ephemeral jargon invented by Whitehall bureaucrats and management consultants with a tin ear for the English language and a passion for performance indicators. Irritation was reflected in the enthusiastic applause at a Service revue for a sketch on the appraisal interview of a wartime fighter ace, disappointed by his ‘overall box marking’:

  WING-COMMANDER ‘TIN-ARSE’ FROBISHER: Well, the thing is, Smedley, you’ve done jolly well on shooting down the Hun. In fact, you’ve exceeded your target by 953%. Trouble is, you have personal development needs.

  FLIGHT LIEUTENANT SMEDLEY: Personal development needs, Sir?

  WING-CO: Yes, Smedley. You have personal development needs in the areas of policy formation, project management and resource planning.

  SMEDLEY: But Sir, I’m a Spitfire pilot. Surely, my job is to shoot down Nazi bombers before they obliterate London?

  WING-CO: That’s all very well, Smedley, but we senior managers have to . . . consider broader issues.

  A similar theme was pursued in another sketch, when pirates of the Caribbean, despite record levels of stolen booty, complain that their careers are being blighted by the lack of‘a skills-based competency audit framework’.43 Such minor irritants had no significant influence on overall morale. A later report by ‘Investors in People’ found that ‘the Service is in a remarkable state of health, despite the pressures,’ ‘morale is very positive’ and ‘staff have a real passion for the work that they do.’44

  Operation RHYME in 2004 pre-empted an even more dangerous Islamist attack than Operation CREVICE. The chief plotter was a British Hindu convert to Islam, Dhiren Barot, who, the DG told staff, was ‘believed to have been personally selected and groomed for operational deployment by Khalid Sheikh Mohammed, the A[l] Q[aida] planner behind 9/11’.45 Among the plots devised by Barot was the ‘Gas Limos Project’, which aimed to explode three limousines crammed with gas cylinders, explosives and nails in London underground car parks. He wrote gleefully about another of his projects: to explode a bomb on a tube train travelling in a tunnel beneath the Thames: ‘Imagine the chaos that would be caused if a powerful explosion were to rip through here and actually rupture the river itself. This would cause pandemonium, what with the explosions, flooding, drowning, etc that would occur/result.’46 It was also Barot’s ambition to explode a radioactive ‘dirty bomb’, though he acknowledged that ‘for the time being we do not have the contacts that would allow us to purchase such items.’47 In the summer of 2004 Operation RHYME faced the Security Service and the police with an acute form of a familiar counter-terrorist dilemma. Further surveillance and investigation seemed to be required in order to gather the material for a successful prosecution. Delay in disrupting the plot, however, might give Barot and his accomplices time to mount an attack. It was therefore decided to arrest Barot on 3 August. Peter Clarke wrote later:

  It is no exaggeration to say that at the time of the arrest there was not one shred of admissible evidence against Barot . . . I know that some in the media were sharpening their pencils, and that if we had been unable to bring charges in that case, there would have been a wave of criticism . . .48

  The massive surveillance before the arrest and the complex hunt for evidence afterwards made RHYME the most labour-intensive CT operation so far in the history of both the Security Service and Scotland Yard. More than 300 computers and 1,800 discs, CDs, zip drives and hard drives, many encrypted, had to be examined and the information on them decrypted. Police officers also found more than 600 sets of keys and spent fourteen months visiting over 4,000 garages and lock-ups, trying to match them up and succeeding in only seventy-seven cases. The hunt continued for so long for fear that one of the premises might contain explosives or even radioactive material.49 The end-result was to gather so much evidence that Barot became the first Islamist terrorist in Britain to plead guilty to conspiracy to murder. At his trial two years after his arrest, evidence was produced that he had planned attacks against high-profile US as well as UK targets. It included film of the New York World Trade Center taken by Barot before 9/11 with a commentary including a voice imitating an explosion. Though Barot was a protégé of the chief planner of 9/11, Khalid Sheikh Mohammed, he is highly unlikely to have had advance knowledge of the attacks on the twin towers. His film was, as the prosecution put it, more in the nature of a ‘macabre prophecy’.50 Barot was given a life sentence with a minimum term of forty years (reduced to thirty on appeal). At a separate trial seven of his co-conspirators also received lengthy prison terms.

  For almost four years after 9/11 the only successful Islamist attacks against British targets took place outside the United Kingdom, notably a car-bomb attack in Istanbul on the British consulate and the HSBC Bank in November 2003. British citizens were also among those killed in the bombing of Bali nightclubs in October 2002 and of Madrid commuter trains in March 2004. The Service knew, however, that sooner or later an attack in the UK was bound to succeed. Manningham-Buller warned in the summer of 2004:

  There are worrying developments in the radicalisation of some young British Muslims. Action collectively and internationally has prevented or deterred some [terrorist] attacks. But it can only be a matter of time before something on a serious scale occurs in the UK.

  . . . It remains the case that we do not know nearly enough about Islamist extremists in the UK, their whereabouts, networks and activities, to give confidence that terrorist attacks in planning in the UK can usually be disrupted.51

  The bombings of three Underground trains and one London bus by four suicide bombers on the morning of Thursday 7 July 2005, with the loss of fifty-two other lives, were the first successful Islamist attacks in the UK. Jonathan Evans, who had become DDG in February, recalls that it had been ‘a quiet and routine week’, memorable only for the unexpected announcement on the Wednesday that London was to host the 2012 Olympics. Though he received the news of the first of the explosions at 9.20 a.m. on 7 July, it was not until after 10 a.m. that the evidence pointed to a series of terrorist attacks. Evans remembers the day as a classic example of ‘the fog of war’, with senior officers watching television to discover what was going on. By lunchtime, with tube carriages still trapped in Underground tunnels, Evans feared that the casualties might rise as high as the 191 deaths caused by Islamist attacks on crowded commuter trains in Madrid in February 2004. Initially, there was only one possible lead to go on. An email in Arabic received from North Africa a few days earlier, but only just translated, offered to provide information on plans for an attack in London in return for a visa to the UK. The sender of the email later agreed to a meeting in North Africa but failed to turn up. Convincing evidence quickly emerged that he was a fraud.52

  Though no member of Security Service staff was killed or injured on 7 July, a majority had come to work by Underground or bus, and phoned anxious relatives to say that they were safe. For a time the Thames House phone system was in danger of being swamped. The impact of 7/7, as it came to be called, was thus direct and personal. One member of the Board recalls that even fellow intelligence agencies ‘did not understand just how deeply the Service felt about the July attacks, the shock, anxiety, and deep need to ensure it didn’t happen again’.53 In the immediate aftermath of the attacks, the Service was bound to ask itself whether there was more it could have done or whether warning intelligence had been overlooked. In May investigations of several Islamist groups (not including the 7/7 suicide bombers) had concluded that none of them was planning an attack. JTAC had reported, ‘We judge at present there is not a group with both the current intent and the capability to attack the UK,’ and took the decision to reduce the UK threat level from ‘Severe General’ to ‘Substantial’. Alert levels, however, were not affected.54(1)

  The DG told staff meetings in the Thames House restaurant on 8 July: ‘What happened on Thursday [7 July] is what we’ve
feared, been warning about and have worked so hard to prevent. We were shocked by the horror but, while we had no intelligence that could have prevented it, not surprised.’55 The Home Secretary, Charles Clarke, visited Thames House at midday and seemed impressed by the early stages of Operation STEPFORD, the Service’s investigation into the 7/7 attacks. After meetings with ministers, Manningham-Buller told her senior colleagues that evening that Blair and Clarke were ‘onside, not keen on knee-jerk responses, not witchhunting and keen to let the Police and MI5 get on with the job’.56 During STEPFORD the Service discovered that it had previously encountered two of the suicide bombers, thirty-year-old Mohammed Siddique Khan, the leading plotter, and twenty-two-year-old Shehzad Tanweer, on the periphery of its investigation into Operation CREVICE. Both were British Islamists of Pakistani origin, born and brought up in the UK. The Service also discovered that it had on record a telephone number which, after (but not before) the attacks, it was able to identify as that of a third suicide bomber, Jermaine Lindsay, a nineteen-year-old Jamaican-born British convert to Islam. There was no trace in Service records of the youngest suicide bomber, eighteen-year-old Hasib Hussein, like Khan and Tanweer a British Islamist of Pakistani origin.57

  The first evidence of Mohammed Siddique Khan’s involvement was discovered on 9 July, when credit cards in his name were found at the sites of the two attacks.58 Subsequent investigation by the Service revealed that Khan had visited Pakistan in 2003 and spent several months there with Shehzad Tanweer in the winter of 2004–5, probably in contact with Al Qaida, planning and training for the 7/7 attacks. However, the Service concluded, and the Intelligence and Security Committee agreed, that ‘even with the benefit of hindsight, it would have been impossible from the available intelligence to conclude that either Khan or Tanweer posed a terrorist threat to the British public.’ During Operation CREVICE they had figured only as petty fraudsters in peripheral contact with the plotters.59