The Evolving Terror Threat to the UK

In mid-November, MI5 Director General Ken McCallum gave his annual threat assessment speech, outlining the threats to the UK that his service was monitoring. Much of the focus of the subsequent media reporting was on the state-based threats that he covered (emanating from China, Russia and Iran), but he also highlighted that since his last presentation in July 2021 his service had disrupted eight ‘late-stage attack plots’. Only briefly mentioned was that during this same reporting period, the UK had suffered three terrorist attacks – leading to the death of one attacker and Sir David Amess MP. A close examination of all of this plotting suggests that some important tweaks are necessary to the UK’s CONTEST counterterror strategy to ensure it is able to deal with the complicated threat the UK continues to face.

In his speech, McCallum outlined that the plots the MI5 had detected emanated from ‘a mix of Islamist and extreme right-wing terrorism’ and that the ‘lines demarcating what is and is not terrorism’ were increasingly hard to draw. The focus was largely on lone actor plots (or self-initiated attackers), which his service found across ideologies. He also mentioned the continuing aspiration by groups to launch something more substantial, though this has become much harder for them. All of this may seem a fairly clear assessment, but it is in fact quite difficult to dig into in much detail given current levels of reporting around terrorist plots in the UK.

Security Service reporting around attack plots is increasingly opaque. The habit currently is to refer to disrupting ‘late-stage attack plots’, in which the investigators think that the individual was going down a path of trying to launch an attack rather than conduct some other form of terrorist activity (for example, dissemination of extremist material, radicalisation of others or fundraising in some way). Yet what exactly this looks like has not been clearly defined, and an examination of reporting around terrorism arrests in the UK since July 2021 (when he last gave the speech) reveals only six cases can in which some form of identifiable attack was reportedly being planned.

Many of these are still being managed through the courts, and consequently specific mention needs to be done carefully, but drawing on open source reporting, the following trends are visible in the caseload.

In ideological terms, half appear to have Islamic State inspiration, while the other half have elements of extreme right-wing (XRW) thinking in their make-up. In two of the XRW cases, the ultimate target was a 5G mast, suggesting the influence of conspiracy theories. Both of these cases had deep anger against the government also present in reporting, and both plots involved older individuals (38, 59 and 59). The 59-year-olds were a male and female pair who were reportedly in contact online.

All of the other cases are made up of teenagers, with two cases involving pairs (one two boys of 15 and 19, and the other a male/female 17/18-year-old pair). Of the Islamic State-inspired ones, only one case involves someone with a name of likely Muslim origin, while the others all appear to be non-Muslim origin names, with no reference to conversion in their cases. The targets are all quite general, but it appears that anger against the police or security state is high on their priority list, with two accused of conducting hostile reconnaissance of security establishments (one from each ideology).

They are scattered around the country, and were all active on various online platforms – from large established Telegram groups to gaming platforms and Discord. At least two of the younger boys are identified as being diagnosed with autism spectrum disorders.

When held up against the three attacks that took place during the reporting period which McCallum mentioned only briefly in his speech (Sir David Amess’s murder, the Liverpool Hospital bomber and the Dover migrant centre firebomb), the most obvious similarity is the older nature of the XRW terrorist who attacked the Dover migrant centre. A 66-year-old, his profile fit that of the last four older male XRW terrorists in the UK who launched lone actor plots (Jo Cox MP’s murderer; the Finsbury Park mosque attacker; a man seeking to kill Muslims who stabbed a person in Surrey in 2019; and a Britain First supporter who drove into a curry house owner in Harrow in June 2017). The previously mentioned two disrupted cases seeking to strike 5G masts also somewhat fit this profile.

The other two do not. The ideology of the Liverpool bomber remains unclear, and while he was a younger man, neither he nor Sir David Amess’s murderer were teenagers. Sir David’s attacker appears to have a been a residual case from the cohort of young men radicalised by Islamic State who waited years to launch his attack. This stands in contrast to the confused Islamic State-inspired teenagers in the arrested cohort.

It is hard to know what to draw from this. The most obvious point is the continuation of the previously identified trend of older men (for the most part) being those interested in launching XRW attacks. The fact that 5G masts are a desirable target highlights how the conspiracy theory-driven ideologies that thrived during the pandemic have taken hold among parts of this community. It does suggest a possible new profile of offender that security forces might need to focus on (as general as it might seem). On the violent Islamist side, the Sir David Amess case highlights that there are still residual concerns around the Islamic State-linked cohort, highlighting the long tail this problem can have.

The other side to the age question is the seeming lack of attacks involving teenagers. It is clear from other reporting that the volume of teenagers being arrested is up, but not many are actually launching attacks. Among the XRW community, there have not been any teenagers involved in attacks, and one has to go back to September 2017 and the attempted bombing of an underground train at Parsons Green to find a teenager inspired by Islamic State launching an attack. This is not to discount the potential threat posed by this group, or to suggest that security forces only need to respond to the threat they observe, but it is likely worth considering the extent of the menace actually posed by this young cohort. Jonathan Hall QC, the Independent Reviewer of Terrorism, has raised similar questions, identifying parts of this alarmingly young cohort as ‘keyboard warriors’.

It is also notable that in three of the cases, pairs of individuals were arrested, and in two others there is evidence that the individual was plotting with others online. Only one appears from reporting to be an isolated actor (though this may of course be untrue). This hammers home the oft-repeated point that lone actor terrorists are never really alone. It also raises questions around the three successful attackers – all of whom appear thus far to have been identified as isolated.

This picture is, of course, incomplete and the dataset too small to draw any scientifically satisfactory conclusions. McCallum referred to eight plots, while this author was only able to locate six. But taking this group alone, it is notable how there is a balance between the XRW and violent Islamist groups. The actual danger posed by all of them in national security strategic terms is questionable, though any threat to life clearly needs to have substantial resources dedicated towards countering it. Another aspect McCallum touched upon which is increasingly obvious in XRW plots is the desire to own or use 3D printers to manufacture weapons. Whether this is just for collection or for actual use is unclear, but it helps overcome one of the major hurdles faced by terrorist cells in the UK, which is sourcing weaponry that they can use to cause mass carnage. Guns are hard to obtain in the UK, while bombs require practice to make. Bladed weapons will always limit capability.

Bigger potential terrorist threats were hinted at in other ways. In his speech, McCallum also referred to at least 10 incidents since January of threat to life or kidnapping in the UK involving Iranian actors. This is not new behaviour for Tehran, but the volume when compared to the indigenous domestic threat is notable. It will be interesting to see how much he identifies similar threats from China and Russia, the two other adversaries highlighted, in the future – Russia of course already has form for such action in the UK – and how (or if) the counterterror strategy might seek to address this threat.

There are aspects of the threat beyond the speech which also bear noting. Earlier in November, a 20-year-old and a 17-year-old were arrested in Birmingham for planning to join Islamic State Khorasan Province. This followed earlier reporting of Taliban officials detaining a pair of Britons crossing over from Uzbekistan who were trying to join the group, and a video that emerged from Pakistan which showed an individual identifying himself as Asadullah from England calling for people to come and join the jihad in Pakistan in a strong British-sounding accent. There is a longstanding connection between the UK and jihadist groups in South Asia, and it appears to still be active.

Looking further afield, Syria continues to host a number of potentially threatening groups and UK-linked individuals in Kurdish custody, while Africa has been repeatedly identified as an area where a growing volume of terrorist groups affiliated with al-Qa’ida and Islamic State continue to gather and plot. While it is not clear how much of a threat any of this poses directly to the UK, it illustrates that the threat picture remains fairly constant across much of the globe.

But focusing back on the UK and McCallum’s speech, the most important thing is to try to unpick which aspects of the threat require additional consideration and engagement as the government goes through a review of the CONTEST counterterrorism strategy, and the long-awaited review of PREVENT is released. The threat has clearly changed; it remains to be seen in what way the response will.

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.