

It was early-morning rush hour in London on Thursday, July 7, 2005, when a series of explosions shut down the city’s transport network. At first, the authorities suspected an electricity fault was to blame. But it soon emerged that four Islamist suicide attackers had detonated bombs on three underground trains and a bus, killing 52 people and injuring more than 700. rush hour in London on Thursday, July 7, 2005, when a series of explosions shut down the city’s transport network. At first, the authorities suspected an electricity fault was to blame. But it soon emerged that four Islamist suicide attackers had detonated bombs on three underground trains and a bus, killing 52 people and injuring more than 700. The incident, one of the worst terrorist atrocities in British history, resulted in a major overhaul of policing across the United Kingdom. The government beefed up security, introduced new counterterrorism measures, and retrained first-responders to handle major crises. The attack also reshaped British spy agencies’ tactics and led to a more aggressive use of electronic surveillance – details of which are revealed for the first time in classified documents published today by The Intercept. The documents – from the National Security Agency and its British counterpart Government Communications Headquarters, or GCHQ – offer a unique insight into how U.K. and U.S. intelligence agencies responded in the aftermath of the London bombings. They reveal how the attackers may have been able to evade detection and disclose the existence of a secret intelligence-sharing agreement designed to enable “unfettered” sharing of phone and email records across the Five Eyes, an alliance of spy agencies from the U.K., the U.S., Australia, Canada, and New Zealand. Immediately following the bombing, GCHQ developed a three-tiered strategy, according to the documents, which were obtained by The Intercept from the whistleblower Edward Snowden. The agency focused on providing operational support to the police and security services; worked on “target discovery,” sifting its databases in an effort to find information about the attackers or those connected to them; and formed a think tank called the “Blue Skies Team,” which developed new tools and techniques that could be used to identify people associated with the attackers. A surveillance base in the north of England played a key role. Menwith Hill, located about 9 miles from the small town of Harrogate in North Yorkshire, began listening in on calls that were passing between the U.K. and foreign countries. The base – a “ground station” from which spy satellites are operated – used its surveillance technology to home in on calls associated with Thuraya satellite phones, which are often used in remote parts of the world where there is no access to conventional cellphone or landline networks. “We worked with GCHQ’s International Terrorism Team to put coverage on nine U.K. cities, and compiled a list of U.K. cities and external locations (including Copenhagen, Brussels, and various locations in Spain, South Africa, and Morocco) requiring tighter focus,” explained an NSA employee who was working at Menwith Hill through the incident. “At GCHQ’s request, analysts examined calls from [Thuraya satellite] handsets that had dialed into London from Iraq.”

The radar domes of RAF Menwith Hill in north Yorkshire dominate the skyline on Oct. 30, 2007, Harrogate, England. Photo: Christopher Furlong/Getty Images

Analysts at Menwith Hill discovered that “high priority targets … had phoned specific areas in the U.K. from Pakistan, Afghanistan, Egypt, and Iraq.” They identified particular calls of interest that appeared to be coming from a compound in the self-governing Azad Kashmir region of northeastern Pakistan. The documents do not state whether a link was proven between these calls and the bombings. However, it was reported in 2012 that a British-born Al Qaeda operative named Rashid Rauf – who lived in Pakistan – helped direct the 2005 attack, which was carried out by four men, three of whom were born and raised in England, and one of whom was born in Jamaica and brought to England as a young child. The NSA worked closely with GCHQ through the investigation, providing analysis and technical advice on surveillance methods. Twenty-two NSA employees were transferred to a specialist unit to help with the effort, alongside a department called the Counterterrorism Primary Production Center. After three months, the 22 analysts moved on to other operations. But the impact of the London attack continued to be felt across the Western intelligence community. In June 2004, the Five Eyes had negotiated a secret treaty called the Alice Springs Resolution. The arrangement laid out plans for a single surveillance system that each of the five countries’ spies would be able to access. The system would be used to share metadata, which reveals information about a communication – such as the sender and recipient of an email, or the phone numbers someone called and at what time – but not the written content of the message or the audio of the call. Analysts would be able to search across all available metadata with a single query. The aim of the Alice Springs Resolution was to “enable unfettered access to metadata repositories among our five agencies,” according to an NSA document. The agreement was personally signed off by the director of each agency, presumably during a meeting held in the Australian town of Alice Springs, which hosts a large surveillance facility. The text of the resolution stated that the new arrangement was necessary due to the “increasing importance of the analysis of metadata to the generation of intelligence, particularly against the terrorist target.” The NSA later cited the agreement as a “foundational document” for the agency.