The morning after the recent explosion on an underground train at Parsons Green station, police said they had made a significant arrest in connection with the incident. Another followed later in the day. The police operation though, continued.
No one died and the bomb failed to go off as planned, but 29 people were injured in the incident on September 15.
London, of course, is no stranger to bombings. The IRA left explosive devices across the city and on its trains during the Troubles in Northern Ireland. However, the contours of what terrorists do while they are carrying out attacks have changed since then and continue to change. The response by the security agencies to their actions therefore needs to change, too.
The IRA planted explosive devices quietly, and after a point of time started phoning the authorities to inform them of the threat. The result was large scale and frequent disruption of public transport and daily life – but the loss of life was not what it could have been.
When a new wave of attacks started to hit the UK and Europe in the 2000s, the perpetrators were either killed in an explosion (for example, Hasib Hussain in 2005 and Salman Ramadan Abedi in 2017), shot (Khalid Masood, 2017; Rachid Redouane, 2017) or captured (Michael Adebolajo, 2013) at the crime scene.
Over the past 12 months, however, a visible change has been happening in terrorist tactics. Some perpetrators have been able to flee the scene after committing a major attack. Before Parsons Green, it happened in Berlin (December 2016), Stockholm (April 2017) and Barcelona (August 2017). In each case, the assailants drove their vehicles into crowds, and left the crime scenes immediately afterwards.
The pursuit of a dangerous individual or group suspected of killing or injuring people poses several new challenges for security agencies. Attackers continue to pose a very real risk as long as they remain at large. This is one of the reasons why after the past few incidents the UK Joint Terrorism Analysis Centre (JTAC) has raised the terror threat level from “severe” (meaning an attack is highly likely) to “critical” (meaning an attack is expected imminently). It has remained at that level until the authorities are confident that everyone involved in each incident had been captured or neutralised.
Changing technique
Immediately after an incident, the police’s first objective is to secure the site of the attack, and prevent other attacks. Of particular importance, here, is the time it takes the police to identify and stop the perpetrators. With failed explosive attacks, it’s not immediately obvious where and when the offenders leave the area. They could plant a device and leave before the deflagration or, in the case of a failed suicide bomber, run away among their victims.
In the hours after the Parsons Green attack, the investigators and forensic scientists working on the incident would have engaged in a tremendous investigative effort to identify and locate suspects. Shortly after arriving at the scene, they will have collected witness statements, CCTV footage, photos and videos from people’s mobile phones, and analysed mobile phone calls in the area. They would also have paid close attention to financial transactions, as well as the weapon and any other items that suspects might have left at the scene.
It’s a major challenge for the police to quickly identify the perpetrators of attacks, trace their escape routes, track them down and make an arrest. It is, however, a job that police forces are getting better at. After the 2005 London bombings, it took about six days for the London police to accumulate the evidence needed to identify the perpetrators. By comparison, they arrested Damon Smith – the student who planted a device on the Jubilee line (London) in October 2016 – a day later.
Security agencies use surveillance techniques of the kind seen on reality shows like The Hunted to zone in on targets like Smith. These include going through the email and social media history of suspects, scrutinising their bank statements and scouring CCTV footage from places of interest both before and after the attack. Most importantly, a channel of real time information exchange is immediately established between the command centre coordinating the manhunt and scores of police officers and informants on the ground who act as eyes and ears.
The shorter time it is taking to identify and arrest suspects cannot be attributed to improvement in police practices alone. Every incident differs in many ways that influence how long it takes people to be apprehended and questioned. But what is apparent is that in this form of terrorism, where attackers are leaving the scene of the incident, greater capability is needed by the police to respond in the hours afterwards.
The four-day journey across Europe of the man who carried out the attack in Berlin is a chilling reminder of how far terrorists can get, even after carrying out a deadly attack and being on the radar of every possible security agency.