63. Terror Strikes London: What did MI5 know? (Ep 2)

0:03For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books, join the Declassified Club at therestisclassified.com.

0:20David:This episode is brought to you by NordVPN. Data breaches are rarely singular assaults. Think of a file download as the final step in a multi-stage attack. Whilst waiting for a traditional scan, you could end up exposed to other threats. That's why intercepting threats at the source is key. Neutralising those harmless-looking links, identifying and blocking those scam websites. With NordVPN's digital security app, you won't get ambushed. Much more than a VPN, their built-in next-gen antivirus stands at the forefront of your digital defenses. Anti-scam protection, anti-malware, anti-tracking privacy features, scam call filtering.

1:03NordVPN gives you that ongoing layer of protection operating in the background. To get our exclusive discount on your NordVPN plan, go to nordvpn.com slash restisclassified. It's risk-free with Nord's 30-day money-back guarantee. That's nordvpn.com slash restisclassified. The links in the episode description. For adults with Crohn's disease or ulcerative colitis symptoms, every choice matters. Tremphaya offers self-injection or intravenous infusion from the start. Tremphaya is administered as injections under the skin or infusions through a vein every four weeks, followed by injections under the skin every four or eight weeks.

1:46If your doctor decides that you can self-inject Tremphaya, proper training is required. Tremphaya is a prescription medicine used to treat adults with moderately to severely active Crohn's disease and adults with moderately to severely active ulcerative colitis. Serious allergic reactions, increased risk of infections or lower ability to fight them and liver problems may occur. Before treatment, get checked for infections and tuberculosis. Tell your doctor if you have an infection, flu-like symptoms or need a vaccine. Explore what's possible. Ask your doctor about Trimphia today. Call 1-800-526-7736 to learn more or visit TremfireRadio.com.

2:26David:Every game day you show up for your team. Now it's your time. We Go V! We Go V! Ask your prescriber about We Go V, semaglutide injection 2.4 milligrams, a GLP-1. Call 1-833-4-WEGOV or visit wegovy.com to view the medication guide and to learn more about We Go V. Why wait? We. Go. Leave!

3:06David:Breaking news we're getting from the PA Newswire that there's been reports of an explosion outside Liverpool Street Station. Well, there may be a fatality... We need ambulance, the officers of us will... to King Cross. I'm moving back, please!

3:27David:Most Londoners actually are not going to be afraid by this. I think they're going to continue their daily business. We consider the attack last week on British soil an attack on the civilised world. And what we are confronting here is an evil ideology. It is not a clash of civilisations. All civilised people, Muslim or other, feel revulsion at it. Whatever you do, however many you kill, you will fail. It might be argued by some that MI5 should put everyone they came across under surveillance, gathering intelligence on them until they were sure they did not pose a threat. Had MI5 put unidentified men, C, D, and E, under surveillance for the next 15 months, it is very possible that they would have heard them talking about their plan to bomb London, and they could have stopped them.

4:23Well, welcome to The Rest is Classified. I'm David McCloskey. And I'm Gordon Carrera. And that was a quote from a 2009 report by the Intelligence and Security Committee of Parliament called, Could 7-7 Have Been Prevented? And that, Gordon, is exactly the question we are going to look at in this episode. So last time, just to refresh our dear listeners' memories, last time we looked at what happened on the day of July the 7th, 2005 itself, this massive terrorist attack across buses and the tube in London. We looked at really, I think the first few days of the investigation to identify the four British suicide bombers who had conducted the attack.

5:06And I think within a couple of days, we left on this cliffhanger last time, it became apparent that MI5 knew of the bombers, a few of them. Now, I guess that phrase is a bit of a complicated one because they're sort of on their radar, but what does that actually mean? And I think really even the question we'll be looking at in this episode is if MI5 had come across two of these bombers before, could something different have been done to prevent these horrific attacks?

5:36David:Yeah, that's right. And it's a really difficult, really thorny question. It's one that's been looked at by inquests and oversight committees. And one of the problems is the story kind of It comes out in drips due to revelations, court cases, inquiries, which also makes it feel like something's been hidden. And it is a complicated story. We're not going to get into the weeds of it. But I think some of the detail is important because it gets to that question of could it have been prevented? But it also, I think, does quite a lot to explain what the reality of counter-terrorist investigations are really like and what the challenges are when you're trying to deal with these terrorist groups and surveillance.

6:14David:So we talked last time about how the security service emergency room at MI5 were handling all the leads. They're coming into this conference room. They're arriving in big blue crates. It is hard to remember if it's a more low-tech time. It's not yet the era in which everything is digitized, scanned and on big databases. So it's often photocopies of identity documents which are being sent in, and then it's being inputted in spreadsheets by hand, if you like, from paper onto big spreadsheets. There's not some single big database in which to look things up. And I guess, I mean, it's 2005. So we're still a couple of years away from the iPhone.

6:52Yeah. Right. So most people presumably don't have anything resembling the smartphone.

6:55David:Yeah. And you don't have the equivalent, you know, in MI5 of Google where you just put one name in or one, what they call a selector, like a phone number or a name, put it in and then just pops up everything you know about that person. You've got lots of separate databases to see if there's a match. There's no facial recognition software at this point either. So when you get a picture of someone, you're often getting a photocopy and you're having to then take that by hand or photocopy it again and hand it out to agents to say, do you recognize it? And they're building network diagrams. And in this emergency room, one person's job is to be on top of the overall picture or narrative and update it constantly so that everyone knows the bigger picture.

7:35David:And we left it last time with them finding that in their databases, they've got hits effectively. They find references to two of the bombers, Mohammed Sadiq Khan, often known as MSK, the ringleader, and also Shahzad Tamir. And they're actually going to find, and I think this is what's going to surprise people, multiple pieces of intelligence that they've got about him, but which were, if you like, separate. And you're bound to ask at this stage, aren't you? Did you miss something? Yeah. So the biggest set of leads on Mohammed Sadiq Khan or MSK came from this investigation, which was codenamed Crevice.

8:10David:And Mohammed Sadiq Khan actually appeared with the crevice plotters a number of times. Now, crevice in itself is a really interesting story. It begins in early 2003. MI5 gets intelligence that an individual from Luton in the south of England was the leader of a facilitation network for al-Qaeda in the UK. So that means helping al-Qaeda by sending money and equipment to Pakistan and Afghanistan, but not actually at that point. It's still planning an attack in the UK. And this were Britons whose families had come from Pakistan originally. Then in late January 2004, they identify one man, Omar Khayyam, as apparently a courier.

8:48David:They put him under surveillance. February 2004, surveillance of this courier, Omar Khayyam, he drives to Crawley in the south. Honda Civic parks alongside his car. Kayam gets into that car, drives for 45 minutes for a meeting with one person, while the other three who came stay in Kayam's car. They all go back to their original cars and drive off. That's a bit suspicious. This is under surveillance. So at a service station on the motorway, an MI5 surveillance team photograph secretly the three men in that Honda car who've met with a career. and they are going to be called C, D and E, unidentified males, UDMs, C, D and E.

9:29David:And then these three people are housed, which is like a technical term in MI5, which means you follow them to the address where they go next, just to get the details of that in case you need it for later investigation. Now they don't know at the time, but D was Shahzad Tanwir and E was a Mohammed Sadiq Khan. So two of those seven, seven bombers and people get out the car in Leeds and Dewsbury and the car parks at 10 Thornhill Park Avenue. The address of the register keeper they check is a woman called Hasina Patel. They check her out. They find nothing. She'd actually married Mohammed Sadiq Khan, but their marriage hadn't been registered with civil authorities.

10:06So they don't actually, at that point, have MSK's name attached to this investigation. Exactly, yeah.

10:15David:And it's a really interesting point because people would say, well, you had Mohammed Sadiq Khan under surveillance. Now, they didn't have him under surveillance in the direct sense. And then they've seen him come up in that context of the Al-Qaeda facilitator. And this is a pretty shady meeting. Yeah, it's definitely a shady meeting. And it's shady enough that MI5 have photographed Mohammed Sadiq Khan and have followed him to a house. But that's it. Then February, so just after that, this Operation Crevice changes dramatically because suddenly they get new intelligence, which I think comes from the US, that the group is planning actually to attack the UK.

10:52David:So this was thought to be a facilitation network. Now they think they're planning to make a bomb out of fertilizer. And the career, the facilitator is heard actually discussing targets, mass casualty targets, a shopping center. On February the 20th, 2004, an electronics expert arrives from Canada to help build detonators. And that same day, and this is, I think, interesting, the police anti-terrorist hotline gets a phone call from a member of the public at a storage depot saying that someone's been storing a 600 kilogram bag of fertilizer and they think it's suspicious. I think it's kind of interesting, isn't it?

11:28David:That actually a public tip-off is vital in this case to identify. It also reminds me of the tip-off against the French DGSE team in Auckland for Rainbow Warrior, if listeners remember those episodes, where pretty much the only reason that a subset of the French team was identified was that someone saw the camper van that they were in and thought it was a little bit strange and then called the authorities. So you get a whole bunch of garbage that floods in from these public tip-offs, but in some cases they do prove extremely important. And this is definitely one of them, because this is going to turn crevice into MI5's top priority of investigation at this point in 2004.

12:12David:So remember, we're still more than a year before the 7-7 bombings, their biggest counter-terrorist operation. They visit the storage unit, and then MI5 replace the fertilizer there, that 600 kilogram bag, with something inert without the group knowing. So they've minimized that threat, but they can't be sure that they haven't got more somewhere else. They basically swapped it out. And they're basically at this point making the trade-off of, if we can essentially make the explosives, not explosive. We can continue without much fear to watch this network to see how far the tentacles go out and who's involved.

12:44David:Yeah. And it's really interesting because I think this always is the question with these counter-terrorist investigations is when do you move to arrest? Yeah. Now, MI5, remember, is gathering intelligence and the police do the arresting. So they have to kind of coordinate it between them. And there's always a tension there because you want to arrest them to stop them doing something. That's obvious. But also, if you're going to prosecute them, you need enough evidence, then that's going to take time. And that might require more watching. And secondly, the more you watch them, the more you can gather intelligence about who else they know.

13:15David:Are there any other plotters? What's the network like? So there is a kind of inherent tension about when you move to arrest as opposed to just collect intelligence, I think, on this. Do you think that once the explosive was discovered and the fact that the guy who ends up becoming, you know, MSK, is effectively kind of off the radar of the investigation. Do those two things kind of happening almost within a few months of each other mean that MSK is just kind of lost in the shuffle here? Well, not entirely. Not entirely, because he's going to come up again. What's interesting is in this Crevice investigation, so on the 21st of February, just after the tip-off, there's a farewell meal for the bomb maker, and MI5 are trying to carry out surveillance.

13:58David:Some men are in a car which is bugged by MI5 and they try and transcribe the talk, but it's a bit hazy what they can get. But there seems to be conversations about fraud and about travel to Pakistan for training, some kind of activity in Pakistan and Afghanistan. Mohammed Sadiq Khan is one of those in that conversation, but they still don't have his name yet. But the view is that that conversation, again, which is suspicious, but it's not about planning an attack in the UK still. So it's not yet a top priority. Then there's more surveillance like a week after that of someone in Crevice. And they see the same Honda car they'd seen earlier with these men, CD and E.

14:37David:And there's a 500 mile round trip they do from the north of England, south of England, then back again, which again is just suspicious, just clearly for some kind of meeting. And they now check the car and they now see it's registered to a new name, a Sadiq Khan of 11 Gregory Street Batley. An MI5 surveillance team stays with the crevice plotters, but then a police team follow these unidentified men back to West Yorkshire. They're talking to the West Yorkshire police about them now. There's more meetings in March with surveillance officers, still not identified the men fully. There's a conversation at the end of March with someone about the success of the Madrid bombings, which have just happened and people are talking about, isn't it amazing, it led to a change of government in Spain.

15:25David:So only later will it turn out that one of the people in that conversation is Shezad Tanwir, another one of the 7-7 bombers, but it's not quite clear yet. But then March 2004, Crevis, this existing counter-terrorist operation, comes to a head because they think that the group are getting jumpy. There's talk they might be thinking about leaving the country. They fear that might be because they want to leave the country after hurrying to do an attack. So at that point, the MI5 and police move against the crevice plotters. So they're going to move against that group, which they thought was going to use the fertilizer bomb to carry out the attack.

15:59David:They're not going to go to trial for some time after 7-7, so the details aren't public. But they've arrested them. And then you crucially get this point, which is, OK, we've got them out of the way. Let's look at their contacts. Look at who's left. Yeah, let's look at who's left. And at this point, do they know MSK or Shazad Tanwar's name? Do they even have the names? I mean, they have MSK's wife's address. Yeah. They've also, for instance, got Sadiq Khan for one of the cars. So they've got traces. And MI5 is asking the local police up in this Leeds area for further inquiries on the addresses and the cars and the names.

16:40David:But they don't quite, the names are a bit different. And as they're starting to work through the contacts of the Crevice investigation, and they've got, I think, 4 ,000 telephone contacts to look at. But then another group comes up. So you get another big counter-terrorist operation. So you've cleared Crevice. Then you get a separate one called Operation Rhyme. I remember this one as well, which was the summer of 2004, which was a group of pretty serious Al-Qaeda plotters planning attacks with limousines or big cars packed with gas cylinders, maybe even dirty bombs. So now suddenly this takes up most of MI5's resources.

17:13David:This becomes the priority. And once they're arrested, August, I think, 2004, you then get a load more contacts, which MI5 have got to work through to check out, well, who of their contacts are dangerous. So what you can see is each new operation and set of arrests is throwing up more contacts and then pushing down, working through the older contacts, down the list, if you like. So basically, MI5 are playing catch up at this point. in the bin Laden series, right? We talked a lot about how the path to eventually finding him after 9-11 led through this one courier. And there is this kind of slow process of going from the courier's war name to his true name to a family phone number to his like, so you kind of go through this methodical thing.

17:56In retrospect, it all seems very clear. Yeah. And maybe somewhat obvious. But I think in this case, maybe not giving MI5 enough credit to sort of look at it in retrospect and say, well, look, these future 7-7 bombers here in 2004 are kind of up to some pretty shady stuff with another group that looks to be conducting attacks in the UK. You can almost spin it to look maybe almost obvious. They should have been looked at more closely. But the reality at this time is all of the work that MI5 is doing, it's a resource decision of like, how do we take limited scarce resources and use them and point them at the most direct threats?

18:35Yeah. And you'd have to say looking back at this, I think that it's not at all obvious. Yeah. Yeah.

18:40David:That these guys should have been maybe higher on the list. It's interesting in one of the oversight reports, it says in 2001 MI5, you have about 250 primary investigative targets by July 2004. So about this time of the crevice arrest, that's gone to 500. By the time of 7-7, it's gone to about 800. So they've got a lot of investigative targets. And Jonathan Evans, who's later head of MI5, tells the oversight committee they can only hit the crocodiles nearest the boat. You imagine you're in the boat and crocodiles are snapping. You're just basically hitting the ones which are nearest. And the priority is to go after people who look like they're planning attacks in the UK against the UK.

19:18David:And then that pushes down other contacts further down the list. Now, I think the one criticism, which I think is fair, is it makes sense to look at the ones who are planning attacks. But the harder thing is to look at what if someone is on a journey towards planning attacks. And effectively, they're looking at people and prioritising people who they can say, right now, we see evidence that they are planning an attack on the UK. They go to the top of the list. Everyone else goes further down. But I think they're not prioritising. prioritizing and i think they accept this one of the witnesses from mi5 in the inquest says you know we weren't sufficiently considering people who were on a journey to to move up towards attack planning you know and that was where the resource issue comes up and what it means is muhammad sadiq khan and shazad tamwir are not themselves investigative targets for top surveillance or to be investigated their contacts who mi5 is kind of looking at and saying to the police do you know anything about these guys.

20:18David:They're on the list, but they're not priority targets. Right. And they're not really under surveillance. No. People have followed them, but only because they've met someone who is under surveillance, if you like, rather than them being classified as surveillance targets. But it is true, right, that, and again, this is a counterfactual, but if they had been prioritized differently and put under proper surveillance, it is true that the 7-7 attacks probably would have been prevented, right? Because they would have seen the preparations ongoing and then done something similar to Crevice where they disrupt the bomb making.

20:53And that was that quote you read

20:55David:at the start from the Intelligence Security Committee, which basically says, if they'd been under continuous surveillance, these men who are known as C, D, and E, for the 15 months from Crevice until 7-7, then yes, you would have spotted them. But the report goes on to say, to do that level of surveillance on someone where you didn't have the indications they were planning an attack, you'd need a very different organization. You'd need a much bigger MI5, which operated in a different way. So I think that's one of the questions which I think comes up from this is, if you wanted all of the targets to be put under surveillance, and to still be under surveillance for months, even before they're spotted as planning an attack, you need a much more intrusive and larger security service than we had at the time.

21:41David:We didn't have that. And would you want that as well. It's kind of an interesting question. But maybe there to tease that would be a Pakistan connection here that is going to emerge over the course of this investigation. But let's take a break. When we come back, we'll see how some intelligence supplied maybe by the Americans also becomes key into breaking open this Pakistan connection to the 7-7 bombings. See you after the break.

22:13Football moves quickly now. Teams have more data than ever. But the real skill is knowing what actually matters. And it's exactly the same in business. The problem is work gets scattered across platforms. The info is there, but with so much noise, it's easy to drop the ball. That's why Atio is useful. It's an AI CRM designed for how teams actually operate today. Fast and in sync. By connecting your tools, you get a complete picture of your business. So while others are scrambling for answers, you just ask Atio what you want to know and you get to the right answer faster. When everything's moving quickly, that sort of clarity matters.

22:55Ask more from your CRM. Ask Atio. Try Atio for free at A-T-T-I-O dot com slash goal hanger. This episode is brought to you by the National Archives. It's Tom Holland here from Goalhanger's The Rest is History. Now, American independence is often painted as a quest for freedom,