When does an incident become “Terrorism”?

The public often hears that an incident is “being treated as terrorism” within hours of it occurring. Equally, there are occasions when an investigation that initially proceeds on that basis later becomes an ordinary homicide investigation, or vice versa. In the case of the murder of Ann Widecombe the message went from “At this point there is still no information to suggest that this is a terrorism-related incident” to “we now have new information and evidence that means Counter Terrorism Policing is leading the investigation…”

This naturally raises an important question: what is it that legally distinguishes a terrorism investigation from any other major criminal enquiry?

The answer is that there is no formal declaration of terrorism. Rather, the law provides a statutory definition of terrorism, and separate statutory powers become available where the legal thresholds for those powers are met. Once those thresholds are crossed, the practical conduct of the investigation changes dramatically.

The statutory definition of terrorism

The starting point is section 1 of the Terrorism Act 2000.

In broad terms, terrorism consists of the use or threat of action which:

• involves serious violence against a person, serious damage to property, endangers life, creates a serious risk to public health or safety, or seriously disrupts an electronic system;
• is designed to influence the government or an international governmental organisation, or to intimidate the public or a section of the public; and
• is carried out for the purpose of advancing a political, religious, racial or ideological cause.

Each element is important. Serious violence alone is not enough. Serious violence may be terrifying, but it is not necessarily terrorism. Nor is the existence of political or religious beliefs. The legislation requires both the requisite purpose and the relevant motivation before conduct falls within the statutory definition.

The statutory framework is deliberately broad. Coupled with offences such as preparation of terrorist acts under section 5 of the Terrorism Act 2006, it enables intervention long before an attack is carried out.

Arrest under section 41 and the significance of reasonable suspicion

The gateway to some of the specialist investigative powers contained within the Terrorism Act is section 41.

Unlike an ordinary arrest under section 24 of the Police and Criminal Evidence Act 1984 (“PACE”), section 41 permits a constable to arrest without warrant a person whom they reasonably suspect to be a terrorist.

The definition of “terrorist” is itself wider than many might expect. Section 40 provides that it includes a person who is or has been concerned in the commission, preparation or instigation of acts of terrorism.

The critical phrase is reasonable suspicion.

This is not a concept unique to terrorism law. It has long been established in English law and requires two distinct elements.

First, the officer must genuinely suspect that the individual is concerned in terrorism.

Secondly, there must be objectively reasonable grounds for that suspicion. It is not enough for an officer simply to have an instinct or an unparticularised concern. There must be information capable of justifying the suspicion when viewed objectively.

Importantly, the officer need not personally possess every piece of intelligence giving rise to that suspicion. Officers are entitled to act upon information received from colleagues or other agencies, provided that the information is capable of objectively supporting the suspicion.

Nor are the police required to prove that terrorism has in fact occurred before exercising the power of arrest. The threshold is significantly lower than the evidential test required for charge or conviction. Nevertheless, it must be based upon identifiable facts rather than mere speculation.

And this is one of the important areas where public relations and policing realities meet head on. Often the language used reflects the state of the facts and evidence known at the time of the press release, rather than complete knowledge or, at the other end of the scale, “coppers intuition”.

Detention and interview. Why terrorism investigations are different

One of the most significant legal consequences of an arrest under section 41 is that the ordinary PACE detention regime no longer applies in the same way.

For an ordinary murder investigation, detention is principally governed by PACE. Initial detention is authorised by a custody officer, with extensions requiring progressively greater levels of scrutiny. Even in the most serious homicide investigations, there remains a relatively short period within which investigators must either charge or release the suspect.

The Terrorism Act recognises that investigations of terrorist offending often present very different operational challenges.

Following a lawful section 41 arrest, considerably longer periods of pre-charge detention become available, subject to judicial authorisation. Parliament has accepted that terrorism investigations frequently require investigators to analyse vast quantities of digital material, examine encrypted communications, obtain intelligence from overseas partners, conduct extensive financial enquiries, translate foreign-language material and identify wider networks of associates before an informed charging decision can be made.

The availability of longer detention does not mean that continued detention is automatic.

Applications to extend detention are subject to judicial oversight. The court must be satisfied that continued detention remains necessary and that the investigation is being conducted diligently and expeditiously. The police are therefore required to demonstrate continuing investigative necessity rather than relying upon the seriousness of the allegations alone.

Interview strategy may also differ markedly from an ordinary murder enquiry. Terrorism investigations frequently involve a combination of evidential and intelligence objectives. Whilst the criminal investigation seeks admissible evidence capable of proving offences before a jury, investigators are often simultaneously seeking information capable of identifying wider threats to public safety. Those parallel objectives inevitably influence the timing and structure of interviews and the sequencing of investigative decisions.

The wider consequences for the investigation

Perhaps the greatest practical difference between a homicide investigation and a terrorism investigation lies not in the legislation itself but in the scale and organisation of the investigative response.

Where there are reasonable grounds to suspect that an incident may have a terrorist connection, responsibility will usually pass from the local force to Counter Terrorism Policing (CTP), although the local force invariably remains heavily involved. Counter Terrorism Policing operates through regional Counter Terrorism Units and works closely with the Security Service (MI5), specialist forensic teams, digital investigators, intelligence analysts and national command structures.

This is something that can come as a surprise to those not involved in the criminal justice system. The reality is that the resources deployed to serious criminality may be different dependent upon the exact nature of the offence. It is easy to imagine that every murder has similar resources deployed to it, the reality is that they do not. There is a whole level of policing decision making dedicated to these difficult allocations of resources. 

Rather than replacing the local force, Counter Terrorism Policing effectively overlays specialist capability onto the investigation. Local detectives continue to investigate conventional criminal offences, preserve scenes, obtain witness accounts and undertake many of the enquiries familiar to any major investigation. Counter Terrorism Policing assumes responsibility for those aspects requiring specialist expertise, intelligence assessment and national coordination.

The decision to adopt that approach is not taken lightly.

In the immediate aftermath of a major incident, senior officers conduct what is necessarily a dynamic assessment of the available information. Factors likely to be considered include the nature of the target, statements made by the suspect, available intelligence, apparent ideology, the method of attack, digital material recovered at an early stage, any claims of responsibility and information held by intelligence agencies.

The important thing to observe here is that the decisions will be taken on the totality of what is known. And what is known in the early stages of the investigation is a dynamic state of affairs. Very little may be known until doors are kicked in and evidence recovered. 

The practical consequences are substantial.

Additional investigative teams may be deployed within hours. Digital forensic capability is significantly expanded. Financial investigators, behavioural analysts, specialist search teams and international liaison officers may all become involved. Intelligence from MI5 and overseas partners may be integrated with the criminal investigation. Decisions concerning disclosure, public communications and investigative priorities become considerably more complex than those encountered in even the most serious conventional homicide enquiries.

In many respects, a terrorism investigation therefore proceeds along two parallel tracks. One is evidential, directed towards proving criminal offences before the courts. The other is intelligence-led, directed towards identifying and preventing any continuing threat to national security. The interaction between those two objectives is one of the defining characteristics of modern counter-terrorism investigations.

Conclusion

The phrase “being treated as terrorism” is often reported as though it represents a formal legal status. It does not.

The legal position is more nuanced. The Terrorism Act 2000 defines terrorism in section 1. Section 41 provides a specialist power of arrest where there are reasonable grounds to suspect that an individual is concerned in terrorism. Once that gateway is crossed, a distinct legal framework governs detention, and a fundamentally different investigative model is likely to be adopted.

Understanding those thresholds is important not only for practitioners but also for anyone seeking to understand why some major incidents rapidly become national investigations involving Counter Terrorism Policing, MI5 and extensive specialist resources, while others remain within the conventional framework of homicide investigation. It is also important to understand why a shift is often a dramatic shift. The distinction lies not in the seriousness of the incident alone, but in the existence of objectively reasonable grounds to suspect that the conduct falls within the statutory concept of terrorism.

The public understandably wants immediate certainty. Investigators, however, are under a legal duty to reach conclusions based on evidence rather than assumption. The tension between those two expectations explains why police statements in the hours following a major incident can evolve so significantly as the investigation progresses.