The morning after an explosion on an underground train at Parsons Green station, Londoners got news that everyone had been waiting for – the police had made a significant arrest in connection with the incident. Media reports suggest that the 18-year-old man in custody is the person who planted the bomb.
No one died and the bomb failed to go off as planned, but 29 people were nevertheless injured in the incident on September 15.
London, of course, is no stranger to a sustained bombing campaign by a terrorist organisation. The IRA left explosive devices across the city and on its trains during the Troubles in Northern Ireland. However, the contours of what terrorists do while they are carrying out attacks has changed since then and continues to change. The response by the security agencies to their actions therefore needs to change too.
The IRA planted explosive devices quietly, and after a point of time started phoning the authorities to inform them of the threat. The result was large scale and frequent disruption of public transport and daily life – but the loss of life was not what it could have been.
When a new wave of attacks started to hit the UK and Europe in the 2000s, the perpetrators were either killed in an explosion (Hasib Hussain in 2005 and Salman Ramadan Abedi in 2017), shot (Khalid Masood, 2017; Rachid Redouane, 2017) or captured (Michael Adebolajo, 2013) at the crime scene.
Over the past 12 months, however, a visible change has been happening in terrorist tactics. Some perpetrators have been able to flee the scene after committing a major attack. Before Parsons Green, it happened in Berlin (December 2016), Stockholm (April 2017) and Barcelona (August 2017). In each case, the assailants drove their vehicles into crowds, and left the crime scenes immediately after.
The pursuit of a dangerous individual or group that has already killed or injured people and is still on the run poses several new challenges for security agencies. The attackers continue to pose a very real risk as long as they remain at large. This is one of the reasons why in the past few incidents (including the one at Parsons Green) the UK Joint Terrorism Analysis Centre (JTAC) has raised the terror threat level from “severe” (meaning an attack is highly likely) to “critical” (meaning an attack is expected imminently). It remained at that level until the authorities were confident that everyone involved in each incident had been captured or neutralised.
Immediately after an incident, the police’s first objective is to secure the site of the attack, and prevent other attacks. Of particular importance, here, is the time it takes the police to identify and stop the perpetrator(s). With failed explosive attacks, it’s not immediately obvious where and when the offenders leave the area. They could plant a device and leave before the deflagration or, in the case of a failed suicide bomber, run away among their victims.
In the hours after the Parsons Green attack, the investigators and forensic scientists working on the incident would have engaged in a tremendous investigative effort to identify and locate the offender. Shortly after arriving at the scene, they will have collected witness statements, CCTV footage, photos and videos from people’s mobile phones, and analysed mobile phone calls in the area. They would also have paid close attention to financial transactions (oyster cards), as well as the weapon and any other items that the offender might have left at the scene.
It’s a major challenge for the police to quickly identify the perpetrator of an attack, trace their escape route, track them down and make an arrest. It is, however, a job that the police is getting better at. After the 2005 London bombings, it took about six days for the London police to accumulate the evidence needed to identify the perpetrators. In comparison, they arrested Damon Smith – the student who planted a device on the Jubilee line (London) in October 2016 – a day later.
Security agencies use surveillance techniques of the kind seen on reality shows like The Hunted to zone in on targets like Smith. These include going through the email and social media history of suspects, scrutinising their bank statements and scouring CCTV footage from places of interest both before and after the attack. Most importantly, a channel of real time information exchange is immediately established between the command centre coordinating the manhunt and scores of police officers and informants on the ground who act as eyes and ears.
The shorter time it is taking to identify and arrest attackers cannot be attributed to improvement in police practices alone. Every incident and attacker differs in many ways that influence how long it takes for them to be caught. However, what is apparent is that in this new form of terrorism, where attackers are leaving the scene of the incident, greater capability is needed by the police to respond in the hours afterwards.
The four-day journey across Europe of the man who carried out the attack in Berlin is a chilling reminder of how far terrorists can get, even after carrying out a deadly attack and being on the radar of every possible security agency.