Appendix: Police briefing note
5th October '05
Anti Terrorist Branch (SO13)
Three month pre-charge detention
This paper will set out the issues from a police
perspective which are driving the need for a pre-charge period
of detention in terrorist cases which, subject to regular judicial
oversight, might extend for a period of up to three months. The
paper will be divided into three sections as follows:
— The
overall case for change from current arrangements
— Actual case studies derived from recent
investigations
— A theoretical case study drawing together
many of the issues into one 'storyline'.
The Case For Change
Throughout the campaign waged by Irish terrorists,
the concept of counter-terrorist investigation focussed on interdicting
the terrorist at or near the point of attack. This enabled the
best evidence to be obtained, in terms of catching the suspect
in possession of terrorist material, or at a point where the evidence
as to his intentions was unequivocal. In the times when the requirements
of disclosure were not so stringent, this approach enabled the
intelligence agencies, their techniques and investigations to
be shielded from exposure in judicial proceedings.
The threat from international terrorism is so completely
different that it has been necessary to adopt new ways of working.
Irish terrorists deliberately sought to restrict casualties for
political reasons. This is not the case with international terrorists.
The advent of terrorist attacks designed to cause mass casualties,
with no warning, sometimes involving the use of suicide, and with
the threat of chemical, biological, radiological or nuclear weapons
means that we can no longer wait until the point of attack before
intervening. The threat to the public is simply too great to run
that risk. During every counter-terrorist investigation a balance
is struck between the maintenance of public safety, the gathering
of evidence and the maintenance of community confidence in police
actions Public safety always comes first, and the result of this
is that there are occasions when suspected terrorists are arrested
at an earlier stage in their planning and preparation than would
have been the case in the past. In one recent case it was not
possible to be sure that the terrorists were not about to mount
an attack, and so the decision was taken to arrest. At that point
there were more than ample grounds to make the arrests, but there
was little or no admissible evidence. That had to be gathered
during the following 14 days, with key parts of the evidence emerging
by chance from a mass of material at the very end of that period.
The heart of the issue is this. Public safety demands
earlier intervention, and so the period of evidence gathering
that used to take place pre-arrest is often now denied to the
investigators. This means that in some extremely complex cases,
evidence gathering effectively begins post-arrest, giving rise
to the requirement for a longer period of pre-charge detention
to enable that evidence gathering to take place, and for high
quality charging decisions to be made.
Aside from the changed concept of operation described
above, there are a number of specific features of modern terrorism
that drive the need for an increased period of time to be available
before the decision to charge or release can properly be made.
These can be summarised as follows:-
— The
networks are invariable international, indeed global in their
origins and span of operation. Enquiries have to be undertaken
in many different jurisdictions, many of which are not able to
operate to tight timescales.
— Establishing the identity of suspects
often takes a considerable amount of time. The use of forged or
stolen identity documents compounds this problem.
— There is often a need to employ interpreters
to assist with the interview process. The global origins of the
current terrorist threat has given rise to a requirement, in some
recent cases, to secure the services of interpreters who can work
in dialects from remote parts of the world. Such interpreters
are difficult to find. This slows down the proceedings, restricting
the time available for interview.
— Terrorists are now highly capable in
their use of technology. In recent cases, large numbers (hundreds)
of computers and hard drives were seized. Much of the data was
encrypted. The examination and decryption of such vast amounts
of data takes time, and needs to be analysed before being incorporated
into an interview strategy. This is not primarily a resourcing
issue, but one of necessarily sequential activity of data capture,
analysis and disclosure prior to interview.
— The forensic requirements in modern terrorist
cases are far more complex and time consuming than in the past,
particularly where there is the possibility of chemical, biological,
radiological or nuclear hazards. Following the discovery of a
'bomb factory' in Yorkshire after the 7th July attacks in London,
it was over 2 weeks before safe access could be gained for the
examination to begin. It took a further 6 weeks to complete the
examination. The Al Qaeda methodology of mounting simultaneous
attacks inevitably extends the time it takes for proper scene
examination and analysis.
— The use of mobile telephony by terrorists
as a means of secure communication is a relatively new phenomenon.
Obtaining data from service providers and subsequent analysis
of the data to show linkage between suspects and their location
at key times all takes time.
— There is now a need to allow time for
regular religious observance by detainees that was not a feature
in the past. This too causes delay in the investigative process
during pre-charge detention.
— A feature of major counter-terrorist
investigations has been that one firm of solicitors will frequently
represent many of the suspects. This leads to delay in the process
because of the requirement for consultations with multiple clients.
All of the above factors have contributed to the
requirement, in the most serious and complex cases, for there
to be the possibility of extended detention for the purposes of
investigation prior to point of decision about charging or release.
It is not an issue that can be resolved simply by putting more
resources into the investigation. Certainly this can help, in
turns of ensuring that as much material as possible is available
to investigators and to prosecutors. However, the process of staged
disclosure to the defence, consultation with clients to take instructions,
interview and assessment is essentially sequential, which the
application of extra resources will not materially shorten.
Case Studies
Operation Springbourne 2002-2005—the so-called
'ricin' plot. This was a wide ranging investigation into a network
of Algerian extremists who were engaged in terrorist activity.
Some of this activity was clearly terrorist in nature, but at
the same time there was a great deal of peripheral supporting
activity involving the use of forged documents, cheque and credit
card fraud and the like. The investigation ran over several months
and spanned not only the UK but some 26 other jurisdictions as
well. Many of those jurisdictions (especially those with an inquisitorial
system) work to extended timescales in such cases, and cannot
respond to our enquiries within the timeframes demanded by our
pre-charge time limits. The challenge was to analyse a huge amount
of material, to identify the prime conspirators (and what it was
they were plotting to do), and to clarify the roles played by
each of the suspects. This proved impossible in the time available,
and the result was that several suspects were originally charged
with terrorist offences who were eventually proceeded against
for crimes such as fraud or forgery. This is symptomatic of the
current situation where investigations have to be shaped to fit
the procedural requirements of the time-limited charging procedure,
rather than simply following the evidence in an objective search
for the truth. Had there been the opportunity to understand the
complexities of the conspiracy before the decision was required
to charge or release, the right charges against the right people
could have been determined from the outset. The quality of the
original charging decisions would also have been higher, and it
is probable that the suspect who fled the country while on bail
and who eventually proved to have been a prime conspirator, would
have stood trial in this country. If that had happened, the outcome
of the trial process might have been very different.
Operation 2004 (this case is sub-judice and it
would therefore be inappropriate to release further details)
This case was concerned with a group of British men
who, it will be alleged at trial, were planning to construct and
detonate a bomb in the UK. A long-term surveillance operation
led to the arrest and charging of 8 men with offences of conspiring
to cause explosions. The investigators are of the opinion that
if the decision to charge could have been delayed while the investigation
developed and the precise role of individuals became clearer,
then the outcome in terms of admissions, intelligence and evidence
against key individuals might have been different. It can reasonably
be argued that in this case the current system worked contrary
to the overall objective of preserving public safety. The silence
of the suspects, encouraged by current custody time limits, shed
no light on the intentions or capabilities of the terrorist network.
The case will be heard in January 2006.
Operation 2004—(this case is sub-judice
and it would therefore be inappropriate to release further details)
This investigation focussed on a group of British
men who, it will be alleged at trial, were engaged in terrorist
reconnaissance and planning in the US and the UK. After their
arrest in August 2004, a vast amount of material was recovered
in searches, including some 90 hard drives, much of the content
of which was encrypted. The sheer weight of material to be analysed
and the number of suspects in custody meant that it was impossible,
within the 14 days, to complete a fuller investigation. There
were many key pieces of evidence which police were unable to put
to the suspects in interview because they were not discovered
until after the detention period had elapsed.
Operation 2005—(this case is sub-judice
and it would therefore be inappropriate to release further details)
This is the investigation into the attacks in London
on 21st July 2005. One of the suspects has already raised the
defence that he intended to do no more than cause a demonstration
of some sort, but not to kill anyone. It is possible that this
defence will be followed by others. If there had been the opportunity
to delay charging, this would have been taken. A definitive analysis
of the explosive devices would have enabled an interview strategy
to be constructed that would be based on firm knowledge of the
nature of the devices, rather than a very limited assessment.
The point in this case, as with those quoted above, is that an
extended period of detention would enable the quality of material
disclosed to the defence in advance of interviews, to be immeasurably
improved.
Theoretical Case Study
This case study has been constructed with the assistance
of the Crown Prosecution Service and draws upon issues that have
arisen in many real cases. The statistics used are entirely typical
of the scale of events that have been seen in terrorist investigations
in recent years.
The Security Service are told by an agent that a
group of men in various parts of the country are planning terrorist
attacks on the Houses of Parliament and the British Embassies
in Pakistan, Istanbul and Morocco. They have been exploring conventional
and homemade explosives as well as CBRN possibilities. It is believed
that this will be carried out in 3 months time. The agent is reliable
and his information must be acted on for public safety reasons.
Surveillance is started on 2 of the men identified
and over a period of 2 months they are seen with numerous other
people. All of the people seen are unknown to intelligence services
and cannot be identified. 5 key addresses were identified and
probes put into each over the period.
The agent does not know where the dangerous materials
are being stored or where they have been obtained from although
he believes that some might have been brought in from abroad.
The men are believed to be all illegal entrants to this country
and are each living on at least 2 false identities.
Police arrest 15 people following the execution of
Terrorism Act warrants in 4 different areas of the country on
day 1. Each arrest requires time-consuming custody procedures;
sterile arrest, transportation to the secure suite at Paddington
Green, the forensic examination of prisoners and taking of evidential
samples. The samples are particularly important as it is thought
that the men are not who they purport to be and/or not from the
countries they claim to come from. Each has at least one false
passport.
These procedures have to be completed before any
detained person can consult with their legal representatives.
On this occasion they took about 8 hours for each person. Some
could be conducted simultaneously, but some (like booking in with
the Custody Sergeant) had to be done individually.
The fingerprints are sent to 5 different countries
to see if the men can be properly identified.
With 15 people under arrest, a disclosure strategy
was required so as to achieve the best evidence from the interviews
and test the accounts given. This was done whilst the defendants
were being examined and other procedures carried out, and whilst
the police were waiting for the solicitors to arrive. Each disclosure
package given to the respective legal representative required
lengthy consultations with the detainees.
2 firms of solicitors represented all the detained
men. Their representatives were not available immediately; the
police had to wait 4 hours for one and 5 for another. Each firm
only provided 2 representatives. The initial consultations with
each client lasted on average 4-5 hours. This time took up some
of the time available to the officers to conduct their detailed
interviews and enquiries, the clock did not stop running whilst
the detainees were taking legal advice.
In addition all 15 men need to be allowed to observe
prayer 5 times a day and all say that they need an interpreter.
In the first 14 days a total of 165 interviews were
conducted. Most of the suspects are saying nothing, but as more
evidence is put to them by the 14th day, 2 appear to be getting
concerned and might talk.
Within the first 4 days of detention, 55 forensic
searches were conducted around the country involving residential
and non-residential properties and vehicles, again involving an
enormous amount of work by officers to speedily assess the relevance
of exhibits within the time limits imposed.
Each of these required a separate warrant and information
received led the police to believe that there could be CBRN material
on the premises as well as possibly conventional and homemade
explosives. This meant that specialist teams had to be deployed
and some of the premises were unsafe to enter until various forms
of risk assessments had been done and procedures carried out.
There are only a limited number of specialists available to do
this work and it was only possible to do one premise at a time.
10 of the premises require this procedure and were in three of
the different parts of the country, some about 5 hours drive away
from the other.
During this period of time a vast amount of exhibits
were seized during the searches. This had to be examined, prioritised,
sifted for relevance, an assessment made of which individual should
be questioned about which exhibit and a decision made on which
should be sent to experts in chemical weapons, which on biological,
which to FEL and which to the AWE.
There were about 4,000 exhibits labelled in the first
week with many more outstanding for examination. At least half
of the documentary exhibits (about 600) are in Arabic. Most of
the available interpreters are being used for the interviews and
after trawling the country police manage to locate another 3 who
can begin on the documents. There are also several boxes of videos
tapes the contents of which the police do not know until they
have been viewed. There are no labels on them. A cursory viewing
of a handful shows that they are extremist in nature and mostly
with Arabic voiceovers or individuals speaking in Arabic on. There
is little point in the officers viewing these further as they
cannot understand them.
A decision had to be taken about where each of the
exhibits should go first. It is decided to fingerprint 300 documents
first. Half of these are handwritten and will also need to be
examined for handwriting analysis. All the identification documents
found (at least 100) need to go for expert analysis to see if
they are false. 15 of these are French, 10 each are Spanish Italian
and Turkish, but the majority appear to be of Eastern European
extraction, maybe Bosnian, and all have to be submitted to their
country of origin to check whether they are genuine.
There have been over 268 computers seized together
with 274 hard drives, 591 floppy discs, 920 CD DVDS and 47 zip
discs. The High Tech Crime Unit say that every computer hard drive
seized during that period of time takes a minimum of 12 hours
to image for the assessment teams at Paddington to then provide
to the interviewing officers. The preliminary assessments carried
out, due to the time constraints imposed, cannot be considered
as thorough and have to be revisited as other factors emerge and
different matters become relevant. About a quarter of the computers
and hard drives have encrypted material on them and the suspects
are refusing to give the keys saying that the computers, even
those found in identifiable homes, are nothing to do with them.
Assistance is required from a number of agencies here and abroad
with regard to this and an assessment has to be made about which
computers to prioritise.
It is not clear which of these computers was used
the most as the man believed to be the leader and 2 others have
been itinerant, using at least 20 of the known addresses over
the last 6 month period.
The main suspect was of no fixed abode. He had items
of personal property at a number of addresses. Some in false;
fingerprint and DNA work done in the first 4 weeks enabled police
to establish this.
During the first two weeks 60 seized mobile telephones,
mostly pay as you go, were forensically examined. The sheer volume
of material to be gathered from these examinations meant that
much of it was not available until the 6th week of investigation.
This evidence is crucial as it is needed to corroborate associations
and prove movements. DNA analysis is required to discover which
telephones have been used by which suspects, again because they
have used or visited many addresses.
Some 25,000 man hours were spent examining CCTV footage.
Some 3674 man hours are used to assess the eavesdropping material
gathered by probes operating 24 hours each day over an 8 week
period. There are 850 surveillance and observation point logs
that must be assessed for their evidential value. This evidence
will be crucial to establish who was present at which meetings
and what was said.
In the first 4 weeks the police identified 6000 actions
in the investigation. 10,000 documents, 2300 statements and 7000
exhibits have been seized or created by week 8 of the investigation.
Crucial evidence is still awaited from DNA, other scientific work
and from various foreign enquiries coming in gradually over the
period of detention.
Letters of request for legal assistance in gathering
evidence abroad have been written by prosecutors and sent through
emergency channels to 17 countries.
As the enquiries progress more addresses are being
identified, more searches done and more exhibits, computers and
false documentation with photographs of the suspects and others
are being discovered. In amongst the documents are some bearing
the picture of a well known international terrorist being held
in custody in another country where it is not easy for the police
to obtain access or information. This might be a crucial link
with some of the suspects being held and an approach needs to
be made through diplomatic channels.
Throughout the detention period it is becoming abundantly
clear that there were plans to use a dirty bomb in the Houses
of Parliament, conventional explosives for an attack on 2 of the
Embassies and a possible chemical attack on the third. Each suspect
has several identities. We are waiting to hear if the requested
countries can establish the true identity of the men. Fingerprints
of each man are being found on some documents of a suspicious
nature. It is unclear however which role each man took and whether
they can be linked to any or all of the planned attacks.
The case is largely circumstantial as no chemicals
or explosives or anything else of that nature has been found despite
the fact that the targeting document (found on the 50th computer
to be examined in the 7th week) shows that the attack on Parliament
was due to take place 2 days after the arrests.
2 prosecutors are working full time with the Anti
Terrorist Branch making applications to extend pre-charge detention,
drafting initial and supplementary letters of request and reviewing
the evidence as the investigation progresses. Experts from 10
different disciplines are working on exhibits and documents seized
as well as scouring addresses and cars for explosive and other
traces and ¾ of the police capacity has been involved in
various actions including examination of exhibits, computers,
interviewing, etc.
| 
