Select Committee on Home Affairs Fourth Report

Appendix: Police briefing note

5th October '05

Anti Terrorist Branch (SO13)

Three month pre-charge detention

This paper will set out the issues from a police perspective which are driving the need for a pre-charge period of detention in terrorist cases which, subject to regular judicial oversight, might extend for a period of up to three months. The paper will be divided into three sections as follows:

—  The overall case for change from current arrangements

—  Actual case studies derived from recent investigations

—  A theoretical case study drawing together many of the issues into one 'storyline'.

The Case For Change

Throughout the campaign waged by Irish terrorists, the concept of counter-terrorist investigation focussed on interdicting the terrorist at or near the point of attack. This enabled the best evidence to be obtained, in terms of catching the suspect in possession of terrorist material, or at a point where the evidence as to his intentions was unequivocal. In the times when the requirements of disclosure were not so stringent, this approach enabled the intelligence agencies, their techniques and investigations to be shielded from exposure in judicial proceedings.

The threat from international terrorism is so completely different that it has been necessary to adopt new ways of working. Irish terrorists deliberately sought to restrict casualties for political reasons. This is not the case with international terrorists. The advent of terrorist attacks designed to cause mass casualties, with no warning, sometimes involving the use of suicide, and with the threat of chemical, biological, radiological or nuclear weapons means that we can no longer wait until the point of attack before intervening. The threat to the public is simply too great to run that risk. During every counter-terrorist investigation a balance is struck between the maintenance of public safety, the gathering of evidence and the maintenance of community confidence in police actions Public safety always comes first, and the result of this is that there are occasions when suspected terrorists are arrested at an earlier stage in their planning and preparation than would have been the case in the past. In one recent case it was not possible to be sure that the terrorists were not about to mount an attack, and so the decision was taken to arrest. At that point there were more than ample grounds to make the arrests, but there was little or no admissible evidence. That had to be gathered during the following 14 days, with key parts of the evidence emerging by chance from a mass of material at the very end of that period.

The heart of the issue is this. Public safety demands earlier intervention, and so the period of evidence gathering that used to take place pre-arrest is often now denied to the investigators. This means that in some extremely complex cases, evidence gathering effectively begins post-arrest, giving rise to the requirement for a longer period of pre-charge detention to enable that evidence gathering to take place, and for high quality charging decisions to be made.

Aside from the changed concept of operation described above, there are a number of specific features of modern terrorism that drive the need for an increased period of time to be available before the decision to charge or release can properly be made. These can be summarised as follows:-

—  The networks are invariable international, indeed global in their origins and span of operation. Enquiries have to be undertaken in many different jurisdictions, many of which are not able to operate to tight timescales.

—  Establishing the identity of suspects often takes a considerable amount of time. The use of forged or stolen identity documents compounds this problem.

—  There is often a need to employ interpreters to assist with the interview process. The global origins of the current terrorist threat has given rise to a requirement, in some recent cases, to secure the services of interpreters who can work in dialects from remote parts of the world. Such interpreters are difficult to find. This slows down the proceedings, restricting the time available for interview.

—  Terrorists are now highly capable in their use of technology. In recent cases, large numbers (hundreds) of computers and hard drives were seized. Much of the data was encrypted. The examination and decryption of such vast amounts of data takes time, and needs to be analysed before being incorporated into an interview strategy. This is not primarily a resourcing issue, but one of necessarily sequential activity of data capture, analysis and disclosure prior to interview.

—  The forensic requirements in modern terrorist cases are far more complex and time consuming than in the past, particularly where there is the possibility of chemical, biological, radiological or nuclear hazards. Following the discovery of a 'bomb factory' in Yorkshire after the 7th July attacks in London, it was over 2 weeks before safe access could be gained for the examination to begin. It took a further 6 weeks to complete the examination. The Al Qaeda methodology of mounting simultaneous attacks inevitably extends the time it takes for proper scene examination and analysis.

—  The use of mobile telephony by terrorists as a means of secure communication is a relatively new phenomenon. Obtaining data from service providers and subsequent analysis of the data to show linkage between suspects and their location at key times all takes time.

—  There is now a need to allow time for regular religious observance by detainees that was not a feature in the past. This too causes delay in the investigative process during pre-charge detention.

—  A feature of major counter-terrorist investigations has been that one firm of solicitors will frequently represent many of the suspects. This leads to delay in the process because of the requirement for consultations with multiple clients.

All of the above factors have contributed to the requirement, in the most serious and complex cases, for there to be the possibility of extended detention for the purposes of investigation prior to point of decision about charging or release. It is not an issue that can be resolved simply by putting more resources into the investigation. Certainly this can help, in turns of ensuring that as much material as possible is available to investigators and to prosecutors. However, the process of staged disclosure to the defence, consultation with clients to take instructions, interview and assessment is essentially sequential, which the application of extra resources will not materially shorten.

Case Studies

Operation Springbourne 2002-2005—the so-called 'ricin' plot. This was a wide ranging investigation into a network of Algerian extremists who were engaged in terrorist activity. Some of this activity was clearly terrorist in nature, but at the same time there was a great deal of peripheral supporting activity involving the use of forged documents, cheque and credit card fraud and the like. The investigation ran over several months and spanned not only the UK but some 26 other jurisdictions as well. Many of those jurisdictions (especially those with an inquisitorial system) work to extended timescales in such cases, and cannot respond to our enquiries within the timeframes demanded by our pre-charge time limits. The challenge was to analyse a huge amount of material, to identify the prime conspirators (and what it was they were plotting to do), and to clarify the roles played by each of the suspects. This proved impossible in the time available, and the result was that several suspects were originally charged with terrorist offences who were eventually proceeded against for crimes such as fraud or forgery. This is symptomatic of the current situation where investigations have to be shaped to fit the procedural requirements of the time-limited charging procedure, rather than simply following the evidence in an objective search for the truth. Had there been the opportunity to understand the complexities of the conspiracy before the decision was required to charge or release, the right charges against the right people could have been determined from the outset. The quality of the original charging decisions would also have been higher, and it is probable that the suspect who fled the country while on bail and who eventually proved to have been a prime conspirator, would have stood trial in this country. If that had happened, the outcome of the trial process might have been very different.

Operation 2004 (this case is sub-judice and it would therefore be inappropriate to release further details)

This case was concerned with a group of British men who, it will be alleged at trial, were planning to construct and detonate a bomb in the UK. A long-term surveillance operation led to the arrest and charging of 8 men with offences of conspiring to cause explosions. The investigators are of the opinion that if the decision to charge could have been delayed while the investigation developed and the precise role of individuals became clearer, then the outcome in terms of admissions, intelligence and evidence against key individuals might have been different. It can reasonably be argued that in this case the current system worked contrary to the overall objective of preserving public safety. The silence of the suspects, encouraged by current custody time limits, shed no light on the intentions or capabilities of the terrorist network. The case will be heard in January 2006.

Operation 2004—(this case is sub-judice and it would therefore be inappropriate to release further details)

This investigation focussed on a group of British men who, it will be alleged at trial, were engaged in terrorist reconnaissance and planning in the US and the UK. After their arrest in August 2004, a vast amount of material was recovered in searches, including some 90 hard drives, much of the content of which was encrypted. The sheer weight of material to be analysed and the number of suspects in custody meant that it was impossible, within the 14 days, to complete a fuller investigation. There were many key pieces of evidence which police were unable to put to the suspects in interview because they were not discovered until after the detention period had elapsed.

Operation 2005—(this case is sub-judice and it would therefore be inappropriate to release further details)

This is the investigation into the attacks in London on 21st July 2005. One of the suspects has already raised the defence that he intended to do no more than cause a demonstration of some sort, but not to kill anyone. It is possible that this defence will be followed by others. If there had been the opportunity to delay charging, this would have been taken. A definitive analysis of the explosive devices would have enabled an interview strategy to be constructed that would be based on firm knowledge of the nature of the devices, rather than a very limited assessment. The point in this case, as with those quoted above, is that an extended period of detention would enable the quality of material disclosed to the defence in advance of interviews, to be immeasurably improved.

Theoretical Case Study

This case study has been constructed with the assistance of the Crown Prosecution Service and draws upon issues that have arisen in many real cases. The statistics used are entirely typical of the scale of events that have been seen in terrorist investigations in recent years.

The Security Service are told by an agent that a group of men in various parts of the country are planning terrorist attacks on the Houses of Parliament and the British Embassies in Pakistan, Istanbul and Morocco. They have been exploring conventional and homemade explosives as well as CBRN possibilities. It is believed that this will be carried out in 3 months time. The agent is reliable and his information must be acted on for public safety reasons.

Surveillance is started on 2 of the men identified and over a period of 2 months they are seen with numerous other people. All of the people seen are unknown to intelligence services and cannot be identified. 5 key addresses were identified and probes put into each over the period.

The agent does not know where the dangerous materials are being stored or where they have been obtained from although he believes that some might have been brought in from abroad. The men are believed to be all illegal entrants to this country and are each living on at least 2 false identities.

Police arrest 15 people following the execution of Terrorism Act warrants in 4 different areas of the country on day 1. Each arrest requires time-consuming custody procedures; sterile arrest, transportation to the secure suite at Paddington Green, the forensic examination of prisoners and taking of evidential samples. The samples are particularly important as it is thought that the men are not who they purport to be and/or not from the countries they claim to come from. Each has at least one false passport.

These procedures have to be completed before any detained person can consult with their legal representatives. On this occasion they took about 8 hours for each person. Some could be conducted simultaneously, but some (like booking in with the Custody Sergeant) had to be done individually.

The fingerprints are sent to 5 different countries to see if the men can be properly identified.

With 15 people under arrest, a disclosure strategy was required so as to achieve the best evidence from the interviews and test the accounts given. This was done whilst the defendants were being examined and other procedures carried out, and whilst the police were waiting for the solicitors to arrive. Each disclosure package given to the respective legal representative required lengthy consultations with the detainees.

2 firms of solicitors represented all the detained men. Their representatives were not available immediately; the police had to wait 4 hours for one and 5 for another. Each firm only provided 2 representatives. The initial consultations with each client lasted on average 4-5 hours. This time took up some of the time available to the officers to conduct their detailed interviews and enquiries, the clock did not stop running whilst the detainees were taking legal advice.

In addition all 15 men need to be allowed to observe prayer 5 times a day and all say that they need an interpreter.

In the first 14 days a total of 165 interviews were conducted. Most of the suspects are saying nothing, but as more evidence is put to them by the 14th day, 2 appear to be getting concerned and might talk.

Within the first 4 days of detention, 55 forensic searches were conducted around the country involving residential and non-residential properties and vehicles, again involving an enormous amount of work by officers to speedily assess the relevance of exhibits within the time limits imposed.

Each of these required a separate warrant and information received led the police to believe that there could be CBRN material on the premises as well as possibly conventional and homemade explosives. This meant that specialist teams had to be deployed and some of the premises were unsafe to enter until various forms of risk assessments had been done and procedures carried out. There are only a limited number of specialists available to do this work and it was only possible to do one premise at a time. 10 of the premises require this procedure and were in three of the different parts of the country, some about 5 hours drive away from the other.

During this period of time a vast amount of exhibits were seized during the searches. This had to be examined, prioritised, sifted for relevance, an assessment made of which individual should be questioned about which exhibit and a decision made on which should be sent to experts in chemical weapons, which on biological, which to FEL and which to the AWE.

There were about 4,000 exhibits labelled in the first week with many more outstanding for examination. At least half of the documentary exhibits (about 600) are in Arabic. Most of the available interpreters are being used for the interviews and after trawling the country police manage to locate another 3 who can begin on the documents. There are also several boxes of videos tapes the contents of which the police do not know until they have been viewed. There are no labels on them. A cursory viewing of a handful shows that they are extremist in nature and mostly with Arabic voiceovers or individuals speaking in Arabic on. There is little point in the officers viewing these further as they cannot understand them.

A decision had to be taken about where each of the exhibits should go first. It is decided to fingerprint 300 documents first. Half of these are handwritten and will also need to be examined for handwriting analysis. All the identification documents found (at least 100) need to go for expert analysis to see if they are false. 15 of these are French, 10 each are Spanish Italian and Turkish, but the majority appear to be of Eastern European extraction, maybe Bosnian, and all have to be submitted to their country of origin to check whether they are genuine.

There have been over 268 computers seized together with 274 hard drives, 591 floppy discs, 920 CD DVDS and 47 zip discs. The High Tech Crime Unit say that every computer hard drive seized during that period of time takes a minimum of 12 hours to image for the assessment teams at Paddington to then provide to the interviewing officers. The preliminary assessments carried out, due to the time constraints imposed, cannot be considered as thorough and have to be revisited as other factors emerge and different matters become relevant. About a quarter of the computers and hard drives have encrypted material on them and the suspects are refusing to give the keys saying that the computers, even those found in identifiable homes, are nothing to do with them. Assistance is required from a number of agencies here and abroad with regard to this and an assessment has to be made about which computers to prioritise.

It is not clear which of these computers was used the most as the man believed to be the leader and 2 others have been itinerant, using at least 20 of the known addresses over the last 6 month period.

The main suspect was of no fixed abode. He had items of personal property at a number of addresses. Some in false; fingerprint and DNA work done in the first 4 weeks enabled police to establish this.

During the first two weeks 60 seized mobile telephones, mostly pay as you go, were forensically examined. The sheer volume of material to be gathered from these examinations meant that much of it was not available until the 6th week of investigation. This evidence is crucial as it is needed to corroborate associations and prove movements. DNA analysis is required to discover which telephones have been used by which suspects, again because they have used or visited many addresses.

Some 25,000 man hours were spent examining CCTV footage. Some 3674 man hours are used to assess the eavesdropping material gathered by probes operating 24 hours each day over an 8 week period. There are 850 surveillance and observation point logs that must be assessed for their evidential value. This evidence will be crucial to establish who was present at which meetings and what was said.

In the first 4 weeks the police identified 6000 actions in the investigation. 10,000 documents, 2300 statements and 7000 exhibits have been seized or created by week 8 of the investigation. Crucial evidence is still awaited from DNA, other scientific work and from various foreign enquiries coming in gradually over the period of detention.

Letters of request for legal assistance in gathering evidence abroad have been written by prosecutors and sent through emergency channels to 17 countries.

As the enquiries progress more addresses are being identified, more searches done and more exhibits, computers and false documentation with photographs of the suspects and others are being discovered. In amongst the documents are some bearing the picture of a well known international terrorist being held in custody in another country where it is not easy for the police to obtain access or information. This might be a crucial link with some of the suspects being held and an approach needs to be made through diplomatic channels.

Throughout the detention period it is becoming abundantly clear that there were plans to use a dirty bomb in the Houses of Parliament, conventional explosives for an attack on 2 of the Embassies and a possible chemical attack on the third. Each suspect has several identities. We are waiting to hear if the requested countries can establish the true identity of the men. Fingerprints of each man are being found on some documents of a suspicious nature. It is unclear however which role each man took and whether they can be linked to any or all of the planned attacks.

The case is largely circumstantial as no chemicals or explosives or anything else of that nature has been found despite the fact that the targeting document (found on the 50th computer to be examined in the 7th week) shows that the attack on Parliament was due to take place 2 days after the arrests.

2 prosecutors are working full time with the Anti Terrorist Branch making applications to extend pre-charge detention, drafting initial and supplementary letters of request and reviewing the evidence as the investigation progresses. Experts from 10 different disciplines are working on exhibits and documents seized as well as scouring addresses and cars for explosive and other traces and ¾ of the police capacity has been involved in various actions including examination of exhibits, computers, interviewing, etc.

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2006
Prepared 3 July 2006