WIREDGOV

MI5 Director General Ken McCallum recently (08 October 2024) gave his latest update on the current national security threats facing the UK.

Speaking from the Counter Terrorism Operations Centre (CTOC) in London, he explained that the threat from terrorism, alongside ongoing efforts by autocratic states to harm the UK’s security, presented the most complex threat environment we have ever seen.

Read his full speech below:

Introduction

Thank you for joining me today in the Counter Terrorism Operations Centre, CTOC.

Every day, MI5 officers – investigators, agent runners, data analysts, surveillance specialists, and many others – come here to work alongside teams from Counter Terrorism Policing, the rest of the UK’s intelligence community and an increasingly broad range of partners.

We maintain our separate identities, powers and responsibilities. But by combining forces we’re better able to detect and disrupt the terrorists.

Our international partnerships are pivotal – especially in staying one step ahead of transnational terrorist groups. This summer we worked hand-in-glove with European partners to ensure that the Euros, Olympics and Paralympics are remembered for all the right reasons.

And today I’m delighted to announce that the counter terrorism agencies of the Five Eyes nations are working with the UK agencies here in CTOC to detect and tackle terrorist threats – the sort of ambitious join-up that would have been unimaginable a generation ago.

We need all that same capability, partnering and ingenuity to confront – in parallel – the state threats we increasingly face as conflict and great power competition bite on the UK’s domestic security.

While you’ll recognise the headline themes of terrorism, Russia, Iran and China from previous speeches, the shifts underneath present the most complex and interconnected threat environment we’ve ever seen.

Counter Terrorism

Speaking from CTOC, I have to start with terrorism.

Since March 2017, MI5 and the police have together disrupted 43 late-stage attack plots. Some of those plotters were trying to get hold of firearms and explosives, in the final days of planning mass murder. Our vital work together has saved numerous lives.

The headline split of our counter terrorist work remains roughly 75% Islamist extremist, 25% extreme right-wing terrorism. But under that headline, much has shifted. Straightforward labels like “Islamist terrorism” or “extreme right wing” don’t fully reflect the dizzying range of beliefs and ideologies we see.

We’re encountering more volatile would-be terrorists with only a tenuous grasp of the ideologies they profess to follow. People viewing both extreme right wing and Islamist extremist instructional material, along with other bits of online hatred, conspiracy theories and disinformation.

Compared to my years combating Al-Qaeda, it’s harder these days for my investigators and their police counterparts to quickly and definitively determine whether an act of violence is ideologically motivated or driven by another factor like mental health.

Today, an attacker may have no connections to other terrorists.

They might not be on our records.

And there’s often no claim of responsibility.

MI5 and the police follow the intelligence and evidence to whatever conclusion – or lack of conclusion – they support. To be explicit, politics plays no role in these decisions. We will continue to do the best professional job we can of analysing a picture which is inherently messy.

We’re also seeing far too many cases where very young people are being drawn into poisonous online extremism.

Sadly, 13% of all those being investigated by MI5 for involvement in UK terrorism are under 18. That’s a threefold increase in the last three years. Extreme right wing terrorism in particular skews heavily towards young people, driven by propaganda that shows a canny understanding of online culture.

Managing complex risks intelligently requires varied professional expertise. For those planning attacks, a criminal justice outcome is generally needed. But for some vulnerable individuals, alternative interventions delivered by a wider range of partners may be more effective.

Which brings me to my next point, a predictable one but no less crucial for that: it’s hard to overstate the centrality of the online world in enabling today’s threats.

In both Islamist extremist and extreme right-wing terrorism, lone individuals, indoctrinated online, continue to make up most of the threats. In dark corners of the internet, talk is cheap; sorting the real plotters from armchair extremists is an exacting task.

Anonymous online connections are often inconsequential – but a minority lead to deadly real-world actions. We see this in recent convictions of British teenagers.

One planned to attack a British synagogue. Another posted material that inspired deadly mass shootings in the US. A third drew up plans to stab people at a music festival and shared terrorist propaganda online.

When so much plotting takes place on the internet, our ability to track the online activity of those who mean us harm is utterly crucial.

Maintaining proportionate, lawful access to such communications in the face of ever-more-prevalent encryption is sometimes our only means of detecting and understanding these threats. Privacy and exceptional lawful access can coexist if absolutist positions are avoided. World class encryption experts are confident of this. The alternative is allowing child abusers and terrorists to operate at scale, without fear of consequences.

MI5’s operational focus sits within a much wider online context: the insidious effect of internet hatred and disinformation has played into threats to election candidates, intimidation of communities, and the public disorder that followed the sickening attack in Southport.

Yesterday marked a year to the day since the horrific Hamas attacks on Israel. We’ve seen appalling loss of life in Gaza and now Lebanon, and conflicts spiralling in the wider region with all the implications that brings for Middle Eastern – and UK – security.

Today, we are powerfully alive to the risk that events in the Middle East directly trigger terrorist action in the UK, as we saw with last October’s knife attack in Hartlepool. The ripples from conflict in that region will not necessarily arrive at our shores in a straightforward fashion; they will be filtered through the lens of online media and mixed with existing views and grievances in unpredictable ways.

Thus far, while our police colleagues have responded to rising public order, hate crime and community safety challenges, we haven’t – yet – seen this translate at scale into terrorist violence. The overarching UK terrorist threat level remains at SUBSTANTIAL – an attack is likely – and is kept under constant review.

Alongside the risk of short-run mobilisation to attacks sits slower-burn radicalisation. This tide is hard to quantify or to forecast. It requires a cross-government, and community-based, response. MI5 will contribute its expertise and vigilance.

I’ll finish here with the terrorist trend that concerns me most: the worsening threat from Al-Qaeda and in particular from Islamic State.

Today’s Islamic State is not the force it was a decade ago. But after a few years of being pinned well back, they’ve resumed efforts to export terrorism. The ISKP attack in Moscow was a brutal demonstration of its capabilities. We and many European partners are detecting IS-connected activity in our homelands, which we are moving early to disrupt.

And Al-Qaeda has sought to capitalise on conflict in the Middle East, calling for violent action.

To illustrate, over the last month more than a third of our top priority investigations have had some form of connection, of varying strengths, to organised overseas terrorist groups.

Late last year, a man in Coventry was jailed for life for designing a 3D-printed armed drone for IS in west Africa. Just a few weeks earlier, two brothers from Birmingham were jailed for an attempt to join ISKP in Afghanistan.

These cases are not wild outliers. More will be coming through the courts. Organised groups have the numbers and the know-how to carry out, or inspire, horrendous mass casualty attacks.

I must touch on Northern Ireland. Earlier this year, the threat level was reduced to SUBSTANTIAL.

But sadly, we continue to see aspirations to mount attacks. With our police partners we stamp out most, but very occasionally the small rejectionist groups manage to cause appalling harm, such as in the attack on DCI John Caldwell in February last year.

I’m proud that MI5’s work with the police to disrupt and contain the residual terrorist threat continues to provide the space for constitutional politics to work.

State Threats

I now want to turn to the threats posed by autocratic regimes, whose repression at home increasingly extends to aggression overseas.

They invest heavily in human intelligence capabilities and in advanced cyber operations.

Their targets include sensitive government information, our technology, our democracy, journalists and defenders of human rights.

We’ve been growing our efforts against heightened state aggression for several years now.

In just the last year the number of state threat investigations we’re running has shot up by 48%.

Russia continues its illegal attempt to subjugate Ukraine. While the Russian military grinds away on the battlefield, at horrendous human cost, we’re also seeing Putin’s henchmen seeking to strike elsewhere, in the misguided hope of weakening Western resolve.

Over 750 Russian diplomats have been expelled from Europe since Putin invaded, the great majority of them spies. This goes well beyond all historical precedent – and has put a big dent in the Russian intelligence services’ ability to cause damage in the West.

With allies, we’re keeping up that pressure by denying diplomatic visa applications from Russian spies. It’s not flashy, but it works. Kick them out, keep them out.

Just as they’ve done in Ukraine, though, we must expect them to adjust and adapt. A reduced roster of Embassy-based spies means, for one thing, that cyber is ever more important to them. My teams and their colleagues in the National Cyber Security Centre are on the case. But we should expect further testing – and in places defeating – of the West’s cyber defences.

The more eye-catching shift this year has been Russian state actors turning to proxies for their dirty work, including private intelligence operatives and criminals from both the UK and third countries.

Once again, the internet provides the crucial platform connecting these malign actors.

While altering MI5’s detection challenge, Russia’s use of proxies further reduces the professionalism of their operations, and – absent diplomatic immunity – increases our disruptive options.

Alongside pending criminal prosecutions, the UK has taken robust action to constrain Russian aggression. Earlier this year the last remaining Russian military intelligence officer was expelled from the UK, and diplomatic accreditation removed from a number of sites. We’ll keep bearing down.

The UK’s leading role in supporting Ukraine means we loom large in the fevered imagination of Putin’s regime, and we should expect to see continued acts of aggression here at home. The GRU in particular is on a sustained mission to generate mayhem on British and European streets: we’ve seen arson, sabotage and more. Dangerous actions conducted with increasing recklessness. And having precisely the opposite effect to what the Russian state intends, in driving increased operational coordination with partners across Europe and beyond.

This concerted campaign requires a strong and sustained response. We’re working with the police to use the new National Security Act to its fullest extent.

And the National Protective Security Authority, part of MI5, already works to strengthen our critical national infrastructure. We want to help others who may be at risk of attack. So I urge businesses and public authorities to think about the risks you face. Seek out the NPSA guidance, which is informed by intelligence, to help you protect your people and your assets.

Now, to Iran.

Since the killing of Mahsa Amini in 2022 we’ve seen plot after plot here in the UK, at an unprecedented pace and scale.

Since January 2022, with police partners, we have responded to twenty Iran-backed plots presenting potentially lethal threats to British citizens and UK residents.

As events unfold in the Middle East, we will give our fullest attention to the risk of an increase in – or a broadening of – Iranian state aggression in the UK.

Like the Russian services, Iranian state actors make extensive use of criminals as proxies – from international drug traffickers to low-level crooks. Last December a man was jailed for reconnaissance he had carried out against the then-headquarters of the Iran International media organisation.

Detecting criminals prepared to have their strings pulled by states has at least some similarities to spotting would-be terrorists dancing to the tune of online radicalisers. It is a familiar challenge. We’ll keep finding them.

So to those tempted to carry out such tasks, I say this: If you take money from Iran, Russia or any other state to carry out illegal acts in the UK, you will bring the full weight of the national security apparatus down on you. It’s a choice you’ll regret.

And thirdly, China.

China is different. The UK-China economic relationship supports UK growth, which underpins our security. And there are also risks to be managed. The choices are complex, and it rightly falls to Ministers to make the big strategic judgements on our relationship with China: where it’s in the UK’s interests to co-operate, and how we do so safely.

MI5 continues to focus where you’d expect us to:

Disrupting attempts at harming or coercing people, where often we’re protecting people of Chinese heritage.

Tackling threats aimed at our democracy.

And safeguarding valuable information against a threat that manifests at scale.

Proportionate and targeted security protections are part of the foundation for a confident relationship with China that both enables economic growth and maintains the UK’s values.

Strong as our operational response is, we know that accumulating disruptive successes isn’t enough. The strategic response is to build the UK’s resilience – helping businesses, universities and others intelligently navigate the more contested world we now live in, engaging with China on real opportunities where the risks can be sufficiently managed.

If you are working at the cutting edge of technology, in business or in academia, I encourage you to seek out the NCSC and NPSA joint guidance, Trusted Research and Secure Innovation, to help you secure your hard-won advantage.

And just as we seek to protect the UK’s technological edge, we deploy that edge in support of our mission. We use AI, lawfully and ethically, to detect threat amongst an avalanche of information. Cloud technology gives us faster access to vital insights. Advanced privacy enhancing techniques allow us to join up with the private sector without either party sharing more than they need to. In 2024 scientists and technologists are key to the UK’s national security and to driving growth.

Conclusion

It will be clear to you that MI5 has one hell of a job on its hands. The first twenty years of my career here were crammed full of terrorist threats.

We now face those alongside state-backed sabotage and assassination plots, against the backdrop of a major European land war. We don’t baulk at the challenge – it’s MI5’s job. But I want to close by highlighting three areas that are critical to our ability to take that job on.

First, prioritisation. With the levels of stretch I’ve described, the decisions MI5 has to take on allocating our finite capacity are harder than I can recall in my career.

That’s true at strategic level – judging how much to devote to immediate threat mitigation, and how much on preparing for next year’s menaces.

It’s even more sharply true at the tactical operational level, as we decide how to prioritise the hundreds of fragmentary leads coming in the door each month. This is hard. We can’t always draw the right deductions from tiny clues.

A second crucial plank on which we stand is the vital role played by human sources. Agents. Today I’d like to pay tribute to the brave people who from 1909 to the present day provide us with unique and life-saving insights. Insights of a colour, depth and detail that can illuminate a picture in a way that technical intelligence often cannot.

So many of the plot disruptions we and the police together pull off have at their heart a critical contribution from human intelligence.

Every single day, members of MI5 look in the eyes of courageous human beings working in secret, from Bristol to Belfast to Baghdad, and reiterate our commitment to their safety and security. We know – and they know - that the adversaries they are working against have the capability and intent to do them lethal harm. To retain their irreplaceable contribution to our nation’s safety in the uncertain times ahead, we must retain their confidence and protect them, and their identities, forever.

That ongoing commitment to our agents is marked with a plaque in the entrance to MI5 headquarters which says: whilst their names must go unremarked, their courage and contribution never will.

I’ll conclude close to home, on something which matters deeply to me: in the end, MI5’s success in keeping this precious country safe is all about our people. They provide so much of our edge over far larger adversaries. Their selflessness in making tough decisions every day, knowing they will never receive public recognition, is to the benefit of the whole UK.

I likewise salute our law enforcement, intelligence community and government partners, domestically and internationally, whose support and collaboration are key to our success.

It is my honour to serve alongside the many extraordinary people in MI5. When threats loom large, we are defined by those whose dedication and determination keep the country safe.

They didn’t arrive here following the legendary tap on the shoulder – I certainly didn’t get one.

In many cases they’re here because they saw a news story, or personally felt the impact of a threat, that drew them to an organisation with such a clear sense of purpose.

So if you’re reading or watching this and you’re interested in a unique, rewarding and challenging career, visit the MI5 website today. As I’ve said before: it might change your life, it might save someone else’s.

Thank you.