On May 22, 2017, suicide bomber Salman Abedi detonated a sophisticated explosive device, just outside of an exit to the Manchester Arena in Manchester, England, immediately following a concert performed by Ariana Grande. Twenty two people were killed in the explosion, including seven children. At least another 116 people were injured, 23 of whom were critically wounded. After initially believing that Salman was a violent homegrown extremist acting alone, police quickly came to the realization that Salman was a member of a terrorist network. This caused police to significantly intensify their investigation in an effort to dismantle the network and prevent a follow-up bombing. As of the evening of May 28, 2017, police in the U.K. have arrested 15 individuals and have executed numerous search warrants. Two of those subjects were released following their arrests. Thirteen subjects remained in police custody. On May 23, 2017, the Islamic State issued a statement via social media claiming responsibility for the bombing. Also, British Prime Minister Theresa May elevated the nation’s threat level from “severe” to “critical,” which is the highest threat level. On May 27, 2017, as the investigation progressed and police became confident that they had arrested the key members of the network, Prime Minister May lowered the threat level back to “severe.”
One of the initial arrests was that of Salman’s younger brother Hashem Abedi. He was arrested in Libya. Hashem admitted being aware of the Manchester plot and was charged with planning a bombing in Libya. Salman traveled frequently to Libya to visit his family. It is believed that during one or more of these trips he traveled to Syria to receive training. As evidence is being collected and reviewed, investigators have stated that they believe Salman was planning the attack for approximately one year. He opened a bank account about a year ago that remained dormant until shortly before the attack when he used funds from the bank account to pay for the nuts and bolts he purchased and used as projectiles for his bomb. Further reporting from investigators noted that the funding that went into the bank account came from student loans.
Assessment
- The Manchester bombing presents a stark reminder of how fragile life is and how real and devastating the threat of terrorism continues to be.
- As of the evening of May 28, 2017, the police investigation progressed to a point where police announced they had made "immense progress" and gathered significant evidence. This is reflective of outstanding and expeditious investigative work that no doubt was driven in great part by financial intelligence. The investigation and benefit of financial intelligence will be further detailed below.
- As the investigation has evolved and will continue to evolve, the network or cell structure will become more real and concerning. It will likely be determined that the cell structure in Manchester will be much like the network structures of the cell(s) responsible for the Paris and Belgium bombings.
- As the investigation has evolved and will continue to evolve, linkage to the Islamic State will continue to emerge. What is troubling is that it is likely that if a command and control structure is identified, it will be identified in Libya instead of Syria or Iraq. This is an extremely disturbing possibility because the extent of the Islamic State's presence and influence in Libya is not currently known. The Islamic State attempted to expand their Caliphate into Libya in Sirte. Factions of the Libyan government, with U.S. military air support, drove the Islamic State out of Sirte. The residual Islamic State presence in Libya is not known.
- There is a terrorist attack cycle that involves six steps: target selection, planning, deployment, attack, escape and exploitation. It is likely that this cycle was followed in Manchester. The Manchester Arena is the largest concert arena in the U.K. Ariana Grande is a U.S. celebrity. Suicide bomber Salman did not likely enter the arena but was at an exit connected to a train station connected to the arena. By not entering the arena, Salman avoided venue security and ensured he was in a softer location outside of the security perimeter. These facts indicate that to some extent, the terrorist attack cycle was followed in Manchester.
- Undoubtedly, as the investigation unfolds, the success of the initial police investigation and the subsequent investigative direction will be shown to have been driven by financial intelligence developed at the outset of the investigation, probably originating at the crime scene.
- This will prove to be a two-pronged investigation. The first prong focuses on the bombing in Manchester and the network that supported suicide bomber Salman. This aspect of the investigation has been conducted with a sense of urgency at a rapid and visible pace. The intent was to identify members of the network as soon as possible and to prevent a potential second bombing. The second prong of the investigation will be more meticulous and long term. Police investigators will evaluate evidence gathered in the numerous searches conducted and develop investigative leads from the evidence. They will begin to develop timelines for all of the subjects arrested, especially one for Salman. The purpose of the timelines will be to track back their daily activities for at least a year, if not longer, to account for everything they did and everyone they had contact with. This will also link network members together to develop evidence of a conspiracy and complicity in supporting the bombing. Investigators will use the timelines, evidence collected at the bombing site and where search warrants were executed, as well as other evidence and new information to trace the network back to Libya and Syria. If and when investigators can establish a definitive nexus back to Libya and/or Syria, then the U.K. and their allies, particularly the U.S., will determine how best to interdict the Islamic State command and control structure responsible for the bombing. The development of timelines for Salman and network members and the identification of additional subjects will be greatly contingent upon financial and communications records.
Investigative Response
The police in Manchester and throughout the U.K. deserve considerable credit for the rapid and successful pace of the investigation to date. From identifying evidence at the crime scene, especially in quickly identifying suicide bomber Salman, to identifying and arresting 13 alleged network members and executing numerous search warrants, investigators prevented a potential second bombing and have advanced the investigation significantly.
Make no mistake about it, a significant reason that the investigation progressed as quickly as it did was through the development of financial intelligence. Without question, investigators developed financial leads at the bombing crime scene and during the initial searches that helped significantly drive the investigation. Police investigators in the U.K., like police investigators in the U.S., are adept at working with financial institutions to develop financial evidence. Once Salman was identified as the suicide bomber, police undoubtedly received numerous leads from financial institutions in the U.K., as well as from financial institutions around the world through law enforcement channels from country to country. For example, in the U.S., financial institutions run negative news and when hits occurr, they immediately pass the financial intelligence to the FBI’s Terrorist Financing Operations Section (TFOS), who in turn provide the financial intelligence to the agencies responsible for the bombing investigation, in this case the Manchester police and the appropriate terrorist financing investigators.
As noted in the above assessment, police are conducting a two-pronged investigation. The first prong is more short term and expeditious. It focuses on the bombing, the bomber and the network identified. The second prong is long term and will focus on identifying additional subjects in Manchester and the U.K. It will meticulously focus on the potential nexus to the Islamic State in Libya and/or Syria. This aspect of the investigation will be more long term and will require more international cooperation from U.K. allies.
AML Context and Response
As with the 9/11 terrorist attacks, the attacks in Paris and Brussels, and so many other events, there is little likelihood these attacks could be identified beforehand by financial institutions through transaction monitoring or other alerting mechanisms. It is more likely and probable that once the attack has taken place and the names of those individuals responsible are reported in the media that financial institutions will be alerted through negative news reporting.
It is essential that financial institutions respond to these reactive situations with a sense of urgency. As the facts surrounding the Manchester bombing and investigative developments become known, it will be determined that financial institutions played a key role in the short- and long-term investigations. Financial institutions have and will continue to provide valuable actionable and timely financial intelligence to police investigators.
With regard to the ever-looming threat of terrorist attacks, financial institutions should establish “Critical Incident Response Teams” to deal with terrorist and other critical incidents where financial intelligence is needed to support the law enforcement response. Regardless of the size and capacity of the financial institution, the institution should establish a critical incident response capability. Some financial institutions have formed Critical Incident Response Teams that have greatly assisted law enforcement from the outset of their investigations. As what occurred with the 9/11 investigation in the U.S., the U.K. Manchester investigation will prove to have succeeded in great part because of financial intelligence provided by financial institutions.
Conclusion
Finance and communications present the biggest vulnerabilities for terrorists. By responding to terrorist attacks in an “urgent” reactive manner, financial institutions play a significant role with law enforcement in their immediate investigative response to a terrorist event. Financial institution Critical Response Teams are one example of how important public–private partnerships are in the fight against terrorism and other significant threats to national security and the economy.
On July 13, 2017, KYC360 spoke with Dennis Lormel about terrorist financing and the Manchester Bombing. To listen to the interview, click here.
For more information on how to identify and mitigate terrorist financing, please visit http://www.acams.org/counter-terrorist-financing-training/.
