In wake of Westminster incident, huge number of live cases raises questions over best way to prevent attacks

This article is more than 2 years old

This article is more than 2 years old

The investigation into the alleged terror attack outside parliament is one of hundreds being conducted by authorities in the UK.

Downing Street officials revealed on Tuesday that counter-terror police and MI5 had 676 investigations open at the end of June.

Police and the security services have previously said there are around 3,000 active “subjects of interest” plus a wider pool of more than 20,000 individuals who have featured in inquiries and are kept under review.

The staggering numbers raise questions – particularly when an individual slips through the net – about how security services decide where to focus their resources. The Met police on Tuesday said the suspect in Tuesday’s incident, Salih Khater, did not appear to be known to authorities.

Since 2011, MI5 and the counter-terror police network have used a “triage” process for sorting incoming threat intelligence. The system is regularly reviewed for adjustments according to the “waxing and waning” of risk.

On receipt, new intelligence is checked for links to existing investigations. If there is a connection to an ongoing inquiry, the information is passed to the relevant team. If not, the intelligence is assessed to establish whether a new lead or investigation should be opened.

A lead is intelligence or information not linked to an ongoing investigation that, after initial assessment, suggests activities of national security interest.

Investigations are given a priority according to the risk they carry. There are four broad categories:

Priority 1: investigations into individuals or networks where there is “credible and actionable” intelligence of attack planning.

Priority 2: investigations into high- and medium-risk extremist activity, such as a serious intent to travel overseas and fight, terrorist training or large-scale fundraising.

Priority 3: investigations into uncorroborated intelligence, where further action is needed to determine whether a threat exists.

Priority 4: investigations into individuals who have previously posed a serious threat to national security, who are not currently deemed to be involved in such activities, but where there is a risk of “re-engagement”.

Targets will be prioritised according to their position or importance within most investigations. These can fall into three tiers: the main targets of an investigation; key contacts of the main targets; and contacts of tier 1 and 2 targets who are likely to be involved only in marginal aspects of any activities.

There are no strict rules for what resources are given to a particular investigation.

Priority levels are regularly tested at senior level and can be changed to take account of shifts in activities or the aspirations of individuals or networks being monitored.

A report from parliament’s intelligence and security committee published in December revealed that MI5’s counter-terrorism activities were increasingly focused on “high-risk casework”.

This typically relates to individuals who have received terrorist training or are attempting to procure the means to carry out an attack, but who may not yet have a current plan.

Previously, such cases represented a smaller share of MI5’s work, with a greater proportion being “slower burn” and requiring less resource-intensive monitoring, such as radicalisation or fundraising cases.