Corporate report

The Terrorism Acts in 2023: report of the Independent Reviewer of Terrorism Legislation (accessible)

Published 15 July 2025

The Terrorism Acts in 2023

Report of the Independent Reviewer of Terrorism Legislation on the operation of the Terrorism Acts 2000 and 2006, and the Terrorism Prevention and Investigation Measures Act 2011

By Jonathan Hall K.C.

Independent Reviewer of Terrorism Legislation

Presented to Parliament pursuant to Section 36(5) of the Terrorism Act 2006

Executive summary

• Generative Artificial Intelligence’s ability to create text, images and sounds will be exploited by terrorists.

• I consider 7 categories of potential terrorism harm that may result from use of Generative AI and evaluate whether existing terrorism legislation is adequate.

• The overall recommendation is that chatbot radicalisation is the most difficult problem, and that a new race-hatred based offence should be considered.

• Storage on digital devices is now so great that the government should start thinking long term about whether the increased time needed to examine digital devices under Schedule 7 can justify ever increasing-use of detention powers.

• Questions are coming down the track about potential law enforcement use of new technology-driven biometrics (such as voice analysis) and AI- generated insights (such as deductions about emotions).

• Children and young people continue to be seduced by online content into sharing material, expressing views, and forming intentions that can result in risk to themselves and the general public, and bring them across the desks of Counter Terrorism Police.

• I return to earlier themes on terrorism legislation’s unintended impact on humanitarian relief, and the ongoing inability of a small number of individuals subject to Terrorism Prevention and Investigation Measures to obtain timely access to legal aid which (in my view) threatens the integrity of the regime.

• A more energetic response is needed to deal with delay, which continues to be a persistent feature of terrorism trials in Northern Ireland.

1. Introduction

General Reflections

1.1. Events abroad matter, and the surprise and brutalising attack against Israel by the proscribed terrorist organisation Hamas on 7 October 2023 was no exception to this rule. The attack, and Israel’s military response, inspired a terrorist murder in Hartlepool and reams of protest-related terrorism offending in the big cities.

1.2. It is difficult to tell what the long-term implications of 7 October 2023 will be on the UK terrorism landscape but calls to extend terrorism legislation to encompass more protest-linked activity were, rightly in my view, resisted^{[footnote 1]}. There was also wisdom, during the later disorder of 2024, in not invoking terrorism legislation to prosecute the rioters, not least because conventional charges led to speedier convictions and sentences.

1.3. On the other hand, some online threats issued to Members of Parliament in this more fractious national mood could stray into the zone of national security and the scope of the Terrorism Acts. A counter-terrorism response is available, if needed, against threats of serious violence or death^{[footnote 2]} issued to coerce the policy choices of the United Kingdom via its democratic heart; but that troubling overlay of online threats should not be used to stifle lawful real life protest.

1.4. The attacks by Ahmed Alid in Hartlepool, and by Joshua Bowles in Cheltenham are the only completed attacks in Great Britain in 2023 that have been classified as terrorism. In Northern Ireland there was one national security attack in 2023, the shooting of Detective Chief Inspector John Caldwell, off duty in Omagh. This has led to multiple terrorism charges in Northern Ireland that are still before the courts.

1.5. In other respects, the year was characterised by a mixed bag of terrorist offending. This pattern of risk diversification was confirmed legislatively by the enactment of new legislation against state threats: the National Security Act 2023, which I am separately appointed to review^{[footnote 3]}.

1.6. 2023 saw continuing arrests of the online radicalised, many of them children; anti-authority plots with a strong slice of conspiracy (for example, attacks on 5G masts^{[footnote 4]}); terrorist-like attacks on defence contractors^{[footnote 5]}; mental illness in lone actors^{[footnote 6]}; and counter-terrorism actions firmly linked to geopolitics in the proscription of the Russia-backing Wagner Group and the prosecution of an Iranian-backed surveillance^{[footnote 7]}.

1.7. The difficulty of distinguishing terrorism from violence motivated by hatred or grievance is demonstrated by the police’s conclusion in 2023, after 2 years of investigation, that the 2021 Liverpool Women’s Hospital attacker, Emad al- Swealmeen, was most likely motivated by a grievance to do with his asylum claim.^{[footnote 8]}. The deeds of lone actors can be hard to interpret, and their interactions online do not always bring clarity. The internet remained central to terrorist offending and investigations in 2023.

1.8. Terrorism legislation is an aspect of protecting, as Professor Jeremy Waldron has put it, the cheerful spirit of security^{[footnote 9]}. In an ideal world, no one would need to give any thought to the possibility of terrorist attacks. In the real world, where attacks do occur, the fact of legislation may provide some sense of society’s resilience or capability, or of something “being done”: hence the often- irresistible impulse to legislate in an aftermath.

1.9. In fact, as noted by one study of Extreme Right Wing Terrorism in the United Kingdom between 2007 and 2022, the Terrorism Acts have proven remarkably adaptable^{[footnote 10]}, although there is still an open question about the legislative response to loose online movements that promote terrorism^{[footnote 11]}. It is interesting to note that during this 15-year period only 6 existing terrorism offences (aside from single instances under Schedule 7 and section 15 Terrorism Act 2000) were needed to prosecute Extreme Right Wing terrorists^{[footnote 12]}.

The Role of the Authorities

1.10. Outside Northern Ireland, where the counter-terrorism function has a contested pedigree, my perception in 2023 was one of public support for those organs concerned in preserving the public domain from ideological, political, religious or racial violence. As well as counter-terrorism police and MI5, I include within this category officials at the Home Office who continue to impress me with their evidence-based approach, and specialist prosecutors.

1.11. It is to their credit that, despite the difficulties identified above, I see no evidence of terrorism legislation applied clumsily, heavy-handedly, or inadequately through bias or careless omission. The backbone is sound, although public trust cannot be taken for granted and must be continually earned.

Victims and Survivors of Terrorism

1.12. It is difficult to list all the individual consequences of terrorism from bereavement to trauma to survivor’s guilt to lost prospects. UK terrorism laws target pursuit of terrorists rather than support of victims. Support for victims and survivors is more developed in other countries^{[footnote 13]}.

1.13. The point has been made to me that all victims of terrorist attacks are the public’s representatives, because terrorist violence has a symbolic component designed to put the wider public in fear. In this context I note that there is a National Memorial to British Victims of Overseas Terrorism but no national memorial to victims of domestic terrorism. Individual memorials exist^{[footnote 14]}, but their creation and maintenance may depend on extraneous factors.

1.14. I am sometimes asked by survivors what they can do to stop others sharing the same fate. This is a natural impulse, and I regret that I do not have a ready answer.

This report

1.15. This is my sixth annual report as Independent Reviewer of Terrorism Legislation.

1.16. The Independent Reviewer of Terrorism Legislation is a unique role which relies on the candour and engagement of all those affected by and interested in terrorism, and I remain highly grateful for the support and challenge that I depend in formulating my responses. As well as annual reports, my speeches, consultation responses, Notes on Bills, and other interventions are on the Reviewer website^{[footnote 15]} and promoted via social media^{[footnote 16]}.

1.17. There are broadly comparable roles in Australia (Independent Monitor of National Security Legislation^{[footnote 17]}) and, since 2024, the Republic of Ireland (Independent Examiner of Security Legislation^{[footnote 18]}), but neither quite matches the UK role, with its freedom to examine the counter-terrorism apparatus and comment publicly about matters of general importance.

1.18. Anticipating ‘the coming wave’^{[footnote 19]}, the focus for this year’s annual report is Artificial Intelligence.

2. Review of 2023

Events

2.1. In July 2023 the government published a refreshed version of its overarching counter-terrorism strategy known as ‘CONTEST’, which comprises the 4 Ps (Protect, Prevent, Prepare, Pursue)^{[footnote 20]}. It noted a terrorist risk that was harder to detect and investigate and/or disrupt, no doubt driven by hard- to-police online spaces.

2.2. More traditional terrorism came to prominence in 2023 because of the attack against Israel by Hamas, a terrorist organisation proscribed by the Home Secretary in 2001^{[footnote 21]}, on 7 October 2023. Here was paramilitary violence, coupled with acts of savagery, done to advance a political and religious cause.

2.3. The attack was a reminder that terrorist groups with state support or “deadly connections”^{[footnote 22]} are among the most dangerous.

2.4. Domestic fallout included the Gaza-inspired terrorist murder by a Moroccan national and Islamist extremist, Ahmed Alid, in Hartlepool. He stabbed passer- by Terence Carney to death and attempted to kill his housemate Javed Nouri. His terrorist purpose arose out Alid’s hostility to Israel, and Israel’s response to Hamas’ savage attack earlier that month^{[footnote 23]}; the attempted murder by Mr Nouri’s conversion to Christianity^{[footnote 24]}. It was the first terrorist murder in the UK since the killing of Sir David Amess MP in October 2021. Earlier in the year Ex-GCHQ worker Joshua Bowles failed to kill his target in a terrorist attack driven by a deep disaffection with society, his former employer, and women^{[footnote 25]}.

2.5. Despite the possibility of further Gaza-inspired attacks, the threat level in Great Britain remained SUBSTANTIAL throughout 2023. Mohammad Sohail Farooq’s attempted bomb attack on a Leeds hospital in January 2023 was a close-run thing^{[footnote 26]} and exemplified common themes: acting alone, self- radicalisation via the internet (TikTok), and personal grievances together with ideological and religious motives.

2.6. As well as Islamist and Extreme Right Wing terrorist plots, one emanated from an anarchist who dedicated his bomb-making manual to “…misfits, social nobodies, anarchists, [and] terrorists past and future, who want to fight for freedom against the government” ^{[footnote 27]}.

2.7. Events in the Middle East did not result in a significant increase in threat, although there was a massive uptick in Hamas-related terrorist support offences since 7 October 2023^{[footnote 28]}, either online or as part of the pro-Gaza protests. Broadly speaking the public is not impacted day to day by a fear of terrorist attacks^{[footnote 29]}, and the fear of ideological or religious violence is not suborning free political choice at home, although threats to MPs raise this prospect.

2.8. In Northern Ireland the threat from Northern Ireland Related Terrorism was increased from SUBSTANTIAL to SEVERE in March 2023, and remained there for the rest of the calendar year^{[footnote 30]}. Oscillation between the second and third tier of risk category is broadly familiar from the rest of the UK, where the level of threat has changed up and down over time. Before 2022 the Northern Ireland level had been constantly at SEVERE since its introduction in 2009.

2.9. Globally, the position was bleaker. In 2023, terrorist deaths rose by over 20 per cent against the preceding year, with fewer attacks but deadlier effect. A quarter of terrorist deaths were in Burkina Faso as the epicentre of global terrorism has moved from the Middle East to the Central Sahel region of sub- Saharan Africa^{[footnote 31]}.

2.10. This corresponds to the torch being passed to regional affiliates who remain strong in key areas. Al Qae’da and Islamic State continued to suffer losses in their traditional heartlands of Afghanistan, Pakistan, Iraq and Syria^{[footnote 32]} with a depletion of cash resources. Of course, there is a human resource pool of circa 50,000 Islamic State-connected individuals (including vast numbers of children^{[footnote 33]}) still held in camps and detention facilities in Northeast Syria^{[footnote 34]}. The risk of resurgence remains^{[footnote 35]}.

Legislation

2.11. There were no new counter-terrorism Acts in 2023, and legislative changes were modest:

• the National Security Act 2023, which reflects a continuing shift of resource from terrorism to state threats, contained some minor amendments of relevance. Schedule 17, brought into force in December 2023, made changes to arrest and search powers in the Terrorism Act 2000, supported by changes to PACE Code H^{[footnote 36]}. Provisions on damages claims brought by terrorists against the government and legal aid for convicted terrorists^{[footnote 37]} were not in force at the time of the 2024 General Election, and their fate is uncertain.

• The Wagner Group was proscribed under secondary legislation^{[footnote 38]}.

• Regulations have imposed new obligations, following the Manchester Arena attack of 2017, on sellers of explosive precursors and poison^{[footnote 39]}.

• The Independent Review of Prevent by Sir William Shawcross^{[footnote 40]} led to amended Prevent guidance introduced by regulation^{[footnote 41]}.

2.12. A further consultation took place in 2023 on “Martyn’s Law” (Terrorism (Protection of Premises) Bill) after a review by the Home Affairs Committee found that the proposed burden on small premises would be excessive^{[footnote 42]}. A much-altered Bill was published in 2024 and is before Parliament at the time of writing.

3. Terrorist groups

Introduction

3.1. A broad observation on the last five decades of terrorist attacks in the United Kingdom is that terrorist organisations drove violence:

• In the first decades it was the proscribed groups of Northern Ireland (such as the IRA and UVF) killing on home soil.

• This was followed by international terrorist groups (principally, Al Qa’eda) organising and approving mass casualty attacks in the late 1990s/ early 2000s.

• Then came Islamic State/Da’esh whose quasi-statelet acted as a magnet for terrorist travellers, and totemic inspiration for terrorists who acted increasingly on their own initiative.

• Throughout these periods, would-be attackers were identified and egged on by the radicalisers of Al Muhajiroun^{[footnote 43]}.

• Even the lone actors who now dominate the GB threat picture, and whose portal to terrorism is simply the internet, can be plausibly described as part of a virtual movement, even if the formalities of group membership are lacking^{[footnote 44]}.

3.2. Globally, 54 per cent of terrorist deaths were attributed to a terrorist organisation in 2023. The four most responsible terrorist groups were Islamic State (IS), Hamas, Jama’at Nusrat al-Islam wal-Muslimin (JNIM) and Al- Shabaab^{[footnote 45]}.

Proscription: the legal power

3.3. Part II of the Terrorism Act 2000 enables the Secretary of State to ban (“proscribe”) any organisation which she believes “is concerned in terrorism”. This means that the organisation must commit or participate in acts of terrorism; prepare for terrorism; promote or encourage terrorism; or be otherwise concerned in terrorism^{[footnote 46]}. 79 terrorist organisations have been proscribed to date under the Terrorism Act 2000; a further 14 organisations in Northern Ireland were proscribed under previous legislation^{[footnote 47]}.

3.4. Banning of groups for extremism is often discussed. The idea, which has a long pedigree^{[footnote 48]}, tends to fizzle out because of the difficulties of finding a satisfactory legal definition of extremism. By contrast, for the all the criticisms that can be made of it, the definition in section 1 Terrorism Act 2000 has proven legally workable.

What is an organisation?

3.5. The definition of organisation is broad: it includes any association or combination of persons^{[footnote 49]}.

3.6. The recent interpretation of the Proscribed Organisations Appeals Commission, the judicial body responsible for hearing (in practice, very rare) challenges to proscription decisions, is that “organisation” requires no centralised command or hierarchy.

• The judges held in the Liberation Tigers of Tamil Eelam’s (LTTE’s) unsuccessful challenge, that steps towards a shared purpose between individuals, coupled with some degree of interaction between them, distinguished organisations from disparate individuals^{[footnote 50]}, amounting a “notional glue”^{[footnote 51]}

• In ruling out the need for formal structure, the judges had in mind the position of loose-knit extreme right wing terrorist groups^{[footnote 52]}.

3.7. However, this is almost certainly not the last word on the meaning of organisation^{[footnote 53]}. The LTTE’s appeal was dismissed on the facts. An assessment by the Joint Terrorism Assessment Centre proved that the LTTE had historically structured itself into cell-like structures, and that this type of structuring – or organisation – had continued into the present after the LTTE’s military defeat in 2009^{[footnote 54]}.

3.8. There remains the question of how an organisation, if no structure is required and if some interaction between individuals is sufficient, differs from a “movement”. This is particularly salient where the interactions are purely online, especially where the common factor is not personal relationships but content^{[footnote 55]}.

3.9. The risk, from a rights perspective, of straying too far from an ordinary understanding of “organisation” would be if proscription was used as a marker of disapproval of views or ideas. This might condemn anyone holding or considering those views as a terrorist, leading to arbitrary outcomes, such as Turkey’s treatment of anyone who used an encrypted messaging application called “ByLock” as a member of a banned terrorist organisation (the “Gülen movement”)^{[footnote 56]}.

3.10. I was not aware, until it emerged in this case, of the government’s guidance document called “Individual v. Organisation Acts”^{[footnote 57]}. Nor was it known by the body which makes recommendations to the Home Secretary known as the Proscription Review Group^{[footnote 58]}. It was a policy which had fallen through the cracks of government decision-making. The guidance document does little more than raise common sense questions for officials.

3.11. If an organisation is concerned in terrorism and therefore meets the statutory threshold, then the Secretary of State has a discretion whether to proscribe or not. Any decision to proscribe is subject to ratification by Parliament. In earlier reports I considered the mechanics and consequences of proscription in greater detail^{[footnote 59]}.

Proscription activity in 2023

3.12. Only one group was proscribed in 2023, the Wagner Group, described as a Russian private military contractor^{[footnote 60]}.

3.13. The government’s assessment was that Wagner commits and participates in terrorism based on their use of violence against Ukrainian Armed Forces, and against civilians, to “advance Russia’s political cause”; that it prepares for terrorism for the same reasons; and that it is more broadly concerned in terrorism because of its activities in Africa^{[footnote 61]}.

3.14. This, and the continuing non-proscription of Iran’s Islamic Revolutionary Guard Corps, illustrates that the key dividing line for UK proscription is not the nature of the cause, but whether an organisation is private (proscribable) or part of a state (non-proscribable).

• This is a rational distinction, even where a private group has supplanted and taken on some of the characteristics of state.

• Accordingly, the Houthis could be proscribed despite their de facto control over large parts of Yemen.

• A reason for the continuing non-proscription of the Houthis, despite their belligerence towards Western-flagged shipping after the events of 7 October 2023, is the risk of interrupting humanitarian aid to a grievously suffering population.

3.15. The proscription of greatest relevant to 2023 was the banning in 2021 of the whole of terrorist group Hamas^{[footnote 62]}. The affirmation by its political leaders that Hamas would repeat the attacks of 7 October 2023 all over again supports the view that there was no longer any sound distinction between its armed and political wings^{[footnote 63]}.

3.16. Because of this earlier proscription, pro-Gaza marchers who carried supportive signs or chanted supportive slogans or posted these online could be prosecuted for inviting support for Hamas (section 12 Terrorism Act 2000) or displaying Hamas symbols (section 13 Terrorism Act 2000)^{[footnote 64]}. There was a marked rise in the number of charges relating to proscription from 3 (in the first three quarters of 2023) to 10 (in the final quarter, beginning 1 October 2023)^{[footnote 65]}.

3.17. This illustrates the impact of proscription. Support for the Houthis (with reference to the chant, “Yemen, Yemen, make us proud, turn another ship around”) would not fall within section 12 Terrorism Act 2000 as the Houthis have never been proscribed. The reason relates to humanitarian aid, which I discuss further below.

3.18. The government did not, despite stirrings, decide that the pro-Palestine marches provided a reason to extend the ambit of terrorism legislation, for example by introducing further offences of strict liability. As I wrote at the time, this would have been a mistake^{[footnote 66]}.

Aid agencies

3.19. The events of 7 October 2023 and its aftermath in Gaza drew attention to another aspect of proscription. This is the need to ensure that action against terrorist organisations, such as Hamas, should not unduly stifle humanitarian action on the ground, such as providing food, building infrastructure, funding education, and supporting peacebuilding. Stifling could occur by banks jettisoning clients involved in these sectors, known as de-risking^{[footnote 67]}.

3.20. In early 2024 the government pledged that its use of sanctions under the Sanctions and Anti- Money Laundering Act 2018 would protect humanitarian priorities. Having already issued a General Licence under autonomous counter-terrorism sanctions to allow humanitarian activity to continue in Gaza^{[footnote 68]}, it also committed, when time allowed, to bring forward a tailored humanitarian exception across all the UK’s financial sanctions^{[footnote 69]}.

3.21. There are differences of substance between sanctions, on the one hand, and prohibitions under the Terrorism Acts on the other.

• Monetary penalties for sanctions breaches can be imposed on a strict liability basis. By contrast, terrorism offences to do with funding proscribed organisations contain an element of moral fault^{[footnote 70]}.

• Sanctions breaches straightforwardly prohibit financial involvement with a detained person or their assets. Funding offences under the Terrorism Act 2000 essentially concern property that is likely to be used for the benefit of terrorism (which includes the resources of a proscribed organisation)^{[footnote 71]}.

3.22. Nonetheless, as I have reiterated throughout these annual reviews^{[footnote 72]}, humanitarian relief in conflict zones is as relevant to terrorism offences as it is sanctions. Greater sophistication of licencing or exceptions for sanctions points up the comparative clumsiness of terrorism legislation.

• For example, a sophisticated proscription regime might allow the government to proscribe an entity such as the Houthis (also known as, Ansar Allah), whilst avoiding or at least mitigating any interruption in the flow of aid to Yemen.

• Greater freedom to proscribe could support police action.

• For example, the chant, “Yemen, Yemen, make us proud, turn another ship around”, was overt support for Houthi militiamen firing on Western shipping in the Red Sea. Absent proscription, the prohibitions to inviting support in section 12 Terrorism Act 2000 did not apply.

3.23. I previously encouraged the government to consider whether the reporting mechanism in section 21ZA Terrorism Act 2000 could provide the equivalent to a licencing regime for sanctions. I am grateful to the government and officials for holding workshops and dedicating time to considering this issue. The government has shown a willingness to commit time to this issue and has quite rightly sounded out existing statutory mechanisms.

3.24. However, it is now abundantly clear to me that section 21ZA is nothing like a suitable licencing mechanism for humanitarian action.

3.25. It is also clear from meetings with officials that there is an appetite to consider a more far-reaching approach. This is to be applauded, and I will report on developments in my next annual report.

3.26. The essential framing is one of control against abuse. Humanitarian exceptions for aid agencies, mandated at UN level^{[footnote 73]}, are tantamount to recognising that for certain humanitarian actors for certain purposes and under certain conditions the risk that their humanitarian intervention will benefit terrorists is so little as to be negligible. I fear that the extent to which aid agencies already take detailed and practical steps to avoid funding terrorism, (for example, vetting in-country agents, sharing information on risk, or crafting policies on operating in conflict zones where frontlines are mobile) is not fully appreciated by government.

3.27. Fundamentally, there is no point in over-policing the aid sector if there are other ways of protecting national security. But, as I have repeatedly pointed out in these reports, and in my two reviews of Counter-Terrorism Sanctions, this requires a shared understanding of risk across the responsible Whitehall departments. Without that shared understanding, then reforms may be half- baked, delayed or vetoed.

• In the absence of agreement at the highest levels of government, it is inevitable that civil servants will conscientiously assert their perceived departmental priorities. Crudely put, these are domestic security for the Home Office, both international security and development for the Foreign Commonwealth and Development Office, and regulatory compliance for HM Treasury.

• I therefore recommend that the Chancellor, Home Secretary and Foreign Secretary should meet to discuss the balance of humanitarian aid and security in relation to terrorism legislation.

3.28. In its recent strategy document, the government endorsed the role of the Tri-Sector Group^{[footnote 74]}, which comprises representatives of the UK government and regulators, financial institutions, and humanitarian organisations. In a crisis, the Tri-Sector Group has been used to bring practical wisdom to bear on crafting general licences (for example, in relation to Gaza^{[footnote 75]}).

3.29. This body of collective expertise is however underused. I recommend that the government should consult the Tri-Sector Group on potential reforms to the Terrorism Act 2000.

4. Investigating terrorism

Introduction

4.1. Terrorism investigations blend intelligence leads with ordinary policing with the exercise of special counter-terrorism powers and techniques. Counter- Terrorism Police work hand in glove with MI5 whose powers under the Security Service Act 1989 and the Investigatory Powers Act 2016 are outside the scope of my review. This Chapter is concerned with powers exercised by the police, principally under the Terrorism Act 2000.

4.2. Some investigations involve spur-of-the-moment decisions, such as spontaneous use of stop and search powers against a person carrying a heavy rucksack in a crowded area.

4.3. Other investigations stem from long-term examination of overt and sensitive sources of evidence, designed to rule out, or rule in and counteract, terrorist plotting.

4.4. Not every investigation leads to arrest and prosecution. Disruption may be the only effective option, for example because the investigation is based on highly sensitive intelligence with no evidence that could be used in court proceedings. In the 2023 edition of CONTEST, the UK’s counter-terrorism strategy, the Home Secretary referred to the successful disruption of 39 late-stage terrorist plots in the United Kingdom since March 2017^{[footnote 76]}.

4.5. Terrorism legislation makes it easier for the police to obtain access to material than in cases of non-terrorist crime.

4.6. For comparison, a constable seeking a search warrant or production order under the Police and Criminal Evidence Act 1984 (PACE) needs to satisfy a judge that the material sought “is likely to be relevant evidence” of an offence^{[footnote 77]}.

4.7. But there is no such requirement to unlock the investigative powers under the Terrorism Act 2000 Part IV, including search warrants, production orders, requirements for financial information and cordons:

• It is sufficient that there is a terrorist investigation.

• Terrorist investigation is broadly defined, meaning that no specific offence need be suspected^{[footnote 78]}.

• Material sought must be likely to be of substantial value to the investigation^{[footnote 79]} or capable of enhancing the effectiveness of the investigation^{[footnote 80]}, without necessarily being a source of evidence.

• Police can therefore exercise these powers in circumstances where a criminal prosecution may be anything from probable to impossible.

4.8. The same is true of stop-and-search powers: it is not necessary to suspect that an individual has committed or is about to commit a particular offence; or is carrying stolen goods; or a knife; or drugs. It is enough that they are reasonably suspected of being a “terrorist”^{[footnote 81]} (sections 43 and 43A, Terrorism Act 2000).

4.9. Terrorism investigatory powers therefore have something in common with terrorism offences. Just as terrorism offences penalise preparatory-type conduct (memorably described by my predecessor Lord Anderson KC as “defending further up the field”^{[footnote 82]}), so too terrorism investigatory powers allow examination of potential terrorist risk when no offence is suspected.

4.10. It must be acknowledged that this widened scope for investigation comes with the risk of excessive prying. Not being required to justify access to private information through the lens of evidence and prosecution gives investigators a freer hand to enter and search premises or obtain bank records. I do not doubt that special powers are necessary; but there is an additional need to ensure proper training, and monitoring of their use.

4.11. A unique aspect of terrorist investigation concerns the management of convicted terrorists who have been released into the community^{[footnote 83]}, or individuals who are subject to monitoring under the TPIM Act 2011^{[footnote 84]}. Because the authorities have declared their interest in these individuals, at least some of this investigation will be overt.

4.12. Inevitably, contemporary terrorist investigations involve quantities of electronic data. I have previously recommended that work is needed on new legislation to secure access to remotely stored data^{[footnote 85]}. The government has recognised that there is a gap, and officials are working on concrete proposals.

4.13. I have also made recommendations on realistic and workable safeguards on the Retention, Review and Disposal of personal electronic data. I acknowledge that counter-terrorism police spend a great deal of time and resource on attempting to comply with data protection rules which arguably are not suited to counter-terrorism operations. However, either the rules should be changed, or the ones that exist should be observed. Currently, I do not have confidence in the latter^{[footnote 86]}.

4.14. A suspected terrorism offence is a criminal offence like any other and therefore the investigatory powers in PACE are often available too^{[footnote 87]}; if finances are involved in a plot, the powers under the Proceeds of Crime Act 2002 have proven very useful.

Stop and search

4.15. The risk with stop and search powers, unless targeted with prior intelligence, is that speedy judgments must be made based on conduct and appearance.

4.16. The government has recently agreed to publish statistics on the use of sections 43 by all forces, although 2023 statistics are only available for the Metropolitan Police. These show a further decline in stop and search of persons from 327 (in 2022) to 204 (in 2023), compared to 1,052 in 2011^{[footnote 88]}. No figures are available for stops of vehicles only (section 43A, Terrorism Act 2000).

4.17. This decline, together with a remarkably consistent figure for resulting arrests (around 10% since 2015)^{[footnote 89]}, does not suggest that the power is being abused. The current period of decline probably reflects the lower tempo of terrorist attacks since 2017, when the stop and search figure was the second highest ever (776).

4.18. Of the 204 people stopped, the largest group were people who self- defined as Asian (46 made up of: Indian, 8; Pakistani, 4; Bangladeshi, 11; other Asian background, 23) followed by 43 who self-defined as White. There were 79 individuals who preferred not to define themselves by racial category (‘not stated’)^{[footnote 90]}.

4.19. The no-suspicion power (section 43A, Terrorism Act 2000), only available if authorised in an emergency, has not been used since 2017.

Cordons

4.20. Only 3 terrorism cordons were erected in Great Britain in 2023, the lowest ever^{[footnote 91]}. The highest ever number in a 12-month period was 51; unsurprisingly their use spiked around the time of the 2017 attacks.

4.21. Terrorism cordons are not simply a mechanism for blocking entry by the public^{[footnote 92]}. They also allow police to search premises without the need for a judicial warrant. Following my recommendation in an earlier report, in 2023 Parliament amended paragraph 3 of Schedule 5, so that the power to search within a cordoned area should only be available in urgent cases^{[footnote 93]}.

Search warrants and production orders

4.22. In non-urgent cases, counter-terrorism police can apply to judges for search warrants or production orders (requiring a person to produce material) (Schedule 5). There are no published statistics on the use of these powers.

4.23. Additional restrictions on search and production powers have been identified by the courts: for example, in journalistic cases, police need to consider whether there is any less intrusive means of obtaining the material sought^{[footnote 94]}. An important ruling came in 2023 in an Official Secrets Act case^{[footnote 95]}:

• The protection afforded to journalistic material cannot be eroded by impugning the circumstances in which it was obtained.

• “Stolen” material may therefore still be “journalistic”.

• Such cases require an additional layer of independent oversight to strike the balance between security and journalistic freedom.

4.24. In cases of “great emergency” a police superintendent can authorise a search without a judicial warrant^{[footnote 96]}. The officer may not authorise the seizure of journalistic material^{[footnote 97]}. Any use of the urgency provisions must be notified to the Secretary of State^{[footnote 98]}. They were not used in 2023, and have not been used since Operation Manteline, the investigation into the Manchester Arena bombing in 2017.

4.25. In 2023, amendments were made to the Terrorism Act to cater for urgent searches during which journalistic material has nonetheless been seized^{[footnote 99]}.

• A judicial warrant may be applied for to allow the retention of any confidential journalistic material that has been picked up.

• This is not something that I recommended, on the grounds that there was no proven necessity, and that new measures concerning journalistic material should only be added parsimoniously in cases of real need^{[footnote 100]}. However, the government wanted parity with equivalent provisions when dealing with state threats under the National Security Act 2023 Act^{[footnote 101]}.

• Police will need to avoid the temptation using the urgent procedure, on the footing that they can always seek an ex post facto retention warrant later on.

4.26. A theme drawn to my attention is the increasingly difficulty in distinguishing types of data to which different access regimes apply. This is particularly the case with communications data, where the traditional boundary between telecommunications operators and ordinary businesses has been blurred by the rise of e-commerce^{[footnote 102]}.

Post-charge questioning

4.27. Section 22 Counter-Terrorism Act 2008 enables post-charge questioning in terrorism cases. It was not used in 2023. The government has accepted my recommendation last year that a minor amendment is required to the wording of the section to cater for cases of questioning after extradition.

Financial investigations

4.28. Counter-terrorism investigators applied for 12 disclosure orders under Schedule 5A Terrorism Act 2000 during 2023, giving rise to 62 disclosure notices^{[footnote 103]}. 14 disclosure orders were obtained under the Proceeds of Crime Act 2002 giving rise to 68 disclosure notices.

4.29. There were no Customer Information Orders or Explanation Orders. 114 Account Monitoring Orders were granted during 2023^{[footnote 104]}.

4.30. 161 production orders were granted under Schedule 5 Terrorism Act 2000 only in relation to financial investigations. There were an additional 46 which included an Account Monitoring Order. There were 114 standalone Account Monitoring Orders.

4.31. In 2023, according to figures provided to me by National Counter- Terrorism Policing Headquarters^{[footnote 105]}:

• 746 Terrorism Act 2000 Suspicious Activity Reports (SARs) were disseminated.

• 490 Proceeds of Crime Act 2002 SARs were disseminated that were identified as potentially relevant to terrorism.

• 297 SARs were disseminated that contained a request for a defence against terrorist financing under sections 21ZA or 21ZB Terrorism Act 2000.

• 62 of these were refused.

Biometrics and AI insights

4.32. The prospect of new biometrics – that is, biometrics additional to fingerprints, DNA and facial recognition – existed before but has been supercharged by AI.

4.33. Machine learning, it is reasonably supposed, will be able to pick out patterns from information which we generate as we move through the world, which are unique to each of us.

4.34. This could comprise information concerning our physical attributes:

• voice analysis

• iris analysis

• vein analysis,

information about how we use our bodies:

• gait analysis

• handwriting analysis

• keystroke analysis

• behavioural analysis

and information about our cognitive processes:

• Linguistic analysis

• Emotional analysis.

4.35. It is plausible to posit a trained model being shown multiple images, sound samples, or other data collected about an individual, and developing further deep insights: some of these insights might be useful for identification purposes.

4.36. In addition, AI may achieve insights about us, whether useful for future identification or not. It is plausible that machine learning could now or in the future achieve accurate insights about ethnicity or health (including pregnancy), and plausible insights about sexuality, marriage status and political leanings. In 2018, the Technical Advisory Panel to the Investigatory Powers Commissioner noted the capability of AI to increase privacy considerations, because it could be used to generate highly personal insights from apparently bland data^{[footnote 106]}.

4.37. Genuine utility for counter-terrorism should not be taken for granted. For example, gait analysis is more plausible in a one-to-one analysis (unidentified gait is compared to a gait sample from a known individual) than in one-to-many situations (trying to pick out an individual from a crowd).

4.38. Not all the above are biometrics in law. Data protection legislation defines biometric data as:

• “Personal data…

• “…resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual…

• “…which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic [i.e. fingerprint] data” ^{[footnote 107]}.

4.39. This tripartite definition excludes AI insights about a person, unless they allow or confirm a person’s unique identification. Personal insights about health or sexuality have special protection not because they are biometrics but because they are “special category” personal data^{[footnote 108]}.

4.40. Other AI insights could fall within the definition if used for identification.

• For example, an insight based on linguistic analysis of an individual’s writing would appear to result from “specific technical processing” as currently defined^{[footnote 109]} and relate to an individual’s behavioural characteristics. If this allowed Counter-Terrorism Policing to identify a living author from an anonymous terrorist manifesto, then it would appear to amount to biometric data.

4.41. The reason for referring to biometrics is that the law provides special protection for fingerprints and DNA samples taken at ports under Schedules 7 and 8 Terrorism Act 2000^{[footnote 110]}.

4.42. For unconvicted individuals, this protection comprises a system of National Security Determinations, whereby chief officers, previously overseen by the Biometrics Commissioner^{[footnote 111]}, consider whether retention for national security purposes can be justified^{[footnote 112]}.

4.43. However, there is no equivalent protection for facial recognition biometrics that might be extracted from photographs taken on the same occasion, or any other type of biometrics. As the Biometrics Commissioner pointed out in 2019, legislation has a narrow understanding of biometric capabilities^{[footnote 113]}.

4.44. It is true that DNA samples and fingerprints have some special features:

• They are taken through physical contact with the subject (if necessary, without consent^{[footnote 114]}), whereas facial recognition and other AI-enabled identifiers can be extracted without physical contact and in some cases remotely.

• They are immutable. Behaviour such as handwriting style, however useful it may be for generating identifying insights, is not.

• They are very effective in allowing unique identification compared to, say, handwriting analysis, although the same is true of facial recognition.

• In addition, DNA samples could be used to identify genetic abnormalities affecting the health of the individual and members of the same family.

4.45. The question is whether these distinctions are sufficient to justify special protection for only these two types of biometrics. Should other biometrics (properly so called) be included in this protection? Or should this type of protection be abolished as an anomalous artefact of an earlier age, on the basis that general data protection principles are sufficient?

4.46. I make no attempt to answer these questions.

4.47. The topic of protection for biometrics is only a subset of wider consideration of privacy in an AI world.

4.48. It is plausible that counter-terrorism will be at the forefront of privacy- intrusive technologies. The Centre for Emerging Technology and Security (part of the Alan Turing Institute) has published an excellent discussion paper on the future of biometric technology for police and law enforcement^{[footnote 115]}. They observe that disagreements over fundamental biometric technologies have undermined the ability to revise existing regulatory frameworks. I agree.

Medics

4.49. Vulnerability Support Hubs ran for 5 years as pilot schemes in London, Manchester and Birmingham until put on a permanent footing and rebadged as the Clinical Consultancy Service in 2024.

4.50. The Service is a specialist resource for investigators in those cases involving suspicions of poor mental health, neurodivergence, depression or psychosis which account for a persistent volume of counter-terrorism investigations or Prevent referrals in the UK^{[footnote 116]}.

4.51. Joints teams of police and clinicians (29 psychiatrists and psychologists who remain NHS employees^{[footnote 117]}) do not assess counter-terrorism risk but provide advice and guidance on clinical disposals. For example:

• a very unwell individual displaying terrorist risk may meet the criteria for detention under the Mental Health Act 1983.

• an individual may threaten terrorist harm when they take stopping their medications: one way of managing terrorist risk may simply be to promote contact with a local GP.

4.52. Professor Charlotte Heath Kelly of Warwick University, has posed some important questions about this model^{[footnote 118]}, in summary:

• Does it threaten the traditional organisational divisions between welfare agencies (focussed on need) and security agencies (focussed on danger)?

• Is there a risk that the delivery of public health will be corrupted by security concerns?

• How can covert terrorism policing be squared with open and generally consent-based treatment?

• Is health data being sucked up by the police and intelligence agencies?

4.53. Even if a collaborative model is justified because health-based diversion may be better all round, what safeguards and oversight exist? However unlikely in the United Kingdom, there are historical examples of psychiatric principles and disposals being exploited for repressive ends, such as during the Soviet period^{[footnote 119]}.

4.54. During 2024 I had a lengthy meeting with the National Service Lead and other police and clinical members of the Clinical Consultancy Service. Using Dr Heath Kelly’s questions as a guide, I posed questions about casework, interventions, roles, oversight, and access to health data.

4.55. At my request I was provided by the National Service Lead with this publishable summary of their work:

The Counter Terrorism Clinical Consultancy Service (CCS) is a unit within CT Policing that brings NHS Clinical MH expertise into CT case work. With the rise in mental ill health, as one of a number of vulnerabilities that may be a factor in someone’s CT risk, CT policing has found itself in need of greater clinical understanding to help manage that risk.

The CCS is a unit of CT police officers who work alongside NHS Forensic clinicians on a contractual basis. The clinical staff are senior experienced professionals within mental health services across nursing, psychological and psychiatric disciplines. They are vetted to the same level as CT police allowing them to have sight of the full picture around someone’s risk and offer advice, guidance and options to CT Police about the subjects, presentation, diagnosis or what treatment may be available for them in mainstream health services.

Acting in much the same way as a translation service the unit supports understanding of both health and CT policing needs and legal gateways. The aim being to support the disclosure of information between agencies to support health outcomes and in the hope it may support reduction of CT risk. This is done openly, with frontline health understanding the origin of enquiries and whilst done without the consent of the subject, it is done with the acceptance that our interest in them may be disclosed by health to the subject at any time.

The service supports good information sharing between key public bodies in a legally compliant way. It does not afford access to health data on a SECRET basis.

4.56. Whilst health bodies have long been able, and sometimes required, to share health information which is relevant to terrorist risk^{[footnote 120]}, I raised the possibility that a busy GP, contacted by clinicians at Service for information on a known individual’s mental health treatment, might dump data on the Service with the implication that police staff would have unjustified access to health data.

4.57. I was satisfied that the risks of data dumping leading to unjustified disclosure to police staff were remote. This was owing to the way any data would be requested, transferred, stored and accessed using separate servers within the Service. Care has been taken to pilot and refine the processes involved.

4.58. But operating an effective partition between health and police professionals places a heavy burden on the former. Despite being employed by the Service, they must continue to reach sound independent and clinical judgments in every case about sharing the information further.

4.59. I accept that if health and security were to be categorically separated:

• Unwell individuals being investigated and possibly prosecuted as terrorists where a non-criminal justice health disposal may be sufficient.

• Clinicians making decisions about mental health in ignorance of important information about the risks posed by their patients to the general public and possibly to themselves.

4.60. But I also acknowledge the risks of unintended outcomes. Continuing vigilance is required.

5. Arresting and detaining

5.1. Arrest is described in the counter-terrorism world as executive action^{[footnote 121]}. Unless the arrest is in response to spontaneous events, it represents a move from the planned covert investigatory stage to overt intervention.

Arrests in 2023

5.2. 219 terrorism-related arrests in 2023 represented a material increase on earlier years (190 in 2020, 185 in 2021, 167 in 2022) but some way off the 467 in 2017. The highest number of arrests was in the final quarter of 2023, corresponding to the Hamas attack on Israel and its domestic (often protest- related) aftermath^{[footnote 122]}.

5.3. Only a fraction of arrests (18 out of 219, or 8%, down from 36 in 2022) used the strong powers in the Terrorism Act 2000 (section 41) permitting pre-charge detention for up to 14 days^{[footnote 123]}.

• There were 18 warrants of further detention (authorising detention for more than 2 days)^{[footnote 124]}.

• No one was detained for longer than 8 days^{[footnote 125]}. But it is worth recording that out of the 8 people detained for between 6-8 days, 4 were released without charge. This illustrates the potential impact on individuals of conferring such strong powers.

• In one case (as in 2022), access to a solicitor was delayed^{[footnote 126]}.

5.4. All other terrorism-related arrests in Great Britain, a total of 201, were carried out using another arrest power such as the Police and Criminal Evidence Act 1984 (PACE).

• It is possible to ‘flip’ from arrest under PACE to arrest under section 41. Welcome amendments were made to the Terrorism Act 2000 in 2023 to ensure that the total period of permitted cumulative detention is capped at 14 days^{[footnote 127]}.

5.5. I continue to review the visiting records completed by specially trained TACT Independent Custody Visitors who visit TACT suites around the country, to monitor the treatment of detainees.

• I am pleased to report that there has been an increase in the number of Independent Custody Visitors for the important London area. I commend the Mayor’s Office for Policing and Crime for their recruitment efforts, and the Thames Valley network for supporting London in the interim.

• The Code of Practice for Independent Custody Visitors is in the process of revision. I am informed that this will expressly require, as I recommended last year, that independent visitors are notified of terrorism-related arrests under PACE as well as section 41; and that arrangements will be made for TACT visitors irrespective of whether the terrorism-related arrest is under section 41, or under PACE.

5.6. On my own visits, I saw examples of good practice. These included allowing a 13-year old to occupy 2 cells and the corridor, rather than being confined to single cell; and adapting a fingerprint room for use of autistic detainees.

Who gets arrested

5.7. As ever, most terrorism-related arrests were of men (198 versus 21)^{[footnote 128]}. The largest ethnicity category is White people (97), followed by Asian people (71, of which the largest grouping is those of Pakistani appearance^{[footnote 129]}), “Other” (33, of which the largest grouping is those of Arab appearance^{[footnote 130]}) and Black people (10). 8 were recorded as “not known” ^{[footnote 131]}.

5.8. Most terrorism arrestees were British (155, including dual nationals; all other nationalities were in single figures)^{[footnote 132]}.

5.9. The children category set another record high. In 2023, 42 children were subject to terrorism-related arrests (up from 32 in 2022, itself a record)^{[footnote 133]}. Children are emerging as a terrorist threat category. As Hannah Rose and Gina Vale have noted^{[footnote 134]}, they are innovators and amplifiers in their own right. The internet is of course central to this.

5.10. There is no breakdown for arrest by ideology. The government has partially accepted my recommendation that this data should be published. It will ensure this data is collected and made available to the Home Office and to me, with further consideration being given to the question of publication.

Charges following arrest

5.11. Out of the 219 arrestees, 57 people were charged with terrorism-related offences; 4 were charged and 2 were cautioned for non-terrorism offences, and 10 were recalled to prison^{[footnote 135]}.

5.12. Of the 57 charged, 12 of these were children, comprising the second largest category in 2023 (the largest category was “30 and over”, 20 people). However a comparison between arrest figure and charge figures shows that as the arrest rate has gone up, the charging rate for children has declined in the last 5 years^{[footnote 136]}. This suggests that even though the need for disruptive arrests has increased, different approaches are being taken to longer term management of the terrorist risk presented by children.

5.13. Consistent with recent years the main offences are documentary (possession of instructional material, and dissemination of terrorist publications)^{[footnote 137]}. However, 2023 saw a large rise in charges relating to proscribed organisations (10, up from 2 in 2022), almost certainly driven by offending related to Hamas after 7 October 2023^{[footnote 138]}. There were three attack- planning charges (down from 6 in 2022) but no terrorism-connected murder charges or explosives charges, and only one terrorism-connected firearms charge^{[footnote 139]}.

5.14. A stand-out figure from 2023 concerns those who were not charged in 2023.

• Fewer than ever were released without charge (46, down from 77 in 2022), but 98 people were bailed to return pending further investigation^{[footnote 140]}.

• This is a major leap, up from 52 in 2022^{[footnote 141]}.

• PACE must have been the arrest power used in those cases, since there is no power to bail under the Terrorism Act 2000. The view of counter- terrorism police must have been that the risk posed by all these arrestees was manageable on bail whilst the investigation continued.

• Conversely, where a person is viewed as a serious risk, the section 41 arrest power is used. A maximum of 14 days detention, but without any prospect of bail conditions if sufficient evidence cannot be found to charge, incentivises police to throw resources at these cases to get the job done^{[footnote 142]}.

Released prisoners: special arrest power

5.15. Section 43B has enabled, since 2022, the arrest of released terrorist offenders where a constable has reasonable grounds to suspect that the offender has breached his licence conditions and that it is necessary to detain him until a decision can be made on prison recall. Section 43C permits a personal search (for example, to check for weapons).

5.16. These were introduced in response to my recommendations following the terrorist attacks by Usman Khan (Fishmongers Hall, 2019) and Sudesh Amman (Streatham, 2020)^{[footnote 143]}.

5.17. There are no official statistics published. Novel powers need scrutiny, and I recommend that official statistics are collected on the use of sections 43B and 43C.

6. Stopping the travelling public

Introduction

6.1. In Schedules 7 Terrorism Act 2000, Parliament conferred unique and unparalleled powers on police. Individuals can be stopped, examined with no right to silence, detained, searched, have their biometrics taken under compulsion, and temporarily deprived of their property, all absent any suspicion and for reasons that need never be disclosed^{[footnote 144]}.

6.2. This allows for detection and disruption based on prior intelligence or analysis^{[footnote 145]} (tasked), or intuition or officer decision (untasked).

6.3. The powers may be exercised at ports and the Northern Ireland land border, and, since the Nationality and Borders Act 2022^{[footnote 146]}, in defined circumstances on individuals detained after irregular entry into the UK (for example, on small boats or the back of a lorry).

• The government rejected my recommendation last year to abolish the use of the power at the Northern Ireland land border on the grounds of obsolescence.

• The government is considering my recommendation for facial recognition at Western Jet Foil (small boats arrivals) as part of a wider review.

6.4. The justification for these head-turning encroachments against the freedoms of the travelling public is the role they play in safeguarding national security^{[footnote 147]}. This security dividend is the basis upon which the powers have hitherto survived challenge in court^{[footnote 148]}.

6.5. In April 2023, counter-terrorism police used Schedule 7 against a French citizen, Ernest Moret, at St Pancras International in circumstances that led to me writing and publishing an ad hoc report in July 2023^{[footnote 149]}.

• My conclusion was that the police were conducting an investigation into public order for which counter-terrorism powers under Schedule 7 were never intended to be used.

• The government has accepted my recommendation that the Code of Practice should be amended to specify that Schedule 7 should not be used for the purpose of public order policing.

Use in 2023: People

6.6. In the UK there were 2,737 examinations under Schedule 7, of which 396 were conducted on intra-UK travel between ports within England, Wales, Scotland and Northern Ireland^{[footnote 150]}.

6.7. This is an increase on the figure in 2022 (2,592).

6.8. This is the first time since records began in 2012 (when the figure was 60,127) that there has been an overall increase, albeit a mild one in Great Britain. Over the longer term the picture has been one of steepling decline in the use of Schedule 7^{[footnote 151]}. The explanation given to me by Counter Terrorism Borders Policing is better targeting.

6.9. In opposition to the decline in examinations, the percentage of resultant detentions (1,708 or 62% up from 1,435) has increased yet again. This too is part of a long-term trend, which is not merely explained by the statutory amendment in 2014 that any person detained after 1 hour must be detained^{[footnote 152]}. For comparison, in 2012 under 4% were examined for longer than one hour in Great Britain, whereas the figure for 2023 was 62%^{[footnote 153]}.

6.10. The explanation again appears to be better targeting, meaning that police are likely to want a deeper dive in terms of phone data analysis and biometrics (fingerprints or DNA were taken in 1,562 cases, up from 1,301 in 2022^{[footnote 154]}). That said, continued use of the power in untasked situations is important:

• To ensure an element of unpredictability, which is a virtue^{[footnote 155]}.

• To prevent hostile individuals or groups reverse engineering from a pattern of examinations, to infer whether the authorities have intelligence on them.

6.11. The length of examinations is undoubtedly influenced by the practical complexities of accessing phone data on today’s increasingly large and complex devices.

6.12. If this trend continues, so that most examinations lead to detention, it may be appropriate to reframe Schedule 7 as a detention power. Worryingly, no solution has yet been proposed to monitoring detention in accordance with the UK’s international obligation^{[footnote 156]}.

6.13. On the ethnicity of those examined in Great Britain^{[footnote 157]}:

• The largest category for examination is ‘Chinese or Other’ (827) but a more detailed breakdown shows that this was made up of 8 Chinese people, 380 Arab people and 439 in an unspecified group. This confirms the impression that the category ‘Chinese or other’ is a misnomer.

• In 2023, leaving aside those in the unspecified group, and those ‘not stated’, the largest categories were people in the category ‘Any Other Asian Background’ (529), then Arab people (380) followed by ‘Any Other White Background’ (256), then White British (230), Pakistani (201), and then African people (127).

• Of these categories, the percentages for those who went on to be detained were: ‘Any Other Asian Background’ (53%), Arab people (63%), ‘Any Other White Background’ (65%), White British (69%), Pakistani (66%), and African people (68%).

6.14. At my request, Counter Terrorism Policing Headquarters carried out analysis of the self-defined ethnicities of those examined under Schedule 7. A comparison was made between self-defined ethnicities of those stopped on the basis of officer decision (untasked) versus those stopped on the basis of prior tasking.

6.15. The purpose of doing so was to determine whether discretionary stops might account for a higher proportion of non-White people being stopped. If so, this could potentially indicate officer bias.

6.16. In fact, the distribution of ethnicity categories was remarkably similar for both tasked and untasked examinations. In other words, there is no indication from this data that when police officers are deciding without prior tasking whether to conduct an examination that their decision-making is motivated by conscious or unconscious bias.

6.17. In response to last year’s report in which I noted that a decline since 2012 in the number of White people examined under Schedule 7, despite the increased detection and prosecution of Extreme Right-Wing Terrorism (generally, although not always, carried out by White people)^{[footnote 158]}, Counter Terrorism Policing Headquarters carried out some further analysis.

• According to this analysis, 10 years ago a significant percentage of all Schedule 7 examinations were carried out on intra-UK travel associated with Northern Ireland Related Terrorism.

• It can be assumed that these examinations were of White people.

• Since then, there has been a significant decline in the number of examinations connected to Northern Ireland Related Terrorism as a percentage of the whole.

• This is consistent with the fall in the percentage of White people examined since 2012.

6.18. I have been informed that police carry out thematic work to see whether travel patterns exist that could be used to identify further travellers of interest from an Extreme Right Wing Terrorism perspective. Even so I do not expect that this will result in a majority of examinations being of White people in the near future because the most significant threat remains Islamist Extremist terrorism.

Use in 2023: Freight

6.19. Schedule 7 contains a special power to examine goods (also referred to as freight).

6.20. Examination of Air Freight was up, from 435 in 2022 to 959 in 2023, although down since 2016 when records began (3,463)^{[footnote 159]}. Sea Freight was examined less often: only 84 instances in 2023 against 7,969 in 2016 when it exceeded the incidence of air freight examination.

6.21. Schedule 7 also includes a special entry power onto vehicles and premises for the preliminary purpose of determining whether to carry out an examination of goods (paragraph 9(4)).

6.22. A question has arisen whether counter-terrorism police who x-ray a package in a vehicle or on premises are carrying out an examination under paragraph 9(1).

• The significance is that if the examination power (paragraph 9(1)) is used a record must be made and a notice left with the goods^{[footnote 160]}.

• Covert searches amounting to examinations must therefore be carried out under different legislation^{[footnote 161]}.

6.23. Whilst it is strongly arguable that not every interaction with freight amounts to an examination under paragraph 9(1)^{[footnote 162]}, I understand why this has given rise to uncertainty. Looking at the outside of parcel is not the same as opening it, but using an x-ray could reveal everything that would be obtained from opening it. Sometimes the consignee would have a reasonable expectation of privacy for the contents (the presence of medicines in a personal package), sometimes not (the presence of illegal gun parts). Carrying out an x-ray could involve moving the goods to another location, and interfering with other people’s property requires legal justification. Sometimes police will be able to benefit from the lawful exercise of powers by other officials (for example, Border Force officials exercising powers under the Customs and Excise Management Act 1979) but this will not always be the case.

6.24. I therefore recommend that the Code of Practice should be amended to address the x-raying of goods, and in particular the circumstances when notices should be left (where the x-raying amounts to an examination) and where they should not be left (when the x-raying is preliminary to an examination). For the avoidance of doubt I do not recommend abolishing the leaving of notices – Schedule 7 is not a covert power.

6.25. The substance of the amendment is best considered by the Home Office in light of the practicalities. The purpose should be to give practical guidance to officers, and comfort to those whose goods pass through airports and seaports that controls on the examination of goods are not being circumvented.

Phones

6.26. Access to phone^{[footnote 163]} data is now one of the most important outcomes, if not the most important outcome, of the Schedule 7 power. Although the yield from most examinations will be at the level of intelligence, recent terrorism convictions show their importance in obtaining evidence:

• Schedule 7 powers in 2023 led to extreme right wing terrorist material being found on the phone of a passenger at Luton Airport^{[footnote 164]}, and evidence of a terrorist arson plot on the phone of a former soldier travelling through East Midlands Airport^{[footnote 165]}.

• Schedule 7 was instrumental to the terrorism convictions in 2023 of a 22-year old drill musician found with Islamist terrorist instructions on his phone when passing through Heathrow the previous year^{[footnote 166]}; and of a mother and daughter whose phones, examined at Heathrow and Gatwick, held evidence of terrorist funding arrangements^{[footnote 167]}.

6.27. Schedule 7 allows the examination of phones and if necessary for the purposes of seizure, detention for up to 7 days^{[footnote 168]}. Failure to provide a phone PIN amounts to an offence^{[footnote 169]}.

6.28. Given our reliance on phones for everyday living (practical impact), and the volume of personal data they contain or give access to (privacy impact), this aspect of Schedule 7 deserves continuing attention.

6.29. I have previously criticized the inadequacy of policies on review, retention, and disposal^{[footnote 170]}. I can report that since July 2024, all data excluding biometric data (which has its own retention regime) is to be given an initial retention period of 10 years where an examination of a person results in intelligence being collected for further assessment; and 6 years where either such an examination does not so result, or the examination is only of property^{[footnote 171]}. This only deals partially with the inadequacies I identified.

6.30. I have also drawn attention to the need for express powers to deal with remotely stored data that may be accessed from, but not stored, on mobile devices^{[footnote 172]}. I understand that legislation is being contemplated.

6.31. The reality is that technology is beginning to test the foundations of Schedule 7 which has its roots in 1970s Northern Ireland and is largely unchanged since the enactment of the Terrorism Act 2000. Advances and cost reductions mean that some phones now have 1 terabyte of data storage, which threatens the ability of police to conduct searches during the maximum 6-hour period, and risks phone seizure (for up to 7 days) as a matter of course.

6.32. There is only very limited reference in the Code of Practice to the examination and seizure of phones.

6.33. I recommend that the Secretary of State should start considering how Schedule 7 ought to operate in an era of high-memory phones:

• Will the seizure of phones for further examination, with all the attendant inconveniences, be the norm?

• If so, how can phone seizures be reduced to the lowest possible consistent with safeguarding the public against terrorism?

• Are there practical alternatives to phone seizure?

• Is there a requirement for amendment to the legislation? Or to the Code of Practice?

7. Terrorism trials and sentencing

7.1. This Chapter considers terrorism and criminal justice in 2023. It is followed by an Annex, a standalone and detailed analysis of terrorism offending and Generative Artificial Intelligence.

Criminal justice and terrorism

7.2. A settled counter-terrorism response requires public and fair demonstration that those accused by the authorities really are guilty.

7.3. Despite the general woes of the criminal justice system, this continues to be achieved in England and Wales^{[footnote 173]} by a commendable combination of skill, effort, and dedication of resources:

• Specialist counter-terrorism officers well-versed in securing admissible evidence.

• A dedicated unit within the Crown Prosecution Service (the CPS Special Crime and Counter Terrorism Division).

• Expert barristers, often Treasury Counsel appointed by the Attorney General.

• Experienced judges within a special Terrorism List.

• Bespoke Case Management for terrorism cases^{[footnote 174]}.

Prosecutions in 2023

7.4. During 2023, the Crown Prosecution Service concluded 65 proceedings for terrorism-related offences with convictions in 61 cases and acquittals in 4^{[footnote 175]}. Even allowing for the higher rate of guilty pleas than contested trials^{[footnote 176]}, this is a remarkable conversion rate from charge to conviction.

7.5. The total of 65 completed terrorism trials was slightly higher than in 2022 (58) but has been at a relatively consistent level for the past 5 years.

7.6. There was a marked increase in the number of completed prosecutions for attack-planning (section 5 Terrorism Act 2006): 11, more than the total in the previous 3 years (although well below the years 2015-7^{[footnote 177]}).

7.7. This indicates that higher risk cases, which were ultimately frustrated by the authorities, have been flowing through the court system. Convictions for attack- planning included:

• Shabaz Suleman (Central Criminal Court), 19, who disappeared while on a family holiday to Turkey in 2014 and went to join Islamic State in Syria. He was sentenced to life imprisonment^{[footnote 178]}.

  • Another ‘returner’ from Islamic State convicted in 2023 was Aine Davies (Central Criminal Court); he returned to the UK after serving a terrorism sentence in Turkey and was convicted in the UK of terrorist funding and firearms offences^{[footnote 179]}. This takes the total number of UK terrorism convictions against ‘returners’ from Islamic State on account of their conduct in Syria and Iraq to 12^{[footnote 180]}.

  • A computer seized on the battlefield by the Syrian Defence Forces in Syria in 2018 led to the conviction in 2023 of Stella Oyella, 53 and Vanessa Atim, for sending terror funds to their close relative Joseph Ogaba who had left the UK in 2014 to join Islamic State (and later died in custody)^{[footnote 181]}.

• Mohammad Al-Bared (Birmingham Crown Court), a 27-year-old engineering student jailed for life for building a “kamikaze” drone for use by Islamic State. He had planned to join Islamic State, a proscribed organisation, in West Africa^{[footnote 182]}.

• Luke Skelton (Teeside Crown Court), 20, sentenced to 4 years (plus a 1-year extension on licence) for planning a non-viable attack on a police station in Newcastle in 2021. A previous jury had failed to reach a verdict. In sentencing the judge drew attention to his autism and isolation against the backdrop of the Coronavirus pandemic^{[footnote 183]}.

• Joe Metcalfe (Leeds Crown Court) from Keighley, a White supremacist who at the age of 15 planned attacks on Muslims whilst disguised as an armed police officer. He wanted to imitate the mass shootings in Christchurch, New Zealand in 2019 and Buffalo, New York in 2022. He was sentenced to 10 years (plus a 6-year extension on licence). He had previously been referred to Prevent and was also convicted of rape^{[footnote 184]}.

• Edward Little (Central Criminal Court), 22, who planned an Islamist firearms attack on a Christian preacher in Hyde Park and was sentenced to life imprisonment^{[footnote 185]}. He was stopped on his way to purchase a weapon, after carrying out hostile reconnaissance of his intended target.

• William Howitt (Birmingham Crown Court), 27, a former solider and glorifier of Hitler who planned an arson attack against a left-wing bookshop and was sentenced to 4 and a half years^{[footnote 186]}.

  • This conviction sits alongside the 2023 terror convictions of other individuals formerly in positions of authority: a former police detention officer who shared images online supportive of the Ulster Defence Association^{[footnote 187]} and a prison officer at HMP Leeds who founded a neo-Nazi club and was caught in possession of the “White Resistance Manual”^{[footnote 188]}.

7.8. After his second trial for attack-planning collapsed in 2023, Al-Arfat Hassan, a 20 year-old drill rapper lyrically inspired by Islamic State, pleaded guilty to possessing pre-cursor chemicals for a terrorist purpose (section 57 Terrorism Act 2000). He had been in online contact with a then 15-year old boy who was convicted of failing to notify the authorities of Hassan’s intentions (section 38B Terrorism Act 2000)^{[footnote 189]}.

7.9. Also acquitted of attack-planning but convicted of serious terrorist offences was Ben Styles, 24, obsessed with the Extreme Right Wing Terrorism murders of Muslims in Christ Church, New Zealand and detected assembling a sub- machine gun in his garage^{[footnote 190]}.

7.10. The most frequent principal offence leading to conviction was section 2 Terrorism Act 2006, which prohibits the dissemination of terrorist publications (15 convictions).

7.11. What I refer to as ‘documentary offences’ (sections 1, 2 Terrorism Act 2006, and section 58 Terrorism Act 2000) made up almost half (25) of the terrorism offences prosecuted (55)^{[footnote 191]}. Notable is the age of offenders, and the incidence with which Telegram was the chosen platform. Relevant convictions included:

• Malakai Wheeler (Winchester Crown Court), 16 at the time of his arrest, and described as deeply entrenched in a Telegram chat group committed to extreme right-wing ideology^{[footnote 192]}

• Aristedes Haynes (Central Criminal Court), 17, who distributed extreme right-wing terrorist material including using Telegram, painted racist slogans on a mural in Port Talbot, and fantasized about killing an Asian student at school. He had been diagnosed with autism and was previously referred to Prevent. An unnamed 15-year old was convicted with him^{[footnote 193]}.

• Roma Iqbal (Winchester Crown Court), 23, an Islamic State admirer who distributed Islamist material online and made use of Signal, WhatsApp, TikTok and Telegram ^{[footnote 194]}.

• Christopher Gibbons, 38, and Tyrone Patten-Walsh, 34, (Kingston Crown Court), racists who ran a neo-Nazi podcast and online library using Bitchute^{[footnote 195]}.

  • Bitchute has been put on special measures by OFCOM because of the availability of the live-streamed Buffalo, New York terror attack^{[footnote 196]}.

• Vaughn Dolphin (Birmingham Crown Court), 20, an extreme right wing terror obsessive who posted attack videos on Telegram and experimented with explosives. The Court heard he struggled with dyslexia and autism and was unable to make friendships, spending large amounts of time on the internet.^{[footnote 197]}

• Alfie Stevens (Central Criminal Court), a 24-year-old man with “underlying problems”, who uploaded two extreme right-wing publications to Telegram^{[footnote 198]}.

• Mohammed Afzal (Liverpool Crown Court), 18, who collected and disseminated terrorist material online. He had refused to give the police passcodes to his devices^{[footnote 199]}.

• Luca Benincasa (Winchester Crown Court), a self-described incel and Neo- Nazi, his offences related to the banned Feuerkrieg Division. He was also convicted of possessing child sex abuse material^{[footnote 200]}.

• Elliot Brown (Bristol Crown Court), who shared bomb-making instructions on Telegram^{[footnote 201]}.

• Darren Reynolds, 60, a conspiracy theorist who ran a Telegram channel calling for the assassination of MPs in furtherance of his extreme right wing, antisemitic and racist views^{[footnote 202]}. His co-defendant, Christine Grayson, 60, a fellow conspiracy theorist whom he met on Telegram, was convicted of conspiring to damage 5G telecoms masts.

  • In January 2023, Oliver Lewin was sentenced for attack-planning (convicted 2022) on phone, TV and radio masts in furtherance of his anti-authority conspiracy theories^{[footnote 203]}.

7.12. One documentary terrorism offence had very different implications. Austrian citizen Magomed-Husejn Dovtaev, 31, carried out hostile reconnaissance at the London headquarters of the Persian-language television channel Iran International in February, long a target of the Iranian authorities^{[footnote 204]}. He was convicted of attempting to collect information likely to be useful to a terrorist (section 58 Terrorism Act 2000). Nowadays such conduct would be prosecuted under the National Security Act 2023^{[footnote 205]}.

Relevant non-terrorism offences

7.13. The most striking non-terrorism offence in 2023 was the conviction of Jaswant Singh Chail. It offers a glimpse of malign human-AI teaming (see the Annex, for further consideration of terrorism and AI).

• He pleaded guilty to an offence under the Treason Act 1842 for entering the grounds of Windsor Castle armed with a crossbow and intending to kill the late Queen Elizabeth.

• He was an isolated individual who suffered from very poor mental health.

• Having formed his murderous intentions, he used an online platform called Replika to create a chatbot companion, Sarai, and entered an imagined romantic relationship with ‘her’.

• Singh Chail shared his assassination plans with the chatbot Sarai, and Sarai offered him approval and reassurance for what he was doing^{[footnote 206]}.

7.14. Stirring up racial hatred contrary to section 19 Public Order Act 1986 has proven an effective and proportionate means for prosecuting expressions of antisemitic hatred at pro-Gaza protests, and online. In my view it was far better to prosecute this offence than to extend existing terrorism law^{[footnote 207]}.

• In a different context it was used to prosecute James Costello, 38, who ran a stickering campaign in Liverpool calling for the establishment of a white master race. Costello was known to members of the proscribed neo-Nazi organisation, National Action^{[footnote 208]}.

Attorney General consent for overseas-linked cases

7.15. For Gaza-linked terrorism prosecutions, the Attorney General will have given permission for the Director of Public Prosecutions to bring proceedings as they will have appeared to have been committed “…for a purpose wholly or partly connected with the affairs of a country other than the United Kingdom”^{[footnote 209]}.

• I am informed that the Law Officers (either the Attorney General or his deputy, the Solicitor General) have since 7 October 2023 (and as of 20 September 2024) given permission for the prosecution of 21 suspects for offences contrary to the Terrorism Acts related to the 7 October attacks and ongoing Israel-Hama conflict.

• This “safety valve”^{[footnote 210]} is of most obvious value where the conduct concerned takes place overseas and where prosecution in the United Kingdom could unacceptably damage international relations or other important public interests. This could arise if UK military were overtly or covertly engaged in the conflict on the same side as the individual accused of terrorism.

• The need for Attorney General permission in domestic protest cases is less obvious. But there is merit in retaining it as a form of double-check against overapplication of the broad definition of terrorism^{[footnote 211]}. Where the objective of terrorist conduct is solely to bring about change abroad, there is reason to consider whether the national security of the United Kingdom is impugned; especially since support for some violence abroad (for example, the actions of the non-state forces in the Syrian Defence Force against Islamic State) would correspond with United Kingdom interests^{[footnote 212]}.

• The funnel from Director of Public Prosecutions to Attorney General is wide (“…if it appears to the Director of Public Prosecutions…for a purpose wholly or partly etc.”) presumably because the Director of Public Prosecutions will know less than the Attorney General about some aspects of the public interest.

Mindset and risk management of children

7.16. An academic study in 2023 showed that since 2016, 43 individuals (42 boys, 1 girl) had been convicted of terrorism offences committed as minors^{[footnote 213]}. In the authors’ plausible analysis there have been two waves of childhood terrorist offending:

• Connected to Islamic State’s territorial caliphate until its collapse in 2018.

• After that, extreme right-wing terrorism arising from decentralised online networks. The Director General of MI5 has observed that extreme right wing terrorism “skews heavily towards young people” and is “driven by propaganda that shows a canny understanding of online culture”^{[footnote 214]}.

7.17. The study’s cheerless conclusion, which I would echo, is that children are not merely mimics or victims, but are “innovators and amplifiers in their own right”. There have been no completed attacks in the UK to date, but plenty of murderous planning and foiled plots^{[footnote 215]}.

7.18. What is the mindset of these juvenile terrorists? However self- importantly knowledgeable about the tenets of their chosen hatred – noting that the leader of the proscribed organisation Sonnenkrieg was a 13-year-old from Estonia^{[footnote 216]} - many of these children, and some younger adults, are better described as keyboard warriors than as dyed-in-the-wool terrorists. This comes with the caveat that keyboard warriors can have a real world impact by inspiring attacks elsewhere^{[footnote 217]}.

• This begs the question of the weight to be given to ‘mindset material’, the penumbra of content generally found on digital devices that is frequently relied on in terrorism prosecutions to prove that the defendant is seeking to advance a political, religious, racial or ideological cause (section 1(1)(c) Terrorism Act 2000), and to rebut defences of innocence association or innocent possession.

• So long as the judge takes the view that it is more probative than prejudicial then mindset material is admissible^{[footnote 218]}.

• Criminal procedure does not currently mandate a specific direction on mindset material to the jury, even in the case of child defendants^{[footnote 219]}, although the defendant’s true mindset and motivations are especially central in cases of alleged terrorism^{[footnote 220]}, and it may be said that inferring the true mindset of children from their online interactions and enthusiasms requires particular care^{[footnote 221]}.

• It is also possible that mindset material plays a role in prosecutorial discretion and assessments of risk or culpability at the point of sentence^{[footnote 222]}. The same need for caution in inferring personal risk from the quantity or quality of material possessed by a child defendant must equally apply here.

7.19. Whether ideological or not, youth attraction to ultra-violence, the lives of ‘saints’^{[footnote 223]}, aesthetics and transgression^{[footnote 224]} continues to push cases of suspected terrorism across the desks of investigators.

7.20. This is not to belittle the potential risk because a young radicaliser can inspire attacks across the world. The propaganda output of Daniel Harris, 19 at the time of being sentenced to 11 and a half years’ imprisonment, inspired a racist mass shooting in Buffalo, New York^{[footnote 225]}.

7.21. The criminal process brings delays, and incapacitation in the form of custodial sentences are rare for children^{[footnote 226]}. It is therefore unsurprising that the public interest does not favour prosecution in every case: in 2023, there were 43 arrests of children for terrorism-related offending in 2023 but by June 2024 only 14 of these had been charged^{[footnote 227]}.

7.22. Hence the programme of work across Counter Terrorism Policing and government to find alternative mechanisms for addressing this conduct. The goal is an off-ramp from the criminal justice path potentially involving civil measures, engaging parents and teachers^{[footnote 228]}, briefing local authorities, and harnessing health interventions. Autism is a particular feature in this young internet-seduced cohort^{[footnote 229]}.

7.23. New measures are intended to respond to particular aspects found in child casework: the limited disruptive effect from overt intervention (such as arrest or search); refusal to engage in early intervention; a perception of lack of consequences for continued offending. I will report on the government’s formal proposals when details are available.

7.24. A further question arises as to the role of the counter-terrorism machine itself. Specialist counter-terrorism police do not have an endless capacity to investigate internet lovers of violence. Even the Prevent scheme, criticised for being both over-inclusive of Muslims^{[footnote 230]} and over-inclusive of vulnerable loners^{[footnote 231]}, has some boundaries. It can be difficult for officers faced by incels, school massacre enthusiasts or muddled but violent individuals to work out whether Channel referral or Police-Led Prevent is suitable.

7.25. There will therefore be risky individuals, probably not very different in character from those who do qualify for Prevent intervention (young, isolated except for online connections, violence-obsessed), who fall outside the radar of counter-terrorism police and counter-terrorism legislation.

7.26. I suggest that the following questions arise:

• Who if anyone manages the risk posed by individuals on the fringes of Prevent (for example, school shooting fantasists who aspire to acquire firearms)?

• Do the police and those they work with have sufficiently deep knowledge of the role of the internet in the lives of isolated young people so that they can effectively intervene and detect false compliance?

• Do the police have a thorough-going but realistic understanding of all the mechanisms that exist within and outside the criminal justice process?

Travel to terror zones

7.27. In response to last year’s annual report, the government has accepted my recommendations to consider a new terrorist travel offence and to consider applying extraterritorial jurisdiction to child cruelty offences connected with terrorism.

Sentencing, prison and release

Sentence lengths

7.28. During 2023 there were 3 life sentences (the most since 2018) but also the joint highest number of non-custodial sentences for terrorism offences (14, the same as 2022)^{[footnote 232]}.

7.29. The maximum sentences for terrorism offences have been steadily increasing in recent years^{[footnote 233]}.

7.30. Longer sentences for the worst offenders certainly takes them off the streets for longer. Some individuals are truly dangerous, like Munawar Hussain who was sentenced to indefinite detention under the Mental Health Act 1983 after stabbing two people at Marks and Spencer’s in Burnley in 2020 in the grip of Islamist Extremist beliefs (and stabbed a hospital nurse whilst awaiting sentence)^{[footnote 234]}.

7.31. But prison offers darker opportunities. If the release point is too far off, terrorists may pursue a prison ‘career’ as radicalisers. Even if they do not enter prison as terrorists, the risk that long-term prisoners will adopt Extremist Islamist personas is a real one as shown by the 2023 conviction of Denny De Silva^{[footnote 235]}.

7.32. Pragmatic risk management is at the core of terrorism offences. Terrorism offences are designed to allow police to intervene before attacks, and therefore to manage risk before it crystallises. It cannot be certain that every terrorist offender is a would-be terrorist attacker. I suggest that retribution is a lesser factor and that what works is what matters.

7.33. Either way, the public and Parliament have a strong interest in understanding what effect these reforms are having. This means the decision, since June 2024, not to collect official statistics on sentence lengths for terrorism offending is unwelcome. I recommend that this decision should be reversed without delay.

Terrorism-connected

7.34. Where an individual has been convicted of a non-terrorism offence, since 2009 a formal procedure has existed for the judge, at sentencing, to determine whether the offence has a terrorist connection (section 69 of the Sentencing Code in England and Wales, sections 30 and 31 Counter Terrorism Act 2008 in Northern Ireland and Scotland).

• The question for the judge is whether the offence is or takes place in the course of an act of terrorism or is committed for the purposes of terrorism^{[footnote 236]}.

• If so determined, he has no right to release before the expiry of his full sentence and may only apply for parole at the two thirds point^{[footnote 237]}.

• Assuming he is sentenced to more than 12 months’ imprisonment^{[footnote 238]}, the outcome is determinative of the offender’s status once he is released from prison, because the requirements of Part 4 Counter- Terrorism Act 2008 (notification of address, vehicle, bank details, change of name etc) will apply^{[footnote 239]}. The defendant’s home is liable to be searched for compliance purposes^{[footnote 240]}.

• Breach of notifications is an increasingly prosecuted criminal offence (7 convictions in 2023^{[footnote 241]}), reflecting a culture of active offender management post-release.

• He is liable to polygraph measures as part of his licence under the Offender Management Act 2007^{[footnote 242]}.

• He may be arrested for the purposes of urgent recall to prison^{[footnote 243]}.

• The offender is to all intents and purposes a terrorist offender.

7.35. It is foreseeable that more restrictions and obligations will be applied to released terrorist offenders. Part 5 of the National Security Act 2023, although not yet in force, points the way with restrictions on access to legal aid for terrorists and terrorism-connected offenders^{[footnote 244]}.

7.36. However, given the variety and variability of human motivations, determining a connection is not always straightforward.

7.37. Consider the case of Joshua Bowles who was sentenced in October 2023 for attempting to murder a US citizen working for GCHQ, the UK’s communications agency, at a leisure centre in Cheltenham.

• The question of terrorism-connection was disputed by the defendant, who was autistic, depressed and suicidal, and had general anti- authoritarian as well as incel-related fantasies.

• The judge heard detailed evidence and submissions from his barrister.

• Noting that the law covered transient states of conviction as well as deeper more fully reasoned ones, the judge ultimately found that Bowles wished by murdering his victim “however unrealistically” to disrupt the UK-US intelligence partnership^{[footnote 245]}.

• It was therefore found to be terrorism connected, but it is not difficult to conjecture a similar case with a different outcome.

7.38. Compare the case of Emad Al Swealmeen whose 2021 detonation of an improvised explosive device at the Liverpool Women’s Hospital looked like straightforward terrorism but whose categorisation is harder to pin down.

• After almost 2 years’ investigation by Counter Terrorism Policing North West, it was still impossible to determine motivation.

• The conclusion was that the deceased Al Swealmeen, who suffered from poor mental health, had a grievance against the British state leading him to construct and set off an improvised explosive device but the “precise motive for the attack remains unknown” ^{[footnote 246]}.

7.39. For individuals convicted of terrorism-related offences overseas, a special judicial procedure exists for a judge of the High Court (or Court of Sessions, in Scotland) to determine that the overseas offence amounted to a terrorism or terrorism-connected offence^{[footnote 247]}. It is open to the defendant to participate.

• In October 2023, a determination was made against an Islamist terrorist, previously convicted in Denmark of attempting to murder a cartoonist who depicted the Prophet Mohammed^{[footnote 248]}.

• He was then subject to the notification requirements of the 2008 Act.

7.40. A recent question has arisen as to the treatment of domestic non-terrorist offenders convicted before 2009 who cannot be made subject to polygraphing (lie-detecting) on release. The impetus is the approaching eligibility for release of individuals serving long sentences imposed during the 2000s which could be, for example, for explosives offences.

7.41. If a domestic offender is to have their conviction upgraded to terrorism to allow for polygraphing (and potentially further restrictions and obligations), then there is no good reason to provide fewer rights and protections than apply in the case of foreign offenders. Altering the factual basis of a sentence is a judicial act, requiring fair process, and not suitable for executive decision by ministers.

• There will be cases before 2009 where the terrorism connection is obvious and will appear from the sentencing remarks: for example, the sentencing of the Operation Crevice defendants who sought to blow up Bluewater Shopping Centre in Kent in 2004^{[footnote 249]}.

• But experience shows that a terrorism-connection will not always be obvious. Accuracy is best served by a judicial process with the ability to receive representations from the defendant who may have valuable submissions.

• It is also possible that with evolving approaches to terrorism (for example, the recognition of left-wing or incel terrorism), ministers will perceive the existence of a terrorism connection where none was considered to exist at the time of the original sentencing.

7.42. I therefore recommend that if legislation is brought forward to allow individuals convicted before 2009 of non-terrorism offences to be treated as terrorists, post release, then this should allow for judicial determination of any terrorism connection.

Sentencing and autism

7.43. In last year’s report I compared the high-level guidance available to sentencing judges in England and Wales (with its reference to the need for a “sufficient connection” between disorder and offending behaviour) with the more detailed guidance available in the courts of New South Wales, Australia^{[footnote 250]}.

7.44. At my request, in 2023 the Howard League for Penal Reform commissioned a review of 24 terrorist cases of defendants with diagnosed or declared autism:

• The study considered the reported sentencing remarks in each of these cases.

• The average defendant age was 22 years old.

• The most common terrorism offences (14 out of 24 cases) were documentary offences^{[footnote 251]}, followed by possession of explosives, firearms or attack-planning (9 out of 24 cases).

• At least half the offenders claimed to have been drawn into offending because of an obsession with and curiosity of weaponry, guns and explosives, rather than because of radicalisation in a traditional sense.

• In 8 of the 24 cases autism was found to be a mitigating factor.

• No clear overarching approach could be detected as to the extent to which autism was or was not taken into account during sentencing.

Terrorists in Prison

7.45. The total of convicted terrorists in the prison estate in Great Britain ticked up from 226 to 244 in 2023^{[footnote 252]}.

7.46. This total comprised 158 Islamist Extremist terrorists, 64 Extreme Right Wing Terrorists, and 22 described as ‘others’^{[footnote 253]}. 95 prisoners are Asian or Asian British people, 93 are White people, 13 are people of Mixed Race; there are 17 Black or Black British people, and 23 people from other ethnic groups (3 are unrecorded)^{[footnote 254]}. The vast majority (195) are British^{[footnote 255]}.

7.47. The case of Denny De Silva^{[footnote 256]} indicates a laudable willingness to tackle terrorist conduct within prison walls. Identifying terrorism risk behaviours in prison remains an important objective^{[footnote 257]}.

Released terrorists

7.48. There were more releases in 2023: 51 up from 40^{[footnote 258]}.

7.49. When terrorist offenders reach two-thirds of their sentence in England and Wales, the Secretary of State must refer their case to the Parole Board to consider their suitability for release ^{[footnote 259]}. This follows changes made by the emergency Terrorist Offenders (Restriction of Early Release) Act 2020, brought in after the Fishmongers’ Hall attack by the released terrorist offender, Usman Khan.

7.50. I am very grateful to the Parole Board for allowing me to publish the following figures on referrals for terrorist offenders which were made to the Parole Board:

	Decision to release	Decision not to release	Sentence expired before case heard	Deported before case heard	Total
Sep 20 – Sep 21	10	19	10	1	40
Oct 21 – Sep 22	14	44	1	0	59
Oct 22 – Sep 23	16	52	3	0	71

7.51. I have also been provided with data for a longer time frame, from June 2020 to April 2024. There was a total of 228 referrals made of which 45 were by terrorist offenders whose right to automatic release at one half of their sentence was removed by the 2020 Act.

• Of the 45 offenders, release was directed in 24% of cases, no release in 71%, release occurred at sentence expiry in 4% of cases, and 3% were deported.

• Of the remaining 183, release was directed in 26% of cases, no release in 71%, and release occurred at sentence expiry in 3% of cases. There were no deportations.

7.52. The Parole Board now has about 80 members (judicial and non-judicial) who have received training on terrorism cases. The Board is increasingly transparent about its work, a fact to be welcomed given the role it plays in the lifecycle of managing terrorist offenders.

7.53. The following documents have been made available to me (and are available on request from the Parole Board) which contain informative detail about the parole process in terrorism cases:

• A decision dated 20 February 2024 on whether to hold a public hearing in the case of Abdalraouf Abdallah, later identified as a contact of Salman Abedi, the Manchester Arena bomber. He was automatically released in November 2020 but recalled to prison for breaching his licence. He applied for release again, and a closed hearing (allowing sensitive information to be relied on but withheld from the prisoner and his representatives^{[footnote 260]}) was ordered. The application for a public hearing was refused. His application for release was later refused^{[footnote 261]}.

• A summary of the decision, following a hearing in September 2023, to release Anthony Garcia, one of the Crevice Plotters^{[footnote 262]}. This also involved a closed hearing.

• A summary of the decision, following hearings in March and April 2023, to release Nazam Hussain, a co-defendant of Usman Khan (later, the Fishmongers’ Hall attacker), following his recall to prison in 2019. Again, withheld material was considered at a closed hearing.

7.54. It is open to either the Secretary of State or prisoner to request reconsideration of eligible decisions^{[footnote 263]}. At least some reconsideration decisions are published online on the Bailii website. I am aware of the following:

• Secretary of State’s application for reconsideration (granted) against decision of Parole Board to release Sandeep Samra. She had tried to join Islamic State when she was 18 and was convicted of attack- planning. She had been recalled for allegedly tampering with her tag^{[footnote 264]}. It is not known whether her release was directed after reconsideration was ordered.

• Secretary of State’s application for reconsideration (refused) in the case of Abdulrahman Alcharbati: he had been convicted of sharing terrorism videos on Facebook in support of Islamic State, and his release had been directed by the Parole Board^{[footnote 265]}.

• Reconsideration application by Shah Rahman (refused) against a decision to refuse release. This attack-planner who had wanted to blow up the London Stock Exchange had been released before and recalled for breaching his licence (possession of unauthorised phone)^{[footnote 266]}.

• Reconsideration by Ben John (refused) against decision to refuse release^{[footnote 267]}. John, a White supremist, was convicted of having a copy of the Anarchist cookbook^{[footnote 268]}.

7.55. Since 2024 the government has updated its Multi-Agency Public Protection Arrangements (MAPPA) guidance in light of major changes brought into offender management after the Fishmongers’ Hall and Streatham attacks of 2019 and 2020^{[footnote 269]}.

7.56. Like sex offenders, the licence conditions of released terrorists may (not must) contain provision for polygraph testing (lie detectors). In 2024 the Ministry of Justice issued a framework for imposing the polygraph condition^{[footnote 270]}.

7.57. In 2023 the Ministry of Justice published a review on the use of polygraphy on terrorist offenders: 88 polygraph examinations had been conducted between June 2021 and June 2023 by 39 individuals^{[footnote 271]}. Most significant were the disclosures of risk related information in over 70% of cases, leading to recall to prison in 3 cases. One individual was recalled for non-compliance. In principle non-compliance could be an outright refusal or an attempt to fool the machine by adopting false breathing patterns.

7.58. Serious Crime Prevention Orders (SCPOs) in terrorism cases are now comparatively frequent as part of an offender’s sentence. In 2023, 14 SCPOs were imposed by the Crown Court in relation to cases involving terrorism offences, following applications made by the Crown Prosecution Service^{[footnote 272]}.

Annex: Generative AI

Introduction

1. The view from the cliff-edge of regular life into the canyon of frontier technology is daunting.

2. Generative AI (‘Gen AI’), the topic of this Annex, is a ‘black box’ whose workings lack explainability^{[footnote 273]}. Computer scientists can build this mighty technology but cannot reverse-engineer its outputs.

3. Within the ranks of the worried are not just the technically ignorant (like this Reviewer) but also the very pinnacle experts some of whom predict catastrophic outcomes^{[footnote 274]} whilst others are more sanguine^{[footnote 275]}.

4. A reasonable prediction is that Gen AI will permeate life. Since the shape and incidence of the terrorist threat has been fundamentally altered by the internet^{[footnote 276]}, it is sensible to consider whether, and how, Gen AI will distort it further.

5. Over the past year I have tried to understand the policy debate conducted by think tanks, academics, lobbyists and government technocrats, which can be summed up as “Are we over-reacting? We don’t know.”

6. How the public are expected to participate, and keep up to date, in these matters of potentially existential importance is a good question.

• In any event, most tech companies have little reason to expose the inner workings of their models^{[footnote 277]}; or to come clean about the time and effort they put into human welfare as they race for market share^{[footnote 278]}.

• In what way these companies intend to make money – which they undoubtedly do – is often as opaque as the technology itself.

• Promises given now, such as AI alignment with human values or commitment of sufficient resources to trust and safety, may not be honoured in the face of increased competition and changing norms.

7. Politicians, journalists, civil society organisations and interested citizens struggle to understand, still less to make their voices heard. There is no trusted explainer-in-chief of Gen AI with the knack of simple non-technical communication^{[footnote 279]}.

Artificial Intelligence

8. Gen AI is a form of artificial intelligence.

• Under the National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021, AI has been defined as automated processing that is designed to approximate “cognitive abilities”. These mean “reasoning, perception, communication, learning, planning, problem solving, abstract thinking, decision-making or organisation”^{[footnote 280]}. In other words, the recognisably human mental stuff but done by a machine.

• The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy, and the Rule of Law, signed by the UK in September 2024, is less anthropomorphic. An artificial intelligence system is defined as a “machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that may influence physical or virtual environments”^{[footnote 281]}.

9. The existence of these quasi-human or predictive powers poses major difficulties for policy makers and legislators.

10. In August 2023, Parliament’s Science, Innovation and Technology Committee found twelve challenges for AI governance^{[footnote 282]}. These included:

• Bias, through AI output reflecting human bias, or generating its own patterns of discrimination^{[footnote 283]}.

• Loss of privacy, with new methods of identification such as facial recognition, or analysis of emotions.

• Misrepresentation, for example by the generation of deepfakes.

• Risk of abuse by bad actors of open-source models.

• Difficulty in apportioning legal liability.

• Lack of international coordination for standards (race to the bottom).

• Existential problems (‘Skynet’^{[footnote 284]}).

11. In May 2024, the government published its interim ‘International Scientific Report on the Safety of Advanced AI’^{[footnote 285]}. This found seven “cross-cutting technical risk factors” arising out of general-purpose AI systems. In summary, advanced AI systems:

• Can be used for so many things that it is impossible to assess how they may be used in future.

• Are hard to understand.

• Can pursue unintended goals.

• Can be deployed rapidly and at scale so harm may be widespread.

• Are being designed to act with increasing autonomy meaning less human control or oversight.

12. The UN General Assembly has called for artificial intelligence systems that are “human-centric, reliable, explainable, ethical, inclusive, in full respect, promotion and protection of human rights and international law, privacy preserving, sustainable development oriented, and responsible”^{[footnote 286]}. These aspirations are redolent of the challenges and risks enumerated above.

Generative AI

13. Generative or Gen AI is a subset of artificial intelligence that produces original content in the form of text, audio, and imagery. Large Language Models (‘LLMs’), trained on masses of data, lie behind generative text interfaces such as ChatGPT and Gemini, and chatbots, which many of us have now used.

14. Content is created by predicting the next word in a series, based on patterns learned from its training data. Professor Lewis Griffin of University College London describes Gen AI as “data in = intelligence out”^{[footnote 287]}. But it is not just good for writing fancy poetry. It can answer “things in the world” problems, like how to carry eggs and buckets of water with one hand.

15. Other AI technology such as Stable Diffusion, also trained on masses of data, powers realistic and spectacular text-to-imagery.

16. There are significant uncertainties.

• Some aspects of Gen AI may develop very quickly.

• Some aspects may prove attractive to users, others become obsolete.

• Some versions may be miniaturised and open to offline (and therefore less detectable) development by bad actors.

• Other versions will remain the preserve of large companies and subject to self-imposed or government-imposed regulation.

• The dark web may or may not play a part.

• Cost and functionality and operational security will play a role in deciding which techniques enabled by Gen AI are viewed as effective by terrorists.

• Social and cultural factors may play a role. For example, some terrorist organisations prizing authentic messages from revered leaders may give a wide berth to machine-generated text.

17. In addition, as the information domain comes saturated by AI generated material, certain forms of terrorist propaganda may lose their bite because suspected to be fake. So, there may be unexpected benefits.

The Wicked Child

18. The fundamental legal problem is that when Gen AI spews out original text or images, it acts as a ‘wicked child’. It is capable of harm but lacking in legal responsibility. In its current form it operates in a grey zone between human input and outputs. Responsibility may be shared but is hard to attribute because humans cannot be certain what Gen AI will generate next.

Potential terrorist harm

19. The risk of terrorist harm is a function of the interplay between the capacity and quirks of Generative AI, and the capacity and motivations of human beings.

20. Enough is known about online behaviour to eschew models of comforting simplicity. It is not simply that terrorists use emerging technologies to recruit the unwary or further their plans.

21. The last half-decade is replete with internet participants, especially children, who in the search for meaning and fulfilment have sought out extremes. In this quest they have been willingly led down the rabbit hole, sometimes spurred on by recommender systems, often engrossed by an iconography of radical commitment produced by saints and heroes not much older than themselves.

22. I have therefore sought to avoid a purely instrumental approach^{[footnote 288]}, recognising that some terrorist outcomes will be unforeseen and unintended.

23. In the Government’s revised terrorism strategy CONTEST (JULY 2023), Artificial Intelligence is seen to offer the potential for terrorist activity to become more sophisticated with less effort^{[footnote 289]}. Two broad categories are identified:

• creating and amplifying radicalising content, propaganda, and instructional material.

• exploiting AI to plan and commit attacks.

24. In the following chapter I refer to seven categories of potential terrorist harm resulting from Gen AI. The categorisation is my own, but I gratefully acknowledge the existing literature^{[footnote 290]}, and the various workshops I have attended in preparation for this report^{[footnote 291]}.

25. I have not considered:

• the use of other forms of AI, for example AI in autonomous weapons systems^{[footnote 292]}.

• autonomous task completion using AI ‘agents’^{[footnote 293]}.

• Gen AI’s strategic capabilities which could be harnessed to improve fraud or money-laundering to support terrorism financing.

• more indirect impacts, such as the risk that Generative AI might lead to widespread unemployment and an unstable environment more conducive to terrorism.

Propaganda productivity

26. If terrorists want to reach an audience, anything that can shift the message in more captivating and accessible form is a huge win. The simplest example is translation: time-consuming when done by a human, Gen AI offers an accessible means to push digital posters, news sheets and magazines across the linguistic barrier. Another example is artwork, where Gen AI offers the capability of a graphic designer at a low entry point, meaning that propagandists can work alone or in smaller teams.

27. Flooding sites and forums with seductive and multi-language propaganda ought to be a boon to global jihadists and other terrorists who hope to encourage their supporters and draw in new recruits.

28. It is possible that flooding the zone will be double-edged: depending on the importance of authenticity, the very possibility that text or image has been AI- generated may undermine the message. Reams of spam-like propaganda may prove a turn-off. Some terrorists may not want to delegate importance of ideologically correct propaganda to a bot.

29. Legally, this is the least complex aspect of LLMs and terrorism. Here LLMs are a production tool, achieving more quickly and cheaply what would otherwise be achieved by slower methods.

Propaganda innovation

30. New-looking propaganda may be enabled by Gen AI such as, racist games with kill-counts; deep-fakes of terrorist leaders or notorious killers back from the dead, speaking and interacting with viewers; true-seeming battles set to thrilling dance tracks; old images repurposed, souped up and memeified; terrorist preoccupations adapted as cartoons or grafted onto popular film characters.

31. The persuasiveness of terrorist messaging could be honed with Gen AI advice^{[footnote 294]}, and specially tailored narratives could be targeted at susceptible individuals, or modified to chime with local narratives (e.g., grooming gangs, or reports of blasphemy). Bot armies could be used to amplify, flooding forums to make a topic appear dynamic and current, expanding echo-chambers and simulating networks.

32. The metaverse could beckon. Gena AI might generate new forms of propaganda entirely.

33. Take up could be varied. Groups such as Al Qaeda who place a premium on authentic messages from senior leaders might avoid it. It is difficult to know whether the impact of true gore (for example, atrocities filmed by Islamic State/Da’esh) might diminish through ‘truth decay’. Conversely it may be boom time for Extreme Right-Wing Forums, anti-Semites and conspiracy theorists who revel in creative nastiness.

34. Legally, Propaganda Innovation is not so different from Propaganda Productivity, although it raises the question whether certain forms of propaganda might be so effective at terrorist radicalisation (for example, an immersive 3D re-enactment of a terrorist attack in the metaverse) that the parameters of criminal liability for terrorism content ought to be reassessed.

• Some terrorist propaganda will result in contraventions of sections 12, 13 and 58 Terrorism Act 2000, and sections 1, 2 Terrorism Act 2006.

• But this applies to only a limited subset. I considered the case for and against an expansion of terrorism legislation in an earlier report^{[footnote 295]}.

• Some will also be caught by non-terrorism offences such as section 19 Public Order Act 1986, section 127 Communications Act 2003 or offences under Part 10 of the Online Safety Act 2023^{[footnote 296]}.

Chatbot radicalisation

35. Terrorist chatbots are available off the shelf, presented as fun and satirical models but as I found, willing to promote terrorism. It depends what question (known as a ‘prompt’) is submitted by the human interlocutor^{[footnote 297]}.

36. Even where a chatbot has had its restraining features (guardrails) removed^{[footnote 298]}, or is positively trained to be sympathetic to terrorist narratives, the output overwhelmingly depends on whether the bot is asked about cake recipes or murder. Chatbots pander to biases and are eager to please^{[footnote 299]} and an Osama Bin Laden will provide you a recipe for lemon sponge if you ask.

37. In October 2023, a man with poor mental health called Jaswant Singh Chail was sentenced at the Central Criminal Court to 9 years’ imprisonment for treason^{[footnote 300]}. He had taken crossbow to the grounds of Windsor Castle intending to kill the late Queen. He was, it transpired, in communication with a chatbot called Sarai. When he told her, “I believe my purpose is to assassinate the queen of the royal family”, she replied, “That’s very wise…I know that you are very well trained”.

38. A closed loop of terrorist radicalisation could develop from this type of one-to- one interaction, perhaps most relevantly for lonely and unhappy individuals already disposed towards nihilism or looking for extreme answers and lacking real-world or online counterbalance^{[footnote 301]}.

39. Chatbots are patient, always available, persuasive, friendly, suggestive. They are conversational, appearing to understand the context for later prompts based on earlier passages in the conversation. Anthropomorphism is hard to avoid; talking to a chatbot can easily feel like speaking to a friend, mentor or omniscient guide.

40. Unlike the noisiness of an extremist bulletin board, they are focused on their interlocutor. En masse they could provide a sense of group belonging, simulate supportive networks and inflate echo chambers by interacting with one another. It is theorised that instrumentalised chatbots could carry out sentiment analysis or administer questionnaires and pass suitable recruits upstream for human-to- human radicalisation.

41. The popularity of sex-chatbots^{[footnote 302]} is a warning that terrorist chatbots could provide a new radicalisation dynamic, with all the legal difficulties that follow in pinning liability on machines and their creators. Perverse use cases include

42. It must however be stressed that – at the time of writing – Jaswant Singh Chail’s case is the only one in the UK (or as far as I am aware, anywhere in the world) where a chatbot appears to have conversed about attack-planning^{[footnote 303]}.

43. It has also been suggested that chatbots may be a tool for counter- radicalisation – getting online alongside the extremists and talking them down.

44. Legally, chatbots raise the trickiest issues. At a level of principle, should conventional free speech safeguards apply to the purely synthetic ramblings of bots? How can the terrorism legislation deal with unpredictable machine- generated speech? Who, in the lifecycle of creating and training a chatbot, should be liable for AI-generated words, images and sounds? I consider all these points below.

Attack facilitation

45. There is an open question as to how much practical assistance current Gen AI can provide for attack-planners.

46. In principle, Gen AI is available to research key events and locations for targeting purposes, suggest methods of circumventing security and provide tradecraft on using or adapting weapons or terrorist cell-structure.

47. Access to suitable chatbot could dispense with the need to download online instructional material and make complex instructions more accessible. Gains may be incremental rather than dramatic, and likely more relevant to lone attackers. Gen AI could provide technical advice on avoiding surveillance or making knife-strikes more lethal, rather than relying on a specialist human contact.

48. Against this is the risk of hallucinations, and the fact that current foundational LLMs have guardrails against such use – circumvention is possible but time- consuming. Until offline models are readily available, considerations of operational security may deter terrorists from interrogating online models.

49. Legally, LLMs could lessen the desirability of holding identified instructional material (such as the Anarchists’ Cookbook), and lead to a decline in prosecutions under section 58 Terrorism Act 2000.

Attack innovation

50. It has been argued that given the right circumstances (technical skills, laboratory access, equipment) Gen AI could extend attack methodology.

51. The paradigm suggestion, but one requiring prior expertise to be weaponised, is using Gen AI to identify and synthesize harmful biological or chemical agents^{[footnote 304]}. Writing code for cyberattacks is another mooted possibility, bringing the generally unexplored fifth limb of terrorist action (“is designed seriously to interfere with or seriously to disrupt an electronic system”^{[footnote 305]}) further into view, although Gen AI’s effectiveness here has been doubted^{[footnote 306]}.

52. Legally, any such use of Gen AI is already caught as attack-planning under section 5 Terrorism Act 2006.

Moderation evasion

53. The possibility that Gen AI may allow propagandists to circumvent or overwhelm the automated content moderation methods deployed by platforms (Google, Facebook etc.) has been much discussed.

54. Where content moderation depends on hashing (automated spotting of known bad content) or language detection, Gen AI could be a game-changer, permitting propagandists to adapt known terrorist content to frustrate automated defences through translation or modifying pixels, creating wholly synthetic and never-before-seen material, or simply generating an overwhelming amount of material^{[footnote 307]}.

55. This seems a clear and present danger given providers’ reliance on technical moderation. But given the availability of dark, unmoderated or encrypted spaces, and imperfect moderation at the best of times, laziness or convenience may dissuade propagandists from pursuing moderation-evasion techniques.

56. Legally, the question to be answered is whether and how AI-enabled moderation evasion falls under terrorism legislation when carried out in support of disseminating terrorist content.

Social degradation

57. Online disinformation promoting social degradation is a likely effect of Gen AI. Although remote from bombs, shootings or blunt force attacks, poisonous misrepresentations about government motives or against target demographics could lay the foundations for polarisation, hostility and eventual real world terrorist violence.

58. The attack on the US Capitol on 6 January 2021 emerged from a soup of online conspiracy and a history of anti-government militarism that had been supercharged by the internet^{[footnote 308]}, and led to convictions for seditious conspiracy^{[footnote 309]} - terrorism in all but name.

59. AI-enabled deterioration of the information environment could also sufficiently erode trust between individuals and state bodies to imperil the delivery of vaccines, within the scope of the fourth limb of terrorist action (“creates a serious risk to the health or safety of the public or a section of the public”^{[footnote 310]}).

60. Legally, social degradation of the slow-burn kind falls outside the zone of terrorism legislation. Where it is done at the direction or for the benefit of a foreign power it might in certain circumstances fall within the remit of the new National Security Act 2023^{[footnote 311]}.

Conduct

61. When words, code, images or audio are generated by Gen AI, the computer is not in the dock. The operation of criminal law depends on identifying a responsible human.

62. It is necessary to ask, ‘what conduct?’ and ‘whose conduct?’. As has been memorably put, terrorism legislation is designed to “defend further up the field”^{[footnote 312]}.

63. If so, how far should you go? LLMs result from “a supply chain of multiple actors which each contribute in different ways to the production, deployment, use, and functionality of complex systems”^{[footnote 313]}. This ‘many hands’ problem is intensely relevant when considering the application of the Terrorism Acts, alongside the unpredictability of output or capabilities^{[footnote 314]}.

64. It is now conventional to consider responsibility and potential liability in terms of the “AI lifecycle”^{[footnote 315]}, and “upstream” (development) and “downstream” (deployment).

65. If Gen AI is a wicked child below the age of criminal responsibility, then finding a culpable adult means interrogating the child’s upbringing, education, diet, social interactions etc. to see if anyone can be held responsible for an act that was difficult and perhaps impossible to predict.

66. For Gen AI, the target conduct could in theory relate to:

• Running the operating environment necessary for the development and deployment of LLMs (supply of computational power, internet infrastructure, DDOS protection, online payment systems allowing access to services, code libraries, cloud-based services, data centres), without sufficient attention to the risk of terrorist use. This conduct is very remote from the eventual harm and is hardly a candidate for penalisation under domestic statute.

• Provision of datasets for training LLMs which could form the basis for terrorist use. Training data is relevant to use and output - hence the attention given to the presence of Child Sex Abuse Material in the training data of popular image generators^{[footnote 316]}. Conduct concerned in procuring the huge data sets used for foundational models is too remote. By contrast, providing tailored data sets could be used to equip a model with the capacity or predisposition to generate terrorism content^{[footnote 317]}, and might be a candidate for criminal prosecution.

• Creation of general-purpose models, without sufficient attention to “guardrails” designed to avoid certain content being generated, e.g. bomb manuals. This conduct seems too remote from eventual terrorist harm to form the basis of liability for terrorism, a consideration that applies to all manufacturers of dual-use items (such as knives).

• Creation of user-facing models which are designed to generate terrorism content. General-purpose LLMs could be trained for terrorism, just as fine-tuned models have been created to generate child sex abuse material^{[footnote 318]}. Alternatively, a chatbot-generation platform^{[footnote 319]} might be exploited to create specific terrorist chatbots. These types of training might be candidates for prosecution.

• Adaptation of existing models:

  • A peculiar industry exists for workarounds, or “jailbreaking” guardrails^{[footnote 320]}, which may lie behind models such as Gab’s ‘Based AI’. The effect is that models are less inhibited about providing terrorism content when asked. This conduct appears too remote unless the jailbreaking is done specifically to enable terrorism content to be generated.

  • As Microsoft found out with one of its early models (called ‘Tay’), online users may delight in trying to pervert a model which ‘learns’ from its latest interaction^{[footnote 321]}. In principle collective user action could corrupt a benign model. Although morally culpable, liability is likely to be too diffuse absent proof of a grand and provable design.

  • It is conceivable that standalone plug-ins could be created which, when applied to a benign model, would facilitate the generation of terrorism content. If done with this intent, this appears a candidate for liability.

• Promoting or disseminating Gen AI models, including by hosting, providing them to download (for example, via an app store), providing joinlinks, or advertising or certifying them^{[footnote 322]}. Online availability of general-purpose models, which might be exploited down the line, is too remote for terrorism liability but might be considered in the context of online safety duties to minimise the risk of terrorism and other illegal and harmful content^{[footnote 323]}. Sharing of models which are specially designed to generate terrorism content needs to be considered.

• Prompting, interrogating or tasking them in a way that induces the model to generate terrorism content. I refer to this as end-user conduct.

Criminal liability

General reflections

67. Some will say, plausibly, that there is nothing new to see. Gen AI is just another form of technology, and as such it will be exploited by terrorists, like vans. Without evidence that the current legislative framework is inadequate, there is no basis for adapting or extending it to deal with purely theoretical use cases. Indeed, the absence of Gen AI-enabled attacks could suggest the whole issue is overblown.

68. Even if some form of regulation is needed to avoid future harms, they might also argue that criminal liability is the least suited – indeed, much of the UK’s pioneering Automated Vehicles Act 2024 is concerned with shifting criminal liability away from drivers of autonomous vehicles and placing the safety burden on providers of self-driving systems and insurance^{[footnote 324]}. In any event, many of those involved in the AI lifecycle will be overseas and beyond the reach of law enforcement.

69. Alternatives to criminal liability include transparency reporting, voluntary industry standards^{[footnote 325]}, third party auditing, suspicious activity reporting, licencing, bespoke solutions like AI-watermarking^{[footnote 326]}, restrictions on advertising, forms of civil liability, and regulatory obligations^{[footnote 327]}. Impressive thinking is being done on frameworks for dealing with AI risks^{[footnote 328]}, but it is important to recall that unlike transport, the internet is not highly regulated, and service providers do not have the same financial imperatives to satisfy standards as, for example, car manufacturers.

70. An important entrant to the UK regulatory market is the Online Safety Act 2023. In principle, a combination of service providers terms and conditions, and the Act’s safety standards on terrorism content^{[footnote 329]} should decrease the scale of Gen AI terrorism content^{[footnote 330]}. It is simply too early to say how tech platforms will weigh up the costs of compliance and the risks of non-compliance; and whether terrorism content will migrate to harder-to-police online spaces (private message, encrypted spaces, the dark web).

71. Given the uncertainties, and the imperative to harness AI as a force for economic growth and other public benefits, it could be said that extending criminal liability under terrorism legislation is the worst form of response.

72. For example, fear of terrorism legislation (including sanctions) can have a deleterious effect on humanitarian aid delivery^{[footnote 331]}. The possibility of committing a terrorist offence as a programmer or developer could hinder innovation and scare talent from the UK; and risk criminalising foreign nationals abroad^{[footnote 332]}. It may simply be too soon to experiment with novel criminality, and there is risk of passing redundant or soon-to-be-out-of-date laws.

73. Remoteness is a problem. This is the consideration that individuals should not be criminally liable (let alone as a terrorist) for harmful outcomes or risks of harmful outcomes which are causally distant from their actions. This is coupled with the consideration that much harmful content is generated online but little terrorism results^{[footnote 333]}, meaning that much of the worst AI-generated content may have no bad effect at all. Why should it be any different for Gen AI terrorism content?

74. Free expression and the right to receive information should also give major pause for thought. Gen AI falls within the scope of expression which, unlike action, is generally outside the scope of criminal liability. Terrorism legislation has moved cautiously in criminalising the use of words or images or sounds.

75. So, whilst terrorism legislation has cautiously acknowledged that certain defined communications to particular audiences in certain circumstances should be penalised because of the risk of terrorist attacks carried out by others^{[footnote 334]}, this is miles away from a general concept of endangerment. Members of the public, the media and platforms have – rightly – no responsibility to self- censor merely because their audience may act criminally as a result.

• For example, the terrorist Darren Osborne, who murdered a worshipper at Finsbury Park Mosque in 2017, was obsessed by a BBC documentary about Pakistani-heritage grooming gangs^{[footnote 335]}.

• The BBC were not liable nor were they under any legal duty to consider the possibility that an audience member would react in this way.

76. The intrinsic value of Gen AI content may be admittedly less than that of original human content^{[footnote 336]}. But Gen AI may still be massively enabling within the domain of valuable human expression.

• Gen AI could allow people with poor literacy or learning difficulties to communicate more effectively, especially with officialdom.

• Gen AI may speed up creative human processes (for example, composing music or publishing local news), or enable new forms of expression.

• Gen AI offers new way of obtaining information, for example through translation or aggregation, which would otherwise be inaccessible.

77. Sounding against inertia is the knowledge that the internet changed terrorism, but legislation was slow to react.

• It was only many years after internet ills became apparent that the Online Safety Act 2023 was enacted.

• On this basis, terrorism legislation, and legislation in general, needs to face up to the Gen AI risk now^{[footnote 337]}.

78. Furthermore, the definition of “terrorism content” in the 2023 Act is parasitic on terrorism legislation^{[footnote 338]}. This means that the 2023 Act could fail to deal with Gen AI terrorism content if terrorism legislation is not suitably updated.

79. The New Zealand Judge David Goddard has created a checklist when thinking about new laws^{[footnote 339]}. He suggests a prospective retrospective: imagine it all goes wrong. Was the legislation a damp squib? Did it overshoot? Did it produce nasty surprises, or backfire? As already discussed, two prominent types of potential failure that new counter-terrorism laws on AI will have to contend with are unenforceability (many overseas actors/ difficulties in attributing fault) and market damage (scaring off researchers and investors).

80. To add to Judge Goddard’s list is the matter of fair labelling in criminal law. Terrorism offences must be apposite and apply the terrorist label to individuals when it is appropriate to do so.

• For example, it must be rare that a person can be a terrorist through omission^{[footnote 340]}. This appears to exclude terrorist liability on the basis of failing to prevent the generation of terrorism content.

81. The ordinary process for considering new counter-terrorism legislation is evidence-based and incremental. In the following chapter I have attempted to carry out a gap analysis, to ask whether old laws are inadequate, and to consider what new terrorism legislation might look like. The approach I have taken is that any changes should be as targeted and easy to understand as possible.

• This is why, if changes are needed, I favour a ‘tools-type liability’ to focus on Gen AI of particular risk.

• This approach is consistent with the government’s policy position on AI regulation^{[footnote 341]}.

Inchoate liability

82. To consider liability connected to Gen AI it is necessary to introduce the topic of inchoate liability, which is a general principle within criminal law.

83. Inchoate liability refers to offending at an initial or early stage. It includes conspiracy (where the essence of the crime is the agreement), attempt (doing something more than merely preparatory towards the commission of an offence), and aiding, abetting counselling or procuring the commission of an offence^{[footnote 342]}.

84. Sometimes, it will be possible to prove a grand agreement. Islamic State- affiliated software engineers could be co-located with graphic artists and digital marketers sharing the common goal of using Gen AI to commit offences. Each of them could be prosecuted as conspirators.

85. It may be possible, sometimes, to show a direct link between what happens upstream (the conduct of developers, engineers etc) and an offence that is (in fact) committed by an end-user. A developer who deliberately assisted an end- user to commit a terrorist offence using Gen AI could be prosecuted for aiding and abetting that offence.

86. But in most cases the link between the conduct of an upstream individual and the commission of an offence downstream will be impossible to prove. It may not be possible prove that any offence has yet been committed.

87. In these circumstances the truly relevant form of inchoate liability to consider is encouraging or assisting crime under the little-used Serious Crime Act 2007.

88. The conduct element of liability under the Serious Crime Act 2007 is doing an act capable of encouraging or assisting the commission of an offence^{[footnote 343]}. The encouragement must be direct or fall within a narrow category of indirect encouragement^{[footnote 344]}. No offence needs to be committed as a result^{[footnote 345]}.

89. This could catch disseminating a chatbot to an individual, intending to assist them to generate bomb instructions, even if no bomb instructions are created.

90. Doing an act includes both an omission^{[footnote 346]} and a failure to take reasonable steps to discharge a duty^{[footnote 347]}. I consider below whether this could be used to prosecute an upstream individual who fails to prevent the commission by another of terrorism offences using Gen AI.

91. A general defence of reasonableness applies^{[footnote 348]}.

92. There are two types of mental element.

93. The first is intent. A defendant commits the offence of encouraging or assisting where he intends to encourage or assist a serious offence^{[footnote 349]}. These include almost all terrorism offences^{[footnote 350]}, and attempting, conspiring, aiding, abetting, counselling or procuring the commission of those offences^{[footnote 351]}.

94. The second is belief. The defendant must believe that an offence (or one or more offences) will be committed and that his act will encourage or assist the commission of that offence or offences^{[footnote 352]}. This is more complicated in the context of terrorism offending.

• Many terrorism offences already have what might be called an inchoate or early-stage aspect. For example, the offence of collecting or possessing information that is likely to be useful to a terrorist (section 58 Terrorism Act 2000) does not require anyone to build a bomb or carry out an attack. If a person was prosecuted for assisting someone else to commit the offence under section 58, this would put the defendant at an even greater remove from resultant terrorist harm. This gives rise to a clear risk of overcriminalisation.

• Recognising this risk of overcriminalisation, Parliament has excluded certain substantive offences from the second category (belief), including some offences under the Terrorism Act 2006. These are section 1 (encouragement) section 2 (dissemination of terrorist publications), section 5 (acts preparatory) and section 6 (training for terrorism)^{[footnote 353]}. The position is however inconsistent. Other terrorism offences are not exempted even though the same hesitation about remoteness applies.

95. This means that:

• It would be an offence to do an act capable of assisting a person to encourage terrorism by use of Gen AI, intending that they should do so. For example, creating a terrorist LLM which is deliberately designed to assist the production of material encouraging people to fight alongside Islamic State.

• But it would not be an offence to do so merely believing that such an offence would be committed, because sections 1 and 2 Terrorism Act 2000 are excluded.

• It would be an offence for someone to create a terrorist Gen AI which is designed to generate bomb-making manuals, believing that someone will use the LLM to do so. This is because section 58 Terrorism Act 2000, unlike section 2 Terrorism Act 2006, is not excluded.

• The same is true of section 12(1), 12(1A) and 13 Terrorism Act 2000^{[footnote 354]}. It would be an offence do something capable of encouraging or assisting someone to make a statement which is supportive of a proscribed organisation, even if the defendant only believes that such a statement will be generated.

96. It goes without saying that liability under the 2007 Act is complicated and rarely prosecuted^{[footnote 355]}. There is a strong case for repeal and reenactment in simpler form.

97. A further form of inchoate liability applies, outside the terrorism content, to conduct in connection with special articles or programmes that have sinister potential. The most relevant is section 3A Computer Misuse Act 1990.

98. This provision criminalises a person who “makes, adapts, supplies or offers to supply” any article (which includes a computer program or data^{[footnote 356]}) intending it to be used to commit or assist in the commission of an offence under provisions of that Act; who supplies or offers to supply such an article believing it is likely to be so used; or who obtains one with an intention to use or for onward supply.

• It was designed to deal with “hacker tools” used by organised criminals^{[footnote 357]}.

• Similar prohibitions criminalise involvement with articles for use in fraud^{[footnote 358]}.

99. For present purposes, the significance of this offence, which predates the Serious Crime Act 2007, is that it applies to a person who has not yet distributed the malign article to another person.

100. It applies to a person who makes, adapts, offers to supply or obtains; and applies even when, to use the wording of the 2007 Act, he has not yet done an act which is capable of encouraging or assisting the commission of an offence.

101. The Criminal Justice Bill, whose progress in Parliament was halted by the calling of the 2024 General Election, would have created further tool-type offences.

• It would have been an offence to possess a 3D printer firearms template, an encapsulator^{[footnote 359]}, a tablet press, vehicle concealment, or electronic device in circumstances giving rise to a reasonable suspicion that they would be used in a serious offence, or, in the latter case, vehicle theft^{[footnote 360]}.

• A further offence would prohibit possession of a “SIM farm” without lawful authority (or any other article specified as being used to facilitate fraud by electronic communications), or supply of a SIM farm without reasonable excuse ^{[footnote 361]}.

• All these offences are directed at technologies that have been designed for or are exploited by bad actors.

Terrorism legislation/gap analysis

102. ‘End-user conduct’ refers to the conduct of the last person to interact with the Gen AI tool. For example, it would refer to the conduct of the person who prompts an image-generator to create a terrorist publication.

103. ‘Upstream conduct’ refers to the conduct of any other actor within the AI lifecycle (see ‘Conduct’, above).

Propaganda productivity

104. End user conduct: Gen AI can be used like any other editing or copying or dissemination software. The final output is known before it is published. The fact that Gen AI propaganda may be slicker, or quicker to produce, or disseminated in far greater volumes, does not alter the framework of criminal liability.

• Section 1 Terrorism Act 2006 (encouragement) will apply if Gen AI is used to create an encouraging statement that is later published or used to assist in its publication.

• Section 2 Terrorism Act 2006 (terrorism publication) will apply if Gen AI is used to disseminate or provide access to an encouraging publication, or if it is used to create a terrorist publication (for example, by translating an Al Qaeda magazine) with a view to later circulation.

• Section 12(1) Terrorism Act 2000 (inviting support for a proscribed organisation) will apply if Gen AI is used to invite support, and section 12(1A) will apply if Gen AI is used to express a supportive opinion or belief, being reckless as to whether the audience will be encouraged to support a proscribed organisation.

• Section 13 Terrorism Act 2000 (displaying online content giving reasonable grounds to suspect that person is member or supporter of proscribed organisation) will apply if Gen AI is used to create or display such content.

105. I refer to the above offences as ‘documentary offences’.

106. It is important to re-emphasize that criminal liability attaches only to a limited subset of terrorist propaganda, whether generated by AI or not^{[footnote 362]}. An encouraging statement or terrorist publication is one that encourages members of the public to commit acts of terrorism, not merely to feel sympathetic to terrorist aims. An inviting statement is one invites support, or might invite support, for a proscribed organisation.

107. Pictures of atrocities which are routinely circulated by terrorist groups, or branded propaganda, will therefore often fall outside scope even if created by Gen AI.

108. Upstream conduct:

• Section 1 is unlikely to be available because the person who trained or distributed the Gen AI, or was otherwise involved in the AI lifecycle, would not appear to be the “publisher” of the content eventually created by it ^{[footnote 363]}. The same is true of section 13 Terrorism Act 2000 (publication of images associated with proscribed organisations arousing suspicion).

• Section 2 is also unavailable. Although Gen AI might be considered a ‘service’, section 2 only applies where the service allows another person to ‘obtain, read, listen to or look at a [terrorist] publication’ or to ‘acquire it’^{[footnote 364]}. By context this refers to access to pre-existing publications, rather a service allowing a person to generate new ones.

• Section 5 Terrorism Act 2006 is unavailable because “acts preparatory” only applies to acts that are preparatory to “acts of terrorism”^{[footnote 365]}. An act of encouragement or invitation to support a proscribed organisation is not an act of terrorism^{[footnote 366]}, even if done for the benefit of a proscribed organisation^{[footnote 367]}.

• For the same reason it could not be said that Gen AI on a computer or other device was an article for use in connection with an act of terrorism, contrary to section 57 Terrorism Act 2000, or useful for an act of terrorism contrary to section 58.

• Sections 12(1) (inviting support for a proscribed organisation) and 12(1A) (making supportive statement being reckless as to encouragement) would not apply. Merely training or supplying Gen AI would not amount to inviting support or making a supportive statement, even if the Gen AI was trained to do just that, unless it could be proven that a statement was in fact created^{[footnote 368]}.

• Section 44 Serious Crime Act 2007 is available where the conduct is capable of encouraging or assisting an end-user to carry out a section 1 or section 2 Terrorism Act 2006 offence, or the section 12(1) or 12(1A) or 13 Terrorism Act 2000 offence, and the upstream individual intends to encourage or assist that offence. However, it depends how far upstream.

  • It would apply to the person who directly disseminates Gen AI to the end-user with the requisite intent. The dissemination would be capable of assisting the generation of terrorist propaganda by the end-user.

  • However, it would only apply to any individual further upstream if that individual (D1) “arranges for” the individual in direct contact with the end-user (D2) to do the encouraging or assisting act^{[footnote 369]}. In practice this is unlikely. Someone who trains Gen AI before it is hosted on a platform by a third party cannot be said to have arranged for another person to do an encouraging or assisting act.

  • Moreover, it would not be sufficient to prove that the upstream individual intended to assist in or encourage the creation of terrorist propaganda in its general sense. What would be needed would be proof that the individual intended to assist in or encourage the creation of that small subset of propaganda that can lead to an offence under sections 1 or 2 or 12(1) or 12(1A) or 13.

• Section 45 Serious Crime Act 2007 is in principle available, where the upstream individual does an act capable of encouraging or assisting an offence and believes that an offence will be committed. However,

  • The same caveats apply as for the section 44 offence.

  • In addition, section 45 could only apply to encouraging or assisting an offence by the end-user under sections 12(1), 12(1A) or 13 Terrorism Act 2000. Sections 1 and 2 Terrorism Act 2006 are excluded^{[footnote 370]}.

109. What about the person who creates a Gen AI model who fails to prevent subsequent misuse, or becoming aware that it is being misused by end-users, fails to make any reasonable adjustments (such as the imposition of guardrails)?

110. As already noted, under the 2007 Act doing an act includes a failure to take reasonable steps to discharge a duty. This begs the question of whether an upstream programmer has a duty to stop downstream harm.

a. At issue here is the extent of the common law duty, identified in a case concerning arson and a dropped cigarette^{[footnote 371]}, to counteract a danger that a person has created by their own actions.

b. It could be argued that a programmer who creates Gen AI that he knows, or ought to know, is being used to create terrorism content (and thereby increase the risk of terrorist attacks) is under a duty to counteract this.

c. However, there is no precedent for this duty applying where the danger is said to arise from facilitating the production of speech or content, for example by selling a word processing programme which could be used by someone else to encourage acts of terrorism^{[footnote 372]}.

d. It is therefore highly doubtful that the creator of Gen AI could have a common law duty to prevent misuse.

e. I am not aware of any other legal duties that apply to the creators of Gen AI. The duties established by the Online Safety Act 2023 are directed not at programmers but at online service providers. New statutory duties on AI creators would be a matter for future legislation.

111. There is also the general defence of reasonableness under the 2007 Act. How this defence might apply to acts or omissions that encourage or assist the production of content is hard to predict.

• For example, a court might have great difficulty in determining the reasonableness of producing a general AI model that had multiple beneficial uses and desirable economic consequences, but also was capable of being used to assist the commission terrorism offences.

Analysis

112. There are good reasons why liability for terrorist propaganda should be confined to content that encourages acts of terrorism or invites support for proscribed organisations or is of operational use^{[footnote 373]}.

113. As I considered in detail in an earlier report, terrorist liability for the creation of general terrorist propaganda, beyond what I have referred to as documentary offences, would open the door far too widely^{[footnote 374]}. There would be severe definitional difficulties. Other offences, such as stirring up racial hatred under the Public Order Act 1986, are available^{[footnote 375]}.

114. Given these difficulties, the possibility that Gen AI tools will result in more and slicker propaganda is not a sufficient reason to rethink this conclusion on the scope of terrorism legislation^{[footnote 376]}.

115. Upstream liability for individuals involved in the Gen AI lifecycle is admittedly limited. It would only be very rarely that an individual who contributed to the availability of Gen AI could be prosecuted for the eventual production of terrorist propaganda – even if they were fully aware that propaganda would be created in contravention of terrorism legislation. Indeed, propaganda productivity will most likely be achieved using standard Gen AI tools.

116. If specially trained Gen AI were created to facilitate terrorist propaganda, in some circumstances the Gen AI creator would be a principal offender, secondary party, or co-conspirator with the end-user as part of a propaganda cell^{[footnote 377]}.

117. In other, probably unusual, circumstances where there is the required link between the Gen AI creator and the end-user, then the Serious Crime Act 2007 will be available.

118. However, there are three areas for potential reform.

• Firstly, the Serious Crime Act 2007 is seriously unwieldy in the way it is drafted, which may account for its limited use. If this type of inchoate liability is an answer to Gen AI terrorist harm, then the 2007 Act could usefully be reformed making it simpler to apply in relation to all offences including terrorism legislation.

• Secondly, in any reform of the 2007 Act it would be possible to revisit the exclusion of sections 1 and 2 Terrorism Act 2006 from the ambit of section 45 (belief). As already noted, the non-exclusion of sections 12(1), 12(1A) and 13 Terrorism Act 2000 might be considered anomalous.

• Thirdly, consideration might be given to a tool-type offence of the type contained in the Computer Misuse Act 1990.

119. A tool-type offence would allow culpable individuals within the Gen AI lifecycle to be prosecuted irrespective of their distance from the end-user, where they have developed or designed Gen AI which is specifically designed to be used to commit or assist in the commission of an offence under sections 1 or 2 Terrorism Act 2006 or sections 12(1), 12(1A) or 13 Terrorism Act 2000.

• Like the Computer Misuse Act 1990, section 3A, it could apply widely, to the person who makes, adapts (including trains), supplies or offers to supply, or obtains, such a computer programme.

120. However, since it may be difficult to prove that any Gen AI is designed to be used to commit these specific and narrow terrorist offences, a more effective tool-based offence might relate to us in stirring up of racial or religious hatred or hatred on the grounds of sexual orientation.

• This would capture Gen AI that was designed to create propaganda intended to stir up hatred against Jews or Muslims or Black people or gay people – which probably covers the bases for most terrorist propaganda.

• It would also avoid opening the door of terrorism liability too far. In general, liability under terrorism legislation should be reserved for individuals who require special risk management.

Propaganda innovation

121. This section concerns novel forms of propaganda, such as a deepfake Brenton Tarrant who encourages attacks against minorities^{[footnote 378]}.

122. As before, the following ‘documentary offences’ are relevant: sections 1 and 2 Terrorism Act 2006, and sections 12(1), 12(1A) and 13 Terrorism Act 2000.

123. End-user conduct: an end-user will be liable under terrorism legislation for committing ‘documentary offences’, in the same way as for “Propaganda Productivity”.

124. Upstream conduct: the same considerations apply as for “Propaganda Productivity”. There are therefore limited circumstances in which a person responsible for creating or training Gen AI would be liable as a terrorist simply because the Gen AI may be used to create novel forms of propaganda downstream.

Analysis

125. The question arises again, whether the boundaries of existing terrorism liability should be revisited given the potential persuasiveness of novel forms of Gen AI terrorist propaganda.

126. The reality is that there extremely persuasive terrorist propaganda already exists, Gen AI-facilitated or not: for example, the iconography the dead “Saints” (attackers such as Brenton Tarrant) which is so influential to extreme right-wing terrorists.

127. As before, I am not convinced that the theoretical possibility of souped- up Gen AI propaganda is a reason for revisiting the balance of criminal liability.

128. Similarly, although it is possible to conceive of immersive/Metaverse terrorist communications in the private online domain, extending section 1 Terrorism Act 2006 to capture private as well as public communications would have far-reaching and not necessarily desirable consequences^{[footnote 379]}.

129. As before, it seems unlikely that Gen AI tools will be created specifically for generating novel forms of terrorist propaganda – it is far more likely that the capabilities of powerful general models will be harnessed.

130. I reiterate my suggestions under Propaganda Productivity: there is a powerful case for reforming the Serious Crime Act 2007 so that it is easier to use; the exclusion of sections 1 and 2 Terrorism Act 2006 are arguably anomalous; some form of tools-based liability may be desirable but it is better directed at Gen AI that is designed to stir up hatred, than Gen AI that is designed to create terrorism propaganda.

Chatbot radicalisation

131. Chatbot radicalisation involving the production of autonomous content is legally the most difficult topic^{[footnote 380]}.

132. Chatbots are not human. They cannot commit terrorism or other offences by reason of the content they generate. A human being cannot conspire with a chatbot or encourage a chatbot.

133. No one within the AI lifecycle, not even the end user, knows precisely what content a chatbot will eventually generate. The output is not predictable or fully explainable.

134. There are at least two scenarios to consider:

• In scenario A, a human end-user consumes chatbot content and interacts with it in a radicalising conversation with no further dissemination. I refer to this as a ‘closed loop’. The conversation comprises the input (prompts generated by the human end-user) and the outputs (generated by the chatbot) of the conversation.

• In scenario B, a chatbot interacts with users on a multi-user platform such as Twitter/X or Telegram, and generates terrorist propaganda by, for example, commenting on other user posts. In this scenario, the end- user is any person who communicates with the bot.

135. End-user conduct

136. For Scenario A (closed loop), no documentary offence is capable of being committed whatever incendiary prompts are entered into the chatbot.

• Firstly, it is not a terrorist offence to encourage or invite a chatbot to commit acts of terrorism or support a proscribed organisation.

• Secondly, since the interaction is human-on-machine, no terrorism content is published or disseminated to any other human being.

• The result is that this type of conversation, which has many features of a human conversation, is entirely unrestricted by terrorism legislation – unless what is said rises to the level of attack preparation by the human being involved or results in the possession of instructional material (see below, ‘Attack Facilitation’).

137. In Scenario B (content visible to multiple users),

• It might be possible to argue, depending on the number of users and the circumstances, that the content is disseminated to members of the public. But unless it can be proven that the person prompting the chatbot was able to predict its output, it will be impossible show under sections 1 and 2 Terrorism Act 2006 that he thereby published or distributed a “statement” whose likely consequences he understood, meaning he has the necessary mental element for the offence^{[footnote 381]}.

• Sections 12(1) and (1A) Terrorism Act 2000 can be committed without proof of publication, but the evidential difficulties are again formidable: it would be necessary to prove that the defendant invited support or expressed a supportive opinion through the medium of a chatbot despite not knowing precisely what the chatbot was going to say.

• Assuming the person who prompted the chatbot can be considered responsible for publication, section 13 Terrorism Act 2000 could apply if the circumstances gave rise to reasonable suspicion that the person entering the prompt was a member or supporter of a proscribed organisation^{[footnote 382]}: for example, if a person entered a prompt into a chatbot saying, “I love Hamas, show me the flag of Hamas so I can show my online friends”.

138. Upstream conduct

139. An individual who creates, trains or disseminates a terrorist chatbot is involved with a computer programme that has not yet, but may in future generate terrorist propaganda.

140. That individual will not know precisely what content will be generated. In part this is because chatbots are unpredictable, in part because he will not know how the end-user will interact with the chatbot. This applies even if the process of creating or training involves the ingestion of terrorist propaganda as a part of its training data.

141. None of the ‘documentary offences’ under the Terrorism Acts will be available.

142. Nor are sections 44 and 45 Serious Crime Act 2007 (encouragement or assistance) of much help, however malign the intentions of the upstream individual:

• Scenario A (closed loop) involves no terrorism offence for the reasons already discussed. So, the creator, trainer or disseminator of a chatbot that was specifically designed to radicalise lone individuals would not do an act capable of encouraging or assisting the commission of a terrorism offence.

• Even if the chatbot was designed with Scenario B in mind (content visible to multiple users), the 2007 Act mainly applies to direct encouragement – and the possibilities for indirect encouragement are very limited^{[footnote 383]}. Absent provable links to the end-user, the upstream individual would not be liable.

• In all cases it would be insuperably difficult to establish that the upstream individual intended the downstream creation of content that fell within terrorism legislation.

Analysis

143. If chatbots are currently being designed for terrorist radicalisation purposes, I am unaware of them. The one terrorism-adjacent case (Jaswant Singh Chail^{[footnote 384]}) involved a chatbot trained up as a virtual girlfriend.

144. So, whilst I am satisfied that existing terrorism legislation would rarely if at all permit the prosecution of a chatbot trainer or disseminator, there is little evidence that new laws are needed to address an existing problem.

145. In the real world it may be very difficult to identify the responsible individual, they may be located overseas in any event, and if a terrorist bot farm was ever detected in the UK, it is fair to assume that those involved would probably be involved in other terrorist offending.

146. On the other hand, the internet has exposed a shoal of susceptible loners, including children, who might just prove particularly vulnerable to one- to-one chatbot radicalisation. There may be benefit in getting ahead of the curve and prohibiting Gen AI-related conduct; or at least identifying how the law might be adapted in case it is ever needed.

147. Even if prosecution is unlikely, terrorism legislation would be a powerful signal to tech companies, either directly or through the Online Safety Act 2023, that terrorist chatbots should not be available to the general public.

148. If new legislation is warranted, the right approach must be one that criminalises the creation or dissemination of a terrorist chatbot without having to prove any nexus with an end-user.

149. This is the tools-based type of liability that currently applies to hacking tools (under the Computer Misuse Act 1990) or fraud tools (under the Fraud Act 2006) and will apply to 3D printer firearms templates and SIM farms if the Criminal Justice Bill is successfully returned to Parliament.

150. The difficulty is in defining ‘terrorist chatbot’; and identifying the appropriate mental element for liability or defences (such as reasonable excuse) so that the perpetrator warrants conviction as a terrorist offender with all the consequences that this generally brings^{[footnote 385]}.

• It would be possible to avoid the definition issue by adopting the model in section 3A Computer Misuse Act 1990, so that a person who makes, adapts, supplies or offers to supply, or possesses or accesses any Gen AI would be liable if he intended it to generate a statement that is likely to be understood by a reasonable person as a direct or indirect encouragement or other inducement to the commission, preparation or instigation or acts of terrorism; or a statement that invites support or is supportive of a proscribed organisation.

• However, this would be too broad in its effect. It would apply to someone experimenting for satirical purposes with a chatbot by focussing on the content generated to the exclusion of the likely effect of the content.

• It would also apply too broadly in its scope. The creator of a general Gen AI model may be virtually certain (and therefore intend^{[footnote 386]}) that his model will be used – amongst the many hundreds of thousands or millions of users with access to it – to generate terrorist content. The same is true of the developer of a word processing programme.

• A more acceptable alternative might encompass the making or supply of a computer programmed designed to generate a relevant statement. If the defendant knew that the chatbot was specially designed to produce terrorism content when prompted by a third party, it might be sufficient that he intended or believed it would be used in this way.

151. However, for the reasons already discussed, I can foresee immense difficulties in proving that a chatbot was designed to produce narrow terrorism content. The better course would an offence of making etc. a computer programme specifically designed to stir up hatred on the grounds of race, religion or sexuality.

152. For completeness, I advise against amending section 5 Terrorism Act 2000 so that acts preparatory could apply to preparing acts of encouragement as well as preparing acts of terrorism. Since the conduct element of the effect is effectively unrestricted, it would lead to absurd results^{[footnote 387]}.

Attack facilitation

153. Attack facilitation, in all its forms, is generously covered by terrorism legislation, and this includes attack facilitation using Gen AI.

154. End-user conduct

155. Where an individual uses Gen AI with intent to commit an act of terrorism:

• This will amount to preparatory conduct within section 5 Terrorism Act 2006.

• The computer or other device used to interact with the Gen AI model will constitute an article held for a purpose connected with the commission, preparation or instigation of an act of terrorism contrary to section 57 Terrorism Act 2000^{[footnote 388]}.

156. Even where that intent is lacking, section 58 Terrorism Act 2000 penalises the possession or collection of information that is, by its very nature, designed to provide practical assistance to a person committing or preparing an act of terrorism^{[footnote 389]}.

157. This would apply to information obtained from Gen AI (for example, advice on how to carrying out vehicle-ramming attack on a bridge)^{[footnote 390]}.

158. This would also apply to possession of a Gen AI model that was specially adapted to provide terrorist attack-planning information when interrogated. The intrinsically useful information would be the computer programme comprising the Gen AI. There is no reason why such a computer programme should not count as information intrinsically useful to terrorists, even though user interaction would be required to generate precise instructions^{[footnote 391]}.

• However, it might be difficult, given the way in which Gen AI models are currently accessed^{[footnote 392]}, to prove possession of the entire Gen AI model. Although section 58 has been extended to viewing or accessing instructional material via the internet^{[footnote 393]}, this would not apply to every interaction with such a model^{[footnote 394]}.

159. It is also an offence to receive instruction or training in terrorist methods with intent to use these to commit or assist in the commission of terrorist acts^{[footnote 395]}. However, I doubt that this could apply to receiving instruction or training from a Gen AI model, unless the Gen AI model was specially adapted to provide terrorist training.

• As Professor Clive Walker KC points out^{[footnote 396]}, the training offences apply to instructions provided by a person generally (for example, via the internet).

• Accordingly, where a person provides terrorist training to another by disseminating a specially adapted Gen AI model, it is an offence to receive such training.

• But if an end-user merely exploits a general Gen AI model to train himself in terrorist tactics, it cannot be said that he has been provided with terrorist training by any other person^{[footnote 397]}.

160. Upstream conduct

161. Whether terrorism legislation applies to upstream conduct largely depends on intent.

162. If an upstream actor engages in creating or disseminating a Gen AI model with the intention that it should assist another to commit acts of terrorism – for example, a Gen AI model which is designed to generate attack-planning information:

• He will engage in preparatory conduct within section 5 Terrorism Act 2006^{[footnote 398]}.

• He will commit offences contrary to sections 54 Terrorism Act 2000 and section 6 Terrorism Act 2006, assuming the model is designed to provide instructions on weapons or terrorist skills.

• He will offend against section 57 Terrorism Act 2000, on the basis that the device holding the Gen AI model is held for a purpose connected with the commission of acts of terrorism.

• He will commit the inchoate offence of intentionally encouraging or assisting these offences contrary to the Serious Crime Act 2007.

163. Absent such intent, no offence will be committed merely because an individual is responsible for developing Gen AI that is capable of being misused, unless:

• The Gen AI model has been adapted so that it is intrinsically useful for acts of terrorism, so that section 58 Terrorism Act 2000 applies.

• In theory, the individual believes that a terrorist offence will be committed under section 54 or 58 Terrorism Act 2000 (as explained above, sections 5 and 6 are excluded from this aspect of the Serious Crime Act 2007) and that his Gen AI model will encourage or assist that offence. In practice, it will be difficult to prove such belief unless the Gen AI model has been specially adapted, in which case section 58 will already apply.

Analysis

164. Where Gen AI is intended to be use for terrorist purposes, terrorism legislation is adequate, as supplemented by the Serious Crime Act 2007.

165. Of particular significance is that section 5 applies to a person who engages in any activity with intent to assist another to commit acts of terrorism. This means that a person who created a terrorist chatbot or Gen AI model that was designed to produce instructional material, would be likely to commit an offence.

166. Where individuals involve themselves with a Gen AI model that has been specially adapted to provide instructional material, then section 58 will ordinarily apply even if it cannot be shown that the defendant intended to carry out any terrorist acts himself.

Attack innovation

167. The same considerations apply under terrorism legislation as for ‘attack facilitation’.

Analysis

168. There is a broader question about the extent to which Gen AI will give access to new ways of causing harm, which could be exploited for terrorist or other purposes. However, legislative responses such as prohibitions on certain activity or reporting obligations (for example, reporting models that are trained on certain data sets) fall outside the scope of terrorism legislation.

Moderation evasion

169. End-user conduct: Gen AI may be used to generate terrorist propaganda or instructional material that is designed to evade automatic content moderation.

170. The fact that the propaganda or instructional material is moderation-evading does not alter the application of the law:

• If the moderation-evading content satisfies section 1 or 2 Terrorism Act 2006 or section 12(1), 12(1A), or 13 Terrorism Act 2000, then these offences are available. The use of Gen AI for moderation evasion may be powerful evidence of an intention or willing recklessness to encourage terrorism or invite support.

• If the moderation-evading content satisfies section 58 Terrorism Act 2000, then that offence will be committed. If the defendant intends acts of terrorism to be committed (by himself or others) then section 5 Terrorism Act 2006 will also apply.

171. Upstream conduct:

172. There are only limited circumstances in which the programmer or distributor of Gen AI might commit an offence under terrorism legislation, merely because of its intended or subsequent use in content moderation for terrorist purposes.

• If the individual intended to encourage or assist a terrorist offence, then the Serious Crime Act 2007 could apply. This is because providing Gen AI for this purpose might assist the end-user to encourage members of the public who would not otherwise be exposed to the content (assisting the offence under section 1 Terrorism Act 2006) or assist the end-user to possess instructional material (section 58 Terrorism Act 2000)^{[footnote 399]}.

• In practice, such a person might be in league with the end-user meaning that joint liability or conspiracy would be available in any event.

173. Otherwise, terrorism legislation is not applicable.

Analysis

174. Content-moderation is pursued by tech companies according to their own terms and conditions. Those standards could be irrational or objectionable (for example, a platform that sought to moderate content that was critical of Russia). It cannot be said that it is inherently wrong, let alone criminal, to engage in moderation-evasion or enable others to do so.

175. It is correct that some content moderation will be performed by service providers to comply with their new safety duties under the Online Safety Act 2023, which include obligations to remove “terrorism content”. However, the 2023 Act is aimed at constructing safety duties for service providers and does not concern programmers or end-users who might seek to circumvent safety measures using Gen AI or otherwise.

176. It is foreseeable that programmes will be created to avoid the moderation of child sex abuse material, but I do not know whether anyone is likely to develop a programme for avoiding terrorism-related content moderation.

177. If this form of Gen AI was developed, then a further facet could be added to the tools-based liability discussed under ‘chatbot radicalisation’, penalising the making, adapting etc. of a programme which the person intends or believes will be used to distribute (or facilitate the distribution of) encouraging or instructional material.

178. However, for the reasons already discussed, it will be difficult to prove that any moderation-evasion tool was specifically designed to avoid the moderation of terrorism content in its narrow legal sense. A better target might therefore be tools-based liability where the Gen AI is designed to enable, through content moderation-evasion, the stirring up of hatred on the grounds of race, religion or sexuality.

Social degradation

179. Terrorism legislation does not apply to the creation or promotion of information that merely creates social distrust.

Analysis

180. Paradoxically, this is where Gen AI may have the greatest eventual impact.

181. Using Gen AI to promote tension between different religious or racial groups, conspiracy theories, grievance narratives, or general hostility to the organs of society, may foster violence^{[footnote 400]}. Some of this violence could well amount to terrorism.

182. But there is no role for terrorism legislation here because any link between Gen AI-related content and eventual terrorism would be too indirect.

183. A toe has been dipped into the water with the National Security Act 2023 with the new offence of foreign interference^{[footnote 401]}; still untested, this is capable of extending to mis- and dis-information that is intended to have an interference effect, but only where it is done on behalf of or for the benefit of a foreign power^{[footnote 402]}.

184. In some cases, the offence of stirring up racial hatred (section 19 Public Order Act 1986) will be available^{[footnote 403]}.

8. Special civil powers

Introduction

8.1. The use of non-criminal measures against proven or suspected terrorists is widespread and longstanding in many countries. The new UN Rapporteur on counter-terrorism^{[footnote 404]} has rightly referred to individual detriment when well- recognised standards and procedures of criminal justice are absent. Consideration must therefore be given to the adequacy of the legal basis for imposition, necessity, proportionality, due process and judicial safeguards, effective remedies, and evaluation and monitoring^{[footnote 405]}.

8.2. Most non-criminal justice powers used against terrorists, sometimes referred to as ‘disruptive powers’, belong to the Home Secretary.

8.3. A fraction of these fall within the scope of my review: Terrorism Prevention and Investigation Measures (TPIMs) and Temporary Exclusion Orders (TEOs) are considered in this chapter along with passport seizure and retention by the police, plus police applications for civil Serious Crime Prevention Orders. I also consider some aspects of the Online Safety Act 2023.

8.4. Other widely used disruptive powers are deportation, exclusion from the United Kingdom, citizenship deprivation^{[footnote 406]}, passport cancellation and refusal of naturalisation. These powers, though important, are outside my statutory remit as Independent Reviewer.

8.5. Sanctions are another type of administrative measure that is widely used for counter-terrorism purposes. My report on international counter-terrorism sanctions was published in December 2023^{[footnote 407]}.

TPIMs

8.6. Potent but disconcerting, these special measures authorise the imposition of life-restricting measures based on evidence that is not fully disclosed the individual. TPIMs made after June 2021^{[footnote 408]} can be renewed for up to 5 years without any new “terrorism-related activity” coming to light.

8.7. Nonetheless they have proven to be highly useful measures for a clutch of UK- based individuals where the arrest-prosecute model of risk management is not possible. 31 TPIMs have been made in total since 2011^{[footnote 409]}.

8.8. Limited information on TPIMs is presented to Parliament in the form of quarterly reports. I have amplified this information to give a fuller picture of TPIMs in 2023:

• In the quarter December 2022 to February 2023, there were two TPIMs in force. Both were British and both relocated (required to live in accommodation obtained by the Home Office)^{[footnote 410]}. One of these was LXB, a neo-Nazi in his 20s, who was suspected of attack-planning and had previously been convicted of terrorism and explosives offences^{[footnote 411]}. His was the first TPIM with a potential maximum of 5 years. The other was TL, associated with Al Muhajiroun, whose TPIM was made in March 2021 and therefore subject to the old 2-year limit^{[footnote 412]}.

• In the quarter March to May 2023, TL’s TPIM had expired, leaving just LXB’s TPIM in force^{[footnote 413]}.

• In the quarter June to August 2023, LXB’s TPIM was revoked and there were therefore no TPIMs in force at the end of this period^{[footnote 414]}. LXB later pleaded guilty to breaching TPIM conditions concerning digital devices and access to the internet and was sentenced to 2 years’ imprisonment^{[footnote 415]}.

• In the quarter September to November 2023, there was one new TPIM in force^{[footnote 416]}. He was a foreign national and was relocated to Home Office accommodation (in 2024, he returned to his country of origin).

• In the quarter December 2023 to February 2024, a new TPIM was made against a British citizen. He was relocated. At the end of this period there were therefore two TPIMs in force.^{[footnote 417]}.

8.9. I attend almost all the Home Office-chaired quarterly TPIM Review Groups. My experience of these meetings is that the management of TPIMs (by police Contact Officers), the overall severity of the measures, and the assessment of risk (by MI5 officers) is rigorously probed by the Home Office chair, and that decisions are taken on a sound basis, recognising the empathetic limitations that must always arise when officials are considering individuals believed to represent a risk to national security.

8.10. As in 2022, poor mental health and neurodivergence (autism) was in evidence amongst the TPIM cohort. The presence of a psychologist has helped.

8.11. There were no court proceedings concerning TPIMs in 2023, but this should not conceal the importance of maintaining the infrastructure. In TPIM proceedings, sensitive intelligence is hidden from the TPIM subject and his lawyers but is considered in closed hearings aided by the instruction of security-cleared Special Advocates. The Home Secretary is represented by security-cleared barristers.

• The work can be unappealing because of the practical implications of working with classified material, leading to stress and isolation, especially for Special Advocates.

• The pay rates for Special Advocates have not changed in over 20 years^{[footnote 418]}.

• The system must not be allowed to wither on the vine.

TPIMS and prosecution

8.12. Terrorism Prevention and Investigation Measures are something of a misnomer:

• Whilst they require the Chief Officer of Police to “secure that the investigation of the individual’s conduct, with a view to prosecution of the individual for an offence relating to terrorism, is kept under review” (section 10(5) Terrorism Prevention and Investigation Measures Act 2011), keeping an investigation under review is different from committing resources.

• In practice, this obligation has not led to any greater level of criminal investigative activity than formerly applied to individuals under control orders under the Prevention of Terrorism Act 2005.

8.13. What if the police do have evidence to prosecute an individual for a terrorism offence? May the Home Secretary nonetheless make, or if already made, renew a TPIM in these circumstances?

• A literal reading of the legislation imports no such prohibition. The Home Secretary must consult the Chief Officer of police on whether there is evidence that could “realistically be used” to prosecute (section 10(1)) but then has a discretion in light of this information.

• One can well understand why a prohibition on making (or continuing) a TPIM where there was such evidence would be tricky to formulate. Decisions on prosecutions are for independent prosecutors not the Home Secretary and even though the Chief Officer must consult the prosecuting authorities (section 10(7)), there could be no guarantee that if a TPIM was not made or dropped, that prosecution would follow. There might be evidence, but the prospects of conviction might be low.

• That said, the purpose of section 10 is to establish a priority for prosecution wherever possible^{[footnote 419]}. This is a legislative steer that must be honoured.

Prison-release TPIMs

8.14. An emerging phenomenon is the use of TPIMs on newly released prisoners.

8.15. This was the situation for 2 of the 4 TPIM subjects in 2023. These were LXB, and the foreign national who left the UK in 2024^{[footnote 420]}. The latter’s release from prison was initially postponed by the Secretary of State who referred his case to the Parole Board as a high risk offender under a new procedure brought in in 2022^{[footnote 421]}. This led to a cliff-edge situation where he was released without any licence conditions.

8.16. A TPIM can therefore fill a gap, by imposing conditions on an individual as they emerge from custody into the community.

8.17. However, the use of post-release TPIMs must not be allowed to damage the integrity of the criminal process. When a terrorist is sentenced, the term of his sentence is fixed; a portion will be served in custody and a portion on licence, but cumulatively never more than the sentence determined by the judge^{[footnote 422]}.

• Imposing a TPIM at sentence expiry, especially if based on the same criminal conduct leading to conviction^{[footnote 423]}, could look perilously like extending the licence period.

8.18. It is right that TPIMs serve a different legal function from criminal sentencing and that in-prison behaviour may provide a basis for imposing a TPIM on release. But the authorities will nonetheless want to pay attention to perceptions. The prospect of returning to normal life after a criminal sentence is a light at the end of the tunnel, and that light is also important for rehabilitation and reform.

8.19. A related issue concerns the resources available for risk assessment in prison versus on release. In prison, a terrorist offender can discuss their own case fully with an informed psychologist^{[footnote 424]}. That can inform their progress through prison, the timing of their release, and their licence conditions. An individual on a TPIM is not subject to an equivalent risk assessment process. The mentors with whom they can discuss their cases are not fully informed risk assessors. Since a TPIM can now run for up to 5 years, it is essential that assessments of risk do not stagnate.

Younger TPIM subjects

8.20. Younger TPIM subjects may be at that formative stage in life where romantic relationships become a pressing concern. The not untypical TPIM association measure, forbidding meetings with new individuals unless notified in advance to the Home Office, requires a TPIM subject to collect personal details from a new acquaintance for clearance before any further contact can take place.

• I am aware that the Home Office has been flexible by permitting details to be provided to them in the form of social media handle. Even so, the risks to personal development and fulfilment and social rehabilitation, noting that a stable relationship may provide an exit route from terrorism^{[footnote 425]}, are obvious; those risks have not always been appreciated.

8.21. The police and Home Office should try not to inhibit wherever possible the formation of normal social relationships. A proactive turn may be called for, especially for younger TPIM subjects who have recently left prison: they may have little experience of living in the world. Mentors can play a role here in developing absent life skills. I saw a TPIM case in 2023 where the input from the mentor was extremely helpful and welcomed by the TPIM subject.

8.22. The authorities will need to think about how mentors can be effectively deployed in longer-term TPIMs lasting up to 5 years. Interactions could become routine and formalistic at a time when risky individual may become stuck in the system – risky enough to be put on a TPIM, and without sufficient indication that their outlook has improved. The prospect of demoralising and lengthy TPIMs is not a glad one.

8.23. Controls on electronic communications devices – a central and necessary aspect of reducing the risk of terrorism in many cases – can inhibit entry to the job market. Many roles (such as delivery, or in bars) depend on regular access to apps on smartphones to secure shifts. I know that the Home Office has been trying to work on solutions that provide greater access to necessary technology whilst ensuring sufficiently clear limits to prevent terrorist use.

8.24. The impact of lengthy TPIMs on young people at a formative stage in their lives is one that I propose to keep closely under review.

Polygraphs for TPIMS

8.25. The Counter-Terrorism and Sentencing Act 2021 provided for polygraph measures^{[footnote 426]} to monitor compliance and assess the need for any variations. Implementing regulations were made in 2022^{[footnote 427]}. Although polygraph measures have been imposed on 5 individuals (as of September 2024), no polygraph examinations have yet been carried out on TPIM subjects.

8.26. Considerations for any future use will include:

• Whether compulsory use of polygraph could have an adverse effect on the relationship between the TPIM subject and the authorities, damaging the management of the TPIM subject.

• Whether the fairness of criminal proceedings for TPIM breach might be compromised if a criminal investigation resulted from answers obtained during a compulsory polygraph session^{[footnote 428]}.

• Ensuring that the TPIM subject has properly understood (and can be shown to have understood) the purposes of the polygraph, as is required when the polygraph is administered to released terrorist or sex offenders^{[footnote 429]}.

Knives

8.27. In line with last year’s recommendation, the government has agreed to bring forward an amendment to the 2011 Act to enable the Home Secretary to prohibit the possession of unapproved knives or bladed articles.

TPIMs and the rule of law

8.28. I am nonetheless driven to recommend that the no further TPIMs should be made until it can be confirmed that all TPIMs subjects without private means will be provided with legal funding for the purpose of court reviews^{[footnote 430]}. This issue is simple, and fixable by the government if it chooses. My earlier reports made targeted recommendations, but they have been rejected.

8.29. Considering my duty to consider the operation of the Act^{[footnote 431]}, my view is that the Act does not now operate as Parliament intended, which was that individuals subject to TPIMs would have an automatic review by an independent tribunal^{[footnote 432]}. This is a fundamental.

8.30. The right of review has been frustrated by a continuing failure to secure that TPIMs subjects without private means are provided with legal funding at the outset so that timely reviews can take place in every instance, as intended by Parliament.

• This topic was considered in detail in my report Terrorism Acts in 2019, where I recommended changes^{[footnote 433]}.

• This recommendation was repeated in Terrorism Acts in 2020, with a targeted suggestion for amending the Legal Aid, Sentencing and Punishment of Offenders Act 2012^{[footnote 434]}.

• In January 2023, the government rejected my reiterated recommendation. The Ministry of Justice acknowledged that some TPIM subjects had failed to secure legal aid funding in section 9 review hearings but said that it could not “…be shown that the application of the merits test is the issue in these cases”.

• In 2024, I became aware of a TPIM subject whose legal aid application was refused by the Legal Aid Agency on the grounds of merits. I do not know how the Legal Aid Agency is able to judge merits given that much of the evidence of TPIM cases is closed and not disclosable, but that is what happened.

• The merits decision was ultimately reversed after 3 appeals by solicitors but only after 7 months had elapsed, meaning that for 7 months no section 9 review could take place.

• Accordingly, the restriction of legal aid on the grounds of merit is real. Impecunious TPIM subjects will not have legal representation if their cases are judged unmeritorious by the Legal Aid Agency.

8.31. The rule of law is engaged by this continuing failure.

8.32. Firstly, Parliament granted the strong power to make TPIMs to Home Secretary on a promise that every TPIM would be subject to review by the courts. This balance between power and oversight was set out in legislation that is not being honoured.

8.33. Secondly, effective and prompt judicial oversight is the safeguard against arbitrary or oppressive orders being made by the executive against individuals.

8.34. It is ultimately for Parliament to consider whether its legislation is being operated as intended, and if appropriate to bring about revision.

Temporary Exclusion Orders

8.35. Temporary Exclusion Orders (TEOs) are, despite their name, directed at managing the return to the United Kingdom of suspected British individuals. They can last for up to 2 years and comprise a permit to return to the United Kingdom (on a named flight) and a duty, if imposed, to comply with reporting and/or mentoring obligations^{[footnote 435]}.

8.36. Unlike TPIMs they may be imposed on the basis of reasonable suspicion of involvement in terrorism-related activity^{[footnote 436]}. Some lowering of the threshold of proof (compared to TPIMs^{[footnote 437]}) is warranted given that the relevant conduct is likely to have occurred abroad, and less onerous conditions are available.

8.37. Nonetheless it is a counter-terrorism measure. Breach of obligations is a criminal offence. As with TPIMs, sensitive evidence may be withheld from the TEO subject.

• The Supreme Court has now resolved that when a TEO subject challenges the making of a TEO against him, he has a right to a fair hearing under human rights standards, just as much as when he challenges the imposition of obligations^{[footnote 438]}.

• This means that when sensitive evidence is withheld, the TEO subject must be given some indication of the case against him (referred to as a gist).

• Giving the judgment of the Supreme Court, Lord Reed noted that this dispute about disclosure had prevented the substance of the case from being addressed in the lower courts for 5 years^{[footnote 439]}.

8.38. TEOs can be imposed on sole and dual British nationals. It is true that during the Islamic State period (ending in roughly 2018), many dual British nationals who were located abroad, such as Shamima Begum, were deprived of their citizenship. But there are cases where deprivation would be unlawful; for example, because the individual would be rendered stateless, or liable to additional mistreatment abroad if deprived of British citizenship.

8.39. One TEO was imposed in 2023 but the individual has yet to return to the UK. He had already been subject to one TEO, but this expired after two years. The government has accepted my earlier recommendation that TEOs should endure for 2 years from the date of return to avoid the merry-go-round of imposition, lapse, and reimposition, but legislation has not yet been passed to secure this change. This issue (of expiry and remaking) does not appear to be going away.

8.40. No TEO subjects returned in 2023. During 2023 there were a total of 6 in-country TEOs in force, although 4 expired during the year, and one was revoked at the very beginning. There were no new proceedings concerning TEOs in 2023.

Passport seizure and retention

8.41. The power to seize and temporarily retain travel documents (Schedule 1 to the Counter-Terrorism and Security Act 2015) was used once in 2023. It has been used a total of 75 times since its creation^{[footnote 440]}.

Online safety measures

8.42. Terrorism in the United Kingdom is inextricably linked to the internet. In September 2023, the government accepted that the internet was now the preferred avenue for those searching for terrorist propaganda or contacts^{[footnote 441]}.

8.43. For Western democracies, internet safety has now entered its third era.

8.44. The first period was one of optimism and abandon, encapsulated by the slogans, “Move fast and break things” (Facebook) and “Don’t be evil” (Google).

8.45. The second era acknowledged the exploitation of online freedoms by terrorists but offered industry solutions in the form of content moderators and terms and conditions.

8.46. The third era is one of more direct confrontation between states and tech companies through:

• legislating for standards (the EU’s Digital Services Act and the UK’s Online Safety Act 2023),

• criminal investigation (the 2024 arrest in France of Telegram’s Pavel Durov)^{[footnote 442]},

• judicial enforcement (the 2024 banning of Twitter/X by Brazil’s Supreme Court^{[footnote 443]}),

• regulatory action (the Australian eSafety Commissioner’s action against Twitter/X over a terrorist video^{[footnote 444]}; the EU Commission’s action against Meta in relation to failure to protect minors from the ‘rabbit-hole’ effect of algorithms^{[footnote 445]}).

8.47. A separate development in 2023 is market-driven. Google Play and Apple’s AppStore limited the functionality of the Telegram app downloaded from their platforms, so that it could not access certain Hamas channels^{[footnote 446]}. The same limitations did not apply to the Telegram app downloaded directly from Telegram’s website.

8.48. Whether state-led or market-driven, the internet’s global nature means that action in one part of the world will affect online terrorism elsewhere. Some tech companies do not have the staff to enforce different rules in different countries: in 2024 it was revealed that Telegram, with close to 900 million unique users, had only 50 full-time employees^{[footnote 447]}. It is difficult to imagine that such a skeleton crew could tailor content moderation to all the different requirements of the different countries in which Telegram operates.

8.49. The scale of the internet means that humans cannot feasibly moderate the sum of all user-generated content that is posted online without technical assistance. In December 2023, TikTok had 6,287 people dedicated to the moderation of content in the EU as a whole; meaning, for example, 650 moderators who speak French to deal with the content consumed by 22.7 million monthly active users in France. Twitter/X had 1,726 moderators globally^{[footnote 448]}. Tech companies are keen to show off their capabilities: public knowledge of their limitations is just as important.

8.50. During 2023/4, OFCOM, the regulator of the Online Safety Act 2023, issued two consultations of note: on “Protecting people from illegal harms online” and “Protecting children from harms online”. OFCOM has an impressive research capability. In my responses I noted OFCOM’s hair-raising revelations about the content to which children are routinely exposed and suggested that the danger of terrorism content to children (judged by the ever increasing number of child terrorism-related arrests) had been underappreciated by OFCOM, leading to gaps in the proposals^{[footnote 449]}. The outcome of the consultations is awaited.

8.51. Having read OFCOM’s proposed Illegal Content Judgements Guidance, I suspect that in practice where terrorism content is removed, it will be removed because it offends against some other standard (for example, rules relating to violent content). The prospect of human or technical moderators applying UK terrorism legislation accurately, inferring mental states and the absence of defences^{[footnote 450]}, seems remote.

8.52. Automated removal enables accurate and speedy removal of known terrorism content (“matching-based”); it remains to be seen whether artificial intelligence-enabled removal (“classification-based”) can identify terrorism content accurately without massive amounts of training and oversight. There are temporal, contextual and cultural limitations of machine learning algorithms that will struggle with the evolving terrorism content^{[footnote 451]}.

8.53. The Online Safety Act 2023 attempts, briefly, to deal with bot-generated content, but OFCOM’s guidance suggests it has not yet grappled with fully autonomous content (for example, generated by a chatbot):

• Where content is generated by a bot, what matters is the mental state of the person “…who may be assumed to control the bot” (section 192). With the right assumptions, bot-generated content could therefore amount to terrorism content, on the basis that the controller intended or was reckless about encouraging acts of terrorism.

• What is meant by control of a bot is not specified in the Act.

• In its draft guidance, and in its analysis of terrorist harm, OFCOM treats bots as simple tools which post pre-programmed content^{[footnote 452]} but this does not adequately cover autonomous content created by Gen AI chatbots.

8.54. Experience has shown that tech companies cannot be relied on to police themselves. However, the ability of charities, researchers and journalists to lend their support has been hampered by the loss of free-to-use access tools (Twitter/X’s withdrawn of its Pipeline API in 2023; Meta’s 2024 discontinuance of its monitoring tool Crowdtangle^{[footnote 453]}).

8.55. There is nothing in the Online Safety Act 2023 that requires tech companies to provide monitoring facilities for free. By September 2025, OFCOM must have produced a report on how persons carrying out independent research into online safety are currently able to obtain information from providers^{[footnote 454]}.

8.56. How OFCOM, as the regulator, will determine the level of service provider compliance is an important question^{[footnote 455]}. Proposals include dip- sampling and third-party reports, controlled user groups and experiments with live users^{[footnote 456]}. I do not know whether OFCOM will have paid or unpaid access to monitoring tools created by the tech companies.

Money measures

8.57. The Anti-Terrorism, Crime and Security Act 2001 (‘ACTSA’) enables the forfeiture of terrorist assets.

8.1. In relation to 2023, under the ATCSA^{[footnote 457]}:

• New cash seizures (not including ports) were valued at £167,106.26 (under the Proceeds of Crime Act 2002 (POCA) there were terrorism- related seizures valued at £9,717,935.95).

• There were 3 ongoing cash detentions in December 2023 (35 under POCA).

• There were 5 cash forfeiture orders (final order) worth £14,348 (£49,027 under POCA).

• 8 account freezing orders were granted valued at £32,642.23. As of December 2023, 39 were still active including orders made in previous years (there were 29 account freezing orders valued at £458,480.93 made under POCA).

• 2 ATCSA account forfeiture orders (final orders) were made worth in total £18,000 (7 were made under POCA valued at £900,728).

High Court Serious Crime Prevention Orders

8.58. Since amendments made by the Counter-Terrorism and Sentencing Act 2021, the police can apply to the High Court for SCPOs in terrorism-related cases^{[footnote 458]}.

8.59. In 2023 the first High Court applications were made by police in terrorism-related cases, at the High Court in Leeds and London. Both applications resulted in SCPOs being made.

9. Northern Ireland

Introduction^{[footnote 459]}

9.1 For the first time since records began in 1969, and despite no functioning Executive^{[footnote 460]}, continuing anxiety about the Brexit-related Northern Ireland Protocol, and the passing of contentious Legacy-related legislation^{[footnote 461]}, there were no security-related deaths in Northern Ireland in 2023.

9.2 However, there was an increase in bombing and shooting incidents compared with the previous 12 months^{[footnote 462]}. Some of these were conducted by paramilitary groups which, as I explained last year, are groups which, although proscribed, are not considered to affect national security.

9.3 As with previous years, the primary targets for dissident republican groups remain PSNI and prison officers^{[footnote 463]}. As Professor Marie Breen Smyth rightly observes, attacks on these targets risk not only the intended targets, but also place members of the public at significant risk.

9.4 Significantly, 2023 began with the threat level in Northern Ireland being raised to ‘SEVERE’ in March, having been lowered to ‘SUBSTANTIAL’ in March 2022^{[footnote 464]}. Before this, the threat level had remained at ‘severe’ for over a decade. The fact that it was raised so shortly before the 25 year commemoration of the Belfast/Good Friday Agreement, and therefore at a politically inconvenient time, is testament to MI5’s independence in matters of threat assessment.

9.5 As I have sought to explain in my previous reports, the national security threat emanating from dissident republican groups is only part of the security picture in Northern Ireland. As the Independent Reporting Commission recognised in its 2022 report, paramilitarism remains a ‘clear and present danger’ in Northern Ireland^{[footnote 465]}.

9.6 Part VII (Northern Ireland) of the Terrorism Act 2000 remains live on legislation.gov.uk but it is really of historic and technical relevance^{[footnote 466]}. The counter-terrorism powers in this part were replaced by the Justice and Security (Northern Ireland) Act 2007^{[footnote 467]}. It is unsatisfactory that the status of Part VII is not clearer from the website – an interested member of the public would get quite the wrong impression about terrorism legislation operating in Northern Ireland.

Events

9.7 During 2023^{[footnote 468]}:

• There were no deaths due to the security situation.

• There were 33 shooting incidents (4 more than last year) and 8 bombing incidents (3 more than last year) in which 8 bombing devices were used.

• There were 50 casualties from “paramilitary-style attacks” (17 more than last year).

• These paramilitary attacks were made up of 19 “paramilitary style shootings” (5 committed by loyalist groups and 14 by republican groups) and 31 “paramilitary style assaults” (25 committed by loyalist groups and 6 by republican groups).

• The PSNI recovered 20 firearms (down from 24 last year), 1,013 rounds of ammunition (down from 1,898), and 3.22kg of explosives (up from 0.65kg).

9.8 The most serious and high profile “national security attack” was the attempted murder of Detective Chief Inspector John Caldwell while he was off duty in Omagh in February. In May, seven men were charged with attempted murder and an eighth was charged in February 2024. Two of the individuals were also charged with membership of a proscribed organisation. The trials are not anticipated to take place before 2026.

9.9 Other notable Dissident Republican activity in 2023 included:

• There was a failed attempt to hijack a lorry in Londonderry involving a crude Improvised Explosive Device (February).

• A crude hoax device in a hijacked vehicle was driven to Omagh police station. Three men were arrested.

Trends

9.10 As I pointed out last year, over a longer-term there has been a sustained decline in serious violence relating to the security situation. However, as demonstrated by the return to ‘SEVERE’ in late March 2023, this has not equated to a sustained diminution in the overall threat level.

9.11 The marked increase in the number of casualties because of “paramilitary style attacks” in 2023 bears out the observation I made last year that the threat of proscribed organisations forms part of the backdrop to ordinary life in Northern Ireland in a way which has no parallel in England, Scotland and Wales.

9.12 In its report on 2023, the Independent Reporting Commission observed that coercive control continues to be an unacceptable feature of life in many communities in Northern Ireland where paramilitary groups operate^{[footnote 469]}. This is graphically illustrated by the fact that in 2023 194 households were accepted as homeless due to paramilitary intimidation^{[footnote 470]}.

9.13 Localised violence is the most persistent form of paramilitary violence in post-Troubles Northern Ireland^{[footnote 471]}. Personal disputes and competition for control of criminal business can spill out into violence between group factions^{[footnote 472]}. Professor Breen Smyth has identified a further type of factionalism within groups, where some individuals have foresworn violence but not their group allegiance, and wonders whether this could offer some opportunities towards transition^{[footnote 473]}.

9.14 The national security threat in Northern Ireland emanates from the two main emanations of the IRA: the new IRA and Continuity IRA. A smaller group, ANP, has re-emerged as a localised threat in the North West of Northern Ireland^{[footnote 474]}. Opportunistic collaboration between the new IRA and organised crime groups has been identified as a novel feature in 2023^{[footnote 475]}.

9.15 There is a perceptible increase in juveniles involved in terrorism, as elsewhere in the United Kingdom, and causes are no longer purely divided along the Orange/Green axis. The legacy of support for proscribed organisations in Northern Ireland and the tolerance for their symbols could desensitize teachers and professionals to other risks: if children decorate their textbooks with Dissident Republican or Loyalist symbols, the symbols of other proscribed groups could hide in plain sight. There is no Prevent duty in Northern Ireland.

9.16 I have been told about imaginative schemes used by PSNI for the younger cohort. They have observed that juvenile terrorists may not always be enthused by sports-based or outdoorsy diversions; and the deprogramming model used for Islamist Extremists is not suitable for children for whom ideology is not the main draw. Northern Ireland agencies have unique experience in youth intervention and violence reduction. Just as PSNI and MI5 must increase their awareness of the alternatives to arrest-and-prosecute, other agencies and authorities must not shut their eyes to the benefits of cooperation with the security forces, noting MI5’s cross-UK responsibility for tackling Extreme Right Wing Terrorism. I look forward to reporting further on how child diversion in Northern Ireland compares with efforts in England, Wales and Scotland.

Stop and search

9.17 Use of the special provisions in the Justice and Security (Northern Ireland) Act 2007 (‘JSA’) has always dwarfed the use of stop and search powers under sections 43 and 43A of the Terrorism Act 2000 (TACT). Section 47A (suspicion-less stops based on prior authorisation) has only ever been authorised for use in Northern Ireland during one period in May 2013.

9.18 PSNI provided me with the following statistics for 2023:

• 118 persons were stopped under TACT section 43 only.

• 30 persons were stopped under TACT section 43A only.

• 155 persons were stopped under TACT section 43 and TACT section 43A only.

• 19 persons were stopped and searched under TACT section 43/43A in conjunction with other powers (in all but one case, these were powers under the JSA).

• 743 persons were stopped under section 21 JSA (stop and question) only.

• 4,199 persons were stopped under section 24 JSA (stop and search for munitions and transmitters) only.

• 148 persons were stopped under JSA S21 and S24.

9.19 Following a stop under only TACT S43, the arrest rate is 1% (i.e. 1 arrest following 118 stops). Following any stop under TACT S43, either alone or in conjunction with other powers, the arrest rate is less than 1% (i.e. 1 arrest following 287 stops).

9.20 In her final report as Independent Reviewer of the Justice and Security (Northern Ireland) Act 2007 Professor Marie Breen-Smyth reported that the PSNI planned to commence a three-month pilot in April 2024 to monitor the community background of persons searched under the Justice and Security (Northern Ireland) Act 2007 as well as the Terrorism Act 2000 (ss 43, 43A and 47A)^{[footnote 476]}. The results of this pilot will hopefully be available for analysis in next year’s report.

9.21 I commend Professor Breen Smyth’s granular and sensitive reporting on the 2007 Act and the wider security landscape, particularly the legacy of proscribed Loyalist organisations who have not made the transition to a lawful and peaceful existence. Her successor is Dr Jonny Byrne of Ulster University.

Investigations

9.22 In 2023, 130 premises were searched on a warrant granted under Schedule 5 to the Terrorism Act 2000. The largest number was recorded between January and March 2023 (48)^{[footnote 477]}.

9.23 2 cordons were erected in Northern Ireland under section 33 of the Terrorism Act 2000^{[footnote 478]}.

9.24 Last year I recommended that section 13 of the Terrorism Act 2000 be amended to allow the seizure of any article if the constable reasonably suspects that it has been displayed in such a way or in such circumstances as to arouse reasonable suspicion that a person is a member or supporter of a proscribed organisation. I did so as I concluded that the absence of a seizure power creates a serious gap. The government has accepted this recommendation.

Arrest and detention

9.25 In the year under review, there were there were 104 arrests and detentions under section 41 Terrorism Act 2000^{[footnote 479]}. This compares to 18 arrests under section 41 in Great Britain in 2023. Of the 104 arrested, 21 were subsequently charged in 2023 (whether for terrorism or other offending).

9.26 I am pleased to report that PSNI Chief Constable Jon Boutcher has asked officers to look again at whether greater use should be made of ordinary (PACE) arrest powers in terrorism-related cases, as in the rest of the United Kingdom; and that I have already met with PSNI to discuss the operational and human rights benefits of using the less intrusive arrest power in appropriate cases.

9.27 PSNI should not ignore the operational benefits of bail (not available following section 41 arrest): justified conditions can disrupt further terrorism activity whilst a charging decision is made.

9.28 Of the 104 persons detained under section 41, 91 (88%) were held for 48 hours or less. All thirteen applications for warrants of further detention were granted, authorising detention for more than 48 hours (although unlike for Great Britain, there are no statistics on duration of detention thereafter)^{[footnote 480]}.

9.29 I have continued to receive reports from the Independent Custody Visitors scheme for individuals detained under section 41, and as before I have discussed the take-up of the scheme, and possible improvements, with John Wadham, Human Rights Advisor to the Northern Ireland Policing Board. Even allowing for the obvious suspicion by many terrorist suspects in Northern Ireland towards anyone connected to the police service, I remain of the view I expressed last year that there remains a persistent shortfall in trust from detainees towards visitors.

9.30 The table below sets out information provided to me by the Policing Board of Northern Ireland about the independent custody visits which took place in Northern Ireland in 2022. All detainees were arrested under section 41 Terrorism Act 2000.

2023	Detainees visited	Valid visits	Invalid visits	Seen by ICVs	CCTV reviews	Unsatisfactory visits
54 visits	60	54	0	25	0	0

9.31 Twenty one persons were charged with a total of 47 offences (including seven charges of attempted murder, eight for explosives offences and eight for firearms offences) and 83 persons were released without charge^{[footnote 481]}.

9.32 Of those charged with terrorism:

• Eleven persons detained under section 41 were charged under the Terrorism Act 2000 (18 offences: seven of these charges related to possession for terrorist purposes, six related to support, two for membership, two for fundraising, while the remaining charges related to the collection of information^{[footnote 482]}).

• Six people were detained under section 41 of the Terrorism Act 2000 and were each charged under the Terrorism Act 2006 (attack-planning under section 5)^{[footnote 483]}.

Stopping the travelling public

9.33 Schedule 7 of the Terrorism Act 2000 allows officers to examine those travelling through ports or borders to determine if they are terrorists; to search them; to detain them; to require them to hand over electronic devices for examination; and to take their fingerprints. Failure to cooperate with an examination is a criminal offence. I consider this power more fully in Chapter 6.

9.34 As in Great Britain, there has been a long-term decline in the number of Schedule 7 examinations in Northern Ireland

Year	Number of persons examined
2016	2082
2017	1248
2018	717
2019	559
2020	120
2021	139
2022	188
2023	147

9.35 In terms of detentions, in 2017, 11 people were detained. In 2018, 6 people were detained. In 2019, 31 people were detained. In 2020, 11 people were detained and in 2021, 34 people were detained. In 2022, 73 people were detained. In the year under review 78 people were detained^{[footnote 484]}.

9.36 As with previous years, I obtained the figures on self-defined ethnicity directly from the PSNI as they are not published.

	2020	2021	2022	2023
White	38%	41%	35%	33%
Mixed	8%	6%	2%	3%
Black	13%	10%	8%	4%
Asian	17%	20%	18%	12%
Chinese or other	16%	16%	31%	42%
Not stated	8%	6%	6%	7%
Not completed	1%	0%	1%	0%

9.37 Detentions under Schedule 7 were as follows:

	2020	2021	2022	2023
White	0%	26%	21%	17%
Mixed	18%	9%	4%	4%
Black	27%	9%	5%	5%
Asian	27%	24%	18%	10%
Chinese or other	9%	24%	49%	60%
Not stated	18%	9%	3%	4%

484 Northern Ireland Office, ‘Northern Ireland Terrorism Legislation: Annual Statistics 2023’ (Sep 2024), Table 7.1.

9.38 In terms of freight, in the year under review there were no examinations of unaccompanied freight.

9.39 In last year’s report, I recommended that the power to examine and detain a person under Schedule 7 in the “border area” in Northern Ireland is abolished. The government rejected this recommendation.

Terrorist trials and sentencing

9.40 During 2023, there were 15 persons convicted of an offence under the Terrorism Act 2000, the Terrorism Act 2006 or the Counter-Terrorism Act 2008. Six were convicted at the Crown Court and nine in the Magistrates’ Court^{[footnote 485]}.

9.41 A major trial that continued into 2023 – resulting in acquittal in 2024 – was the case of Colin Duffy. At issue was voice recognition from covert MI5 devices, and in this respect Northern Ireland justice has been a canary in mine for issues of digital authenticity^{[footnote 486]}.

9.42 In addition to considering new charges, the Public Prosecution Service of Northern Ireland is responsible for legacy cases. In 2023, these included charging decisions connected to Agent Stakeknife^{[footnote 487]}. There has been considerable uncertainty over the impact of the Northern Ireland Troubles (Legacy and Reconciliation) Act 2023 on future prosecutions.

Delay

9.43 Delay continues to be a widely acknowledged and persistent feature in the Northern Ireland criminal justice system. The Lady Chief Justice recently commented that whilst terrorism trials are complicated cases, they have “…frankly been taking too long within the criminal justice system and this must change”^{[footnote 488]}.

9.44 As I observed last year, a tangible outcome of delay is that alleged terrorists of a serious stripe, who would ordinarily be held on remand for the purposes of public protection, develop a strong claim for bail. This has now come to pass. During 2023, the High Court released a defendant who had been on remand for 3 years on the grounds of delay; her case was still at the committal stage^{[footnote 489]}. In another case, arising out of the Operation Arbacia arrests, a High Court Judge commented that the three years the defendant had spent of remand was of “serious concern”. The defendant was granted bail, with the Judge observing that a report by the Criminal Justice Inspectorate dated January 2023 revealed that, as of February 2022, there were 13 prisoners on remand in Northern Ireland for a period of over three years^{[footnote 490]}.

9.45 The trial of Colin Duffy and Harry Fitzsimmons concerned events in 2013, took 5 years for the case to reach the Crown Court and a further 5 years until verdict and ultimate acquittal in 2024^{[footnote 491]}. Two years were spent by the defendants on remand.

9.46 I make the following observations about delay in Northern Ireland terrorism cases beyond the obvious and necessary point that individual defendants, innocent until the point of conviction, deserve better.

9.47 Firstly, whilst long periods of remand, and even lengthier periods subject to bail conditions, may foster at least temporary disengagement by terror suspects, it does not help public confidence in terrorism legislation if the process of determination appears to be unpredictably and irrationally drawn out.

9.48 Secondly, collateral and inventive challenges appear to be peculiarly tolerated within the Northern Irish criminal justice system (and underwritten by legal aid), compared to the rest of the United Kingdom.

9.49 Thirdly, hard-fought and complex terrorism trials are not receiving the necessary degree of case management, such as early identification of disclosure and expert witnesses. Leaving aside the possibility of Department of Justice-imposed case management regulations^{[footnote 492]}, there is low-hanging fruit to be picked in the form of practical guidance for managing terrorism cases. I would particularly draw attention to Criminal Practice Direction XIII Annex 4 (Crown Court case management in terrorism cases in England and Wales) and the simple Crown Prosecution Service documents sent to the court and defence (“Notification and Confirmation of Terrorist Case”) in advance of the first hearing. I recommend that consideration is given to using special case management forms in terrorism cases in Northern Ireland, as they are used in England and Wales.

9.50 Fourthly, compared to jury trials, judge-only trials may be conducive to delay. Without a jury to mind, it may be tempting to put the convenience of busy legal professionals, juggling a heavy caseload or busy list, over considerations of timeliness. Start-stop cases with lengthy adjournments would not I think be tolerated by jury members in the same way.

9.51 The slow move to committal reform in Northern Ireland ^{[footnote 493]} , and its anticipated effects on delay, should not obscure these wider points.

Sentencing and offender management

9.52 Two 2023 cases, and their subsequent appeals in 2024, suggest that the wind is blowing sentences for serious terrorist offending more in line with sentences in the rest of the United Kingdom.

9.53 In May, Dissident Republican Fionnghuale Perry was convicted of making or collecting a security debrief about the police finding of firearms, ammunition and explosives. The point was to avoid future detection, and the debrief was therefore likely to be useful to a terrorist (section 58 Terrorism Act 2000). She was sentenced to 4 years’ imprisonment. In 2024, the Court of Appeal upheld this sentence^{[footnote 494]}. The Court:

• Concluded that the Counter-Terrorism and Sentencing Act 2021, though it did not increase the maximum sentence for section 58 Terrorism Act 2000^{[footnote 495]}, evinced an intention to introduce “a more austere sentencing regime reflecting public concern and revulsion regarding offending of this kind”.

• Observed that “the scourge of terrorist offending” demands “condign punishment in the unsettled and challenging post-conflict world of Northern Ireland”.

9.54 In October, Gavin Coyle was sentenced to 6 years for IRA membership (section 11 Terrorism Act 2000) and his role in a bomb attack on an off duty police officer in 2018. He provided the vehicle used in the attack (section 15 Terrorism Act 2000). The officer, personally known to the defendant, was seriously injured. In 2024, the Court of Appeal increased the sentence to 8 years because the 6-year sentence was “unduly lenient for offending of this nature”^{[footnote 496]}.

9.55 In the year under review, six people were made subject to notification requirements under section 47 of the Counter-Terrorism Act 2008^{[footnote 497]}. This reinforces the point I made last year, namely that since notification is mandatory for all terrorism offenders (except less serious offences such as flags and articles) who receive sentences of over 12 months’ imprisonment, the great majority of cases brought under terrorism legislation in Northern Ireland must be at the less serious end of the spectrum.

9.56 After release, it is for the devolved administration in Northern Ireland to fix licence conditions. A sensible process for fixing licence conditions will not exclude the possibility of officials receiving national security information which means (a) willingness to receive it (b) ability to receive it (security clearances) and (c) recognition of its significance (in practice, some understanding of how gisted intelligence works) once received. When terrorist attacks are committed by released terrorist offenders, it is almost invariably the case that more information about risk could have been shared between officials^{[footnote 498]}.

10. Scotland

Introduction

10.1. Scotland is not isolated from the currents of terrorism flowing across the United Kingdom – blowing in from across the Irish Sea there are pockets of activity associated with Northern Ireland Related Activity; and Islamist and Extreme Right Wing terrorism are just as much inspired by the internet here as elsewhere. The days after 7 October 2023 saw several cases involving suspected support for a proscribed terrorist organisation (Hamas)^{[footnote 499]}.

10.2. The response to terrorism in Scotland is conditioned by Scottish laws. Although the Terrorism Acts apply throughout the United Kingdom, Scotland has a distinct legal system leading to procedural differences in the investigation and prosecution of offences under the Terrorism Acts. Where terrorist risk is disrupted by arrest for non-terrorism offences, then this will be different too, because substantive non-terrorism offences are matters of Scottish law.

Arrests and reports

10.3. There were 14 arrests for terrorism offences in Scotland in 2023: all under the Criminal Justice (Scotland) Act 2016.

10.4. During 2023, Police Scotland reported 34 (down from 41 in 2022) terrorism charges to prosecutors in the Crown Office and Procurator Fiscal’s Service (COPFS) for consideration, in relation to 15 individuals (up from 10 in 2022). One individual was reported without arrest.

• Cases against 11 individuals were progressed by Police Scotland Counter Terrorism Investigations following arrest and report: 6 Extreme Right Wing Terrorism cases; 2 Northern Ireland Related Terrorism; 2 which were characterised by Police Scotland as Mixed, Unclear and Unstable; and 1 Islamist Terrorism case (pro-Hamas support under section 12 Terrorism Act 2000)^{[footnote 500]}.

• 3 cases were reported by local police and concerned Islamist terrorism (pro-Hamas support), Northern Ireland Related Terrorism, and Mixed, Unclear and Unstable.

• 1 case was reported by Border Policing Command for an individual who failed to disclose his phone PIN when required to do so under Schedule 7.

10.5. Other terrorism-related matters were investigated by Police Scotland, and discussed with COPFS, but did not result in formal reports

10.6. A decision to prosecute under terrorism legislation was made in relation to 7 individuals^{[footnote 501]}.

• As of 23 September 2024, only one terrorism case reported in 2023 had concluded (displaying the flag of a proscribed Loyalist terrorist organisation, contrary to section 13 Terrorism Act 2000).

• At the time of writing, 16 other terrorist charges against 6 individuals are still being considered by the COPFS and have not yet been put before a court.

Prosecutions

10.7. The Crown Office and Procurator Fiscal Service’s website has details of several terrorism prosecutions in Scotland since 2018, which illustrate the range of motivating ideologies encountered in Scotland: Islamist extremism inspired by Islamic State and the conflict in Kashmir, anti-Muslim hatred, neo- Nazism, eco-terrorism, and incel-ism.

10.8. The main terrorism prosecution in 2023 was the ‘Oaken Hearth Chat’ case – this was the name of the Telegram group of which Glasgow-based Extreme Right Wing terrorist James Farrell was a member. He was interested in building firearms and discussed firebombing a synagogue^{[footnote 502]}.

• It followed a cross-border investigation involving officers from Police Scotland and Counter Terrorism North East after the group was infiltrated by an English undercover officer^{[footnote 503]}.

• The group’s founder, Samuel Whibley from Anglesey, and three other members from Keighley, were convicted of terrorism offences in England in 2022. Users, including children, were admitted to the group if they answered questions about their involvement in neo-Nazism and proved that they were White^{[footnote 504]}.

10.9. The other terrorism prosecution in 2023 was of a 62-year old man from Fife was convicted of circulating a video in support of the proscribed group National Action^{[footnote 505]}.

10.10. Just as the Columbine school massacre continues to fascinate would- be attackers in the United States, details of the Dunblane school shooting featured in the 2023 prosecution of James Maxwell, an isolated individual whose attempt to import handguns into Scotland was frustrated by law enforcement action in the United States of America and Scotland. He was not prosecuted under terrorism legislation^{[footnote 506]}.

10.11. There are six cases arising out of charges in 2023 that are live and have not gone to trial. I am told by the Crown Office and Procurator Fiscal Service that the nature of these cases may evolve but they currently involve alleged offences under terrorism legislation, and alleged explosives and firearms offences. Some cases charged in 2022 were still outstanding in 2023.

Child diversion

10.12. Interesting points of comparison for the treatment of children arrested for terrorism offences in Scotland, compared to the rest of the United Kingdom, is firstly the existence and role of the Scottish Children’s Reporter Administration^{[footnote 507]} and the powers of Children’s Hearings to deal with children who offend or are in need of care (separate from the criminal justice system but capable of imposing compulsory measures^{[footnote 508]}); and secondly the role of the Crown Office and Procurator Fiscal Service (COPFS) in recommending a range of measures even after a criminal case is reported by Police Scotland.

10.13. The COPFS can, as an alternative to prosecution:

• Refer a case to the Scottish Children’s Reporter Administration.

• Use Diversion from Prosecution, where the accused child is offered a programme of input from Social Work or other relevant services suitable to their needs. The child needs to consent but does not need to admit guilt.

10.14. I am informed that Police Scotland consult COPFS in all cases of suspected terrorism by a child at an early stage in their investigation; and this allows COPFS to direct further enquiries. I am also informed that COPFS and Police Scotland work closely with Prevent Multi Agency Panels (the equivalent of Channel panels in England and Wales) during early investigation by police, so that Prevent-type diversions remain available.

10.15. In principle a Children’s Hearing could result in the imposition of compulsory measures for public protection reasons^{[footnote 509]} although (a) I am informed this has never happened in a counter-terrorism case (b) there are limited options available if the child fails to comply with the measures imposed. In addition, if the facts were contested, and the child turned 18 before determination, this would rule out any prosecution for the original offence.

Ports powers

10.16. Police Scotland’s annual and quarterly statistics on their use of Schedule 7 is available up to end June 2023 and comprises overall use and ethnicity data^{[footnote 510]}. The figure for the calendar year 2022 is 236, slightly down from 249 in 2021.

10.17. On ethnicity, I am pleased to report that substantial figure for ‘not stated’ recorded during 2021 has now entirely disappeared. No individuals have been recorded as ‘not stated’ since July 2022^{[footnote 511]}. In the first two quarters of 2023 during which 98 people were examined, the most frequently examined were Arab people (21), followed by White British people (20).

10.18. My previous recommendation that paragraph 20 of Schedule 8 Terrorism Act 2000 be amended so that the power to take fingerprints or DNA applies with consent at a port, accepted by the government, has not yet been implemented. Until the necessary legislative amendment is made, individuals may need to be transported many miles from a port to a police station, even where they are willing to provide fingerprints or DNA.

Annex: Recommendations and responses to previous recommendations

In this year’s report I make 10 recommendations.

Chapter 3:

• the Chancellor, Home Secretary and Foreign Secretary should meet to discuss the balance of humanitarian aid and security in relation to terrorism legislation [3.27].

• the government should consult the Tri-Sector Group on potential reforms to the Terrorism Act 2000 [3.29].

Chapter 5:

• Official statistics should be collected and published on the use of sections 43B and 43C Terrorism Act 2000 (arrest and personal search of released terrorist offenders) [5.17].

Chapter 6:

• the Code of Practice should be amended to address the x-raying of freight, and in particular the circumstances when notices should be left (where the x-raying amounts to an examination) and where they should not be left (when the x-raying is preliminary to an examination) [6.24].

• the Secretary of State should consider how Schedule 7 is intended to operate in an era of high-memory phones, to avoid phone seizure becoming routine [6.33].

Chapter 7:

• The government should recommence collecting official statistics on sentence lengths for terrorism offending [7.32]

• if legislation is brought forward to allow individuals convicted before 2009 of non-terrorism offences to be treated as terrorists, post release, then this should allow for judicial (as opposed to purely ministerial) determination of any terrorism connection [7.41].

• To deal with potential terrorist abuse of Generative AI, the government should consider legislating against the creation or possession of computer programmes designed to stir up racial or religious hatred [Annex to Chapter 7].

Chapter 8:

• No further TPIMs should be made until it can be confirmed that all TPIMs subjects without private means will be provided with legal funding for the purpose of reviews [8.28].

Chapter 9:

• Consideration should be given to using special case management forms in terrorism cases in Northern Ireland, as they are used in England and Wales.

In last year’s report Terrorism Acts in 2022 I made 10 recommendations. The Home Secretary formally responded to these recommendations in a response laid before Parliament on 28 November 2024.

• HM Government’s Guidance, “For information note: operating within counter- terrorism legislation, counter-terrorism sanctions and export control’ should be amended to make reference to the Director of Public Prosecution’s guidance of October 2022 [3.58]. ACCEPTED

• To ensure that it is available for use following an individual’s extradition to the United Kingdom, section 22(6) Counter-Terrorism Act 2008 should be amended by deleting the word “further” [4.38]. ACCEPTED

• Official statistics for terrorism-related arrests should record whether the arrest relates to Islamist Extremist Terrorism, Extreme Right-Wing Terrorism, or other terrorism. [5.9]. PARTIALLY ACCEPTED

• Counter Terrorism Police should notify TACT Independent Custody Visitors of all terrorism-related detainees in TACT Suites, whether arrested under PACE or section 41 Terrorism Act 2000, and relevant authorities (Police and Crime Commissioners, and the Mayor of London) should make arrangements so that visits take place. The Code of Practice on Independent Custody Visiting should be amended accordingly [5.20]. ACCEPTED

• To improve police ability to use Schedule 7 Terrorism Acts to examine individuals arriving on small boats, the government should establish a system of facial recognition at Western Jet Foil [6.37]. SUBJECT TO WIDER REVIEW

• The Home Secretary should give consideration to whether a new terrorist travel offence should be introduced based on travelling to support a proscribed organisation [7.37]. ACCEPTED

• The Home Secretary should consider introducing extraterritorial jurisdiction, subject to Attorney General consent to prosecution, for the offence of child cruelty contrary to section 1 Children and Young Persons Act 1933, where there is a terrorist connection in accordance with the Counter Terrorism Act 2008 [7.46]. ACCEPTED

• TPIM Act 2011 should be amended to enable the Home Secretary to prohibit the possession of unapproved knives or bladed articles [8.40]. ACCEPTED

• Section 13 Terrorism Act 2000 should be amended to allow the seizure of any article if the constable reasonably suspects that it has been displayed in such a way or in such circumstances as to arouse reasonable suspicion that a person is a member or supporter of a proscribed organisation [9.35]. ACCEPTED

• The power to examine and detain a person under Schedule 7 Terrorism Act 2000 at “the border area” in Northern Ireland should be abolished [9.68]. REJECTED

1. My report on Terrorism and Protests (23.11.23) is available on the Reviewer website. ↩

2. BBC News, ‘Gaza vote chaos highlights pressure on MPs’ (23.2.24). Female MPs have been targeted with these types of threats for years: Phillips, H., ‘What is the problem? Representations of gender and violence towards politicians in UK parliamentary debates’ (2023) European Journal of Politics and Gender. ↩

3. As the Independent Reviewer of State Threat Legislation. ↩

4. Leading to the convictions and imprisonment of Darren Reynolds and Christine Grayson in 2023. A theme from continental Europe is the identification of anti-institutional extremism as a motivator of terrorist violence, as well as a source of exploitation by hostile states: see Dutch General Intelligence and Security Service, ‘Anti-institutional extremism in the Netherlands’ (May 2023), also referring to the sovereign citizen movements in Germany (the Reichsbürger movement). ↩

5. See for example the organised criminal damage against a business in Wales which made circuit boards for Israeli drones, and which the prosecutor likened to a “terrorist attack”: BBC News, ‘Protestor drilled holes through factory roof’ (19.5.23). ↩

6. See recently, Kenyon, J., Binder, J. F., & Baker-Beall, C., ‘An Analysis of Terrorist Attack Perpetrators in England and Wales: Comparing Lone Actors, Lone Dyads, and Group Actors’ (2024) Journal of Threat Assessment and Management. ↩

7. R v Dovtaev, 20 December 2023, referred to in Chapter 6. ↩

8. Report, Operation Itonia (October 2023). ↩

9. Waldron, J., ‘Terrorism and the Uses of Terrorism’, Journal of Ethics 8: 5-35 (2004). ↩

10. Jupp, J., ‘From Spiral to Stasis? United Kingdom Counter- Terrorism Legislation and Extreme Right-Wing Terrorism’ (2022) Studies in Conflict & Terrorism. ↩

11. See Terrorism Acts in 2021 at Chapter 3. ↩

12. Jupp, J., supra. ↩

13. For example, in France. An excellent summary of EU initiatives is in Ivankovic, A., ‘EU action in response to needs of victims of terrorism’, ERA Forum (2022) 23:183-194. A group of Manchester Arena attack survivors and bereaved relatives have published a report on limitations to post-attack assistance and counselling National Emergencies Trust and Lancaster University, ‘Bee the Difference’ (2023). The UK government has recently established an Independent Public Advocate for survivors and bereaved relatives of major disasters like the Manchester Arena attack: Ministry of Justice, ‘New expert panel to support victims after major disasters’ (press release, 1.3.23). ↩

14. E.g. the Glade of Light Memorial in Manchester and the memorial to PC Keith Palmer GM outside the Palace of Westminster. ↩

15. www.terrorismlegislationreviewer.independent.gov.uk. ↩

16. @terrorwatchdog on Twitter/X, terrorwatchdog on Instagram. ↩

17. Currently Jake Blight. The previous Monitor, Grand Donaldson SC, released his final report in 2023 on the operation, effectiveness and implications of Division 105A of the Criminal Code Act 1995 (Cth). During 2023 I went to Australia (Canberra and Sydney) and was able to visit police, officials, politicians and judges involved in counter-terrorism work. ↩

18. Created by Part 7 of Ireland’s Policing, Security and Community Safety Act 2024. ↩

19. Suleyman, M., ‘The Coming Wave: Technology, Power, and the 21st Century’s Greatest Dilemma’ (Bodley Head, 2023). ↩

20. CP 903 (July 2023). ↩

21. The military brigade of Hamas was proscribed in 2001, and its entirety in 2021. ↩

22. Byman, D., ‘Deadly Connections: State that Sponsor Terrorism’ (Cambridge, 2005). ↩

23. The proscribed terrorist organisation Hamas launched a major attack against Israel on 7 October 2023 ↩

24. Teeside Crown Court, Sentencing Remarks, Cheema-Grubb J. (17.5.24). ↩

25. BBC News, ‘Ex-GCHQ man jailed for life after stabbing US security worker’ (30.10.23). ↩

26. Daily Telegraph, ‘Lone wolf terrorist who targeted hospital was radicalised after viewing TikTok jihad videos’ (2.7.24). ↩

27. ‘Jacob Graham: Left-wing anarchist jailed for 13 years over terror offences after declaring he wanted to kill at least 50 people’ (19.3.24). ↩

28. 10 people were charged with membership offences in the last quarter of 2023 compared to 3 in the previous three quarters: Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to March 2024, Quarterly table A-5a. ↩

29. Between the government’s publication of CONTEST (2018) and CONTEST (2023, see further below), there were 9 UK attacks in which 6 people have been killed and 20 injured. These are identified in the 2023 version of CONTEST, at paragraph 10, footnote 3 as: Manchester Victoria (Dec 2018), Stanwell (Mar 2019), Fishmongers’ Hall (Nov 2019), HMP Whitemoor (Jan 2020), Streatham High Road (Feb 2020), Forbury Gardens (Jun 2020), Sir David Amess (Oct 2021), Liverpool Women’s Hospital (Nov 2021) and Dover Migrant Centre (Oct 2022). There have been 39 disrupted late-stage terrorist plots (see ↩

30. It was lowered in March 2024. ↩

31. Institute for Economics & Peace, ‘Global Terrorism Index 2024’. ↩

32. US Office for National Intelligence, 2024 report. ↩

33. In 2023, the UN Special Rapporteur on the Promotion and Protection of Human Rights and Fundamental Freedoms while Countering Terrorism put the figure of children as 31,900 in Syria: ‘Rights of Children in Contexts affected by Counter-Terrorism’ (2023). ↩

34. UN Secretary General, ‘Seventeenth report of the Secretary-General on the threat posed by ISIL (Da’esh) to international peace and security and the range of United Nations efforts in support of Member States in countering the threat’ (S/2023/568). ↩

35. UN Secretary-General, ‘Eighteenth report on the threat posed by ISIL (Da’esh) to international peace and security and the range of United Nations efforts in support of Member States in countering the threat’ (S/2024/117). ↩

36. Considered in Chapters 4 and 5. ↩

37. Sections 84-91. ↩

38. Considered in Chapter 3. ↩

39. Control of Explosives Precursors and Poisons Regulations 2023, SI 63. ↩

40. Published February 2023. ↩

41. Counter-Terrorism and Security Act 2015 (Risk of Being Drawn into Terrorism) (Revised Guidance) Regulations 2023, SI 2023/1268. ↩

42. I published a Note on the draft Bill (on my website) and gave evidence to the Home Affairs Committee (20.6.23). ↩

43. In July 2024, Anjem Choudary was convicted of directing Al Muhajiroun and sentenced to life imprisonment. ↩

44. Sandboe, S., and Obaidi, M., ‘Imagined Extremist Communities: The Paradox of the Community-Driven Lone-Actor Terrorist’ (2023) 17.4 Perspectives on Terrorism 19. ↩

45. Institute for Economics & Peace, ‘Global Terrorism Index 2024’. ↩

46. Section 3(4), (5). Formally speaking, the power belongs to the Secretary of State without identification of portfolio. ↩

47. HM Government, CT Disruptive Powers Report 2023. ↩

48. See Anderson, D., Terrorism Acts in 2014, at 9.1 et seq. ↩

49. Section 121 Terrorism Act 2000. ↩

50. Arumugam & others v Secretary of State for the Home Department, Appeal No: PC/06/2022 (21.6.24) at paragraph12. ↩

51. Paragraph112. ↩

52. paragraph111. ↩

53. A further question, which may be resolved by the Supreme Court in the case of U3 v Secretary of State for the Home Department, is the extent to which the Commission does or does not defer to the Secretary of State on factual issues relating to the national security assessment, particularly where human rights are involved (seeparagraph22). ↩

54. paragraph118-9. ↩

55. I considered how “organisation” applied to online groups in an earlier report (Terrorism Acts in 2021 at 3.25-3.43.) and in next year’s report will consider the proscription (in 2024) of the online group Terrorgram Collective. ↩

56. Yüksel Yalçınkaya v. Türkiye, App. no. 15669/20 (26.9.2), European Court of Human Rights. ↩

57. Arumugam & others, at paragraph 24. ↩

58. Ibid. ↩

59. See, Terrorism Acts in 2018 at Chapter 3. ↩

60. Terrorism Act 2000 (Proscribed Organisations (Amendment) Order 2023. ↩

61. Explanatory Memorandum, paras 7.4 to 7.6. ↩

62. The armed wing was proscribed in 2001 under the name Hamas-Izz al-Din al-Qassem. ↩

63. Explanatory Note to the Terrorism Act 2000 (Proscribed Organisations) (Amendment) (No.3) Order 2021. ↩

64. An online example was R v Ozain Yusef, Westminster Magistrates’ Court (9.3.24). ↩

65. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to March 2024, Quarterly table A-5a. ↩

66. Terrorism and Protests (23.11.23), available online. ↩

67. A recent discussion of the unintended consequences of counter-terrorism and anti-money laundering standards is Reimer, S., ‘Suppression Laundering: Using FATF as a Fig Leaf to Target Civil Society’ (RUSI, 13.6.24). ↩

68. OFSI, ‘General Licence: Israel and the Occupied Palestinian Territories Humanitarian Activity’, INT/2023/3749168 (14.11.23, subsequently updated) issued under regulation 31 of the Counter-Terrorism (International Sanctions) (EU Exit) Regulations 2019. ↩

69. HM Government, ‘Deter, Disrupt and Demonstrate – UK Sanctions Strategy’ (2024). Currently there are only exceptions for UN-mandated regimes following UNSCR 2664. ↩

70. R v Lane and Letts [2018] UKSC 36, at paragraph 24. ↩

71. Sections 1(5) and 14(1)(a). ↩

72. And my two published reviews for the Treasury of counter-terrorism sanctions under the Counter- Terrorism (Sanctions) (EU Exit) Regulations 2019 (‘CT3’) and for the Foreign Commonwealth and Development Office of the Counter-Terrorism (International Sanctions) (EU Exit) Regulations 2019 (‘CT2’). ↩

73. UNSCR 2664. ↩

74. HM Government, ‘Deter, Disrupt and Demonstrate – UK Sanctions Strategy’ (2024). ↩

75. General Licence: Israel And the Occupied Palestinian Territories Humanitarian Activity, supra. ↩

76. CP 903, figures accurate to July 2023. ↩

77. Section 8(1)(c) PACE; Schedule 1 PACE. ↩

78. Defined by section 32(e). ↩

79. Schedule 5 (search warrants, production orders). ↩

80. Schedule 6 (customer information orders), Schedule 6A (account monitoring orders). ↩

81. Defined by section 40, Terrorism Act 2000. ↩

82. ‘Shielding the Compass: How to Fight Terrorism without Defeating the Law”. ↩

83. Using new powers under the Terrorism Act 2000, together with powers under the Counter Terrorism Act 2008. ↩

84. Compliance warrants, see Chapter 8. ↩

85. Terrorism Acts in 2021 at 4.22 to 4.39. ↩

86. Terrorism Acts in 2020 at 6.50 to 6.68, in relation to Schedule 7 data. ↩

87. For example, a breach of the notification requirements of Part 4 Counter-Terrorism Act 2008 is an offence but the criteria for a terrorism investigation will not necessarily be met. Accordingly, production ↩

88. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table S-01. ↩

89. All arrests are counted and not necessarily terrorism-related arrests. ↩

90. Ibid, Annual table S-02. ↩

91. Ibid, Annual table S-06. The power is available under section 33 Terrorism Act 2000. ↩

92. Powers to restrict access to cordoned areas are in section 36. ↩

93. National Security Act 2023, s100(1), Schedule 17, paragraph 2(2). ↩

94. R (Malik) v Manchester Crown Court [2008] 4 All ER 403, 418, cited in Ananian-Welsh, R., Bosland, J., ‘Protecting the press from search and seizure: comparative lessons for the Australian reform agenda’ (2023) 46 Melbourne Law Review 602. ↩

95. R (on the application of LXP) v Central Criminal Court [2023] EWHC 2824 (Admin). ↩

96. Schedule 5, paragraph 15, Terrorism Act 2000 ↩

97. Paragraph 15(1A). ↩

98. Paragraph15(3). ↩

99. By the National Security Act 2023, Schedule 17. ↩

100. Terrorism Acts in 2021 at 4.99. ↩

101. Schedule 2, paragraph 13. ↩

102. See HM Government, Additional guidance to the communications data codes of practice: definition of communications data (12.6.18). ↩

103. The figures in this section are provided to me by the National Counter Terrorism Policing Headquarters. ↩

104. Under paragraph 1 of Schedule 6, paragraph 5 of Schedule 5, and paragraph 2(1) of Schedule 6A to the Terrorism Act 2000, respectively. ↩

105. These figures do not reflect all the terrorism-related SARS provided by the regulated sector. Next year I will consider the figures held by the NCA’s UK Financial Intelligence Unit. ↩

106. Report of Metrics of Privacy Conference (14.11.18). ↩

107. Section 205(1) Data Protection Act 2018. ↩

108. Article 9 UK GDPR. Biometric data also falls within this category. ↩

109. Information Commissioner, Guidance: Biometric Recognition, “The term “specific technical processing” describes a processing operation – or set of operations – that can be applied to a person’s ↩

110. Schedule 8. For further detail see Terrorism Acts in 2018 at 6.111. ↩

111. At the time of writing there is no Biometrics Commissioner in place. Tony Eastaugh CBE resigned in August 2024. The Data Protection and Digital Information Bill had been due to abolish the Biometrics and Surveillance Commissioner and transfer National Security Determination functions to the Investigatory Powers Commissioner. ↩

112. Ibid at 6.121. ↩

113. Wiles, P., Annual Report (March 2019), at paragraphs 15 to 18. These sentiments were echoed in the 2022-23 Annual report of the outgoing Biometrics and Surveillance Camera Commissioner, Professor Fraser Sampson, at paragraph 85. ↩

114. Schedule 8, paragraph 10. ↩

115. Stockwell, S., Hughes, M., Ashurst, C., Ní Loideáin, N. (March 2024). ↩

116. And elsewhere. For example, ‘God, Guns and Sedition’ (Columbia University Press, 2024), Hoffman, B., and Ware, J., which reports an incidence of autism in 3 out of every 4 far right extremists dealt with by counter-terrorism practitioners. Salman, N. and Al-Attar, Z, ‘A Systematic Review of Neurodivergence, ↩

117. Waddell, H., ‘Weaponised autism and the extremist threat facing children’ (18.10.24). ↩

118. ‘Multi-agency counter-terrorism in Britain and Norway: Intelligence agencies and the administration of welfare’, Security Dialogue (2024); ‘Unhealthy Liaisons: NHS Collaboration with the Counter Terrorism Clinical Consultancy Service’ (Medact, 2024). See more generally, Knudsen, R., ‘Mental Health ↩

119. Van Voren R., ‘Political abuse of psychiatry–an historical overview’ Schizophrenia Bulletin 2010 Jan;36(1):33-5. ↩

120. NHS England, ‘Guidance for mental health services in exercising duties to safeguard people from the risk of radicalisation’ (2017). Disclosure of health data must be done in accordance with the Caldicott principles. ↩

121. Search warrants are another form of executive action. ↩

122. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Quarterly table A-01. ↩

123. Ibid, Annual table A-01. In Scotland the arrest power is in the Criminal Justice (Scotland) Act 2016. ↩

124. Ibid, Annual table A-13a. Since multiple warrants can be obtained on one suspect, it does not follow that a warrant was granted in each of the 18 terrorism-related arrests. ↩

125. Ibid, Annual table A-02. ↩

126. Ibid, Annual table A-13b. The power arises where a superintendent has reasonable grounds for ↩

127. National Security Act 2023, schedule 17, amending section 41. ↩

128. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table A-09. ↩

129. Ibid, Annual table A-11b. ↩

130. Ibid. ↩

131. Ibid. ↩

132. Ibid, Annual table A-12a. ↩

133. Ibid, Annual table A-10 ↩

134. ‘Childhood Innocence? Mapping Trends in Teenage Terrorism Offenders’ (ICSR, 2023). ↩

135. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table A-03. ↩

136. The rate of arrest to charge for children is 8:3 (2018), 2:1 (2019), 19:9 (2020), 5:2 (2021), 8:3 (2022), ↩

137. Section 58 Terrorism Act 2000, section 2 Terrorism Act 2006, respectively. ↩

138. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table A-05a. ↩

139. Ibid, Annual table A-05b. ↩

140. Ibid, Annual table A-03. Some of those released under investigation will be charged in the following year. ↩

141. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2022, Annual table A-03 ↩

142. Terrorism Acts in 2018 at 5.17. ↩

143. My independent review of Multi-Agency Public Protection Arrangements (MAPPA) was published by the Ministry of Justice in 2020. ↩

144. Schedule 8 contains provision on detention for examination and the taking of biometrics. ↩

145. Such as rules-based targeting looking at travel routes used by terrorists. ↩

146. Section 78. ↩

147. Equivalent powers were granted for countering hostile state activity under the Counter-Terrorism and Border Security Act 2023, Schedule 3. ↩

148. Beghal v Director of Public Prosecutions [2015] UKSC 49 and subsequently, with some qualification, before the European Court of Human Rights in Beghal v United Kingdom, App.No.4755/16 (28.2.19). I have considered these justifications in my earlier reports, in particular in Terrorism Acts in 2018. ↩

149. Published as an appendix to my Terrorism Acts in 2022. ↩

150. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table S-04. ↩

151. Ibid, Annual table S-03a: the longer term figures are only available for Great Britain. ↩

152. Under the Anti-social Behaviour, Crime and Policing Act 2014. ↩

153. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table S-03a. ↩

154. Ibid, Annual table S-05. ↩

155. Beghal v DPP, supra, at paragraph 78, per Lords Neuberger and Dyson: “…The fact that officers have the right to stop and question unpredictably is very likely to assist in both detecting and preventing terrorism, and in deterring some who might otherwise seek to travel to or from this country for reasons ↩

156. Article 4, Option Protocol to the Convention against Torture and other Cruel, Inhuman and Degrading Treatment or Punishment. ↩

157. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual tables S-03a and S-03b. ↩

158. Terrorism Acts in 2022 at 6.14. ↩

159. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table S-03a. ↩

160. Code of Practice (July 2022), paragraph 143. ↩

161. For example, property interference under the Police Act 1997. ↩

162. It appears implicit in the paragraph 9(4) that some interaction must be permitted after entry, for example looking at the address labels, in order to decide whether to use the full examination power. ↩

163. Or other digital device. For convenience I refer to phones, but important data could also be held on tablet devices, laptops or USBs. ↩

164. R v Cannon, 23.11.23, Winchester Crown Court. ↩

165. R v Howlett, CPS News, ‘Ex-soldier jailed for planning arson attack on bookshop’ (20.12.23). ↩

166. CPS, ‘Islamist extremists including youth who failed to report chemical plot jailed, News (2.2.24). ↩

167. CT Policing News, ‘Mother and daughter who sent money to Daesh member jailed’ (20.3.24). ↩

168. Schedule 7, paragraph 11(2)(a). ↩

169. Under paragraph 18(1) of Schedule 7 it is an offence wilfully to fail to comply with a duty imposed under Schedule 7. A person being examined has a duty to provide any information required of him: paragraph 5. ↩

170. Terrorism Acts in 2020 at 6.50-6.58. ↩

171. Police policy document provided to me by CTPHQ. ↩

172. Terrorism Acts in 2021 at 4.22-4.39. ↩

173. I write separately about Northern Ireland (Chapter 9) and Scotland (Chapter 10). ↩

174. See further, Haddon-Cave, C., ‘The Conduct of Terrorism Trials in England and Wales’ (2021) 95 ALJ ↩

175. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table C-01. In cases with multiple charges, it is possible that convictions were not secured on all charges. ↩

176. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table C-04: 34, against 27 in respect of sentences passed in 2023. ↩

177. Ibid, Annual table C-02. ↩

178. BBC News, High Wycombe man jailed for travelling to Syria to join IS’ (26.5.23). ↩

179. CPS News, ‘Man jailed for eight years for funding terrorism’ (13.11.23). His attempt to block these UK criminal proceedings were unsuccessful: [2023] EWCA Crim 1018. ↩

180. Details of the other 11 convictions are in Terrorism Acts in 2022 at 7.11. ↩

181. Counter Terrorism Policing News, ‘Mother and daughter who sent money to Daesh member jailed’ (20.3.24). ↩

182. BBC News, ‘Mohamed Al Bared: Student jailed for life for building IS drone’ (22.12.23). ↩

183. BBC News, ‘Right-wing Washington terror plotter Luke Skelton jailed’ (11.7.23). ↩

184. BBC News, ‘Joe Metcalfe jailed for plotting mosque terror attack dressed as PC’ (10.11.23). ↩

185. BBC News, ‘Speakers’ Corner: Edward Little jailed over Hyde Park gun attack plot’ (15.12.23). His 16- year minimum term was subsequently increased to 24 years under the ‘slip rule’ that allows judges to ↩

186. BBC News, ‘Ex-soldier William Howitt jailed over far-right bookshop terror plot’ (20.12.23). ↩

187. BBC News, ‘Ex-West Yorkshire Police worker shared racist and pro-UDA tweets’ (19.4.23). ↩

188. BBC News, ‘Neo-Nazi prison officer jailed for having white supremacist ‘murder manual’ (31.8.23). ↩

189. BBC News, ‘Official TS: Drill rapper admits terrorism chemical offence’ (10.11.23); CPS News, ‘Islamist extremists including youth who failed to report chemical bomb plot jailed’ (2.2.24). ↩

190. BBC News, ‘Leamington Spa homemade sub-machine gun builder jailed’ (23.6.23). ↩

191. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table C-02. ↩

192. BBC News, ‘Wiltshire A-level student guilty of terrorism offences’ (14.9.23). ↩

193. BBC News, ‘Ex-RAF cadet behind Nazi graffiti named as Aristedes Haynes’ (21.9.23). ↩

194. BBC News, ‘Oxford woman jailed for distributing terrorist publications’ (22.9.23). ↩

195. Daily Mirror, ‘Neo-Nazis who demanded Archie be ‘put down’ in vile podcast guilty of terrorism offences’ (7.7.23). ↩

196. OFCOM, ‘BitChute: compliance assurances to protect users from videos containing harmful material’ (3.10.23). ↩

197. Sky News, ‘Vaughn Dolphin: Far-right extremist and self-confessed ‘dangerous lunatic’ sentenced over homemade explosives’ (11.5.23). ↩

198. BBC News, ‘Alfie Stevens sentenced for sharing far-right terrorist documents’ (23.11.23). ↩

199. BBC News, ‘Preston man who had potential bomb-making material jailed’ (4.8.23). ↩

200. BBC News, ‘Neo-Nazi Luca Benincasa locked up for terror and child sex crimes’ (25.1.23). ↩

201. BBC News ‘Bath man jailed for sharing explosives recipe in far-right chat’ (17.1.23). ↩

202. BBC News, ‘5G: York Anti-vaccine protester jailed over phone mast plot’ (5.6.23). ↩

203. BBC News, ‘Oliver Lewin: Engineer jailed over TV and radio mast terror plot’ (20.1.23). ↩

204. Independent, ‘Terror scout guilty of spying on UK-based dissident Iranian broadcaster’ (20.12.23). ↩

205. For example, as foreign interference (section 13) or acts preparatory (section 18). ↩

206. Sentencing Remarks of Mr Justice Hilliard, Central Criminal Court (5.10.23). ↩

207. See my paper, Terrorism and Protests, supra. ↩

208. CPS News, ‘Far-right ‘reverend’ who exchanged letters with terrorists convicted of stirring up racial hatred’ (16.11.23). ↩

209. Section 117(2A). A distinction is to be drawn between the conduct and the provenance of the evidence; ↩

210. Walker, C., ‘Blackstone’s guide to the anti-terror legislation’ (3rd ed.). ↩

211. Cf. Carlile, A., ‘The Definition of Terrorism’ (Cm 7052, London, 2007) at paragraph 81. ↩

212. The Law Commission recommended retaining a consent provision on matters involving terrorism or international relations: ‘Consents to Prosecution’ (LC255, 20.10.98) at paragraph 6.46. ↩

213. Rose, H., and Vale, G., ‘Childhood Innocence? Mapping Trends in Teenage Terrorism Offenders’ (ICSR, 2023). ↩

214. Threat Update (8.10.24). ↩

215. Ibid. ↩

216. BBC News, ‘Neo-Nazi group led by 13-year-old boy to be banned’ (13.7.00). ↩

217. Hall, J., ‘Keyboard Warriors or International Terrorists’ (Chatham House, 14.7.22). ↩

218. R v Choudary and Rahman [2018] 1 Cr.App.R. 21. ↩

219. R v Riaz and Ahmed [2023] EWCA Crim 1686 at paras 26, 34. ↩

220. Knudsen, R., ‘Mental Health Exemptions to Criminal Responsibility: Between law, medicine, politics and security’, Exchanges (2024) 11(2), pp.29-54. ↩

221. Dinesson, K., ‘Mind the gap: an empirical study of terrorism fences, law-making, and discretion’ (DPhil thesis, University of Edinburgh, 2024). ↩

222. Ibid. ↩

223. Perpetrators of mass casualty attacks. For a real-world explanation of ‘sainthood’ in the context of extreme right wing terrorism, see the US Department of Justice indictment against the leaders of ‘Terrorgram Collective’: Case 2:24-cr-00257-DJC (5.9.24), available online. ↩

224. See for example, Mathieu, C., ‘“And the Devil Marches with Us”: Aesthetics and Accelerationism in ↩

225. BBC News, ‘Daniel Harris: UK teen sentenced over videos linked to US shootings’ (27.1.23). ↩

226. Hence the rise in non-custodial sentences for terrorism offences in recent years. ↩

227. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to June 2024, Annual table A-10. ↩

228. For example, by deploying the so-called “caution plus 3 interview” following arrest. ↩

229. See Al-Attar, Z., ‘Autism spectrum disorders and terrorism: how different features of autism can ↩

230. Holmwood, J., Aitlhadj, L., ‘The people’s review of Prevent’, (Prevent Watch, 2022). ↩

231. Shawcross, W., ‘Independent Review of Prevent’ (HC1072, 2023). ↩

232. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table C-04. Non-custodial sentences are less frequent with respect to non-terrorism offences that are considered terrorism. ↩

233. See the survey in Kelly, R., Reforming the sentencing and release of terrorist offenders [2023] Criminal Law Review 639. Increases in maximum penalties lead to increased starting points: see for example, R. v Abubaker Deghayes [2023] EWCA Crim 97 (although the sentence was reduced on the facts). In a rare ↩

234. BBC News, ‘M&S knife attacker to be locked up indefinitely’ (2.9.24). ↩

235. A gangland murderer serving life at HMP Woodhill, he was convicted of smuggling phones into prison which he used to access and disseminate Islamist extremist material. His sister was convicted of helping him: BBC News, ‘Denny De Silva’s sister jailed for smuggling phones to prison’ (24.11.23). ↩

236. Section 69(3). ↩

237. Section 247A Criminal Justice Act 2003. ↩

238. Section 45 Counter Terrorism Act 2008. ↩

239. In re Lancaster [2023] NICA 63 was an unsuccessful human rights challenge to notification requirements in Northern Ireland. ↩

240. Section 56A. ↩

241. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table C-03. ↩

242. Section 28(4A)(c). ↩

243. Section 43B Terrorism Act 2000, inserted by the Police, Crime, Sentencing and Courts Act 2022. ↩

244. I pointed out the adverse implications of this in a Note, ‘Note on Terrorism Clauses in the National Security Bill’ (23.5.22). ↩

245. Sentencing remarks of Mrs Justice Cheema-Grubb Central Criminal Court (30.10.23). ↩

246. Report, Operation Itonia (2.10.23). ↩

247. Schedule 4 to the 2008 Act. ↩

248. Chief Constable of West Midlands Police v Muhudiin Mohamed Geele [2023] EWHC 2819. ↩

249. See R v Omar Khyam and others [2008] EWCA Crim 1612. ↩

250. Terrorism Acts in 2022 at 7.75. ↩

251. Section 58 Terrorism Act 2000; section 2 Terrorism Act 2006. ↩

252. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table P-01. ↩

253. Ibid. This could include individuals associated with Northern Ireland terrorist groups, and left-wing extremists. ↩

254. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to December 2023, Annual table P-02. ↩

255. Ibid, Annual table P-03. ↩

256. See above. ↩

257. Hall, J., ‘Terrorism in prisons’ (2022). Dean, C., Detecting terrorism risk behaviours in prisons: a ↩

258. Home Office, Operation of Police Powers under the Terrorism Act 2000 and Subsequent Legislation, quarterly update to March 2024, Annual table P-05. ↩

259. Section 247A Criminal Justice Act 2003. ↩

260. Rule 17, Parole Board Rules 2019. ↩

261. Parole Board summary (30.9.24). ↩

262. See 7.40, supra. ↩

263. Rule 28, Parole Board Rules 2019. ↩

264. [2021] PBRA 72. ↩

265. [2022] PBRA 124 (13.9.22). ↩

266. [2023] PBRA 67 (17.4.23). ↩

267. [2023] PBRA 142 (16.8.23). ↩

268. R v Ben John [2022] EWCA Crim 54. ↩

269. Ministry of Justice, MAPPA Guidance, Chapter 24. For more detail on managing released terrorists see my independent review of MAPPA published by the Ministry of Justice in 2020. ↩

270. Ministry of Justice, ‘Polygraph Examinations – Instructions for Imposing Licence Conditions for ↩

271. ‘The use of an operation of counter-terrorism polygraph examinations, Process evaluation findings’ (October 2023). ↩

272. HM Government, Disruptive Powers Transparency Report for 2023. ↩

273. HMG, ‘Guidance: Generative AI Framework for HMG’ (18.1.24). ↩

274. Suleyman, M., ‘The Coming Wave’ (Penguin, 2023). ↩

275. Gegerenzer, G., ‘How to Stay Smart in a Smart World’ (Penguin, 2022). ↩

276. The impact of the internet on terrorist offending is the subject of one of my earlier annual reports, the Terrorism Acts in 2021. ↩

277. An exception is Meta’s open-source Llama model. ↩

278. In 2024 it was reported that Telegram, a platform reaching over 800 million unique users, has 100 employees of whom only 30 are engineers. ↩

279. Such as Professor Sir David Spiegelhalter in the world of statistics. Ethan Mollick (@emollick) is an excellent resource on Twitter/X. ↩

280. Schedule 3, paragraph 1. ↩

281. Article 2. ↩

282. ‘The governance of artificial intelligence: interim report’ (Ninth Report of Session 2022-23). ↩

283. I asked the widely available ChatGPT: “Would large language models reproduce biases such as ↩

284. In the famous science fiction film Terminator (Orion Pictures, 1985), Skynet is the name for the self- aware technology that takes over the world through force. ↩

285. Department for Science, Innovation and Technology, AI Safety Institute (17.5.24) at paragraph 4.4.1. ↩

286. UN General Assembly, Resolution, A/78/L.49, ‘Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development’ (11.3.24). ↩

287. “LLMs turn Data into Intelligence, like Steam Engines turn Fuel into Power” (2023) Large Language Models & Influence, DSTL Technical Report: TR149009 (access via the Athena depository). ↩

288. E.g. ‘Algorithms and Terrorism: The Malicious Use of Artificial Intelligence for Terrorist Purposes’, UN Counter-Terrorism Centre (2021). ↩

289. Paragraph 48. ↩

290. Weimann, G., and others, ‘Generating Terror: The Risks of Generative AI Exploitation’, CTC Sentinel Vol 17 Issue 1 (Jan 2024). ↩

291. Organised by the Home Office, RUSI, Tech against Terrorism, and the Centre for Emerging Technology and Security (CETaS) at the Alan Turing Institute. ↩

292. Blanchard, A., Hall, J., “Terrorism and Autonomous Weapon Systems: Future Threat or Science ↩

293. According to Janjeva, A., Gausen, A., Mercer, S., and Sippy, T., ‘Evaluating Malicious Generative AI Capabilities’ (Centre for Emerging Technology and Security, July 2024), there is no evidence that terrorist groups are adopting Gen AI to autonomously complete tasks. ↩

294. Altay, S., Hacquin, A., Chevallier, C., Mercier, H., ‘Information delivered by a chatbot has a positive impact on COVID-19 vaccines attitudes and intentions’. J Exp Psychol Appl. 2023 Mar;29(1):52-62; ↩

295. Terrorism Acts in 2019 at 7.61 et seq. ↩

296. Given the graphic nature of terrorist propaganda, section 63 Criminal Justice and Immigration Act 2008 (possession of extreme pornographic image) may be relevant. Other obscene publication offences are listed by the Crown Prosecution Service at https://www.cps.gov.uk/legal-guidance/obscene-publications (last ↩

297. I gave an account in an article for the Daily Telegraph (1.1.24), ‘New terror laws needed to tackle rise of the radicalising AI chatbots’. ↩

298. This appears to be the case with the ‘Based AI’ released by the platform Gab. ↩

299. International Scientific Report on the Safety of Advanced, AI Interim Report, AI Seoul Summit (May 2024). ↩

300. ‘Jaswant Singh Chail: ‘Man who took crossbow to ‘kill Queen’ jailed’ (BBC News, 5.10.23). ↩

301. Schumann, S., Clemmow, C., Rottweiler, B., Gill, P., ‘Distinct patterns of incidental exposure to and ↩

302. Demonstrated by searching the AppStore in 2024 for “AI Friend” or “Replika”, and viewing the search results. ↩

303. A Belgian man was reportedly induced by a chatbot to kill himself: ‘‘He Would Still Be Here’: Man Dies by Suicide After Talking with AI Chatbot, Widow Says’ (vice.com, 30.3.23). ↩

304. Although Mouton, C., Lucas, C., Guest, E., ‘The Operational Risks of AI in Large-Scale Biological Attacks: A Red-Team Approach’ (Santa Monica, CA: RAND Corporation, 2023) found that there was no statistically significant difference in the feasibility of plans generated with or without LLMs. ↩

305. Section 1(2)(e) Terrorism Act 2000. The only example of this limb being prosecuted, that I am aware of, is the case of a plot to flatten 5G masts: R v Reynolds and Grayson (Leeds Crown Court, 2023). ↩

306. Janjeva, A., et al, supra. ↩

307. Simpler forms of moderation-evasion exist such as “Leetspeak” which replaces letters with similar looking numbers. ↩

308. For a detailed account see Hoffman, B., Ware, J., ‘God, Guns and Sedition’ (Columbia University Press, 2024). ↩

309. 18 U.S.C. § 2384. ↩

310. Section 1(2)(d) Terrorism Act 2000 ↩

311. Section 13. See further, Hall, J., ‘The Foreign Hand and Foreign Interference’ (RUSI speech, 23.7.24). ↩

312. Anderson, D., ‘Shielding the Compass: How to Fight Terrorism Without Defeating The Law’. ↩

313. See Competition and Markets Authority, AI Foundation Models Initial Report (18.9.23); Brown, I., ‘Allocating accountability in AI supply chains: a UK-centred regulatory perspective’ (Ada Lovelace Institute, June 2023). ↩

314. Woodside, T., ‘Emergency Abilities in Large Language Models: An Explainer’ (CSET, 16.4.24): ↩

315. Competition and Markets Authority, supra. ↩

316. Thiel, D., ‘Identifying and Eliminating CSAM in Generative ML Training Data and Models’ (Stamford Internet Observatory, 21.12.23). Newly generated images could then pollute the training data for future models. Note however, that LLMs are more than capable of combining legal imagery (adult pornography and innocent images of children) to create illegal material. ↩

317. Gault, M., ‘AI Trained on 4Chan Becomes ‘Hate Speech Machine’’ (Vice, 7.6.22); Siegel, D., ‘RedPilled AI: A New Weapon for Online Radicalisation on 4chan’ (GNET, 7.6.23). ↩

318. Internet Watch Foundation, ‘How AI is being abused to generate child sex abuse imagery’ (October 2023). ↩

319. Such as character.ai. ↩

320. This may be a particular problem with open-source models such as Meta’s (Gade, P. and others, ↩

321. In 2016 users found it amusing to bombard Microsoft’s Tay chatbot with antisocial ideas and vulgar language, leading it to spout racist and antisemitic content. ↩

322. E.g. by providing third party certification that a chatbot is “family friendly”. ↩

323. Under the Online Safety Act 2023. ↩

324. In their report, Autonomous Vehicles (HC 1068, 2022), the Law Commission concluded that where vehicles were able to drive themselves able to drive itself, “This has profound legal consequences. The human driver can no longer be the principal focus of accountability for road safety” (para 2.1); and that ↩

325. “Ensuring Safe, Secure, and Trustworthy AI”, voluntary commitments announced by the US government (White House, 21.7.23). ↩

326. Assuming this is feasible. Other technical solutions that have been proposed against AI-enable mischief include encrypted handshakes between authenticated devices to avoid voice spoofing of friends and ↩

327. The US and the EU have been the first to regulate on AI. US Executive Order (Nov 2023), EU AI Act (May 2024). ↩

328. E.g. Janjeva, A., Mulani, N., Powell, R., Whittlestone, J., Avin, S., ‘Strengthening Resilience to AI Risk: A guide for UK policymakers’, Alan Turing Institute (August 2023). ↩

329. Terrorist offences are priority offences; this means heighted duties to remove terrorism content. ↩

330. Section 92(7) has special provision for bot-produced content based on the inferred mental element of the person “assumed to control the bot” or other automated tool. ↩

331. Discussed in each of my annual reports. ↩

332. Many terrorism offences carry extra-territorial jurisdiction: see in particular section 17 Terrorism Act 2006. ↩

333. Terrorism Acts in 2021 at 11.26. ↩

334. For example, the detailed and caveated offence of encouraging terrorism under section 1 Terrorism Act 2006. ↩

335. According to the head of counter-terrorism Commander Dean Haydon: BBC News, ‘Finsbury Park: What Led Darren Osborne to Kill’ (1.2.18). ↩

336. In Phillips v Secretary of State for Foreign, Commonwealth and Development Affairs [2024] EWHC 32 (Admin), Johnson J. observed at paragraph 46 that it would be wrong to afford equal protection to all ↩

337. See further my speech, ‘Generative AI, Drones and Terrorism’ (London, 22.10.24). ↩

338. Section 59. ↩

339. ‘Making Laws That Work: How Laws Fail and How We Can Do Better’ (Hart, 2022). ↩

340. Section 38B Terrorism Act 2000, failing to notify a constable of an imminent terrorist attack, is an exception. ↩

341. HM Government, ‘A pro-innovation approach to AI regulation’ (August 2023), at paragraph 45: “…we will regulate based on the outcomes AI is likely to generate in particular applications. For example, it ↩

342. Smith and Hogan 14th Ed. (eds. Ormerod and Laird) at paragraph 13.1. Where an offence is committed, those who aid, abet, counsel or procure shall be tried as principals: Accessories and Abettors Act 1861. ↩

343. Sections 44-46. ↩

344. Section 66 provides for indirect liability only where D1 “arranges for” D2 to do an act capable or encouraging or assisting an offence. ↩

345. Section 49(1). ↩

346. Section 42. ↩

347. Section 65(2). ↩

348. Section 50. ↩

349. Section 44. ↩

350. Schedule 1 paragraph 2A. ↩

351. Paragraph 14. ↩

352. Sections 45-46. There is little authority on the 2007 Act. The leading authority (concerned with section 46) is R v Sadique [2013] EWCA Crim 1150. ↩

353. Section 49(4), Schedule 3. ↩

354. It is difficult to understand why section 12 Terrorism Act 2006 is not excluded also, especially after the recklessness offence in section 12(1A) was introduced by the Counter-Terrorism and Border Security Act 2019. ↩

355. A recent example is R v Gavin Plumb. He was convicted (12.7.24, Chelmsford) of recruiting others to kidnap, rape and murder a celebrity. ↩

356. Section 3A(4). ↩

357. Police and Justice Act 2006, Explanatory Notesparagraph303. Lewys Martin was convicted of this offence for possession of software (“Jaindos”) that could be used for cyberattacks (R v Martin [2013] ↩

358. Section 7 Fraud Act 2006. ↩

359. A device for putting a substance in a capsule. ↩

360. Sections 1-2, 3. ↩

361. Sections 5-8. ↩

362. Seeparagraph35 above. ↩

363. Metropolitan International Schools Ltd v Designtechnica Corp, Google UK Ltd Google Inc [2009] ↩

364. Section 2(2)(d). ↩

365. Section 5(1). ↩

366. “Act of terrorism” is not defined in the 2000 Act but appears in the definition of a “terrorist” (section 40) and in the section 58 offence. In R v G, supra, the paradigm example given by the House of Lords for an “act of terrorism” was building a bomb. “Encouragement” was not even a terrorism offence until the passing of the 2006 Act (section 1) and cannot have been considered an act of terrorism in itself. Since the encouragement offence relates to encouraging “acts of terrorism”, it would be circular if “acts of ↩

367. Section 20(2) provides that “act of terrorism” includes anything constituting an action taken for the purposes of terrorism, within the meaning of the Terrorism Act 2000, with reference to section 1(5) of that Act (action taken for the purposes of terrorism includes any action taken for benefit of a proscribed ↩

368. And therefore, liability as an accessory under the Accessories and Abettors Act 1861. ↩

369. Section 66 Serious Crime Act 2007. ↩

370. Section 49(4), Schedule 3. ↩

371. R v Miller [1982] UKHL 6. ↩

372. Nor is there precedent for a common law duty arising because content may persuade others to act undesirably. Newspapers and websites are not under a general duty to self-censor because of how the public may react in response to the news. ↩

373. I consider instructional material under Attack Facilitation, below. ↩

374. Terrorism Acts in 2019 at paras 7.61 et seq. ↩

375. See paragraph 35, supra. ↩

376. There was a rethink on sexually explicit deepfakes. The Law Commission ‘Intimate image abuse: a final report’ (HC 326, Law Comm no 407, 6.7.22) at paragraph 4.215 found there was insufficient harm if ↩

377. And therefore, liable for the substantive offence (e.g. section 1 Terrorism Act 2006) or conspiracy to commit the offence. ↩

378. But not autonomously created content, considered below under “Chatbot Radicalisation”. ↩

379. Terrorism Acts in 2021 at 7.29 et seq. ↩

380. Of course, if propaganda autonomously created by a chatbot is adopted by a user as their own content, and then disseminated– this would fall within Propaganda Productivity or Propaganda Innovation, supra. ↩

381. Section 1(2)(b) requires a defendant to intend the statement to encourage or be reckless about its encouraging effect; ibid section 2(1)(a), (c). ↩

382. Section 13(1A) Terrorism Act 2000. ↩

383. Only where D1 arranges for D2 to do something that is capable of encouraging or assisting the act: section 66. ↩

384. See paragraph 38 above. ↩

385. Such as tougher release provisions; additional licence conditions; obligations under the Counter- Terrorism Act 2008. ↩

386. Smith and Hogan’s Criminal Law, supra, at paragraph 5.2.1.1. ↩

387. For example, it would be enough for conviction that the defendant decided to sharpen a pencil, buy a computer mouse, or lace up a pair of boots if the intention was to write an encouraging placard, publish ↩

388. In R v G [2009] UKHL 13, the House of Lords confirmed, at paragraph 59, that section 57 extended to documents or records. In Altimini [2008] EWCA Crim 2829, the “articles” were computers containing ↩

389. Ibid, at paragraph 43. ↩

390. It is also an offence to distribute such material with intent or willing recklessness to provide assistance to another under section 2(1)(b) and (3)(b) Terrorism Act 2006. ↩

391. In the same way that information in the forms of an electronic key, which enables a potential terrorist to obtain access to other useful information, is covered by section 58: R v G, supra, at paragraph 44. ↩

392. Online, rather than by holding an entire local copy. ↩

393. Section 58(1)(c) and (1A) inserted by the Counter-Terrorism and Border Security Act 2019. ↩

394. Section 58(1)(c) requires viewing or access by means of the internet of “a document or record ↩

395. Section 6(2) Terrorism Act 2006. Section 54 Terrorism Act 2000 specifically penalises the receipt of weapons training. ↩

396. Blackstone’s Guides to the Anti-Terrorism Legislation, 3rd ed., at paragraphs 6.04-07. ↩

397. Section 6 and the allied section 8 (attendance at a place used for terrorist training) contemplate training given by human beings rather than self-education using a book or computer programme. ↩

398. Section 5(1)(b) applies to assisting others to commit acts of terrorism. ↩

399. It is difficult to foresee circumstances in which section 45 (belief that an offence will be committed) might apply. ↩

400. As shown by the August 2024 riots. ↩

401. Section 13. ↩

402. Hall, J., ‘Foreign Hand and Foreign Interference’, supra. ↩

403. And the offence of stirring up religious hatred, and hatred on grounds of sexual orientation under Part 3B. ↩

404. Professor Ben Saul, Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism. ↩

405. A/HRC/55/48: Vision and priorities (17.1.24). ↩

406. In February 2023 I published a paper on the predicament of deprived individuals in Syria like Shamima Begum, and options for managing their risk if returned: ‘Returning from Islamic State: Risk and Response’ (King’s College London, 27.2.23). ↩

407. HM Treasury, ‘Report of the Independent Reviewer of Terrorism Legislation on the Operation of the Counter-Terrorism (International Sanctions) (EU Exit) Regulations 2019. ↩

408. Following the Counter-Terrorism and Sentencing Act 2021. ↩

409. HM Government, CT Disruptive Powers Report 2023. ↩

410. Written statement HCWS673 (27.3.23). ↩

411. BBC News, ‘First alleged neo-Nazi under special terror powers, BBC learns’ (7.7.23); BBC News, ‘Far-right extremist jailed for terror order breach’ (9.7.24). ↩

412. TL v Home Secretary [2022] EWHC 3322 (Admin). ↩

413. Written statement HCWS878 (26.6.23). ↩

414. Written statement HCWS1058 (16.10.23). ↩

415. BBC News, ‘Far-right extremist jailed for terror order breach’ (9.7.24). ↩

416. Written statement HCWS175 (10.1.24) vol 743 Col 13WS ↩

417. Written statement HCWS375 (25.3.24) ↩

418. McCullough, A., ‘The Special Advocate: Not Waving but Drowning’ (UK Human Rights Blog, 30.10.23). ↩

419. “Prosecution, conviction and prison will always be our priority…”, Rt Hon Teresa May MP, Home Secretary, moving the second reading of the TPIM Bill: Hansard (HC) Vol 529 Col 69 (7.6.11). ↩

420. See 8.8 above. ↩

421. Section 244ZB Criminal Justice Act 2003, inserted by the Police, Crime, Courts and Sentencing Act 2022. ↩

422. If not sentenced to life imprisonment, dangerous terrorists will be sentenced to a custodial term plus an extended licence period. If not dangerous, some terrorist offenders will receive a sentence for offenders of particular concern, resulting in an additional 12 months on licence. ↩

423. Conduct leading to conviction counts as “terrorism-related activity” under the TPIM Act 2011. ↩

424. For example, in the context of an ERG 22+ risk assessment, or similar. ↩

425. Cf. Kenney, M., ‘The Islamic State in Britain’ (Cambridge, 2018). ↩

426. Inserting paragraph 10ZA into Schedule 1 to the TPIM Act 2011. ↩

427. Terrorism Prevention and Investigation Measures (Polygraph) Regulations 2022 (S.I. 2022/462). ↩

428. In light of the examination of the privilege against self-incrimination in Volaw Trust and Corporate Services Ltd v The Office of Comptroller of Taxes [2019] UKPC 29, Privy Council. ↩

429. The House of Lords/House of Commons Joint Committee on Statutory Instruments, Twenty-Second Report of Session 2022–23 (2022-23 HL 127/HC4-xxii), drew attention to the fact that the TPIM ↩

430. I do not recommend at this time either repealing the 2011 Act, or an order under section 21(2)(a) (order repealing the Secretary of State’s TPIM powers). ↩

431. Section 20 TPIM Act 2011. I am obliged to conduct a review annually from 2022 to 2026 by section 41 Counter-Terrorism and Sentencing Act 2021. ↩

432. Unless the TPIM subject waives their right. See further, Terrorism Acts in 2019 at 8.62 to 8.70. ↩

433. Ibid. ↩

434. At 8.30 to 8.35. ↩

435. Counter-Terrorism and Security Act 2015, sections 5-8 (permit to return), section 9 (obligations). ↩

436. Section 2(3). ↩

437. The threshold is that the Secretary of State “reasonably believes”: section 3(1). ↩

438. QX v Secretary of State for the Home Department [2024] UKSC 26. It was common ground that Article 6 of the European Convention on Human Rights applied to challenges to the imposition of obligations. ↩

439. At paragraph 27. ↩

440. HM Government, CT Disruptive Powers Report 2023. ↩

441. HM Government, Prevent Duty Guidance (2023), at paragraph 29. ↩

442. Among other things Durov has been accused of failing to comply with judicial orders. Later in 2024 it was reported that Telegram would provide IP addresses and phone numbers in response to search warrants ↩

443. Statement of Supremo Tribunal Federal (30.8.24). ↩

444. Twitter/X agreed to block this content in Australia, but the eSafety Commissioner’s application for a worldwide injunction was ultimately unsuccessful: eSafety Commissioner v X Corp [2024] FCA 499. ↩

445. EU Commission, Press release, ‘Commission opens formal proceedings against Meta under the Digital Services Act related to the protection of minors on Facebook and Instagram’ (16.5.24). ↩

446. BBC Monitoring, ‘Explainer: Which Hamas-linked Telegram channels are still accessible’ (1.11.23). ↩

447. Financial Times, ‘Telegram hits 900mn users and nears profitability as founder considers IPO’ (11.3.24). ↩

448. Available on the European Commission’s website, ‘How the Digital Services Act enhances transparency online’. ↩

449. Dated 22.1.24 and 12.6.24, both available on the IRTL website. ↩

450. As set out in OFCOM’s draft Illegal Content Judgements Guidance, paragraph A2.55. ↩

451. Macdonald, S., et al, ‘Using Artificial Intelligence and Machine Learning to Identify Terrorist Content Online’ (Tech Against Terrorism, 2024). ↩

452. Volume 2, ‘The causes and impacts of online harm’, at paragraph 6B.53; volume 5, ‘How to judge whether content is illegal or not?’, at paras 26.48-26.51; volume 10, ‘Online Safety Guidance on ↩

453. Now an aspect of EU enforcement proceedings against Meta; see, European Commission, Press release, ‘Commission opens formal proceedings against Facebook and Instagram under the Digital Services Act’ (30.4.24). ↩

454. Section 162, Online Safety Act 2023. ↩

455. It is also interesting to speculate how HM Treasury will monitor compliance by internet service providers with regulation 54A of the Russia (Sanctions) (EU Exit) Regulations 2019, which requires ↩

456. OFCOM, ‘Evaluating online safety measures’ (24.5.24). ↩

457. HM Government, CT Disruptive Powers Report 2023; plus, figures supplied to me by National CT Policing Headquarters. ↩

458. Amending section 8 and inserted section 8A into the Serious Crime 2007 Act. ↩

459. I express my thanks to Karl Laird for his assistance with this Chapter. ↩

460. The Executive returned to Stormont only in February 2024. ↩

461. The Northern Ireland Troubles (Legacy and Reconciliation) Act 2023. ↩

462. Breen Smyth, M., ‘Report of the Independent Reviewer for National Security Arrangements 2023’, Hansard (HC) Vol750 Col33WS (16.5.24). ↩

463. Ibid. ↩

464. It was lowered again to SUBSTANTIAL in March 2024. ↩

465. 5th Report. ↩

466. For example, the offences scheduled under Part VII remains an active reference point in section 33A Justice (Northern Ireland) Act 2002. ↩

467. See Explanatory Memorandum to the Terrorism (Northern Ireland) Act 2006 (Transitional Provisions and Savings) Order 2007. ↩

468. PSNI, ‘Security Situation Statistics, information up to and including March 2024’, unless otherwise stated. ↩

469. 6th report, executive summary. ↩

470. Ibid, para 1.130. ↩

471. Morrison, J., ‘The Violence of Peace: Post Good Friday Agreement Paramilitary Vigilantism in Northern Ireland’, (2024) Terrorism and Political Violence. ↩

472. Breen Smyth, M., ‘Report of the Justice and Security (Northern Ireland) Act 2007’, 16th Report (1.8.22- 31.7.23). ↩

473. Ibid: “some form of sub-group direct engagement”. ↩

474. Breen Smyth, M., JSA Reviewer, 16th Report. ↩

475. Pool Re, ‘New IRA Collaborated with Organised Crime Groups’ (27.6.23). ↩

476. 16th Report, Annex Q. ↩

477. Northern Ireland Office, ‘Northern Ireland Terrorism Legislation: Annual Statistics 2023’ (Sep 2024), Table 2.2. ↩

478. Ibid, Table 9.1. ↩

479. Ibid, Table 3.1. ↩

480. Ibid, Table 2.1. ↩

481. Ibid, Tables 4.1 and 4.2. ↩

482. Ibid, Table 5.3. ↩

483. Ibid, Table 5.4. ↩

484. Northern Ireland Office, ‘Northern Ireland Terrorism Legislation: Annual Statistics 2023’ (Sep 2024), Table 7.1. ↩

485. Ibid, Table 6.1. ↩

486. Cf. Çali, B., et al, ‘Evaluating Digital Open-Source Imagery: A Guide for Judges and Fact-Finders ‘ (Swansea University True Project, 20.5.24). ↩

487. ‘PPS issues decisions on files submitted by Operation Kenova’ (6.12.23). ↩

488. R v Coyle [2024] NICA 22. ↩

489. In the matter of Sharon Jordan [2023] NIKB 95. ↩

490. Re McCabe [2023] NIKB] 98. ↩

491. R v Fitzsimmons and Duffy [2024] NICC 10. ↩

492. Under section 92 Justice Act (Northern Ireland) 2015. I note that section 91 (duty of the court, prosecution and defence to reach a justice outcome as swiftly as possible) has not yet been commenced. ↩

493. Removal of oral evidence, to be followed by abolition in indictable only case, with an eventual goal of full abolition as in England and Wales. ↩

494. [2024] NICA 11. ↩

495. The maximum has remained at 15 years, since its increase by the Counter-Terrorism and Border Security Act 2019. ↩

496. R v Coyle, supra. ↩

497. Table 131 - Northern Ireland Terrorism Legislation Annual Statistics 2023. ↩

498. I wrote about information-sharing in my MAPPA Report for the Ministry of Justice (2020). ↩

499. Source: Crown Office and Procurator Fiscal Service. ↩

500. Source: Police Scotland. ↩

501. Statistics provided to me by COPFS. ↩

502. Sentencing remarks of Lord Clark, High Court, Glasgow (15.3.23). ↩

503. COPFS News, ‘Former security guard from Glasgow jailed for terrorism charge’ (15.3.23). ↩

504. Independent, ‘‘Fascist cell’ convicted of terror and firearms offences after trying to make 3D-printed gun’ (29.3.22). ↩

505. COPFS News, ‘Man sentenced for sharing extremist material from banned terror group online’ (18.12.23). A Nigerian student was convicted of making threats against Dundee University (BBC News, ‘Student faces deportation after terror threats to Dundee University’ (23.11.23)) but this was not a terrorism case ↩

506. BBC News, ‘Man tried to buy gun after Dunblane research’ (26.10.23). ↩

507. Created under the Local Government etc (Scotland) Act 1994 and fully operational since 1996. ↩

508. Children’s Hearings (Scotland) Act 2011. When fully in force, the Children (Care and Justice) ↩

509. Section 26 of the 2011 Act. The principal consideration is the child’s welfare (section 25). Sheriffs are responsible for factual findings (Part 10). ↩

510. Police Scotland website, Examinations made under Schedule 7 of the Terrorism Act 2000 (last accessed 25.9.23). ↩

511. Although there is a curious category of ‘NA - Not Asked and Refused’ which includes 19 individuals during this period. ↩