The man who carried out a deadly terrorist attack in London was British-born and had been previously known to authorities, UK Prime Minister Theresa May said on Thursday.
Police named Khalid Masood, 52, as the Westminster attacker, who mowed down pedestrians on Westminster Bridge before stabbing a police officer inside the gates of Britain’s Parliament on Wednesday.
Masood was not the subject of any current investigation but had been known to police and previously convicted for assaults and possession of offensive weapons. Masood, who was born in Kent and had been most recently living in the West Midlands, had no terrorism-related convictions.
Prime Minister May said the attacker “was not part of the current intelligence picture” and there was “no prior intelligence of his intent, or of the plot.” The individual “was once investigated in relation to concerns about violent extremism” years ago, May said in a speech to the House of Commons Thursday. “He was a peripheral figure,” she said.
It is believed the individual acted alone, she said, and the police have “no reason to believe there are imminent further attacks on the public.” Investigations continue, she added.
British police arrested eight people in overnight raids in London and Birmingham as part of its counterterrorism operation connected to the attack.
ISIS claimed responsibility, calling the attacker an ISIS soldier who acted “in response” to calls from the terrorist organization. A direct link to ISIS has not been confirmed by the British government, and the framing of ISIS’ claim on Thursday is currently that of an attack inspired, rather than directed by, the group.
“It is still our belief — which continues to be borne out by our investigation — that this attacker acted alone and was inspired by international terrorism,” Britain's Metropolitan Police counterterrorism chief Mark Rowley said on Thursday.
Deputy Director of Analysis Bennett Seftel spoke to The Cipher Brief experts Nick Fishwick, former Senior Member of the British Foreign Office, and Mitch Silber, former Director of Analysis for NYPD, about what the attack could mean for UK counterterrorism efforts moving forward.
The Cipher Brief: For the last 18 months, ISIS has repeatedly threatened attacks on Britain and the group specifically singled out the UK at the end of a propaganda video in which it claimed responsibility for the Paris attacks in November 2015. But until yesterday – assuming the ISIS claim of responsibility is accurate — there has not been an ISIS-inspired attack in the country. How does this event change the equation?
Nick Fishwick: The attack will make people obviously more worried than they were. It makes ordinary people more worried, and the point of a terrorist attack is to, of course, scare ordinary people. That, I hope, will die down as the days and weeks follow, and hopefully there are no more successful terrorist attacks. Obviously, if there is another successful terrorist attack quite soon, then that will cause serious consternation.
In terms of the way British authorities are configured to deal with ISIS attacks, it won’t change very much. We have a very mature architecture that’s been in place at least since the attacks in July 2005. We have a clear counterterrorism strategy, clear lines of ownership of counterterrorism like prevention and cure, which are shared by different agencies involved in the struggle against terrorism, and a good emergency system that clicks into action in the unfortunate event of there being a successful terrorist attack.
There’s already something in the British counterterrorism strategy that prepares for reaction to successful terrorist attacks. That actually worked pretty well on Wednesday. The interesting thing was clearly the attacker went for a target or a part of the UK that was going to achieve maximum publicity. He was going for Westminster, which is really important as the Parliament.
On the other hand, he was attacking probably as secure a zone as there is in the UK. The very fact that the House of Parliament, loads of government buildings, and Buckingham Palace are nearby means that the security presence around there is very powerful. It’s obviously not impossible to conduct an attack there, but the likelihood of pulling off a mass casualty attack in a place like that is less strong than it would be if he had attacked somewhere else. The fact that it is so secure and that the response to the attack was so immediate—and of course it is still going on now—shows that there’s a pretty mature counterterrorism architecture in place in the UK. I don’t expect that to change.
Again, if there is another successful attack quite soon, then that might change in terms of the amount of resources that are put into counterterrorism. But that’s an excess not in hand at the moment.
Mitch Silber: At the official level in the UK, the threat level has been severe for a significant period of time. The head of MI6 has talked about it as being unprecedented in the amount of threat and its level. Those who are looking at the threat level from the Intelligence Community have known that the threat in the UK has been tremendously high, even going back to the 2005 attacks in London.
It’s been an amazing credit to British intelligence and law enforcement that there haven’t been other significant attacks during this time period. There have been a lot that have been thwarted, and when attacks are thwarted, they generally don’t make it into the public domain. If anyone in the public domain thought that the threat level wasn’t as high, if not higher than France, Belgium, and Germany, they were mistaken. It is quite high in the UK, and it remains to be seen whether this individual was inspired by ISIS, remotely guided by ISIS, just generally inspired by ideology, or operationally commanded by ISIS to carry out this attack. But nevertheless, it was an Islamist attack, so we know the category it fits in.
TCB: Do you think that if the threat was not jihadist, that it would garner this much media attention? If not, do you think the automatic assumption of ISIS responsibility aids ISIS in terms of momentum and reputation?
NF: Perhaps it does, but I am not sure there is much you can do about that. You might have noticed that in the immediate aftermath of the attack yesterday, the authorities were being very careful not to give the assailant’s identity away. They didn’t want to link it immediately until there had been some investigation with an Islamist terrorist attack.
Even Wednesday evening, Mark Rowley, the UK’s most senior counter-terrorism officer, was saying that it’s is likely a terrorist attack, but the authorities aren’t giving any more details. The fact that information was released fairly cautiously reflects that it’s really important to get facts, rather than speculation, out there. The government and the authorities have to release authoritative facts that people can depend on rather than get people panicking about whether it’s a terrorist attack or not a terrorist attack.
You can only really make sense of an attack like this once the details of the attacker, his motivation, and any contacts that he might have had with other groups, emerge. Then you can start to make sense of whether we’re looking at a lone lunatic attack or something that might be part of a broader problem.
It clearly is part of a broader problem, and that is going to make people worried. Why? Because we know there are at least several hundred people in the UK who have been to Syria, who have trained themselves on how to attack for ISIS out there, and who have now returned to the UK. They are obviously more formidable since they’re trained and probably brainwashed. We know there are a few people like this out there, and we know that they would want to conduct attacks. If you have a person who’s simply representing some personal grievance, then the chances of a repetition are obviously considerably less.
MS: It’s hard to say if an Irish Republican Army (IRA) attack or a similar attack would have garnered the same attention. Probably. But for ISIS, if there is some connection to their organization, it is likely due to the fact that they are under pressure in Iraq in Mosul and they are under pressure in Syria in Raqqa, so there is going to be a certain motivation to prove their relevance and potency by inspiring an attack in Europe.
Also, the idea that as ISIS is getting squeezed, European foreign fighters are going to return back to Europe – we don’t believe the assailant was that – but nevertheless, the threat level is going to continue to escalate in Europe going forward. It’s blowback from our success against ISIS.
TCB: According to news reports, the assailant had previously been investigated by authorities. This is similar to what we’ve seen with other attackers in the past. What does this tell us about the law enforcement mechanisms for investigation and catching these individuals prior to carrying out attacks? What can be done more effectively to ensure those being investigated are vetted more thoroughly?
NF: It’s a critical point, and it boils down to a debate about resources. It’s quite clear that the attacker was on MI-5’s radar screen a year or two ago, and it’s clear that he was no longer under active investigation. Given the nature of our posture against terrorism, that seems to me to be absolutely right. It’s not right for MI-5 and the police to keep investigating somebody who hasn’t shown any signs of involvement in a plot against our country. If you have a finite number of resources, basically MI-5 and the other intelligence agencies, you need to focus those resources on what looks like the most threatening targets.
Now the debate is clearly that the attacker had been spotted by the security authorities at some point over the last few years. We also know, going back to the successful attacks in London in 2005, that at least some of those people were on the periphery of MI-5’s vision. MI-5 can’t measure up resources to cover everybody, and in a democracy, you don’t want them to do that. So there needs to be a debate about whether the level of resources given to the police and to our security and intelligence agencies is right. But that’s a democratic debate, because the more money you give to the security people, the less money goes to schools, hospitals, and the military. It’s not an easy choice.
MS: It is a reoccurring theme that these people who are carrying out attacks, whether it’s in Orlando, Paris, London, or Boston, at some point appeared on law enforcement’s or intelligence’s radar. The challenge is that there aren’t unlimited resources, so the intelligence community has to prioritize and essentially rank individuals and their level of threat. Sometimes, people who get ranked further down in their prioritization can spontaneously activate with little warning.
That’s essentially what it looks like we have here. It is unclear what triggered this individual to go operational but often times, especially given that the capabilities to carry out the attack were a vehicle and a knife, you wouldn’t have much lead time if this individual is becoming activated.
TCB: What about the more restrictive gun control laws in the UK? Do you think they made a difference in this situation?
NF: One of the most interesting cultural differences between the U.S. and the UK is over the possession of weapons. Obviously, it’s a constitutional right and of great symbolic importance in the United States. In Britain, it’s a constitutional right not to carry a weapon, and we don’t like seeing police carrying guns, although today you see them in London more than you used to 10 or 20 years ago.
Basically, we don’t want our police to be armed except when it’s really important that they are. We don’t want to see exchange of gunfire between police and suspects, and we don’t want accidental shootings of people either not committing crimes or committing trivial crimes. We don’t want guns to be available in UK.
Although the policeman in this case who acted heroically didn’t have a gun, and there’s nothing that we can say that will take the pain of that person’s death away, I think we are a safer country, because police don’t routinely carry weapons, and it is not easy for criminals and terrorists to get hold of weapons. This attacker was just carrying two knives. If he’d had a gun, he could have killed a lot more people than three or four.
MS: The attacker didn’t have firearms so that made him a lot less dangerous than had he possessed firearms – if you want to look at gun control that way.
In terms of UK police, the UK is gradually starting to increase the amount of firearms that its law enforcement forces have so that they can put down a threat like this as quickly as possible.
TCB: Is there anything else to look for as the investigation unfolds?
NF: The only way to understand a situation like this is when the investigation is done patiently. There is obviously a lot of pressure, but you can’t cut corners in an investigation. The security authorities will be looking into the attacker – into his background, into his contacts, into where he hung out, his movements, and so on. It’s only when you have a fuller picture that you can really understand what this attack means, whether it’s part of a cell or a broader network of people who wish to cause damage to our country, or whether he is essentially a single motivated person. We just got to wait for the details of the investigation to come out.
I guess the final point is that London is a resilient capital, and it’s also a very cosmopolitan capital. You can see that by the fact that, sadly, some of the people killed yesterday weren’t British. London is proudly tolerant and proudly cosmopolitan, and it will stay that way.
MS: We know the assailant is a lone actor, but the question is: is he a lone wolf? Meaning, were there other people in London who he conspired with? Did he conspire actively with people in ISIS proper? That’s the question. If you look at Nice and Berlin, at first blush, it looked like it was a lone wolf, but in both of those cases, further investigation showed that there was some type of connection – operational or inspirational – to ISIS. That’s part of the question here.
Bennett Seftel (@BennettSeftel) is deputy director of analysis at The Cipher Brief.
National security reporter Mackenzie Weinger (@mweinger) contributed to this report.
