The investigation into London’s Saturday attack is moving quickly with police arresting at least a dozen people in connection to the incident. It came less than two weeks after a suicide bombing in Manchester left 22 people dead. The Cipher Brief’s Leone Lakhani asked Michael Leiter, former Director of the National Counterterrorism Center, about the steps counter-terror investigators are now likely to take.
The Cipher Brief: What types of steps would UK investigators be taking now?
Michael Leiter: This part of the playbook is — regrettably — very well developed. It starts with the perpetrators and the crime scenes. Who were they? Who are their contacts? Examining their phones, online history, travel records, family members, and the like. From there, officials will examine increasingly large concentric circles to understand all of the aspects of their contacts. In addition, thanks to London’s extensive CCTV, officials will be able to track their movements with some specificity.
Separately, British Prime Minister Theresa May will almost certainly now push on two fronts: disrupting online extremist activity; but, I believe, also look at how they can better address the overwhelming volume of threats being faced by the security services.
This may well lead to another push to lengthen pre-charge detention of terrorist suspects. Today, the UK has 28 days – with judicial review – to hold suspects pre-charging, but the Home Office (under May) has previously argued for 40 days, and I expect this will return.
In addition, I suspect the Prime Minister may well push to strengthen and make greater use of Terrorism Prevention and Investigation Measures, which allows the British government to impose restrictions on individual movements, finances and communication, so they have more of the characteristics of the older, pre-2011 Control Orders. This will face some opposition, both domestically and in the European Convention on Human Rights, but I believe May will still make a strong push in this direction.
TCB: Unlike the Manchester attack, which involved a suicide bomber, Saturday’s attack in London seems to follow the “lone wolf” or “lone wolves” type attacks. How do counterterror investigators deal with all these different types of attacks? Is it even possible to guard against all of them?
ML: Contrary to public perception, counterterrorism efforts are always multi-pronged in an effort to detect or at least reduce the effectiveness of a wide-variety of attacks. Trying to figure out the profile of an attacker and his or her means with precision and accuracy is never possible. Thus, there’s the need for a range of offensive, defensive, and mitigation efforts.
For example, officials always try to identify people who are being radicalized through surveillance (physical and cyber), look for communications amongst extremists, or identify suspicious travel. This might have worked for both of these attacks. But beyond that, you might also look at individuals purchasing suspicious explosive precursors, such as larger quantities of hydrogen peroxide to make TATP (triacetone peroxide), as was used in Manchester. This, of course, would have been of no use for Saturday’s attack. Finally, officials have to be ready — as they obviously were in this case — to respond quickly to mitigate the tragedy.
TCB: The UK has been on high alert since Manchester, with ongoing investigations. Are these the type of attacks that would be expected?
ML: Absolutely. Terrorists like to do things that are low-tech and work. They have seen, since the attack in March as well as other attacks in Western Europe, that these simple, straightforward attacks are both difficult to detect before they are launched and also highly effective at affecting the west, both psychologically and politically.
TCB: Would there now also be counter-intel/terror cooperation with other countries including the U.S., even after Manchester police expressed their frustration with U.S. media leaks about that attack?
ML: Yes, although it will surely be a bit more narrow in its scope because of the leaks. I believe the British will still speak with their trusted counterparts, but it will be with care to express the sensitivity of ongoing operations.
TCB: We’ve seen lone wolves attacking soft targets with easily obtainable weapons – vehicles, knives – over the past 2-3 years. Have we made any progress in combatting the lone wolf phenomenon? Is this the new normal?
ML: It is the new normal until we disrupt physical safe havens in places like Iraq, Syria, Libya, and elsewhere, and until we are more able to disrupt the online safe havens that are fueling much of this violent extremism. Prime Minister May was very strong on this front. Although it was missed by almost everyone in the U.S. because of our own domestic politics post-G7, she is working hard to catalyze a movement within the G7 for what she has termed improved “digital policing.”
This is where the big movements will occur in the coming months. I expect the UK to lead a significant push with allies to require key technology providers such as Google, Apple, Facebook, and Twitter to be more proactive in their “policing” of online extremism. In addition, she will make another push to limit the negative security aspects of end-to-end encryption. I expect that President Donald Trump will be more aggressive on this front than was President Barack Obama, but this will be a difficult road to hoe for complex legal, technology, and economic reasons.
TCB: How does the U.S. Intelligence Community react to news such as this? Walk our readers through the next 24-48 hours in the U.S. government after an event like this.
ML: Lots of meetings for situational awareness will be called, but these are probably the least important aspects of the government’s response. Most importantly, there will be very deep cooperation between the FBI, CIA, and NSA with their respective counterparts (MI5, MI6, and GCHQ). This will involve reviews of intelligence, looking for international (and U.S.) connections, and supporting our British friends. At the same time, we should be looking to learn from the event, and immediately adjust our own intelligence priorities (if necessary), as well as protective measures. Finally, it won’t just be the federal government. Key cities, most notably New York and the NYPD, will be closely engaged with the London Metropolitan Police to learn and apply lessons domestically.
