MI5 analysing former terror suspects to catch potential attackers

MI5 has created a new category to rank terrorist suspects and is increasing the number of behavioural scientists it uses by 50% to improve the agency’s chances of catching former jihadists who re-engage with planning attacks, the Guardian has learned.

The moves follow a series of attacks in the UK in 2017, two of which were carried out by former “subjects of interest”. In those cases, active MI5 investigations were dropped only for the suspects to later kill civilians.

The measures are part of a package of changes introduced after the atrocities. Internal reviews led to 125 recommendations to improve counter-terrorism efforts by MI5, the domestic security service, and counter-terrorism policing.

Whitehall sources claim the measures have already led to investigations being reopened on suspects previously thought to pose a lower level of danger.

MI5 is under pressure to show it learned lessons after the attacks. That pressure is expected to grow this week after the agency’s deputy head of international counter-terrorism testifies for two days at the London Bridge inquest. Lawyers for the eight bereaved families claim “opportunities galore” were missed to thwart the attack. The ringleader, Khuram Butt, is believed to be the first suspect under live investigation by MI5 to have carried out an attack.

Until now, MI5 had lists of about 3,000 people under live investigation and a larger category of 20,000 who were previously under active investigation. The security services and police are currently managing an Islamist terror threat of a scale and duration greater than expected.

In 2017, Khalid Masood in Westminster and Salman Abedi in Manchester came from the category of closed “subjects of interest” (SOIs), MI5’s term for suspects.

The agency is introducing new “tripwires” to warn its analysts that former SOIs may be posing an increasing threat. The signs include traumatic life events such as losing a job, and relationship issues. MI5 is making greater use of behavioural analysis to study the 20,000 former suspects, a number that is understood to be growing.

A senior Whitehall source said: “There is a category [within the former SOIs] of individuals who are more likely to be engaged in terrorism than others. Former SOIs sit at different points of the spectrum in terms of risk. Within the 20,000, there is a category deemed more likely to re-engage. The new process recognises that closed SOIs are on a spectrum of risk – it is not binary.”

The Guardian understands that after the London Bridge atrocity, Theresa May demanded that the police and MI5 “regain the momentum” during a crisis meeting with counter-terrorism chiefs.

The attacks led MI5 and counter-terrorism police to set up internal reviews. They were assessed by the barrister David Anderson, as were a series of new measures.

Spotting former suspects who re-engage has been an enduring problem for counter-terrorism investigators. The Whitehall source said: “Because of the behavioural analysis we are doing, it will make us more likely to spot individuals re-engaging and those who are most likely to re-engage. Behavioural analysis is a huge part of this. Some cases have already been reopened because of this process.”

Masood had been investigated in 2012. At the time of the Westminster attack his file was closed. Masood drove a car into pedestrians on Westminster Bridge, then ran into the Palace of Westminster, where he stabbed PC Keith Palmer to death before being shot dead.

The active investigation into Abedi was closed in 2014. He would go on to bomb Manchester Arena, killing 22 people. His case was on the verge of being reopened, and intelligence pointing to his danger had been received by MI5, but the threat he posed was not fully appreciated by analysts.

“MI5 can’t justify intrusion into former SOIs where there is no evidence or intelligence of risk,” the source said. “We are not able and do not have the resources to monitor them all. We are trying to improve the tripwires. We are trying to identify triggers to spot if someone is re-engaging.”

Only a limited section of Anderson’s review was published. An update is due soon.