The revelation that there are now nearly 700 live terrorism investigations lays bare the scale of the threat confronted by Britain’s counter-terror agencies.
There are around 3,000 active “subjects of interest”, plus a wider pool of more than 20,000 individuals who have previously featured in inquiries who are kept under review.
So how do security services decide where to focus their resources?
Since 2011, MI5 and the counter-terror police network have used a “triage” process for sorting incoming threat intelligence.
The system is regularly reviewed for adjustments according to the “waxing and waning” of risk.
On receipt, new intelligence is tested for links to existing investigations.
If there is a connection to an ongoing inquiry, the information is passed to the relevant team.
If not, the intelligence is assessed to establish whether a new lead or investigation should be opened.
A lead is intelligence or information that is not linked to an ongoing investigation that, after initial assessment, suggests activities of “national security interest”.
Investigations are given a priority according to the risk they carry. There are four broad categories:
– Priority 1: Investigations into individuals or networks where there is “credible and actionable” intelligence of attack planning.
– Priority 2: Investigations into high and medium-risk extremist activity, such as a serious intent to travel overseas and fight, terrorist training or large-scale fundraising.
– Priority 3: Investigations into uncorroborated intelligence, where further action is needed to determine whether a threat exists.
– Priority 4: Investigations into individuals who have previously posed a serious threat to national security, who are not currently deemed to be involved in such activities, but where there is a risk of “re-engagement”.
Targets will be prioritised according to their position or importance within most probes.
These can fall into three tiers – the main targets of an investigation; key contacts of the main targets; and contacts of tier 1 and 2 targets who are likely to be involved only in marginal aspects of activities being examined.
There are no strict rules for what resources are given to a particular investigation.
Priority levels are regularly tested at senior level and can be changed to take account of shifts in activities or aspirations of individuals or networks being monitored.
A report from Parliament’s Intelligence and Security Committee published in December revealed that MI5’s counter-terrorism activities are increasingly focused on “high-risk casework”.
This typically relates to individuals who have received terrorist training or are attempting to procure the means to carry out an attack, but who may not yet have a current attack plan.
Previously, such cases represented a smaller share of MI5’s work, with a greater proportion being “slower burn” and requiring less resource-intensive monitoring, such as radicalisation or fundraising cases.