London Bridge & Borough Market Terror Attack

Dear They -

Rt Hon Priti Patel MP

Response_to MCLand MC2 (addressed together_as they both concern sites and criteria for bespoke engagement) MC1 Addressed to the Secretary of State for the Home Department and NaCTSO: | suggest that there be a review of the sensitive national criteria and tests for identifying sites as priority Crowded Places (or for otherwise designating sites at national level as justifying proactive advice on protective security): In that review, one aim should be to ensure that the criteria are not excessively rigid so as to exclude sites which may be particularly attractive and vulnerable to terrorists. If and to the extent that the Secretary of State considers that any other Government agencies should play a part in addressing this concern, their assistance should be enlisted; MC2 Addressed to the Secretary of State for the Home Department and NaCTSO: suggest that consideration be given to putting in place systems of periodic review assurance to ensure that the criteria for identifying priority sites for protective security advice remain fit for purpose and that the list of such sites remains appropriate. The Government accepts these recommendations Co-ordination of work on crowded places The Government's approach to crowded places (which includes crowded spaces) , is overseen and co-ordinated by the Office for Security and Counter Terrorism (OSCT') in the Home Office_ Through this approach advice and guidance is provided to all parties responsible for crowded places to: Raise awareness of the terrorist threat and attack methodologies; Provide advice as to appropriate and proportionate protective security measures; Provide advice on public vigilance , the reporting of suspicious behaviour or activity and appropriate action to be taken following a terrorist attack; and Inform planning and preparation for possible terrorist attacks can take place, for example through staff training and awareness raising and the testing and exercising of emergency procedures. Crowded places encompass a number of different crowded public locations: Permanent buildings which are open to the public; Temporary events (such as festivals or sporting events). Crowded spaces encompass locations such as city centre squares, the public realm, bridges or busy streets where there is mixed and diverse ownership. In these locations, it can be difficult to control and co-ordinate security efforts_ how

There are variety of mechanisms to provide this advice and guidance. These include; Engagement with stakeholders for crowded places by Counter Terrorism Security Advisers ('CTSAs') who provide advice to site owners and operators, local authorities and others; Targeted awareness-raising sessions and training courses delivered by CTSAs and Counter Terrorism Awareness Advisers ('CTAAs') with crowded places managers, front of house and other staff; Engagement with representatives of leading crowded places sectors (e.g. sports grounds, shopping centres, entertainment centres) , member associations and organisations who own or are responsible for crowded places; Advice provided to local authorities, planners, developers and architects by CTSAs, the Centre for the Protection of National Infrastructure (CPNI), and by the Ministry of Housing, Communities and Local Government through the National Planning Policy Framework and associated Guidance,2 designed to ensure that proportionate security measures are considered for appropriate new builds and refurbishments; Online advice and guidance, regularly reviewed and updated, for responsible parties from Counter Terrorism Policing and CPNI; and Targeted communications to crowded places stakeholders from Counter Terrorism Policing: Review of_crowded places As the Government witness for the SSHD at the Inquests acknowledged, the process for prioritising CTSA engagement at sites at the time of the London Bridge and Borough Market Attacks was based on the terrorist threat picture at the time, and its criteria had the potential to exclude a number of locations from being considered for engagement It is estimated that there are over 625,000 organisations which operate at least one crowded place in the UK. All of these are potentially vulnerable and to attack by terrorists It would not be appropriate or proportionate to visit each of these organisations individually to provide advice and guidance. Advice is available for all stakeholders through the above highlighted mechanisms. https Ilgov uklgovernmentlpublicationsInational-planning-policy-framework-2

By definition, any prioritisation system will focus more attention on some locations and organisations than others. It is also important to acknowledge that; as the Government witness highlighted at the Inquests, engagement by a CTSA at a site or with a stakeholder does not necessarily provide any certainty of protection. This is because currently the decision to implement protective security advice lies with the ownerloperator of the site_ Taking all of above into account; the Government is reviewing the basis on which engagement with stakeholders is undertaken in future to report to Ministers in early
2020. The review is complete re-examination of the Crowded Places model including whether it would be appropriate and proportionate for more to be achieved through a legislative approach. Periodic review Counter Terrorism Policing have also committed to institute a periodic review / assurance process to ensure that the locations and stakeholders identified for CTSA engagement will be regularly reviewed. The Government will provide oversight and assurance of this process_ Qther Government action since the 2017 attacks Government's efforts to provide advice to the range of individuals and organisations responsible for crowded places continues to evolve and improve_ Changes since the 2017 attacks have included: programme of sectoral and regional engagement days (branded Action Counters Terrorism: Corporate) initiated by Counter Terrorism Policing to provide advice and guidance to a range of parties responsible for crowded places; An e-learning awareness training programme (covering spotting the signs of suspicious behaviour and what to do if an attack should take place) has been broadened so that it is freely available to all;3 New and revised training and awareness products for managers, front of house and other staff at crowded places, delivered by CTSAs; and https Ilww gov uklgovernmentnewslact-awareness-elearning the

range of new advice and guidance provided by Counter Terrorism Policing and CPNI; including for certain sensitive issues to trusted stakeholders Government will continue to consider how and where our engagement approaches can be improved to ensure we deliver appropriate advice to all stakeholders using cross-Government levers. We are exploring more tailored guidance and communications to different target audiences We are also considering how the crowded places programme can better evaluate the effectiveness of our activity (in particular where and how it leads to meaningful learning or security improvement activity), and based on this, how and where we can most efficiently focus our future efforts_ Response to MC3 and MC4 (addressed together_as_they_both_concern public_authorities; their_roles and responsibilities and how_they are provided with expert advice) MC3 Addressed to the Secretary of State for the Home Department: suggest that consideration be given either (a) to introducing legislation governing the duties of public authorities (including highway authorities) regarding protective security or (b) to producing guidance indicating what existing legal duties require in practice of public authorities regarding assessment of sites for protective security needs and implementing protective security measures MC4 Addressed to the Secretary of State for the Home Department and NaCTSO: I suggest that consideration be given to producing guidance for CTSAs explaining what existing legal duties require in practice of public authorities regarding assessment of sites for protective security needs and implementing protective security measures: The Government accepts recommendation MC3. With respect to recommendation MC4, the Government is considering the scope of existing legislation and whether new legislation is required to improve the safety and security of public venues Existing legislation and current public authority actions Section 17 of the Crime and Disorder Act 1998 (as amended) requires all public authorities to exercise their functions with due regard to their likely effect on

crime and disorder; and to do all reasonably can to prevent crime and disorder_ Crime for these purposes includes terrorism: This requirement was noted by Transport for London in the Inquests as the basis upon which undertake considerations of protective security in all their schemes. The Government is aware of other public authorities which also undertake considerations of terrorism threats and their mitigation with relevant local partners through their Community Safety Partnerships (or County Strategy Partnerships in county councils) or CONTEST Boards: However; it is unlikely that all public authorities have comprehensive systems and processes in place to assess the threat from terrorism as it affects their interests, and to consider reasonable mitigation to these threats through their systems and processes The Governments role in this process is to engage and provide advice to all crowded places" stakeholders to develop an understanding of attack methodologies, threat assessment processes, the range of appropriate and proportionate protective security measures and how to plan and prepare for terrorist attacks. For those stakeholders with an interest in public spaces, such as public authorities, these differ vastly in their nature, and each has different organisational structures, staff skills and capabilities, business processes and plans, and funding cycles: It is for each responsible party to consider specific details regarding the requirements for sites, staff awareness and training, their organisation's security systems and processes, including how assess threats and mitigating measures. The_Government's actions to_improve_ engagement with crowded places stakeholders who OWn_operate or_have an interest in public spaces The Government recognises that more can be done to improve the CO- ordination and consistency of our engagement with stakeholders, including public authorities, who own, operate or have an interest in security at public spaces. With specific regard to public authorities, since the 2017 attacks efforts have been increased to improve this position including: Establishing regular engagement with Local Authority Chief Executives and others in strategic positions, in order to ascertain how considerations of threat can be undertaken and to share best practice; Developing the Security Considerations Assessment4 to provide robust; evidence-based and documented processes relating to the identification and, where applicable, development and ongoing management of security-related vulnerabilities; and https Ilw cpni gQv uklsecurity-considerations-assessment they they they key

Writing to all local planning authoritiess and revised and updated the National Planning Policy Framework and Guidance6 both of which emphasise the role the planning system plays in ensuring that appropriate security measures are in place to help mitigate terrorist threats_ The Government will continue to evaluate how and where our engagement_ advice and communications can be improved, to assist public authorities and other stakeholders to understand threats, and analyse how can better assess and effectively mitigate them through their processes Government is considering the effectiveness of the existing system by which security outcomes are realised through the exercise of their functions, and whether it would be appropriate to revise or develop new legislative requirements. Guidance to highways authorities The Department for Transport (DfT), working with the UK Roads Liaison Group and CPNI; will by the end of 2020 provide additional guidance to all local highways authorities in the United Kingdom. This will build on guidance already available to highway authorities as set out in the Well Managed Highway Infrastructure Code of Practice and other channels: The existing guidance encourages local highways authorities to adopt a security-minded approach to their assets, information and people to ensure appropriate and proportionate security measures are applied to deter andlor disrupt hostile, malicious, fraudulent and criminal behaviours or activities_ Response to MCS MC5 Addressed to the Secretary of State for the Home Department and NaCTSO: suggest that consideration be given to taking measures to make CTSAs, police forces and local authorities aware of protective security equipment infrastructure which can be installed in response to emerging threats (including the criteria and timescales for making particular forms of asset available): also suggest that consideration be given to encouraging highway authorities and other public bodies, especially in metropolitan areas, to adopt security boards similar to the PRSAB adopted in London, with a view to ensuring that there is good understanding of what measures can be taken in the short and longer term to protect sites and areas assessed to be vulnerable Shttps Jlassets publishing service gov uklgovernmentluploadslsvstemluploadslattachment_datallile/627395/Chief_Pla nner etter security_and planning pd https WWWgv Uklquidancelhealth-and-wellbeing they

Awareness of_protective security equipment infrastructure The first part of this recommendation will be addressed by CT Policing, who will give details of the training and continuous professional development provided to CTSAs and briefings provided to Counter Terrorism Security Co-ordinators and other relevant police functions on vehicle threats and the means to mitigate them: The Government's role is one of strategic oversight: This is predominantly an operational issue, and whilst we would not be sighted on the detail of measures which are the responsibility of CT Policing and other partners, we will consider more broadly, through the review of the crowded places model where working with stakeholders across Government can improve engagement and advice to responsible parties, including local authorities_ Consideration of security boards similar to the PRSAB First; it is important to consider the existing legal landscape: Section 17 of the Crime and Disorder Act 1998 (as amended) requires all public authorities in England and Wales to exercise their functions with due regard to their likely effect on crime and disorder, and to do all they reasonably can to prevent crime and disorder. Crime, for these purposes, includes terrorism: This statutealso established the Community Safety Partnerships (CSPs) for local authorities , the police and other partners to work together to tackle identified safety problems. Legislation in Scotland provides for similar local authority led planning, taking into account the resilience and safety of communities. In Northern Ireland, Policing and Community Safety Partnerships were established under the Justice Act (Northern Ireland) 2011,as local independent statutory bodies, which focus on policing and community safety issues_ Second, defining the issues to be addressed is the responsibility of each local authority. The Government is aware of a range of mechanisms through which protective security issues are addressed , including using CSPs, local CONTEST boards, and sometimes Local Resilience Forums. The Government therefore considers that there are number of local mechanisms, including statutory bodies, which are able to deliver local coordination of effort_ That is not to say that if there is a need, particularly in metropolitan authorities for an additional specific group to focus on the consideration of threats in the public realm and their mitigation, that we would not welcome such

developments: The Government considers , however; that the appropriate forum for consideration of protective security issues, ought to be decided by the relevant local authority based upon the specific requirements of its area It is important thatall local protective security forums receive appropriate advice regarding assessment processes which can be undertaken to consider terrorist threats, and what constitutes appropriate and proportionate mitigation. Expert security advice has already been provided to the types of forum mentioned above by CTSAs and CPNI; for example to advise on physical and personnel security measures or products which can be used by local authorities_ This provision of engagement and advice continues at a local level. There is also ongoing engagement by CPNI, for example, with institutions of engineering and other professionals responsible for the creation, maintenance and improvement of the public realm, providing advice through their publications and advice, and speaking at their regional lectures and conferences If groups such as the PRSAB were to become more widely established, Government would consider how it could best continue to provide specialist expert input to them as required. Recommendation MC6 tothe Secretary of State for the Home Department and the Director Genera _ for the Security Service: The Chief Coroner has made recommendation which relates to the suspension of investigations: The MIS investigation into Khuram Butt was suspended twice: from 26 February 2016 to 24 March 2016; and from 21 March 2017 to 5 May 2017. The Chief Coroner concluded in his Article 2 determination that no criticism of the decisions to suspend the investigation on those two occasions is justified. The Chief Coroner notes in his Preventing Future Deaths Report that it is possible however; but for the latter suspension, further useful intelligence about Butt could have been obtained, including more information about his links to the other attackers. The Chief Coroner has recognised that although MIS must be able to prioritise and divert resources at times of greatest demand; the suspension of priority investigations is a matter of iegitimate public concern. Accordingly, the Chief Coroner has recommended that the systems for suspending such investigations (including the criteria for suspension; recording of suspension decisions and systems for re-building intelligence after suspensions) should be specifically considered in the continuing work of review and improvement: That work should also give consideration to the potential value of flexible systems for scaling back, rather than necessarily suspending, investigative work at times of high demand.

Whilst this recommendation and MC7 , 9 and 10 are addressed to both the SSHD and the Security Service, it is the Security Service which leads on these matters and hence the responses to these recommendations reflect this. However, and for the avoidance of doubt; the SSHD agrees with and adopts the response of the Security Service to recommendations 6,7, 9 and 10 Security Service Response Although the suspension decisions in this particular case were sound, as the Chief Coroner found, the Security Service acknowledges that the suspension of priority investigations is matter of legitimate public concern. MIS has reviewed and refined its processes and the assessment of risk relating to suspension to encourage further good practice_ The Security Service has, since 2017, reviewed and revised the guidance relating to the process of suspension that is provided to its investigators and to management. That suspension process expressly includes, amongst a number of other steps, consulting with management; informing CT Police of the suspension decision, and recording the reason for suspension. Since 2017, the Security Service has also reviewed and refined the process for the assessment of the suspension risk posed by an investigation which feeds into the consideration of its suitability, or otherwise, for suspension. As Witness L explained in evidence the suspension of an investigation does not necessarily mean that intelligence gathering will cease_ Whilst typically during suspension monitoring, investigative and analytical activities will be substantially scaled back, flexibility is buiit into the suspension process to allow the investigator the choice to suspend the collection of certain types of coverage and to keep other intelligence streams active, depending on what is possible and appropriate on the facts of that particular investigation. Under the existing model, all counter-terrorism investigations are reviewed quarterly, including those which are suspended at the end of the quarter: In addition there are measures in place during a suspension to capture particular types of intelligence of a high level of concern: An investigation can then be unsuspended quickly if reported intelligence reveals a particular threat or other point of concern The Security Service has also, since 2017, revised the way in which the team with an internal overview of all suspensions tracks the overall suspension 24 page 24-35 and witness statement paragraph 124. very Day

picture to effectively manage resource. This allows that team, and senior management; a view of the spread of suspended investigations including why have been suspended, how long for; by which investigative teams and team capacity, and recognises trends or insights. It has been considered whether a system of partial suspension, or a scaled back form of investigation, should be developed as an intermediate option between suspended and open investigations. In light of the flexibility within the suspension process and open investigations, the Security Service concludes thata new category of scaled back investigation is not required at this point and would not achieve the important aim of properly diverting specialist resource to those investigations deemed to be of the highest priority at the time in order to minimise the risk from attack plans judged to be imminent or which are deemed on the information available to pose the greatest threat to the public Suspension has been an effective tool in the Security Service's investigative risk management process for many years, and is likely to remain a necessary part of maintaining an agile Counter Terrorism response to a high volume and dynamic threat environment for the foreseeable future. Recommendation MCZ to_the Secretary of State for the Home Department and the Director General for the Security Service: Khuram Butt was the subject ofa Potential Lone Actor assessment twice during the investigation into his activities. In September 2015 he was assessed to have strong intent but weak capability, and was assessed to be of medium risk In May 2017 he was tentatively assessed to have moderate capability and moderate intent and had an overall assessment of unresolved risk. The PLA assessments did not result in any downgrading of investigative work. Witness acknowledged however that PLA assessments can be imprecise and have inherent limitations_ The Chief Coroner's view is that investigators must be able to have confidence in the tool if it is to be used effectively. Accordingly, the Chief Coroner has suggested that Ml5, in its continuing work of review and improvement give consideration to some form of assurance to test the reliability of the Potential Lone Actor process: Security Service Response The Security Service accepts the Chief Coroner's recommendation that the Potential Lone Actor process should be subject to an assurance exercise to test its effectiveness and reliability, as Witness acknowledged in his evidence8 25 page 16_ 10 they Day

The Potential Lone Actor process is part of MIS's wider risk assessment framework which includes risk assessment methodologies, processes and capabilities. A review of this wider framework, which includes the Potential Lone Actor process, is currently underway within MIS. The review is supported by MIS's Behavioural Science Unit; which is a team of behavioural scientists and risk management specialists with close links with external academics, the latest academic research and international partners_ MC8 Addressed to the Secretary of State for the Home Department: suggest that consideration should be given to legislating for further offences of possessing the most serious material which glorifies or encourages terrorism_ The Government accepts this recommendation and is currently considering the necessity for a further offence of possessing the most serious extremist material which glorifies or encourages terrorism. The UK has a robust legislative framework on terrorism The Government is committed to ensuring that this keeps pace with the threat. The current legislative framework includes an ideology-neutral definition of terrorism in addition to a broad range of terrorism-specific powers and offences, including the offence of collecting information of a kind likely to be useful to a person committing or preparing an act of terrorism (s.58 Terrorism Act 2000). The Government and its law enforcement partners recently strengthened the legislation through the Counter-Terrorism and Border Security Act 2019 (CTBSA), which (i) updated offences for the digital age and modern patterns of radicalisation, (i) extended extra-territorial jurisdiction, and (ii) strengthened sentencing and offender management powers As to the S.= 58 offence , the CTBSA: amended s.58 so that it is clear that it is an offence to view or otherwise access information of a kind likely to be useful to a person committing or preparing an act of terrorism online without a reasonable excuse; and increased the maximum sentence available for those convicted under S = 58 (an increase from 10 to 15 years)_ Our operational partners must have the tools and powers require to tackle terrorism. The Government notes the Chief Coroner's comments regarding the evidence at the Inquests, the existence of the offence for person in possession of a prohibited image of a child, and the perception that the lack of 11 they

comparative counter-terrorism offence may sometimes prevent Counter Terrorism Policing from taking disruptive action_ Consideration is ongoing between the Home Office and representatives from Counter Terrorism Policing HQ as to whether there is gap in the current legislation from an operational perspective. Government is currently considering their views and deciding next steps, including further stakeholder engagement in relation to this complex issue_ The Government will continue to work closely with the police, the Security Services and other partners to ensure that the tools needed to counter the evolving terrorist threat are kept under review and up to date, whilst also ensuring that proper balance is struck between robust powers and civil liberties_ Recommendation MC9 to the Secretary of State for the Home Department and the Director General for the Security Service: The Chief Coroner acknowledged the effective cooperation between MIS and CTP . He noted, however; that on a number of occasions during his evidence Witness M accepted that he had been unaware of information in the hands of MIS, and that the Post Attack Review and ISC recognised that more can be done in promoting communication and coordination between MI5 and CTP teams on an investigation_ The Chief Coroner notes that further work is being carried out in this area; including a project leading to co-location of elements of CTP and MIS, and encourages efforts to develop and improve co-working arrangements, including sharing as much information as possible which is relevant to post-attack investigations. As such, the Chief Coroner has identified a need to improve communications and co-working between MI5 and CTP officers working on the same investigation: The ongoing work to improve joint working is to be welcomed. There is in particular a need for the police senior investigating officer in an intelligence-led investigation to be briefed regularly and thoroughly by MlS, especially if JOT meetings are not being held regularly. For the sake of completeness; efforts to improve communications between MI5 and CTP should extend to communications between MIS and post-attack investigation teams: Security Service Response The Security Service recognises that continuing to develop joint working is an important priority and that there is scope for further improvement to the excellent working relationship between MI5 and CT Policing: 12

The Security Service and CT Policing have a strong track record of working and communicating together to counter the threat from terrorism in the UK, allowing them to disrupt together 25 terrorist attacks since March 2017. This is thanks in part to the considerable progress made over the past ten years with, in particular; the introduction and refinement of the Intelligence Handling Model, and further developments in how operate together and how review themselves jointly. Since 2017 detailed consideration has been given during the course of the Operational Improvement Review (OIR) to the nature and extent of joint working arrangements between the Security Service and CT Policing focusing as Lord Anderson recognised, on operational issues. That review highlighted the strength of the relationship, and made a number of specific and technical recommendations for its improvement; By way of example, the Security Service (alongside SIS and GCHQ) and CT Policing are committed, through the "CT Up" programme to sharing their knowledge to enable single , common understanding of SOls, and of capabilities and objectives. Further; the OIR also prompted a review of information sharing arrangements, with particular regard to sharing information relating to SOls. world-leading and unprecedented project is underway to significantly increase the colocation of CTP and Security Service teams. This major multi- year project seeks to strengthen the working relationship between CTP and the Security Service and facilitate further collaboration. CT Policing and the Security Service also continue to work together to build IT structures that facilitate more collaborative ways of working: When considering information sharing between them, it must be appreciated that CT Policing and the Security Service each have distinct roles, expertise and strengths within Counter Terrorism investigations As Witness L explained in his evidence, there must always be as much sharing as possible of information between MIS and CTP (which applies equally to post-attack investigation teams) 9 There must; however; always be threshold applied by an investigator andlor management as to what is deemed to be of significance to the investigation such that it needs to be shared with the Senior Investigating Officer (SIO): That threshold will be dependent on the particular facts and context of the investigation. Because of the amount of information at the hands of the investigator it will often not be a practical or proper use of the SIOs time for MI5 to share every piece of information with that officer: To do so would risk significant duplication in the role of the investigator and the SIO, creating Day 25 page 84. 13 they they the Step

substantial inefficiencies in a system where the appropriate use of finite expert resource is essential. Recommendation MC1O to the Secretary of State _ for the Home Department and the Director General for_the Security Service: Two communications were made by members of the public to report concerns about Khuram Butt to the authorities. One was made anonymously to MIS before Butt became an SOl, and the other by a call from Usman Darr to CT Policing's Anti-Terror Hotline in September 2015. Neither made their way to the MI5 or CTP investigative teams (when formed) looking into Butt's activities. The Chief Coroner recognised that there was no opportunity for MIS to follow up the communication made to them, since the report was made anonymously and included an express desire not to be contacted in future: Further; the Chief Coroner acknowledged that it is debatable how much more intelligence could have been obtained from Usman even if he had been willing to co-operate at a later stage. Nevertheless, the Chief Coroner has recommended, because of the concern that public reporting was not directed to the relevant CT Policing and MI5 investigative teams, that in the continuing work to improve information management; efforts should be made to avoid recurrence of this problem. Security Service Response As Witness L explained in evidence10 , the report relating to Khuram Butt from an anonymous member of the public was received before mid-2015, before the investigation into Butt's activities was opened, and before he was a Subject of Interest The report was to the effect that Butt was an extremist; and was made by an individual who was clear that they did not wish to be contacted further: The content of the report did not reach the threshold requiring it to be made Lead, and thus requiring investigation by Ml5 and CTP.11 Further; there was no MI5 or CTP investigation into Butt's activities in existence at the time to which the report should or could have been directed, nor would it have added new information to what was known of Butt when the investigation was opened. MIS defers to CT Policing in relation to reporting received by the police run Anti- Terror Hotline, but notes as the Chief Coroner recognises, that it is debatable 24, pp.86-87 See Witness L witness statement paragraph 27 and footnote. 14 Darr Day

the extent to which more intelligence would have been obtained from Mr Darr had his reporting been passed on to the relevant CTP and MIS teams_ Notwithstanding the above, the Security Service would wish to assure the Chief Coroner that the issue of information management is recognised as being of the utmost importance to its work and has been extensively and robustly addressed by MI5 in the form of the Operational Improvement Review (as to which Lord Anderson noted that there had been detailed recommendations made relating to improvement of systems, guidance and practices). Many of those recommendations have been implemented, constituting significant development in MIS's information management capability, and work is ongoing to further continuous improvement in this area_ Recommendation MC1Ltothe Chiefofthe Secret Intelligence Serviceand the Director-Generalof the Security Service Recommendation MC11 - Addressed to the Chief of the Secret Intelligence Service and the Director- General of the Security Service: suggest that consideration be given to improving facilities for translating communications received from foreign security and intelligence services, since the evidence in this case reveals a troubling delay in the translation of such a communication: SlSISecurity Service Response SIS and the Security Service accept that there is a need for improvement in this area. A number of improvements have made in this respect since June 2017 . Since the London Bridge attack, the UK Intelligence Community (UKIC) has enhanced its secure messaging capability with Counter Terrorist Group partners in relation to counter-terrorism investigations. There is also stronger cooperation on language capability across UKIC. In addition, SIS has formed team of linguists dedicated to supporting counter-terrorism work working alongside operational officers and simplified processes for tasking them. SIS has updated its guidance, in consultation with MIS , relating to the appropriate and timely dissemination of information or requests from foreign liaisons, providing a clear set of handling guidelines concerning responsibilities towards data and issuing tactical reporting SIS also continues to upskill overseas officers with language capability: MC12 Addressed to the Secretary of State for the Home Department; the Secretary of State for Transport and the BVRLA: suggest that 15 been

consideration is given to taking further measures to reduce the risk of rental vehicles being used in terrorist attacks. The measures should include (a) introducing a scheme for real-time reporting of rentals and automated checking of the results against lists of SOls and (b) making the current RVSS scheme mandatory: Measures being taken to_reduce the risk of rentalvehicles being used in terrorist attacks The RVSS Scheme: Working with BVRLA to increase RVSS membership The Government agrees consideration should be given to what further measures could be in place to reduce the risk of rental vehicles being used in terrorist attacks_ To this end, the Department for Transport (DfT) continues to work with industry to increase the take up and impact of the Rental Vehicle Security Scheme (RVSS): From 1 January the British Rental Vehicle and Leasing Association (BVRLA) has introduced the RVSS criteria as requirement within its own conditions of membership12. BVRLA will also include compliance with the terms of RVSS within its audit regime_ In addition, DfT has been working with the United Rental Scheme (a vehicle rental network that reaches some of the companies that are not BVRLA members) to promote RVSS with its members at roadshows and through newsletters and on-line communications. This has led to new members joining the scheme. DfT will continue to use this approach to increase RVSS membership_ DfT has also set up an industry-led Advisory Panel, bringing together industry leaders and cross-government and law enforcement representatives to develop the requirements in the RVSS code and explore how the code could be adapted to make it relevant for other parts of the vehicle rental sector such as peer-to- peer rental and car clubs. This work is achieving positive results without regulation and we will continue to push these approaches. We will keep the coverage and impact of RVSS under review and if steps with industry bodies do not result in the vast majority of UK based rental companies joining RVSS, we will consider legislating to The DfT entered into an agreement to this effect with the BVRLA on 5 November 2019 16 put

make mandatory some or all of the elements ofthe Scheme: A progress review is planned for summer 2020. Real time reporting The recommendation on data and real time reporting of rental vehicles is addressed, inter alia, to the Home Office and the DfT . However; the Home Office and DfT work in close collaboration on these issues with the Police and the Security Service. Hence this response is on behalf of the Home Office, DfT , Counter Terrorism Policing and Security Service_ Any scheme for real-time reporting of rentals and checking against SOI databases would need to be driven by a law enforcement requirement and any case for intervention would rest upon this. As the witness for the Home Office noted in evidence during the Inquests 13 there are a myriad of different ways of obtaining vehicle (including stealing, borrowing and purchasing as well as renting). Further; as Witness L explained in evidence at the Inquests14, there are considerable challenges surrounding the introduction of processes of this kind, The Government continues to work with law enforcement agencies and the Security Service to understand how we can support their objectives_ Requirements would first be discussed with the Home Office_ which would coordinate considerations, engaging with other Government Departments as appropriate. Other measures More broadly, DfT is also leading a wider programme of work to develop vehicle focussed initiatives to mitigate the threat from 'vehicle as weapon' attacks. This includes: commissioning research and working with industry partners to identify existing technologies that can provide mitigations in 'vehicle as weapon' attacks. One project is looking into the feasibility of range of vehicle technologies that could be developed to promote earlier crowd dispersal during a vehicle as a weapon attack: These insights be shared with the rental sector in future, to inform their fleet choices. Response to MC13-MC18 Day 31, 21 June 2019, pp217-220 Day 25. 13 June 2019, pp 124-125 17 the will

Recommendations MC13 to MC18 are not specifically directed to Government but are addressed variously to the London Ambulance Service, the City of London Police and the Metropolitan Police Service_ However, these recommendations do relate to the Prepare strand of the CONTEST strategy for which OSCT (within the Home Office) has national responsibility. We provide some comments below from Government regarding these recommendations as appropriate_ The recommendations which are directed at the emergency services are specifically directed to the London emergency services. We address them below on behalf of Government as we consider it important that a national perspective be included in the response from each service as well as, where appropriate, a Government perspective Emergency response to terrorist attacks MC13 Addressed to the LAS, MPS and CoLP: The evidence in these Inquests rise to concerns that procedures for emergency response to marauding terrorist attacks were inflexible. In particular, the evidence suggested that large areas could be designated hot and warm zones for long periods and formally placed out of bounds to most ambulance and paramedic staff: This feature of the procedures gave rise to a risk of delay in getting medical help to casualties. While this lack %f flexibility has apparently been addressed in the revised Joint Operating Principles, suggest that procedures generally be reviewed to ensure that they accord with the requirements of speed and flexibility of response which appear to be recognised in that document also suggest that training exercises be devised which address demanding situations with features such as (a) hot and warm zones of uncertain extent; (b) a need for re-assessment of hot and warm zones; and (c) a need to locate and assist casualties in dangerous areas. As indicated in MC13, changes have been made to the multi-agency Joint Operating Principles (JOPS') since the Manchester attack These changes draw on learning from the 2017 attacks in Manchester and London, as well as wider exercising and learning, and place greater emphasis on the importance of flexibility and on the use of the Joint Emergency Service Interoperability Principles (JESIP'): JOPS is now in its fifth edition, reflecting a continuous process of reviewing procedures and preparedness. There is already considerable training and exercising on the response to range of terrorist attack types across the country within all three emergency services_ The Government agrees that it is important to ensure that the JOPs are being exercised and applied locally: 18 gave

MC14 Addressed to LAS: The evidence in these Inquests highlighted the importance of identifying the location of casualties at an early stage in a marauding terrorist attack: suggest that LAS review its guidance documents and training exercises to ensure that they stress this point and indicate practical means of locating casualties (e.g: from information in emergency call records): The Government considers that this recommendation applies to organisations beyond the ambulance service. While medical responders would normally take the lead on medical aspects of the response, in the early stages of an attack information about the location of casualties is provided and received by number of organisations (e.g: by phone or from responders at the scene). While there may be improvements individual emergency services may wish to make in terms of technical matters, it is the Government's view that this issue should be sufficiently addressed by the emphasis in the JOPs and related doctrine of the importance of effective multi-agency communication. However; as chair of the cross-Government and Emergency Service Joint Operational Working Group, the Government will consider this element as part of its continuous review of doctrine. MC15 Addressed to the MPS and CoLP: suggest that the emergency services give serious consideration to enhancing first aid capabilities and equipment of either police officers generally or groups of officers (e.g: firearms officers or officers designated for advanced medical aid training). This should include consideration of training some officers in advanced life-saving procedures analogous to battlefield medicine. It should also include considering (a) wider provision of equipment such as tourniquets and the bleed" kits and (b) the inclusion of more spare equipment in officers' vehicles. Armed police already have first aid training appropriate to their role, however we refer to the police response for detail on this issue_ MC16 Addressed to the MPS and CoLP: The evidence in the Inquests raised a concern that there will often be communications difficulties in the early stages of a major incident; including difficulties resulting from multiple officers attempting to make urgent radio transmissions at the same time. In the ongoing work of reviewing and improving communications technology to address these difficulties, consideration 19 "stop

should be given to whether it may be possible for control room staff to isolate and record messages so that they can be listened to separately: This is a technical issue for the police and will be considered by them; in collaboration with the Emergency Services Network programme_ MC17 Addressed to the LAS, MPS and CoLP: suggest that consideration be given to introducing improving technical measures to assist in identifying the exact locations of emergency services personnel so that can be communicated reliably to other first responders. The Government understands that considerable work has been undertaken in relation to this issue within the emergency services, and that there is some capability for asset tracking within the emergency services. However; this is largely single service in approach and there is currently no clear technical solution. The National Police Chiefs' Council is leading work in this area on behalf of the police. MC18 Addressed to the MPS and LAS: The evidence at the Inquests indicated that life-saving efforts of the emergency services, especially in major incidents, are improved by better communications between them: Given the challenges of communications in the early stages of incidents _ suggest that consideration be given (including through the Blue Light Collaboration Programme) to the possibility of having a small number of LAS and London Fire Brigade staff stationed in the MPS control room at all times. The JOPs emphasise the importance of an early three-way communication link between the emergency services and sustained effective communications throughout an incident: The JOPs do not prescribe where or_how this should occur_ to preserve the principle of flexibility that is required: The principles of coordination and co-location are also emphasised in the JOPs. The emergency services will respond on the practicality of the specific recommendation. 20 they