Travel Risk Analysis: London Bridge Knife Attack and UK Terrorism Risk Review

Share on facebook
Share on twitter
Share on linkedin
  • On Friday, 29 November a man wielding a knife carried out an attack on pedestrians and the attendees of an offender rehabilitation conference in the City of London, resulting in two deaths and injuries to three members of the public.

  • The individual had a history of offences relating to Islamic extremist terrorism and was being actively monitored by the security services.

  • The incident has prompted a review of the UK’s criminal justice system and a government crackdown on terrorists released from prison on licence, although this response has been criticised by some for failing to address the root cause of re-radicalisation.

  • The UK continues to face an elevated risk of attacks by both lone actors inspired by extremist propaganda and cells with operational support from domestic and international terrorist networks.

  • The nation’s terrorism threat level is currently rated as ‘substantial’ meaning that there is a persistent “direct and immediate” risk to the UK’s national security, particularly in London. However, the potential impact of such incidents is partially mitigated by the advanced capabilities of the UK’s counter-terrorism police who have demonstrated their proficiency in responding to such incidents.

What happened? The incident details

  • On the afternoon of Friday, 29 November, a man carried out a knife attack on pedestrians and attendees at an offender rehabilitation conference in Fishmonger’s Hall, located at the north end of London Bridge in the City of London.

  • The attack commenced at around 1355hrs (1355 UTC) when the perpetrator, a former inmate who was also attending the ‘Learning Together’ program anniversary event, exposed what appeared to be an explosive vest and threatened to blow-up the venue. He then began attacking people inside the building using two kitchen knives strapped to his hands.

  • Following an intervention by the other attendees who used improvised weapons to confront the attacker, he fled the building and headed south along London Bridge whilst attempting to stab pedestrians on the footpath. He was then pushed to the ground and restrained by members of the public and a plain-clothes British Transport Police officer.

  • An armed response unit arrived at the scene at around 1403hrs (1403 UTC) responding to a call made from inside Fishmonger’s Hall and surrounded the attacker. He was then pulled away from the public and shot twice, killing him instantly.

  • Two people, both young graduates working on the offender rehabilitation programme, were killed in the attack after they were stabbed in Fishmonger Hall. Two others were hospitalised with non-life-threatening injuries, whilst a third was treated for less serious injuries.

The attacker’s profile and motive

  • The suspect has been named by police as 28-year-old Usman Khan, a British national of Pakistani Kashmiri descent who has intermittently lived in Stoke-on-Trent. He is believed to have acted alone in planning and carrying out the attack and utilised crude weaponry including widely available kitchen knives and a fake explosive vest.

  • Khan was known to the British police for historic terrorism offenses and was wearing an electronic tag. He was first prosecuted in 2012 and served six years in prison on an indeterminate sentence, before being released on licence in December 2012. Khan was attending the conference as a program participant.

  • Prior to 2012, Khan had been involved in a plot to establish a terrorist cell and a madrassah (training camp/school) on his family’s property in Kashmir and had participated in the early stages of a planned attack on the London Stock Exchange. The scheme was disrupted by MI5 as part of ‘Operation Guava’ after intelligence officers intercepted a number of Khan’s online messages to fellow plotters. Khan, who was 19 at the time, was arrested and sentenced alongside eight other men.

  • Although, he was ordered to serve at least eight years of a 16-year prison sentence, Khan was granted a five-year extended licence allowing him to be released and actively monitored by the authorities, pending a recall to prison.

  • According to information provided by the UK-based de-radicalisation advocacy group Hope not Hate, Khan was a self-described supporter of Al-Muhajiroun, an illegal militant Salafi jihadist network based in Britain. The group has doctrinal links to the Islamic State (IS) and has directly inspired similar lone-wolf attacks on the public in 2013 and 2017.

  • However, according to Khan’s solicitor, Vajahat Sharif, he had become disillusioned with Al-Muhajiroun after the failed London Stock Exchange plot and had repeatedly requested the help of a de-radicalisation specialist whilst serving his sentence in HMP Whitemoor. By 2018 a panel ruled that Khan appeared to have been successfully rehabilitated, however Sharif has claimed that he is likely to have been “re-groomed” by extremists after his release.

  • On Sunday, 1 December IS claimed responsibility for the attack and that Khan was one of its fighters in a statement via its Amaq online news agency. Such announcements are typical following a high-profile terrorist incident in a western country and IS have frequently claimed to have masterminded or inspired attacks of which they had little or no prior knowledge.

The aftermath and the police response

After the initial call was made to the police, the Metropolitan Police Service promptly established a cordon around London Bridge and the immediate area to the north and advised members of the public to stay away. London Bridge overground station and Monument underground station were also temporarily closed and train services in the area were halted. The bridge remained cordoned-off for over 48 hours to allow forensic work to be carried out, although it has since been reopened to traffic. These measures are typical of a short-term response by the British police in the event of a terrorist incident.

In a statement on Friday, Metropolitan Police Commissioner, Cressida Dick, made an appeal to the public to submit film or picture evidence or any other information that could assist an ongoing investigation into the circumstances of the incident. She also announced that there will be an increased visible police presence on main thoroughfares in the City of London, although counter-terrorism officials have since stressed that officers have been deployed to reassure the public and that a follow-up attack is not anticipated. Within 24 hours of the incident, a series of raids were conducted in Stafford in the west Midlands where Khan is thought to have been living. However, no further arrests have been made and the operations are thought to have been carried out to gather evidence.

The Prime Minister Boris Johnson, who is currently campaigning ahead of a general election on 15 December, has publicly announced that 74 individuals previously imprisoned for terror offences have been released early based on the same licencing conditions as Usman Khan. This figure has been confirmed by the Ministry of Justice (MoJ). In an interview on Sunday, he also implied that the release conditions of these individuals will be reviewed and that he will “take steps to make sure that people are not released early when they commit… serious sexual, violent or terrorist offences”. On the same day police arrested a 34-year-old man his home address in Stoke-on-Trent on suspicion of the preparation of terrorist acts. Although there is no evidence to connect this individual to the London Bridge attack, he is thought to have had a similar background to Khan and was apprehended as part of a “wider on-going review of existing licence conditions of convicted terrorism offenders”. It would therefore appear that a police operation has been launched into reviewing the activity of individuals released from prison on licence.

Criticism of the criminal justice system

The profile of Usman Khand and the context of Friday’s attack have led to increased scrutiny of the British criminal justice system, in particular the conditions of release for individuals convicted of terrorism offenses. Following his trial in 2012, Khan was sentenced to a special prison term known as Imprisonment for Public Protection (IPP), meaning that he was required to serve at least eight years and could only be released following a parole board assessment. Due to a change in the law (which has since been amended again) and a review of his sentence, Khan eventually qualified for automatic release in 2018. At the time of the attack he was being actively monitored and had been granted temporary permission to visit London to attend the conference by a parole officer as he was deemed to be complying with all his release conditions.

In response to criticism over Khan’s circumstances, the UK’s Foreign Secretary Dominic Raab announced that the Conservative Party will develop a new policy to enforce a minimum sentence of 14 years for individuals convicted of serious terrorism offences. However, this reaction has been criticised by opposition politicians, civil servants and some academics who claim that increasing sentencing does not address the root causes of re-radicalisation. According to counter-terrorism analyst and previous government adviser Ian Acheson, efforts to prevent further incidents of this nature should be focused on “what is done when offenders are in custody”. He went on to blame recent government instability and frequent personnel changes at the Home Office and MoJ for a failure to adopt new prisoner treatment and risk management measures which had been suggested in 2016. It is therefore likely that the government’s ‘Desistance and Disengagement Program’ (DDP) which provides tailored counselling and direct intervention in the lives of terrorism convicts leaving jail will also be reviewed in 2020.

The terrorism threat in the United Kingdom

The UK continues to face an elevated risk of further attacks by both lone actors inspired by extremist propaganda as well as cells with more direct contact and operational support from networks like with Al-Muhajiroun. Strict gun control laws in the UK mean that low-capability weapons like vehicles or knives, rather than firearms, will remain the more likely terrorist attack options. The use of improvised explosive devices, including suicide and vehicle-borne variants, is also likely to be a favoured method of causing mass casualties, albeit one which requires significant planning and prior knowledge. There is a risk of more coordinated attacks over a larger area by small cells that could include terrorists who have fought in conflict zones such as Syria and Iraq, although the intelligence services are more likely to identify and arrest these individuals than home-grown extremists. Although London faces the highest risk of such violence, particularly during large events and national holidays, all major cities in the UK have the potential to be affected. Primary targets include civilians in public spaces and high-profile locations, on-duty police officers, restaurants and cafes, shopping centres, transport hubs and entertainment venues.

Earlier in November, the UK’s terrorism threat level was downgraded from ‘severe’ to ‘substantial’ following a review by the multi-agency Joint Terrorism Analysis Centre (JTAC). ‘Substantial’ is the third highest of five ratings categories at which the threat level can stand and is the joint-lowest rating which has been used since the scale was first introduced in 2006. The ammendment followed a period of relative inactivity in 2018 and 2019, following a string of high-profile incidents in 2017. However, the Home Office still regards there to be a “direct and immediate” risk to the UK’s national security and an attack is considered a “strong possibility”. According to JTAC, the rating warrants “additional and sustainable protective security measures reflecting the broad nature of the threat combined with specific business and geographical vulnerabilities and judgements on acceptable risk”. Friday’s attack is certain to instigate a review of the current threat level, although analysts are unlikely to raise it immediately if they categorically determine that Khan was acting alone and was not in contact with a wider network. However, MI5 will also initiate an assessment of the impact of the attack on the hundreds of suspects that the police and security services currently have under surveillance. This process can take anywhere between a week to a few months, as intelligence officers determine whether there is a risk of copy-cat actions or an increase in willingness to expedite existing plots in the aftermath.

Since 2017, physical security measures have been improved in certain key areas of London, including London Bridge where security barriers are being installed to stop would-be attackers from using vehicles to run down pedestrians. Restrictions have also been tightened on the availability of certain items like corrosive liquids alongside temporary halts on the sale of specific knives. Whilst these provisions have gone some way to reduce the potential for high-casualty incidents to occur, the nature of ‘lone-wolf’ attacks makes them largely unpredictable and difficult to disrupt. Individuals like Khan who act alone, on a whim, with limited planning and without disclosing their full intentions to anyone else are very difficult for intelligence officers to monitor as there is no trail to follow or evidence to work with. Nevertheless, the immediate response to Friday’s incident by the security services appears to have minimised the number of casualties and demonstrates the advanced capabilities of the UK’s counter-terrorism police who are well trained in responding to such incidents.