Intelligence and Security Committee Report: Extreme Right-Wing Terrorism/Extreme Right-Wing Terrorism Action (M15 and CTP)

by the Intelligence and Security Committee of Parliament

Layout 2

EXTREME RIGHT-WING TERRORISM ACTION (MI5 AND CTP)

---

 

The case for change

197. The change in responsibility from MI5 to Counter Terrorism Policing (CTP) was significant, and we questioned where the impetus for the change had come from. The Director General of MI5 told us that it had been a natural move for MI5 and the police, and that:

MI5 hadn't in 2015 or 2016 been sort of pushing, because we weren't seeing deficiencies in what the police were doing, but as the threat increasingly crossed the line into national security, we felt there was a worthwhile question to ask there and indeed our police colleagues were not saying "We have got this taped, leave it to us", they were saying "We think we should have a conversation about our division of responsibilities here, it is different to what we are doing on Islamist extremism and, as this threat grows, that feels wrong to us". Then other voices, including Home Office colleagues and, for that matter, David Anderson, who was independently overseeing the Operational Improvement Review process, also had the same view that this was a conversation worth having to look at whether we should change our division of labour.^[1]

198. In March 2018, MI5 told the Committee that "one of the shifts we are making is more of a shift for MI5, is to step into that Extreme Right-Wing work a bit more".^[2] MI5 opened its first Extreme Right-Wing Terrorism (ERWT) investigation in March 2018. Following a pilot phase, MI5 adopted a 'split primacy' model in November 2018. At this point, MI5 took operational primacy for the highest threat ERWT and left-wing, anarchist, single-issue terrorism (LASIT) investigations, with CTP retaining primacy for lower priority investigations, and Joint Terrorism Analysis Centre (JTAC) leading on providing assessments on the national threat picture. The MI5 Executive Board made the decision to move MI5 to full primacy in September 2019. This was enacted in phases across investigative sections and completed by 1 April 2020. MI5 began establishing which *** and the accesses required to facilitate the lawful acquisition of data, as well as transferring existing information on ERWT Subjects of Interest (SOIs) from police systems on to MI5 management systems to enable ***. MI5 also worked with CTP to review and further develop ***.^[3]

199. MI5 subsequently wrote to the Committee on 31 January 2019, confirming that steps had been taken to implement new arrangements in countering what was still at that time being referred to as 'Domestic Extremism Terrorism' (DET):

JTAC, MIS and CTPolice currently have amodel for collaborative working on Islamist terrorism that works exceptionally well by harnessing the strengths of each organisation along with other partners. The overarching principle for the new arrangements is that, as far as possible, that same approach is applied to threats emanating from Domestic Extremism Terrorism (DET). In mid-October [2018], JTAC launched its initial capability on DET, taking the lead for strategic-level national threat assessments through a *** team of analysts (in on-going partnership with CT Police).^[4]

200. In June 2019, David Anderson QC (Lord Anderson) published an unclassified summary of the progress made by MI5 and CTP in implementing the recommendations of the Operational Improvement Review (OIR) and Post-Attack Reviews of 2017. The 'Implementation Stocktake' summarised progress made up to and including 31 January 2019 in a number of key areas, including 'non-Islamist terrorism', and identified a number of challenges. These are listed below, together with MI5's response:

2017 Terrorist Attacks—MI5 and CTP Reviews— Implementation Stocktake[5]
8.17. In keeping with the frank nature of my briefings, I was informed of a number of initial or continuing difficulties. Most of these were not however fundamental in nature, and there has been a healthy tendency to see teething problems as learning points rather than obstacles. For example:
D.	There was some initial reluctance to share information around the CT network which was resolved by negotiation.
E.	It has been necessary to manage the inherent tension that exists between Police prioritisation of evidence-building in order to effect executive action and the intelligence agencies' desire to build as full an intelligence picture as possible, particularly in relation to SOIs [Subjects of Interest] travelling overseas.
F.	There was uncertainty, now resolved, as to who should conduct international liaison (e.g. with the FBI) and who should authorise or seek the authorisation of covert activity: as to the latter, it was concluded that MI5 would have primacy in the covert phase and the police in executive action.
MI5 response:[6] "As outlined here, Lord Anderson has already detailed the mitigations and decisions on each of these issues."
8.19. The changes have had a resource impact for MI5 (though not for CTP), particularly in terms of training. New growth funding has been made available to restore dedicated 'DE' desks in the regions, which existed previously but were phased out a few years ago. MI5 response: "MI5 continues to manage resources dynamically across ERWT, LASIT and International Terrorism based on threat and risk."
8.20. More fundamentally, MI5 identified to me two respects in which its still partial coverage of non-Islamist terrorism would leave it at a disadvantage:
a)	In the identification and stopping of attacks: having restricted itself to the most serious leads, MIS will remain unsighted on the threat posed by those who register less prominently on the radar; and
b)	In the post-incident phase, where a more limited intelligence base may reduce the speed and effectiveness of its response.
MI5 response: "The decision for MI5 to assume primacy of ERWT by April 2020 will help to address these issues. Over time, MI5 will be able to develop a better understanding of the full ERWT threat picture and a fuller intelligence base to rely upon during any post incident scenario, although MI5 notes that it will take some time until they achieve expertise comparable to that for Islamist terrorism."
8.21. Finally, while MI5 would like its discovery tools to be "threat agnostic" and UKIC [UK Intelligence Community] wide, the task of adapting GCHQ's techniques to the non-Islamist threat is for the future. The same is true as regards the use of MI6 liaison facilities with overseas agencies, though. MI5—while unable to act as the UK's sole interlocutor on non-Islamist terrorism—is starting to play a role in liaison with 5 Eyes and European counterparts.[7] MI5 response: "MI5 has begun adapting MI5 Discovery trade craft for ERWT, and have a number of capabilities active against both International Terrorism and ERWT SOI that are threat agnostic. *** MI5 has also used existing relationships with the *** community to begin collaboration on *** tradecraft for the ERWT threat."

201. A number of the issues identified by Lord Anderson in his 2019 Stocktake have since been addressed. In September 2019, MI5 took the decision to move towards full primacy for ERWT, with information on SOIs being transferred from police systems to MI5 systems, so—in theory—it has a holistic view of the threat (rather than simply "restricting itself to the most serious leads"^[8] as it did in the early stages of transition). Subsequently, on 1 April 2020 MI5 assumed full primacy for ERWT and intelligence leads, with ERWT investigations managed in parity with Islamist terrorist investigations.

202. When we asked MI5 for an update on their recruitment of CHIS (Covert Human Intelligence Sources), which was highlighted as a priority in the original OIR, the Director General of MI5 told us that:

***.^[9]

The Head of CTP was clear that CHIS play a central role in the investigation process, and that there were processes in place to ensure that MI5 and CTP were joined up when it came to handling CHIS:

So we provide exactly that same capability. What we have done over the years is the authorisation of the particular individual in the job that is important. So either Ken's people [MI5], senior people would be authorising the job, or mine will be, and then they will seek concurrency from each other, so we are not effectively treading on each other’s toes or we are doing a joint operation on the same subject.

I have always described this as my kind of 'Judi Dench' moment in Skyfall: people get very obsessed with data and IT, but actually without Human Intelligence, we don't get good prosecutions. It is an absolutely vital capability. It saves lives all the time.^[10]

203. However, issues identified by Lord Anderson have yet to be resolved—in particular, the matter of transferring historical records from CTP to MI5, and the requirement for MI5's discovery tools to be 'threat agnostic'. MI5 advised that progress is being made on the transfer of data: "***. So the core elements of [the] police's pre-existing knowledge are now replicated within MI5 systems . . . but there is still further work to do."^[11]

204. There is a tacit recognition that ERWT is a comparatively new area for MI5, and one that has evolved rapidly over the past five years. The Director General of MI5 acknowledged: "We are also very aware that *** when our machine triages an Islamist-related lead, we can pretty rapidly have a pretty confident sense that we are seeing this with a high degree of fidelity." However, he also pointed out that their international counterparts are in a similar situation: "It is not that the UK is playing catch up here. Everyone is dealing with this emerging phenomenon and deepening their understanding as we go."^[12] More broadly, MI5 concede that:

Identifying the boundaries of MI5's role in ERWT has proved challenging. ***.^[13]

205. CTP still holds the responsibility for investigating any other activity that does not meet the ERWT threshold but is of terrorism relevance, including in relation to violent public order issues.

Key parts of CTP

Counter Terrorism Policing (CTP) is an alliance of UK police forces working with UKIC to protect the public from terrorism. Around the UK, there are 11 regional counter-terrorism units (CTUS) and intelligence units. Officers and staff work in a range of specialist fields, such as investigations, digital exploitation, financial inquiries, community liaison and communications.

Within CTP, there are several organisations with key roles in relation to ERWT:

• The Counter Terrorism Policing Headquarters (CTPHQ) sits at the centre of the network that heads up policy and strategy, co-ordinates national programmes, and acts as a single point of contact and co-ordination for CTP.
• The National Operations Centre (NOC) is a part of CTPHQ—it is a central command comprising units that provide operational support to the national network.^[14]
• On 1 April 2020, a Strategic Intelligence and Briefing Unit was set up at the National Police Coordination Centre (NPOCC). These functions were previously based at CTPHQ.^[15]

206. In consultation with the Strategic Intelligence and Briefing Unit, CTP has developed a 'Terminology and Thresholds Matrix' to ensure CTP is able to use its resources appropriately to identify and manage counter-terror related threats. The matrix was launched in September 2020, and sets out language and thresholds to delineate between the types of ideology and activity that formerly fell under the term 'Domestic Extremism'. Crucially, it will allow CTP and National Police Coordination Centre (NPOCC) stakeholders to draw clear distinctions between what does and does not meet the threshold for relevance to CTP.^[16] The Head of CTP explained that the matrix "assesses the ideological outcome against the activity, and that is the matrix which decides where on that threat matrix the target exists and therefore who needs to deal with it".^[17]

207. In addition, a joint ERWT Strategic Hub made up of CTP and MI5 is now being set up to co-ordinate the UK counter-terrorism strategic response to ERWT, engaging with partners across the counter-terrorism mission, within Whitehall and internationally, to progress strategic projects, investigate policy and build capability.

Threat assessments

208. JTAC analyses and assesses all intelligence relating to international terrorism, in the UK and overseas, and produces assessments of threats and other terrorist-related subjects for customers from a wide range of HMG departments and agencies. Following the OIR recommendation that JTAC should be responsible for the production of national Threat Assessments of terrorist threats arising from Domestic Extremism work, JTAC officially took on responsibility for producing assessments for ERWT in October 2018 (they had been producing occasional reports on ERWT prior to this date).

209. JTAC incorporates key international events into the analysis of the ERWT threat to the UK, with dedicated resource providing analysis on ERWT links to the UK from Europe and elsewhere.

210. JTAC also assesses the threat posed by ERWT to UK interests overseas, utilising similar analysis techniques to those applied to the Islamist terrorist threat overseas. An international attack or detention is defined as ERWT in those cases where there is a likely ERWT ideology, and the capability or intent to conduct an attack—however, it can on occasion be difficult to determine whether or not a particular incident is ERWT, as not all countries record right-wing violence and attacks as terrorism. JTAC will include non-violent right-wing extremist activity in its analysis where this rhetoric could inspire others to conduct an attack; however, this extremist activity is not deemed to be terrorism.^[18]

211. ERWT has also been incorporated into JTAC's assessment of the UK National Threat Level, alongside Islamist terrorism, left-wing, anarchist and single-issue terrorism (LASIT) and Northern Ireland-related terrorism in mainland Britain (the NIRT threat level in Great Britain is assessed by MI5).

Investigations

212. MI5 is reliant on information collected either from its activities or provided to it by external sources, whether that is the public, police or partner agencies. MI5 describes an individual who is, or has been, investigated because they are a potential threat to national security as an 'SOI'. In order to assess and manage intelligence, MI5 uses a formal triage process for incoming intelligence, a prioritisation system for ongoing investigations, and a higher-level review process to set strategic priorities.^[19]

The 'Receive' stage

213. All information and intelligence entering MI5 or CTP comes through a single point of entry (SPOE). Processes are in place to receive and assess intelligence 24 hours a day and 365 days a year. On receipt, intelligence is assessed before either being rejected, or progressed as a 'trace' or a 'lead'.

A trace is a request for a check across MI5 indices to determine potential links to extremist activity that does not immediately meet the potential for lead development.

A lead is the term to describe all intelligence or information that is not linked to an ongoing investigation that, following initial assessment, suggests involvement in activities of National Security (NS) concern.

214. Intelligence meeting the threshold for a lead is tested for links to existing investigations, and:

• if the lead is linked to an existing investigation then it is forwarded to the appropriate investigative team; or
• if the intelligence does not relate to an existing investigation, the lead is assessed for credibility and a new investigation is launched, if appropriate.

The 'Assess' stage—the Intelligence Handling Model

215. Management of all new counter-terrorism led intelligence and threat reporting not linked to ongoing counter-terrorism investigations received by both MI5 and the police is conducted through the 'Intelligence Handling Model' (IHM). This is a joint initiative between MI5 and the police and provides a single point of entry for intelligence and ensures new leads benefit, where appropriate, from co-ordinated MI5, GCHQ, JTAC and CTP tracing and expertise. This co-ordination is carried out by dedicated teams in MI5. The IHM provides a robust framework to ensure that finite, covert investigative resources are directed against the most credible new leads—and that leads lacking credibility are resolved in the most appropriate way, without significant covert investigative resource.

216. The IHM uses four key principles against which to assess leads: Risk, Credibility, Actionability and Proportionality. This is known as 'the RCAP Framework'.

Risk:

What is the likely impact if the information/intelligence is not addressed?

What is the likelihood (directly correlated with credibility) of it taking place?

What are the associated vulnerabilities?

What is the imminence of any associated threat?

Credibility:

How reliable are the origins of the information/intelligence?

What is the content and context of the information/intelligence?

What is the intent and capability?

Has the information/intelligence been corroborated (including adverse traces)?

Actionability:

Does the intelligence or information contain any details on which MI5/Police can take specific further actions, or exploit intelligence or investigative opportunities?

Proportionality:

Having considered the above factors, is it necessary and/or proportionate, both in terms of legal and statutory obligations and existing priorities and resource constraints, to investigate further?

217. Using the RCAP Framework, the lead is allocated a traffic-light status, according to the nature of the reporting, and a band according to the credibility of the intelligence:

Risk assessment (traffic-light status)
RED	***
AMBER	***
GREEN	***
BLUE	***
Credibility assessment (band)
BAND 1 Some Credibility	***
BAND 2 Indeterminate Credibility	***
BAND 3 Lacking Credibility	***

The Develop' and 'Decide' stages

218. The next stages, after 'Receive' and 'Assess', are to develop the lead and to decide what action to take:

• Lead development is the process of identifying intelligence gaps and requirements, and the further research and actions necessary, to enable a more informed assessment of the lead. Leads should be developed where possible without the application of significant covert resource (such as surveillance or intercept). MI5 and the police endeavour to agree and deploy resources in accordance with the risk and credibility assessment. Each organisation is accountable for the deployment of its own resources.
• Decisions on what action is to be taken on a lead occur at each stage of the lead assessment process, beginning with the SPOE. The traffic light and band will be reviewed continually and amended where appropriate to ensure they accurately reflect the risk and credibility assessment.

MI5 and CTP will jointly agree on the actions taken on each national security lead. The decision is informed by the credibility assessment; however, at this point consideration is also given to whether any further actions are possible and the proportionality of any further investigation.^[20]

Investigation prioritisation process

219. Investigations are given a priority according to the level of risk they are judged to carry—this is known as the 'P4 process' (that is, Priority 1-4) and is described in the table below.

Category	Definition for counter-terrorism investigations	General resource allocation
Priority 1: Attack planning	Investigations into individuals or networks where there is credible and actionable intelligence of UK (P1A) or Overseas (P1B) attack planning. Includes post-incident investigation where threat of follow-up attacks is still possible.	***.
Priority 2: Heightened risk of extremist activity	Investigation into individuals or networks where there is involvement in activities that directly increase the likelihood of an attack taking place in the UK or against direct UK interests, but that is not assessed to be attack planning. This includes: ● *** ● *** ● *** ● *** ● *** ● ***	***.
Priority 3: Extremist activity	Other extremist-related activity that indirectly increases the likelihood of an attack or contributes to building/supporting extremism in the UK: ● *** ● *** ● ***	***.
Priority 4: Risk of re-engagement following disruption of involvement in extremist activity	Following disruptive action or pending planned disruptive action, threat ***: ● ***[21][22] ● ***	***.

220. Within most investigations, MI5 also prioritises the SOIs into tiers. The tier of an SOI within an investigation can change regularly as the investigation progresses.

Structures within the decision-making process

221. The Strategic Intelligence Group in MI5 is specifically designed to provide assessments which inform resource-allocation decisions and challenge the assumptions of investigators on an ongoing basis.

222. Each week the Head of counter-terrorism investigations holds a meeting to review intelligence developments with updates from operational teams, input from the police and the UK Intelligence Community (UKIC), and JTAC analysis. This produces the 'grid'—MI5's 15 highest-risk investigations—and allocation of investigative resources. In addition, there is a formal system of review:

• Each week, the counter-terrorism senior management team reviews the weekly dashboard of wider investigative resourcing issues.
• The Deputy Director General approves the proposed use of intrusive investigation tools on each investigation, before they are sent through the warrantry process to the Home Secretary.
• Each week, the Director General is briefed on the main developments and risks.
• Each week, the Assistant Commissioner, Specialist Operations (ACSO) is briefed on key developments in investigations. (A senior police investigator is included in the team on every major investigation, and if there is a risk to the public then an Executive Liaison Group is set up to enable MI5 and the police to agree how to manage that risk.)
• Every month, the Head of Counter-Terrorism agrees with UKIC and JTAC any strategic shifts required.
• Every quarter there is a thorough review of counter-terrorism casework, resulting in an internal report on the counter-terrorism threat picture, which informs a strategic review of investigations.

223. Operational decisions on intervention, including what form the executive action will take, are made by the Executive Liaison Group—a body comprising senior representatives of MI5 and CTP. When the Committee asked for a brief description of the handover process whereby an MI5 investigation is handed over to CTP for executive action, Director General MI5 explained:

We [MI5 and CTP] often use the metaphor of a car being driven, and for the first portion of the journey the driver is MI5 and the passenger seat is occupied by Neil's teams [CTP]; then, at the right moment, the roles change and the police take on the driving role and MI5 remains in the passenger seat. The point of the metaphor, which may or may not work for you, is that both parties are present and have full visibility of everything throughout the process but there is clearly a need for there to be a structured conversation about when is the point when responsibility shifts and, clearly, MI5 holds no executive powers or responsibilities. That is what Neil's teams do, but they are present through the whole of the intelligence phase.^[23]

Counter-Terrorism Operations Centre

224. A national Counter-Terrorism Operations Centre (CTOC) in Empress State Building in West London is being created to bring together the London-based counter-terrorism elements of the Intelligence Community, Metropolitan Police Service and other partners. The business case for the CTOC was approved in March 2020—however, as a consequence of the Covid-19 pandemic, the decision was taken to delay entering into the full licence agreement in order to refresh the design of the building. A formal addendum to the business case was presented to HM Treasury in September 2020 in parallel with the UKIC and CTP Spending Review Bids.^[24] The Home Secretary opened the first completed section of the CTOC on 28 June 2021.^[25]

225. MI5 anticipates the CTOC will enable "even closer" MI5-CTP joint working and knowledge transfer, as well as delivering efficiencies enabling investigative teams to cope with increased overall volumes across the combined Islamist and ERWT threats. In addition to MI5 and CTP, the intelligence Agencies, and the criminal justice system, as well as other government agencies focused on tackling the threat from terrorism, will also have a presence in the building. The Head of CTP observed that a large component of Special Operations (SO15) Command are already based in the Empress Building and that the process of integrating the other Agencies and organisations to the CTOC is "timelined between now and 2025".^[26]

Resource implications

226. As of August 2020, there were *** investigative groups working on UK-based counter-terrorism, *** is fully devoted to ERWT and LASIT. This ratio can also be seen from the casework: in July 2020 ERWT and LASIT casework accounted for around under a fifth of all G Branch^[27] investigations (which had previously been managing, almost totally, exclusively Islamist terrorism investigations).^[28]

227. MI5 advised that they have absorbed the increased investigative effort on ERWT from within their existing counter-terrorist investigative cadre, with ERWT and LASIT investigations being prioritised using the same system as used for Islamist terrorism, allowing collection and analysis resources to be moved dynamically between cases, allowing them to allocate the resource necessary to counter the highest-priority threats, regardless of the ideology of the threat.^[29]

228. When we questioned the Home Secretary regarding prioritisation of ERWT, she advised that the balance of effort was kept under constant review and discussed at her weekly meetings at MI5, "just to get a sense check in terms of, you know, where the balance of threats are, the equities, are we resourced in the right way".^[30]

229. Nevertheless, in September 2020, MI5 acknowledged that taking on the new responsibility for ERWT/LASIT investigations did have an impact on the resource they are able to devote to other areas:

Given that we prioritise work on the basis of risk, within G branch the impact of taking on ERWT/LASIT investigations has fallen primarily on the *** of our *** casework, with these investigations generally progressing more slowly and having less access to collection resources. We have not, as things stand, needed to adjust our thresholds for triage and the opening of investigations. Our ability to move investigative resource across to other growing threat areas *** has also been ***.

For particularly specialised collection resources (e.g. bespoke technical operations), which are in such demand that they are deployed only on the highest priority casework, the adoption of ERWT and LASIT will also have impacted on work against ***.^[31]

230. In terms of the impact of its work in countering ***, the Director General of MI5 further explained:

As you know, we have for some years now held an ambition on widening our aperture on ***. The rise of Extreme Right Wing Terrorism has constrained our ability rapidly to grow what we would otherwise be doing on ***.^[32]

231. In contrast, the Head of CTP highlighted the tangible benefits to CTP in resource terms of the 'threat agnostic' approach, now that the ERWT threat is treated the same as the Islamist threat, as CTP no longer have to "set up completely separate teams to deal with the right-wing; we have actually brought them in. So we are more efficient, as well as more effective in this space."^[33] He confirmed that "we have got the right amount of resource which is proportionate to the current threat but, over the past five years, I would say my professional judgement is it has grown".^[34] The Director General of MI5 told the Committee that:

In the Spending review last autumn [2020] we did not bid for additional people capacity to deal with the Right Wing terrorist threat; *** because of the gains that we think will be secured once that facility [CTOC] is in existence.^[35]

However, this was caveated with the observation that a reduction in the volume of *** had been a key factor in enabling MI5 to absorb the increasing amount of work it is doing on ERWT terrorism investigations.^[36]

232. We asked the Home Secretary for her views on the viability of this current arrangement whereby MI5's ability to take on primacy for ERWT without additional resources only appears to have been made possible by a (presumably unexpected) reduction in ***. Acknowledging that prioritising risks was a "constant discussion", the Home Secretary noted that "We [the Home Office] will do our best always in terms of my own advocacy with Her Majesty's Treasury, but of course much of this is not straight out of the Home Office, it comes out from the wider pot of funding for the Intelligence and Security community."^[37]

O. MI5 have taken on responsibility for ERWT without the commensurate resources. Taking the month of July 2020 as an example, ERWT and LASIT casework accounted for around under a fifth of all counter-terrorism investigations: that casework can only be undertaken at the expense of other MI5 work. The impact has been seen on *** casework, which is now progressed more slowly, and on MI5's inability to expand its work on other threat areas as it had intended. This situation is untenable. While MI5, rightly, allocates its resources on what it assesses to be the highest priority work based on its expert knowledge of the threat, we are concerned that MI5 has been expected simply to absorb this new responsibility. MI5 must be given additional funding to enable it to conduct these cases without other areas of work suffering as a consequence.

Behavioural Science Unit

233. The Behavioural Science Unit (BSU) is a team of behavioural and social science specialists within MI5. Their specific role is to provide support and guidance to investigative desk officers and agent handlers to help them understand their SOIS better, as well as advice on a range of approaches to agent handling issues.

234. The Committee's Report on the Intelligence Relating to the Murder of Fusilier Lee Rigby highlighted the potential offered by the BSU in the counter-terrorism space, and made a specific recommendation that the unit should be integrated more thoroughly into investigations. More recently, the Committee's Inquiry into the 2017 Terror Attacks again raised the issue of the BSU and how, if at all, its role had developed in the intervening years. MI5 confirmed in 2018 that:

I think we have developed a BSU role since that time on the extent to which we use them [to assist with] CHIS, assessment of SOIS, and actions that we take about them, and, in relation to SOIs, assessment of the risk that potentially unstable people might represent. So they have been particularly acutely used since that time in the space of, you know, 'more vulnerable individuals' and the 'lone actors' sort of the space, so I think you would find the difference between 2013 and 2017, I guess is what we are looking at today, quite a marked shift in BSU integral involvement.

The one other very quick addendum I would suggest is that, in the Operational Improvement Review, in the work we are now doing to take our methodology one stage further, the BSU again is strongly woven through that. So behavioural science informs at its core the analytical work we are looking to use as we head forwards around data. So we have got an incubator happening right now in Thames House, with GCHQ in place and other colleagues there, with behavioural science methodology very strongly sort of at the centre of that particular piece of work.^[38]

235. MI5 advised that the BSU has embedded its work on ERWT within established structures for triage and prioritisation alongside their work on Islamist extremism^[39]—it also has *** members of BSU staff working closely with ERWT operational teams doing *** in this area.^[40] The Director General of MI5 noted that the BSU has been looking at ERWT for some time, ***:

the Behavioural Science Unit has been interested in this area for some years because, even before MI5 inherited operational responsibilities on Right Wing terrorism, it was an interesting area to do comparative research between different ideologies, different forms of extremism. So there is quite a reasonable level of BSU, Behavioural Science Unit, engagement in this subject . . . we just don't have the same evidence base [as with the Islamist terrorist threat], because there has been less in the way of Right Wing terrorist attacks or plots. So we are building that evidence base all the time but *** So the work is underway but it is constrained not by our wish to do the work but by the fact that there is less of it to study.^[41]

236. Once the evidence base does increase, it would be interesting to see if there is any evidence of links to drug abuse, or other traits, although we note that at present ***.

237. It is clear that the BSU is a vital capability and one that the Director General of MI5 advised is, ***, only brought in to the investigative process ***:

our Behavioural Science Unit is ***, so we typically would not involve them at the initial stage of any individual lead thing but what we do use them on is two related pieces, one of which is *** they feed in a lot of expertise there; but the other and crucial thing they have done, which I think is where your question is going, is they have done properly grounded evidence based studies of the kinds of people who have progressed later to terrorism.^[42]

The Role of the Behavioural Science Unit in ERWT casework

SOI 'A' was a *** who was referred to the BSU when he came to the attention of the authorities ***. This was reported to the police by a lecturer at his university. This information was shared with MI5 and a priority investigation was opened.

The investigation showed that 'A' held *** views and aligned himself with ***. At the time of the BSU's involvement, 'A' had ***. The BSU was asked to advise on:

the nature of his Extreme Right Wing beliefs; how his *** may affect the way in which these beliefs manifest themselves; and any additional risk arising from the wider events in his life.

The BSU discussed the case with the investigator and analysts working on the investigation, examined relevant documents, and provided an assessment that drew upon the BSU's knowledge of *** as well as our understanding of Extreme Right-Wing (XRW) beliefs.

This assessment provided the investigator with a series of hypotheses on the motivations underpinning the behaviour of 'A', as well as a series of indicators (or 'tripwires') that might be indicative of a deepening of his commitment to the XRW cause, or of mobilisation to violence.

This assessment by the BSU helped to: shape the investigator's understanding of the SOI by giving them a greater insight into the psychological impact of *** and how it would have impacted the manifestation of his extremist beliefs; and inform the strategy used by MI5 and the police as they brought the case to a successful disruption.^[43]

P. It is clear that the Behavioural Science Unit (BSU) is making a vital contribution to promoting an informed understanding of the complexities of the Extreme Right-Wing Terrorism (ERWT) threat. We are puzzled that MI5 does not appear to be taking active steps to ensure it has the capacity to be involved at the outset of all investigations. The BSU is clearly an essential capability, particularly when it comes to meeting the ERWT threat, and must be resourced appropriately.

GCHQ

238. In October 2018, MI5 requested support from GCHQ on ERWT work, and GCHQ redeployed some effort from *** in order to increase understanding of the ERWT threat online and provide tactical and strategic support to MI5. GCHQ has now established a new team *** focusing on the ERWT threat—this team will support MI5 in its highest-priority operations. In addition, the GCHQ counter-terrorism UK 'Discovery' team^[44] based in Cheltenham—which identifies individuals ***—is applying this methodology to the ERWT target.

239. In addition to specific operational support, GCHQ has been engaged with MI5 and the Home Office more broadly; in September 2020 it reported that *** had recently authorised GCHQ's first low-level operation ***.^[45]

SIS

240. SIS told the Committee that its Counter Terrorism Directorate (CTD) works closely with MI5, GCHQ and CTP, with many members of staff being co-located. In addition, SIS responds to MI5's prioritisation grid of investigations that fall outside the UK. However, in contrast to MI5 and GCHQ, SIS's work is structured differently, and SIS supports ERWT requirements as and when operationally necessary.^[46] MI5 observed that "[SIS] uses its global network in the way you might expect. When bits of threat pop up in other nations, or there needs to be some form of intervention, the network of SIS stations can be brought to bear."^[47]

---

1. Oral evidence - MI5, 29 April 2021.
2. Oral evidence - MI5, 15 March 2018.
3. Written evidence - MI5, 31 January 2020.
4. Domestic Extremism Terrorism—Letter from Director General MI5 to the ISC Chairman, 31 January 2019.
5. David Anderson QC, '2017 Terrorist Attacks—MI5 and CTP Reviews—Implementation Stocktake, Unclassified summary of conclusions', 11 June 2019.
6. MI5 written evidence—31 January 2020.
7. David Anderson QC, '2017 Terrorist Attacks—MI5 and CTP Reviews—Implementation Stocktake', 11 June 2019.
8. David Anderson QC, '2017 Terrorist Attacks—MI5 and CTP Reviews—Implementation Stocktake', 11 June 2019.
9. Oral evidence—MI5, 29 April 2021.
10. Oral evidence - CTP, 29 April 2021.
11. Oral evidence - MI5, 29 April 2021.
12. Oral evidence - MI5, 29 April 2021.
13. Written evidence - MI5, 14 September 2020.
14. www.counterterrorism.police.uk/our-network/
15. As part of the transition, in April 2020 CTPHQ Intelligence ceased operating two specific functions:
    • The National Joint Assessment Team (NJAT): the NJAT previously jointly assessed leads with CTP regional branches to ensure national consistency and delivery for ERWT. This has now been disbanded in order to ensure an agnostic approach to the Intelligence Handling Model (IHM), regardless of ideology. The IHM assessments are now undertaken by CTP and MI5 regional counterparts. (More information on the Intelligence Handling Model can be found later in this section.)
    • The Potential Lone Actor Desk (PLAD): the PLAD consisted of a small team of officers, detectives and behavioural experts. The behavioural experts were a combination of research psychologists, clinical psychologists, and clinical psychiatrists with specialisms in autism spectrum disorders. This team assisted with providing lone actor assessments on SOIS featuring in leads and priority investigations. MI5 advised that the PLAD was not transferred to MI5 as the majority of their activity on ERWT focuses on Lone Actor detection.
16. Written evidence - CTP, 2 June 2021.
17. Oral evidence - CTP, 29 April 2021.
18. Written evidence - MI5, 31 January 2020.
19. Written evidence - MI5, 31 January 2020.
20. Written evidence - MI5, 31 January 2020.
21. SOI—Subject of Interest.
22. TPIM—Terrorism Prevention and Investigation Measures Act 2011.
23. Oral evidence - MI5, 29 April 2021.
24. Written evidence - MI5, 30 September 2020.
25. 'First elements of new Counter Terrorism Operations Centre in London unveiled '- Metropolitan Police (www.metpolice.uk), 28 June 2021.
26. Oral evidence - CTP, 29 April 2021.
27. G Branch is the division within MI5 which covers international counter-terrorism.
28. Written evidence - MI5, 30 September 2020.
29. MI5 have not provided separate figures for resourcing on ERWT and LASIT.
30. Oral evidence - Home Secretary, 20 May 2021.
31. Written evidence - MI5, 30 September 2020.
32. Oral evidence - MI5, 29 April 2021.
33. Oral evidence - CTP, 29 April 2021.
34. Oral evidence - CTP, 28 April 2021.
35. Oral evidence - MI5, 29 April 2021.
36. Oral evidence - MI5, 29 April 2021.
37. Oral evidence - Home Secretary, 20 May 2021.
38. Oral evidence - MI5, 25 April 2018.
39. Two areas where the BSU's work on ERWT differs from that of Islamist extremism are: forward deploying *** with expertise in issues relating to young people in to investigative group working on ERWT threats; and *** on the diffuse ideological influences underpinning ERWT.
40. Written evidence - MI5, 26 May 2021.
41. Oral evidence - MI5, 29 April 2021.
42. Oral evidence - MI5, 29 April 2021.
43. Written evidence - MI5, 30 September 2020.
44. The term 'Discovery' describes a series of tools and methods used to identify individuals who may pose a risk in a number of areas, including online.
45. Written evidence GCHQ, 30 September 2020.
46. Written evidence - SIS, 30 September 2020.
47. Oral evidence - MI5, 29 April 2021.