An Independent Review of London’s Preparedness to Respond to a Major Terrorist Incident - CCTV Extract
Video Surveillance Systems related extract: (with thanks to Ilker Dervish, our Vice Chairman, for this extract)
Although quite a lengthy article and clearly very London centric, this information remains relevant for all in security across the UK and is worthy of reading.
Terror attacks since 2016
1.2. The world does not stand still, and neither does the nature of those threats which confront countries, societies and individuals. As the UK’s changing threat levels suggest, this is no less true when we consider terrorism and since my previous review of London’s preparedness to deal with terror in 2016, the UK has experienced an unprecedented number of domestic attacks against its citizens, leading to the tragic deaths of 43 innocent people with many more injured.
22.18. Comprehensive CCTV coverage of London’s public spaces provides both an intrinsic part of protective security and a primary line of enquiry in police investigation. While it does not replace the benefits conferred by human eyes and ears in terms of real-time identification of suspicious activity and subsequent alert or action, it is an important complement and in some instances, cameras are able to provide live feeds onto portable devices used by police patrols.
CCTV very significantly broadens the scope of monitoring and is a primary deterrence tactic, not just of terrorist activity but criminal and anti-social behaviour more widely.
22.19. Having also noted the importance of effective and comprehensive CCTV networks in my previous Review, I am concerned by the suggestion put to me that local authorities across the capital have since disinvested in CCTV networks as they seek to respond to funding shortfalls.
Given that terrorist attacks in London have not been confined to central locations, this represents a significant risk to effective security and enquiry (see chapter 7).
22.20. Need for this is further heightened in light of the inquest into the terrorist attack at Manchester Arena in 2017, which has identified several lessons regarding the coverage and operation of CCTV. The very significant role played by the blind spot in which the perpetrator was able to remain unnoticed in advance of his attack is highlighted by the finding that had it been addressed, it is likely the attack would have been disrupted, deterred or, at the least, fewer people killed and injured 150
22.21. It is, however, not possible to take mitigating action against blind spots without knowledge of where they are. And installing additional cameras is not in itself sufficient - monitoring of footage by trained individuals is crucial otherwise the technology is arguably rendered pointless for anything other than after-the-fact identification.
22.22. With the advent of the Protect Duty (see chapter 3) in mind, local authorities and the MPS, in partnership with local business owners (including via Business Improvement Districts where they exist) should work together to map blind spots and take appropriate action to ensure the provision, management and monitoring of CCTV across public spaces is comprehensive and coherent. Where possible, privately owned cameras should feed into monitored networks – security must be understood as, and seen to be, a concern of and responsibility for the community as a whole.
22.23. For some outer London boroughs, additional cameras installed in support of the recent extension of the Ultra-Low Emission Zone (ULEZ) offer further opportunity for efficient multipurpose monitoring. A comprehensive data sharing agreement already allows the MPS to access metadata generated by TfL’s Congestion Charge, Low Emission Zone, Ultra-Low Emission Zone and Journey Time monitoring cameras. I was pleased to hear that work is progressing to add the additional ULEZ cameras into this agreement.
22.24. Access to metadata generated from the current suite of cameras allows the MPS to make post-hoc requests for specific images when the need arises. A number of the cameras are being replaced and TfL and the MPS have taken this opportunity to develop a welcome amendment to the data sharing agreement to allow the MPS direct access to real-time images in high crime areas. Consideration should be given to extending this real-time MPS access to those TfL cameras monitoring areas which contain targets likely to be considered high value from a terrorist perspective (R287).
22.25. More generally, publicly owned CCTV networks should be able to cooperate. This means CCTV operatives of different organisations should be able to access, and be trained in monitoring, a range of feeds including those from local authorities and TfL, where data sharing legislation permits. The MPS Government Security Zone (GSZ) Information Room, for example, ingests feed from CCTV which monitors the GSZ footprint in the City of Westminster. Monitored on a 24/7 basis using trained police officers and staff, the capability is designed to automatically receive input from additional cameras set up within the zone.
Automated Facial Recognition
22.26. Automated facial recognition (AFR) technology has been in use for some years. Deployed via e-gates at UK borders, to facilitate image ‘tagging’ on social media websites and, more recently, as a means of authentication for digital devices, it has been trialled by police with the aim of identifying suspects and preventing crime at large events though comparison of individuals’ facial features in real time with images held on a ‘watch list’.
22.27. Trialling has been led by South Wales Police (SWP) who are the national police lead on AFR. Between 2017 and 2019, the force deployed the technology at a variety of large public events, and the MPS also conducted several trials between 2016 and 2018. Use of AFR is not without controversy and both forces had their trials independently reviewed. While aiding a number of arrests, use of the technology available at that time raised several concerns:
· It generated a high number of false matches and studies suggested a racial and gender bias in the way matches were generated. This meant the faces of black and Asian people, and women, were more likely to be incorrectly matched with those on watchlists.
· The legal and oversight framework was weak with inadequate legislation governing use of AFR and heavy reliance on the user (i.e., the police) self- regulating.
· Because AFR scans the faces of all those passing through the public space it is monitoring, many argued this represents a disproportionate encroachment on privacy rights of innocent members of the public.
22.28. Current AFR technology has significantly improved since those trials. It is now capable of operating with very minimal bias and of handling, with high levels of accuracy, poor quality images as well as instances where faces are partially covered.
22.29. Nevertheless, the development of the technology continues to outpace considerations governing its use and the purposes for which it can legitimately be deployed. Regulatory and legislative frameworks which appropriately and adequately balance public good with ethical and privacy concerns remain weak or lacking. In terms of privacy, the adoption of AFR by SWP has been successfully challenged with the Court of Appeal ruling in 2020 that use of the technology was unlawful. The claimants appeal was allowed on three out of the five grounds raised.
22.30. I am persuaded of the potential value of AFR in terms of preparedness for a terrorist attack – certainly its capacity to scan millions of images in real time means it has potential to augment human capabilities at significant pace and scale. The ability to automatically scan very large crowds amassing in public spaces and at large events across London to identify any persons known to represent a terrorist threat could be a valuable part of the wider protective security toolkit in terms of informing those whose job it is to keep the public safe. It has potential, too, for managing risk through identifying individuals present where they should not be, for example airside in an airport without authorisation. Here, the lack of a match against a database of cleared individuals would raise the flag.
22.31. And I have heard about its value in wider crime prevention, for example in helping businesses drive down instances of shoplifting and pickpocketing through the use of watch lists of known offenders. When such an individual enters a premise, following a positive automatic match to a watchlist (and in most instances a subsequent check by a human moderator), an alert is issued to staff to allow them to focus security accordingly and I have heard powerful accounts of the value of this in discouraging crime.
22.32. Importantly, it reduces the need for staff to challenge someone attempting to leave with stolen goods which can create situations that quickly escalate. In actively making themselves visible to a potential offender before they attempt to commit an offence, staff can effectively deter the behaviour.
22.33. Use of AI in such contexts is compliant with data protection legislation (and passes the ‘substantial public interest’ test) and I have been assured that accuracy rates are around 98% or higher.
22.34. I acknowledge that AFR is not a panacea. It will not, for example, pick up the would-be terrorist in a public crowd who is not behaving out of the ordinary and is hitherto unknown to authorities (unless, as above, they are somewhere they shouldn’t be). And where I do consider it to have potential, that is dependent on the technology being accurate, free from bias (and trusted to be so), and subject to appropriate legislation and independent regulation.
22.35. As the UK’s Information Commissioner has recently pointed out, building public trust and confidence in the way personal information is used is crucial so the potential benefits offered by AFR, including for law enforcement purposes, can be realised. Research suggests that while public awareness of AFR technology is high, knowledge about it is low, particularly with respect to its limitations, and that support for police use of AFR depends upon appropriate safeguards being in place.
22.36. The lack of publicly available data regarding accuracy rates, bias and the basis for inclusion on watch lists is unhelpful in terms of facilitating full and frank debate about whether and how the potential of AFR could and should be harnessed. From a law enforcement and preparedness perspective, there are tremendous potential benefits for AFR data to be combined with data from other sources, such as drones, CCTV and Automatic Number Plate Recognition (ANPR) systems. This must also be considered in a transparent way so that potential gains to public protection and security can be set against the possibility of heightened risks to privacy.
22.37. Ultimately, the use of AFR must be fair, necessary, and proportionate and I share concerns expressed by others, including the Information Commissioner, regarding the potential for its use to progress unfettered by sufficient regard to the nature of the public good set against privacy, consent and governance. However, as I have set out, I am of the view that it has potential to significantly augment the way in which the public is kept safe.
22.38. AFR technology, alongside others, will continue to develop at pace. It would be wrong if the ability of those trying to prevent harm to the public is inhibited by a public debate that is ill informed or out-of-date. It is therefore incumbent on the police and other agencies to work closely with the regulatory authorities to counter misinformation and to explain the importance of various measures in terms of improving preparedness.
22.39. Any use of AFR by the MPS must be overseen by an Ethics Panel and there must be review mechanisms in place (R288) to ensure any implementation and operational issues are identified and reconciled as quickly as possible, with mitigations in place to manage the risk of unintended consequences.
Drones and counter-drone capabilities
22.40. Unmanned aerial vehicles (UAVs) - or drones - are navigated by a GPS tracking system and can be remotely controlled to fly anywhere within a specific radius. Increasingly adopted for personal and recreational reasons, they are also being adopted for agricultural purposes, commercial filming and by the emergency services in some limited situations (including supporting searches for missing persons and crime investigation).
22.41. There is no doubt that as the technology develops, use of drones will increase substantially in the coming years. In 2018, PWC estimated that by 2030, 76,000 drones could be operating across UK skies, carrying goods and people in addition to performing routine photographic, monitoring and assessment duties across a wide range of sectors.
22.42. Of course, drone technology is not deployed and developed only by law abiding users for legal purposes. Drones have been used for some years to drop contraband into prisons, and the sighting of a drone at London Gatwick airport in late 2018 caused several days of chaos and security related concerns.
22.43. And as the world becomes more technologically advanced, so do terrorist organisations and their supporters. Drones have been employed by terrorists for some time, including by Daesh Drones in Syria and Iraq for offensive as well as for information-gathering purposes. Indeed, in November 2021 an exploding drone was aimed (likely by militia forces) at the Iraqi prime minister’s house. While it failed to harm him, the case highlights how drones can be deployed for harmful purposes.
22.44. And while the threat to London should not be inflated, it is equally important to recognise the capabilities of terrorist groups to overcome the relatively low barriers to entry for understanding, procuring and harnessing drones for malign intent. And while, for example, the likelihood of a terrorist attack involving drone dispersal of chemical or biological agents in a crowded location is unlikely, its consequences would be very severe indeed.
22.45. In terms of the threat to London, the city’s air space is heavily restricted – although in itself this does not of course prevent use of a drone for terrorist purpose. This gives rise to my recommendation in paragraph 22.47 below. Legislation in place since 2019 makes it illegal to operate a drone within a five km radius of an airport: given the locations of London Heathrow (LHR) and City (LCY) airports, this means large swathes of the capital are covered and extension from the previous one km radius is welcome. That said, airports must still retain counter-drone capabilities and acknowledging the chaos previously caused at Gatwick, as indicated in chapter 10, LHR and LCY should ensure such functions are in place and properly resourced.
22.46. A permanent geo-fence is in place around the GSZ. This restricts drones from flying above and into this particularly sensitive area of the city which is likely to be considered a high-value target by malign actors. However, said actors are adept at finding ways around obstacles created by law enforcement and the MPS must ensure the geo-fence keeps pace with drone manufacture so it remains capable of withstanding incursion from the different types of device available.
22.47. It is therefore crucial that London’s small but expert counter-drone capability, set up in the MPS following what happened at Gatwick, is at the very least maintained. This must be available on a 24/7 basis (R289). Originally CT focused (it is housed in Protective Security Operations, PSO), the remit of the function has since widened to support countering the use of drones against prisons. While I welcome such cross-cutting functionality, this must not dilute its original CT capabilities: the unit must be resourced to handle CT and other concerns and able to respond swiftly to diversification in the nature and type of drones available which may require amended counter-technology in response.
22.48. The MPS is exploring what London’s future counter-drone capability should look like, recognising that use of drones, and the threat they represent, will continue to rise. The approach is reassuringly forward-thinking. It includes how best to counter multi-swarms of drones, as well as how to identify and safely deactivate a drone with a suspect payload, recognising the diversity of drones that are available on the open market.
22.49. In response to a major incident, while currently limited in terms of substantial load bearing capabilities, drones offer a less costly alternative to helicopters (see chapter 4) in terms of bringing (some) equipment to the scene and recording evidence. Deployed more quickly and to more inaccessible locations, they also represent a more environmentally sound option for use in London. As such, the MPS should consider investing further in its drone capability with respect to supporting the response to a terrorist attack, in complement to its counter-drone activities (R290).
22.50. I have considered the threat posed by drones to London’s very extensive transport network, particularly its surface components. While there are arguably much easier ways for terrorists to attack the transport system, the use of drones for hostile reconnaissance of the network to facilitate such an attack, for example, is not outside the bounds of possibility. Similarly, as elsewhere there remains the potential for a drone to deliver an improvised explosive device or some form of hazardous weapon on or close to a major transport hub.
22.51. In response, Transport for London (TfL) have produced a security guidance note which is being developed into training material for delivery across the organisation. This will focus on the need to differentiate between a drone being used legitimately and one that is not. Where this cannot be determined, staff will be guided to assess risk based on how the drone is being used. If sufficient concern is raised, the police will be informed, people will be moved away from the area and adjustments to train services to prevent more people arriving will be instigated.
22.52. While welcome, this does not constitute in my view as comprehensive a counter-drone strategy as the threat demands. As recommended in chapter 8, I encourage TfL to work with the MPS capability on how risk is identified and categorised and consider how a drone subsequently identified as hostile could be neutralised more rapidly than the current strategy would seem to facilitate. An explicit counter-drone strategy should be developed.
22.53. The Air Traffic Management and Unmanned Aircraft Act (2021) both lowered the threshold for police action with respect to unlawful use of drones and brought in new police powers allowing, among other things, for the seizure of drones (particularly important for any device carrying an illegal or harmful payload). From a preparedness perspective, however, it has been put to me that while welcome, such legislative changes are only a part of the picture.
22.54. Significantly, there remain challenges in securing details of drone owners which complicates the process of identifying and sanctioning illegal operators. While required to register details as part of the purchase process and to enable activation upon receipt, those details are held in the country of drone manufacture – which for the majority of devices is China. Access to those data is therefore likely to be fraught with complexity. Instead, the Department for Transport (DfT) should urgently consider legislation requiring users and owners to register their drones in the UK with heavy fines for those found to be owning or controlling unregistered drones (R291).
22.55. I also have some practical concerns regarding maintenance and any expansion of the MPS’ counter-drone capability without a dedicated Emergency Services radio frequency within which to do so. Allocated by Ofcom, bandwidths are rented at cost to various users including media networks. The HO, in conjunction with the DfT, should work with Ofcom to explore options for a dedicated frequency to facilitate drone use by the emergency services in response to major incidents including terrorist attacks. They should also seek to engage with the Civil Aviation Authority (CAA) to secure dedicated airspace across London for drone operation (R292).
Recommendation 286: Local authorities and the MPS, in partnership with local business owners (including via Business Improvement Districts where they exist) should work together to map blind spots and take appropriate action to ensure the provision, management and monitoring of CCTV across public spaces is comprehensive and coherent. Where possible, privately owned cameras should feed into monitored networks. (22.22)
Recommendation 287: Consideration should be given to extending this real-time MPS access to those TfL cameras monitoring areas which contain targets likely to be considered high-value from a terrorist perspective. (22.24)
Recommendation 288: Any use of AFR by the MPS must be overseen by an Ethics Panel and there must be review mechanisms in place. (22.39)
Recommendation 289: It is therefore crucial that London’s small but expert counter-drone capability, set up in the MPS following what happened at Gatwick, is at the very least maintained. This must be available on a 24/7 basis. (22.47)
Recommendation 290: The MPS should consider investing further in its drone capability with respect to supporting the response to a terrorist attack, in complement to its counter-drone activities. (22.49)
Recommendation 291: The Department for Transport (DfT) should urgently consider legislation requiring users and owners to register their drones in the UK with heavy fines for those found to be owning or controlling unregistered drones. (22.54)
Recommendation 292: The HO, in conjunction with the DfT, should work with Ofcom to explore options for a dedicated frequency to facilitate drone use by the emergency services in response to major incidents including terrorist attacks. They should also seek to engage with the Civil Aviation Authority (CAA) to secure dedicated airspace across London for drone operation. (22.55)
Lord Toby Harris, March 2022