The Defence of the Realm (150 page)

On 4 March 2002, just over a month after Bravo's conviction, a disaffected test co-ordinator at BAE Systems Avionics in Basildon, Ian Parr (who appears to have been on holiday during Bravo's trial in January and unaware of it), also attempted to make contact with Russian intelligence, by passing a packet to the Russian embassy containing three floppy discs with a typed note which read: ‘Attached are sample documents available. I will telephone Friday 8th March at 3pm to confirm your interest, and discuss a meeting. I will give the code word “Piglet”.' Parr had failed to realize, however, that 8 March was International Women's Day, a Russian holiday, and the Russian embassy was closed. On 8 March he received a phone call from the Security Service officer who had earlier contacted Bravo and this time called himself ‘Aleksei'. They later arranged to meet at the Tower Bridge Thistle Hotel on 19 March. At a further meeting at the Esplanade pub in Southend-on-Sea on 22 March, Parr handed over fifty-six floppy disks and fourteen sets of classified documents relating to the STORM SHADOW missile system. ‘Aleksei' paid him and left. Parr stayed behind and had just ordered a lager when the Essex police moved in and arrested him on suspicion of theft and of committing offences under the Official Secrets Act. He was later sentenced to eight years' imprisonment for passing classified information and two years for theft, to run concurrently.
⁸

By the time Parr was jailed, the counter-espionage budget was once again under threat. Though almost 20 per cent of the Service's budget in 2000–2001 was devoted to CE (up from 12 per cent in 1996–7),
⁹
it was cut back once again after 9/11. As the Annual Report for 2001–2 acknowledged: ‘The gearing up of work against international terrorism post 11 September was achieved at a cost to the Service's counter-espionage work. Coverage was reduced effectively to four potentially hostile states and lower priority casework was suspended.'
¹⁰
At the time of Sir Stephen Lander's retirement as DG in October 2002, however, the full extent of the threat to Britain from Islamist terrorism was still not grasped. Deputy Assistant Commissioner Peter Clarke, head of Counter-Terrorism Command at Scotland Yard, later acknowledged, ‘In 2002 the perception was that if there was a threat to the UK, its origins were overseas. The spectre of a home grown terrorist threat was not yet with us.'
¹¹

Well before Lander's retirement, the DDG, Eliza Manningham-Buller,
¹²
then aged fifty-four, was widely regarded as the front-runner to succeed
him. Good at managing personal relations with both her colleagues and Whitehall, she succeeded in conveying authority and friendliness at the same time. As the daughter of the first Viscount Dilhorne (born Reginald Manningham-Buller), successively Solicitor General, Attorney General and Lord Chancellor in the Conservative governments of 1951 to 1964, she was the only DDG or DG in Service history who had been used since childhood to the company of ministers. At Lady Margaret Hall, Oxford, where she read English, she had been a prominent member of OUDS (Oxford University Dramatic Society) and was chosen in 1968 to play the Fairy Godmother in
Cinderella
, the first ever OUDS pantomime. The producer, Gyles Brandreth, later a Tory MP, described her performance as ‘absolutely superb'. ‘It is great fun,' Manningham-Buller was quoted as saying, ‘but I am not intending to be a professional actress.'
¹³
After a few years teaching English following graduation, she was talent-spotted by a Security Service officer who met her at a party; she joined the Service in 1974. Her brief career as an English teacher left its mark on her MI5 career. She later told alumnae of her Oxford college: ‘I have a reputation inside the Service for being particular about grammar. A draft letter or note presents the opportunity for me to indulge my struggle for maintaining standards of written English.' Some of her colleagues, she admitted, probably wished she had taught mathematics or geography instead.
¹⁴
Her insistence on high standards (not merely of English grammar), which some of her staff found intimidating, was balanced by a sense of fun which made her many friends. Manningham-Buller later became the first DG (perhaps the first head of any intelligence agency anywhere) to give a talk to staff entitled, ‘Fun at Work'.
¹⁵
She first began to establish herself as a potential DG under Stella Rimington, when her interpersonal as well as intelligence skills as first head of T2, with responsibility for mainland Republican counter-terrorism, played a crucial part in the fraught but successful transfer of the lead role from MPSB to the Service.
¹⁶

In April 2002, six months before Lander's retirement, four senior mandarins, chaired by Sir Richard Wilson, now cabinet secretary, interviewed a shortlist of three applicants (all internal) for the post of DG. As Manningham-Buller later acknowledged, the essence of her letter of application for the post of DG was that, after the Lander era, ‘I was going to be Miss Continuity.'
¹⁷
The letter had a characteristically engaging conclusion, influenced by memories of the paparazzi pursuit of Stella Rimington a decade earlier and the thought that they might turn up at the farm where she and her husband spent as many of their weekends as possible: ‘I am supported by a happy marriage, many friends and lots of other interests,
so can keep work in perspective and switch off. I also derive strength from my home life to sustain me in crises. What really frightens me is the prospect of being photographed in my farm overalls by the Sun.'
¹⁸
The panel unanimously recommended Manningham-Buller's appointment as DG:

She would be a first-rate choice to lead the Service over the next three years or so. She had immense credibility both in the Service and externally. She had the confidence and understanding of the issues facing the Service to lead it well. The Panel agreed to suggest that a three-year contract would keep open the possibility of appointing someone else with different skills at the end of that period if, for instance, a more strategic view of the Service's role were needed at that stage.
¹⁹

The panel's assessment of Manningham-Buller was well balanced. Her leadership qualities and intelligence judgement are generally regarded by those who know her, inside and outside the Service, as outstanding. She was not, however, an original strategic thinker. Manningham-Buller said of herself at the end of her period as DG: ‘I'm not myself a great generator of fantastic ideas, but I'm good at catching the mood of the moment.'
²⁰
When it became clear in 2003 that the threat from Al Qaida had been underestimated and that Britain was directly threatened by home-grown terrorists, Manningham-Buller caught the mood of the moment once again, abandoned any ambition of remaining Miss Continuity and opted decisively for change.
²¹
At the end of her three-year term as DG, she was renewed for another two years.

The first serious UK-based Islamist plot uncovered by the Security Service and the police during Manningham-Buller's term as DG was a conspiracy by North African extremists to use lethal poisons – chiefly ricin.
²²
A trail of petty fraud and false identity documents led to the discovery at Thetford, in the heart of rural Norfolk, of recipes written in Arabic (beginning ‘In the Name of God the Merciful, the Compassionate') for ricin and other poisons. That led in turn to the discovery on 5 January 2003 of castor-oil beans, the raw material for ricin, in north London at a house in Wood Green. During arrests in Manchester, Detective Constable Stephen Oake was stabbed to death by Kamel Bourgass, an Algerian Islamist. Bourgass was later sentenced to twenty-two years' imprisonment for Oake's murder and to seventeen years for conspiracy to create a public nuisance by use of poisons and explosives. But the available evidence was insufficient to prove the involvement of any other North African extremist in what became known as the ‘ricin plot'.
²³

The first evidence of a major Islamist conspiracy to bomb British targets in the UK was uncovered as a result of Operation CREVICE, which began
with the investigation in the spring of 2003 of a group based in London and Luton which was believed to be supplying money and equipment to Al Qaida fighters and affiliates in Pakistan and Afghanistan. Investigation revealed that most members of the network were second-generation British citizens of Pakistani origin. In the summer of 2003 some of the network travelled to Pakistan for weapons and explosives training. Following their return to Britain, intelligence accumulated that some members of the group had begun planning attacks in the UK – the first since 9/11 by British-based extremists linked to Al Qaida.
²⁴
One of the most important intelligence leads, Jonathan Evans recalls, was a tip-off from a member of the public.
²⁵
CREVICE became the largest counter-terrorist operation yet undertaken by either the Security Service or the police. In early February 2004 intelligence indicated that the network had become ‘operationally active' and that a bomb attack was being prepared. For the next seven weeks the Security Service Emergency Room operated twenty-four hours a day and 34,000 hours of surveillance were logged.
²⁶
The CREVICE plotters were discovered to be planning attacks against nightclubs, pubs and shopping centres which were intended to cause mass casualties. All the key suspects were arrested at the end of March before they were ready to begin a bombing campaign.
²⁷
On 1 April, for the first time in Security Service history, the DG was invited to a meeting of the full cabinet, at which Tony Blair congratulated the Service on a ‘fantastic job'. The cabinet applauded.
²⁸
Though the CREVICE trial was delayed, five British Islamists were later sentenced to life imprisonment for terrorist offences.
²⁹

The growing threat of Islamist terrorist attacks and the diffuse nature of intelligence on it persuaded Security Service top management during 2003 that continued expansion, though essential, was not sufficient. There must also be a step-change in the way that intelligence was collected and assessed.
³⁰
The decision was taken, for the first time since the RSLOs of the Second World War,
³¹
to set up regional offices – initially at undisclosed locations in the Midlands, North-east, North-west, South, East and Scotland, later also in Wales and the South-east. As well as bringing the Service closer to the regional centres of extremist activity, the new offices also improved collaboration with local police forces. The Intelligence and Security Committee (ISC) later declared itself ‘impressed by the speed at which the regionalisation programme has been carried out and the clear benefits it has brought'.
³²
Changes in intelligence assessment were equally radical. In June 2003 the Joint Terrorism Analysis Centre (JTAC) was set up in Thames House as ‘the UK's national centre for the assessment of international terrorism', with representatives of around a dozen government
departments and agencies concerned with various aspects of counter-terrorism.
³³
It was also responsible for issuing threat warnings and assessing the threat level, initially on a seven-point scale (later simplified) going from ‘Negligible' to ‘Critical' (attack ‘expected imminently').
³⁴
In addition to collaborating closely with G Branch, the head of JTAC was accountable to the DG as well as to an oversight board of senior customers across Whitehall. The DG reported on it to the JIC. During its first nine months JTAC processed more than 25,000 items of intelligence and issued over 3,000 reports. Manningham-Buller reported that ‘Formal customer feedback shows high levels of satisfaction.'
³⁵
The ISC agreed. JTAC staff, however, sometimes complained that they were in danger of becoming a ‘tourist site', with ministers from friendly countries around the world anxious to see for themselves how it functioned.

One aspect of the step-change in counter-terrorism was the reorganization of protective security. In 2001 the Security Service had taken the lead role in founding the interdepartmental National Infrastructure Security Co-ordination Centre (NISCC), designed to give advice on protection against e-threats. Its early successes included timely warnings of the ‘I love you' and ‘Kournikova' viruses.
³⁶
The NISCC set up its own website and developed contacts among journalists and businesses, who were aware of its connection with the Security Service.
³⁷
The increase in the Islamist terrorist threat against British targets refocused attention on more traditional forms of protective security. In 2004 the Service set up the National Security Advice Centre (NSAC) to give advice on how ‘to reduce the risk of a terrorist attack, or to limit the damage terrorism might cause'.
³⁸
With information on the NSAC posted on the new Security Service website, inaugurated in April 2004, the aim was to ‘extend the provision of advice to new audiences outside the CNI [Critical National Infrastructure], including local government, small and medium-sized businesses and the general public'.
³⁹
The work of NISCC and NSAC, however, was inadequately co-ordinated. Both developed separate systems to deliver their information electronically to their users – despite the fact that the users were frequently the same.
⁴⁰
The problem was resolved in 2007 by merging the two organizations to form the interdepartmental Centre for the Protection of the National Infrastructure (CPNI), which used resources and expertise from a number of government departments and agencies. Its website declared: ‘Our advice aims to reduce the vulnerability of the national infrastructure to terrorism and other threats, keeping the UK's essential services (delivered by the communications, emergency services, energy, finance, food, government, health, transport and water sectors) safer.'
⁴¹