A Case Study in Intelligence Failure (The 7/7 Attacks) - Qlael Practicalintroduction

Reviewed by : Indrawan Vpp


The UK intelligence community failed to foresee the terrorist attack on the London transport system that took place on 7th July 2005. The intelligence failure can be seen at both a strategic and a tactical level. The strategic failure lay in the underestimation of the threat posed by domestic terrorism. The tactical failure lay in the failure of the Security Service to discover the plot of the 7/7 bombers before they had a chance to carry it out. The JTAC had made the assessment, based on the advice of MI5, that no terrorist group had the intent and capability to carry out an attack against the UK. The threat level was decreased one month before the attack as a result of this strategic assessment.

MI5 failed to uncover the plot despite having an opportunity to do so. Two members of the 7/7 cell had been linked to members of another terrorist cell discovered to be planning attacks in the UK. These two men were Mohammed Sidique Khan and Shaheed Tanweer. The two men were classed as ‘desirable’ rather than ‘essential’ targets, due to MI5’s belief gathered from intercepted conversations that they were interested in financial fraud rather than attack planning. Once operation CREVICE came to its conclusion MI5’s system of prioritization meant that these targets, being only ‘desirable’, weren’t investigated further with any vigor. If a target that is not deemed ‘essential’ goes on to commit a terror attack it is clear that an intelligence failure has taken place. Several pieces of evidence were overlooked by MI5 that, if pieced together, would have indicated a greater interest in carrying out an attack than was concluded. If these men were more thoroughly investigated this could have led to the attack being averted.

Why did the intelligence operation fail?

Ultimately, the intelligence operation failed because the extent of the threat from domestic terrorism wasn’t fully appreciated, which led to failures at both the strategic and tactical levels. This was due to the UK intelligence community’s faith in the strategic concept of the ‘Covenant of Security’. The presence of Islamist extremism had been tolerated in the UK - compared to the rest of Europe - under the understanding that no attacks would be carried out on British soil. This concept has been described as pervading every aspect of the UK’s intelligence apparatus. The British government had put their faith in extremists such as Abu Hamza, Abu Qatada, and Omar Bakri Mohammed. However, following the increased stringency of post-9/11 anti-terror legislation, this covenant began to crumble, which was indicated by those very same men. The view that there was a limited threat from Islamist extremism domestically was not updated. This may have been the reason why when French intelligence made an assessment that an attack was being planned from the UK Pakistani community the intelligence services weren’t unduly concerned. There was a belief, according to the Director-General of the Security Service, that terrorist capability had been dented from the successful conclusions of operations CREVICE and RHYME. 

This demonstrates the intelligence failure at the strategic level - the view that the threat from domestic terrorism was less extreme than it was in reality. This view had a knock-on effect: MI5 wasn’t equipped with sufficient resources to fully cover the threat. In the words of Jonathan Evans, MI5 was only capable of “hitting the crocodiles closest to the boat”. There was enough available evidence to justify further investigation of Mohammed Sidique Khan and Shaheed Tanweer, but a lack of resources meant that MI5 had to ruthlessly prioritize those showing a clear threat to life. MI5 didn’t have the resources to discover all possible threats therefore weren’t aware of their true extent. They were unable to challenge the accepted view and therefore the assessment was made that no groups were actively planning on carrying out attacks on the UK.

MI5 also made mistakes at a tactical level in the course of this operation. They should have been able to bring together several pieces of available evidence about MSK and ST that would have constructed profiles suggesting higher levels of significance. Several of those pieces of evidence were missed due to differing spellings of the name ‘Sidique’. It was missed that MSK and ST likely attended the ‘farewell meal’ of one of the CREVICE plotters, indicating a high level of trust and closeness to several attack planners. These mistakes were largely due to a lack of available man-hours and specialist personnel, especially translators and transcribers.

If an effort was made to build a profile of the two men, then they would at least have been moving towards ‘essential’ status. Taking the example of MSK, there was present: evidence of travel to Pakistan where it was believed he engaged in terrorist activity; a link to an address at an extremist bookshop; repeated connections to the CREVICE plotters; a link to another, separate investigation; and an expression of admiration for the Madrid bombings. All of these pieces of evidence were available to MI5 and should have been indicative of someone who was in danger of carrying out an extremist attack on the UK.

The assessment was ultimately made, based on the available evidence, that the two men were not involved in attack planning. Directed surveillance on MSK and ST, justified by their profiles, would probably have led to the discovery of the bomb factory at 18 Alexandra Grove and thus evidence that they were in the stages of planning an attack. Only through investigation of this type would attack planning have been revealed, as the plotters took efforts to ensure it was kept a secret.

MI5 wasn’t able to justify resource-expenditure on the intensive investigation without evidence of attack planning, and they weren’t able to gather evidence of attack planning without such intensive investigation. This resource-mandated catch-22 is part of the reason why there was a failure at a strategic level in underestimation of the number of groups intent on carrying out attacks, and why there was a failure at a tactical level to discover the plot.

What challenges confronted those conducting the operation?

There were three main challenges facing MI5. Firstly, the most fundamental challenge was a lack of resources. There simply was not enough available personnel, equipment, or funding to be able to properly follow up on all the leads they came across in the course of their investigations. This resource squeeze meant that they had to be quite ruthless in deciding who was a priority and who wasn’t, which inevitably led to some falling through the cracks.

Secondly, a lack of translators and transcribers meant failure to pick up on elements of overheard conversations that would have given the security services further reason to investigate MSK. A conversation captured by a listening device would if properly transcribed and translated, have revealed that MSK was present at the farewell meal for Omar Kyam and had professed an admiration for the success of the Madrid bombings – two things that would surely have sent him further up MI5’s priorities. However, because there weren’t enough staff familiar with the mix of languages the men spoke these pieces of evidence were missing.

Thirdly, domestic terrorist plots take place in a fast-paced environment where there are many changes in the intentions and capabilities of involved persons. There are certainly too many persons in the UK holding extremist views for all of them to be fully investigated, and the journey from extremist to attack planner can take place over as little a time period as a few weeks. This challenge puts immense time pressure on the security services when they do discover attack plans as there is often a very small window to act in. These three factors made uncovering the plot very difficult for MI5.

At what point was the failure of the operation inevitable?

The failure of MI5 to discover the plot became inevitable once it was decided that MSK and ST weren’t enough of a priority to merit further investigation. A deeper look into their activities would have affirmed their extremist links and potentially have led to the discovery of the bomb factory and evidence of the plot. With operation CREVICE wrapped up and the focus of MI5’s resources directed toward operation RHYME and then other investigations the intentions of the 7/7 plotters became a mystery only discoverable by accident to those outside of the intelligence community.

Was the failure of the underlying intelligence concept inevitable?

It has been shown above that the failure of this particular operation wasn’t always inevitable, the professionalism and expertise of MI5 could have generated success in this instance much as they did in operations RHYME and CREVICE. However, there were aspects of the UK intelligence community that meant a failure of this type was inevitable eventually. These aspects were based upon undue political influence on the assessments of the threat level. The strategic concept of the covenant of security led to downward pressure on assessments of the overall threat from domestic terrorism. These effects were recognized by the ISC, stating in their report that the development of the home-grown threat was not fully understood or applied to strategic thinking. This inevitably led to a situation in which MI5 was under-resourced, under-staffed, and unable to measure the true extent of the domestic threat. Therefore, an intelligence failure of this type was inevitable at some point.


  1. Andrew, Christopher (2010). The Defence of the Realm: The Authorized History of MI5. London, Allen Lane (2nd ed).
  2. Black, Crispin (2005). 7/7 The London Bombs: What went wrong? London, Gibson Square Books.
  3. Curtis, Mark (2012). Secret Affairs: Britain’s Collusion with Radical Islam. London: Serpent’s Tail.
  4. Intelligence and Security Committee (2006). Report into the London Terrorist Attacks on 7th July 2005. London, HMSO.

Previous Post Next Post