Independent report

Prevent learning review: Axel Muganwa Rudakubana (accessible)

Published 5 February 2025

Owners: Prevent (Homeland Security Group, Home Office) and Counter Terrorism Policing Headquarters

Version: Redacted report

Executive summary

This Prevent Learning Review (hereafter ‘Review’) was commissioned to examine the Prevent involvement with Axel Muganwa Rudakubana (AMR) prior to the tragic attack which led to the loss of three young lives, which AMR is alleged to have committed, on 29 July 2024 in Southport. This is done with the aim of identifying effective practice, organisational learning opportunities and any further areas for development. It is fully recognised that at commencement of this review, prosecution has commenced with authorisation of charges. Criminal proceedings are therefore active (sub judice). The Reviewer is therefore mindful that the Review must not jeopardise or influence the ongoing judicial and coronial processes and has complied with guidance from the Crown Prosecution Service (CPS) in undertaking the Review.

AMR was referred to Prevent three times. The first referral was received from AMR’s teacher on 5 December 2019. The teacher reported a number of concerns regarding behaviours which included being excluded from his previous school for carrying a knife and searching for mass school shootings on the internet using his school account. After a discussion with Prevent officers (CTCOs) in which AMR accounted for his internet searches, the case was closed on the Prevent system on 31 January 2020. Acknowledgement is made that AMR is extremely vulnerable but there are no CT/DE concerns and appropriate agencies are already in place to support him.

A second referral was received from AMR’s previous school on 01 February 2021. It was reported that a pupil had showed them [social media] posts by AMR which they were concerned about and felt AMR was being radicalised. The CTCO acknowledged the previous referral, however considered the [social media] posts to be not CT/DE relevant and the case was closed on 17 February 2021.

A third referral was received from AMR’s teacher on 26 April 2021. It reported that AMR had been observed with internet tabs open during a lesson showing a search for London Bomb and seemed to have a passionate interest in Israel/Palestine conflict, MI5 and the IRA. The CTCO acknowledged the previous two referrals but considered that AMR’s needs were currently met outside of Prevent and there were no CT/DE concerns to address. The case was closed on 10 May 2021.

Overall, the Reviewer considers there to have been a high level of compliance by the Prevent officers with process timescales, assessment completion and adherence to policy that were in place at the time. However, although processes and polices have been largely followed, it is the subjective decisions that have come into focus and AMR should have been referred to Channel. The Review identifies several areas for learning to strengthen risk assessments, particularly around understanding indicators of radicalisation where a coherent ideology is not present and recognising the potential risk from repeat referrals. A number of recommendations have been identified through this review. These include strengthening training and guidance, changes to terminology used within Prevent, and improving assurance processes.

Introduction

Purpose of review

On 29 July 2024, eleven children and two adults were attacked with a bladed weapon. It has been confirmed by Merseyside Police that three of the victims have died: Bebe (a six-year-old girl), Elsie (a seven-year-old girl) and Alice (a nine-year-old girl). A 17-year-old, British national male in Southport, was detained by police at the scene. The alleged perpetrator, Axel Muganwa Rudakubana (AMR), was referred to Prevent for assessment three times between 2019 and 2021. Each time he was deemed unsuitable for intervention at that initial assessment stage; he was not referred to Channel.

As AMR had been referred into Prevent prior to the alleged incident, a Prevent Learning Review (hereafter the ‘Review’) was jointly commissioned by Homeland Security Group (HSG) and Counter Terrorism Policing Headquarters (CTPHQ) to review the Prevent case management of AMR during the period 2019 to 2021. The aim was to identify whether and how national policy may be improved or operational learning identified.

When this Review commenced, AMR had been arrested and faces three murder charges, 10 attempted murder charges, and a charge of possession of a bladed article. This matter is ‘Sub Judice’. This review process must be mindful of, and not hinder or jeopardise any ongoing police investigations or judicial proceedings linked to this case. We will liaise with the SIO to ensure the integrity of the investigation is preserved.

Methodology

The Review follows the methodology as set out in the Review’s Terms of Reference, which can be found in the Appendices under Appendix A. The overall aim of the Review is to identify if any lessons can be learned from AMR’s Prevent case management that can be carried forward into policy, guidance or best practice in the future.

Due to the desire to identify and implement learning at the earliest opportunity, the initial timings for the Review were two weeks. An extension was granted to allow the Reviewer time to review information which was not immediately available but pertinent to the Review.

The Review involved scrutinising case information recorded by the police on the Prevent Case Management Tracker (PCMT), identifying and requesting further information where required (for example, where held on separate policing systems). The actions taken were then benchmarked against policy and guidance in existence at that time. Current policy and guidance were also reviewed to allow the Reviewer to consider where changes may have already resolved potential areas of learning.

The Review complied with the guidance given by the Crown Prosecution Service and remained a desk-top review. This meant that the Reviewer was unable to interview AMR, the Prevent officers involved in his case management, or any other individuals who engaged with AMR during the relevant time period (2019 to 2021). It is important to note that those individuals referenced in this Review have therefore not had a right of reply, and all information is taken from how it has been recorded in the PCMT.

During this review key documents were requested and provided. A list of these documents can be found in Appendix B. The majority of these are owned by CTPHQ. Some documents were not available for various reasons, including the time constraints, and the limitations on sharing documents due to ongoing judicial and coronial processes. Of note, this also includes liaising with or requesting information from other agencies who may have been simultaneously conducting their own internal reviews. While this has confined the scope of learning from this Review, the Reviewer is confident that it has not hindered the ability to produce valuable learning. Additional learning may be identified when there is an opportunity to take a more holistic approach.

The Review has taken a chronological approach. A detailed timeline has been set out for each of the Prevent referrals, assessing whether the policy at the time was followed, and providing corresponding learning points, lettered A to Z. Where the Reviewer thinks necessary, recommendations have been made, numbered 1 to 14. An overview of the Prevent referral process can be found in Appendix D.

Summary of AMR’s Prevent case management

Prevent Referral 1

Date: 5 December 2019

Referrer: Teacher at Acorns school (then current school)

Rationale: Reports a number of concerns regarding behaviours which included being excluded from his previous school for carrying a knife and searching for mass school shootings on the internet using his school account.

Actions: Prevent police officers (CTCOs) visit AMR asking him to account for the searches he had been conducting using the school internet, all of which he gave an account for.

Closure: The case was closed on the Prevent system on 31 January 2020. Acknowledgement is made that AMR is extremely vulnerable but there are no CT/DE concerns and appropriate agencies are already in place to support him.

Prevent Referral 2

Date: 01 February 2021

Referrer: Teacher from previous school (which AMR was excluded from)

Rationale: Reports that a pupil had showed them [social media] posts by AMR which they were concerned about and felt AMR was being radicalised.

Actions: CTCO assesses the referral from the information provided in the referral only. No additional actions are taken or further information sought. Recognition is given to the previous referral.

Closure: The case was closed on 17 February 2021. The [social media] posts were considered to be not CT/DE relevant.

Prevent Referral 3

Date: 26 April 2021

Referrer: Acorns school

Rationale: Reports that AMR had been observed with internet tabs open during a lesson showing a search for London Bomb and seemed to have a passionate interest in Israel/Palestine conflict, MI5 and the IRA.

Actions: CTCO assesses the referral from the information provided in the referral only. No additional actions are taken or further information sought. Recognition is given to the two previous referrals.

Closure: The case was closed on 10 May 2021. Prior referrals were acknowledged but it was considered that AMR’s needs were currently met outside of Prevent and there were no CT/DE concerns to address.

Detailed timeline with learning outcomes

Prior to 1st referral

In April 2019, AMR was named as a victim of bullying and admitted to carrying a knife at school. AMR was spoken to by police and a high risk Protecting Vulnerable People (PVP) referral was made to police.

It appears that AMR contacted the National Crime Agency (NCA) reporting that he was being bullied at school by a named person and admitting taking a knife to school. NCA contacted local police passing on this information and officers visited AMR at his home address. We have not requested or obtained this information from police and NCA due to the short timescales for the review.

In early December 2019, AMR attended his previous school and assaulted a pupil with a hockey stick causing Actual Bodily Harm and was found in possession of a knife. He was arrested on 11/12/2019 and taken into police custody.

1st Prevent Referral of AMR

05/12/2019

1st referral – submitted by a teacher from Acorns School, Ormskirk. AMR was 17 when the incident in Southport occurred on 29 July 2024, and at the time of this review is 18 years. AMR would have been 13 years old at the point of 1st referral.

AMR was living with [family] in [the area] of Lancashire County.

The referral contained the following information shown in the notes of PCMT:

• 17/10/2019 AMR was excluded from his previous school Range High School having been found in possession of a knife. He also admitted taking a knife into Range High School on 10 separate occasions.
• 15/11/2019 AMR was found researching school shootings in America during ‘ICT’ lesson.
• 29/11/2019 was observed during a class to be walking about punching his hand hard. Also jumped up and punched a laminate hanging from the ceiling very hard. During a discussion on how to promote business it was suggested to AMR that he could say his business was new to the area. AMR thought this not a good idea as people may think he was going to kill them.
• 03/12/2019 during an art lesson AMR questioned why he was able to draw images of guns but not search them on the internet and then asked ‘can we have a picture of a severed head then’.
• Also on 03/12/2019 in another class, AMR was overheard talking to a pupil about watching videos of people hurting themselves. AMR also made a graphic comment about a drill bit breaking and killing someone.
• 04/12/2019 it was apparent to the school that there were 2 relevant local authorities, [one where he lived], and [one where he went to school]. Advice was being sought regarding primacy for multi-agency safeguarding hub (MASH) involvement.
• 04/12/2019 AMR was observed using inappropriate language saying Nicola Sturgeon ‘looked like a retard’.
• 04/12/2019 The school were dealing with AMR’s various forms of disruption, asking [a teacher about their sexuality] and accusing his key worker of being sexist, racist and homophobic. An emergency review meeting was arranged for 05/12/2019 with AMR’s [family member]. The review meeting was to be multi-agency, including Social Care and Community Safety Partnership (CSP) Police.
• A check was made by [a PC], CSP, [police], regarding a MASH referral, but no referral could be identified.
• CSP Police declined to attend the urgent review meeting as the context of the referral was higher risk than CSP would ordinarily deal with, and this fell out of scope for CSP Police to attend.

Reviewer Comment – this information has been obtained from screen shots of the PCMT system. The teacher has not been spoken to as part of this review.

Policy and guidance in place at that time –

• CTPHQ Policy for Prevent Practitioners V 2.1 June 2018.
• Joint letter sent to the Prevent network on 25/06/2019 regarding Mixed Unclear and Unstable Ideology. See Appendix C.
• Channel Duty Guidance 2015 (original).
• [Policy on intelligence] – particularly ‘Annex B Prevent’.

Policy - At the time of the first referral the thinking on ‘School shooter’ / obsession with massacre or extreme / mass violence was encapsulated in a joint letter dated 25/06/2019 from the Home Office Director Prevent and CTP National Coordinator for Prevent sent to all CTP Regional Prevent Coordinators (RPCs), Channel Chairs, Higher Education and Further Education Prevent Coordinators, Prevent Education Officers (PEOs) and NHS Prevent Coordinators. This letter refers to the Mixed, Unclear and Unstable ideologies and describes some scenarios that may fall into this category or may be similar or overlapping. The letter can be found in Appendix C.

Learning point A –

From the text of the referral, AMR may have had a special interest with mass killings. He was conducting searches using the school’s internet on school shootings in America, was talking about drawing guns and searching on the internet for guns in another lesson, was also overheard talking to a pupil about watching videos of people hurting themselves and made a graphic comment about a drill bit breaking and killing someone. It is not known if this special interest in school shooting, violence and injury amounted to a fascination as this interest may not have been fully explored and understood.

A pertinent excerpt from the letter details under which category of Mixed, Unclear and Unstable extremism this referral may fall:

• are obsessed with massacre, or extreme or mass violence, without specifically targeting a particular group (e.g. ‘high school shootings’)

It would therefore appear from the initial referral that AMR could fall into a Mixed, Unclear or Unstable (MUU) category due to his potential obsession with mass violence. While there is no evidence presented by the school of an ideological driver for his behaviours, at this early stage I would describe his ideology as ‘unclear’.

16/12/2019

PCMT record created.

Reviewer comment – this record has been created in a timely manner and in accordance with the Policy for Prevent Practitioners 2018 at the time.

17/12/2019

Case discussed at the Daily Management Meeting (DMM) and allocated to a named officer.

Reviewer comment – The named officer is [a CTCO within Lancashire Prevent Team]. For context the DMM meeting takes place each day, chaired by a senior ranking officer from CTP. The DMM’s purpose is to review all ongoing and new intelligence, allocate resources appropriately and ensure the correct department within CTP takes ownership of the case.

17/12/2019

Strategy meeting held and attended by [the CTCO]. Also present were representatives from Children’s Social Care, Mental Health, Investigating Officer from Merseyside Police, Police Early Action, Education and CTP Prevent.

Reviewer comment – The case notes in PCMT do not confirm who convened the strategy meeting. [The minutes of this meeting are held by another agency and will be thoroughly considered as part of the Child Safeguarding Practice Review]. The strategy meeting fell out of scope for this initial review. Information about the meeting has been taken (paraphrased below) from PCMT notes.

From this meeting the Officer in Charge (OIC) from Merseyside Police gave an update following AMR’s arrest for Assault (Section 47 AOABH), and possession of a knife and an offensive weapon (a hockey stick). The OIC gave information about AMR’s concerning internet searches, and that the assault appeared to be pre-planned.

Reviewer comment – It is not clear if the information concerning AMR’s internet searches was the same information given by the school in the initial referral. The internet searches referred to have been requested but have not been provided to date.

Reviewer comment – The term pre-planned is recorded on the notes within PCMT. It is not known if that term was used by the OIC in their update or by the CTCO when recording a summary of the meeting.

AMR was formally interviewed with an appropriate adult present ([family member]) and legal representation. Information given by AMR’s [family member] during the interview suggests that AMR had a ‘hit list’ of 3 targets. 2 males and an unknown female.

A written statement was provided admitting the offences of assault, possession of the offensive weapon (hockey stick), possession of the knife, but AMR denied accessing inappropriate material via the school website. He did state that he had no intention of using the knife.

Reviewer comment – The information regarding comments made by AMR’s [family member] is recorded on the notes within PCMT as part of the summary from the strategy meeting. It is believed these notes formed part of the updates given by the OIC at the meeting.

AMR was given police bail on 12/12/2019, with conditions, for a charging decision to be made. The conditions were:

• not to be within 400 metre of Range High School, Formby, L37 2NY
• not to contact 2 named individuals (not named here)
• not to attend ‘The Acorn Centre’, Ruff Lane, until confirmation is given by Social Services or the appropriate authority

Further information from Merseyside Police was that AMR stated he was intending to hit the victim with the hockey stick and finish him off with the knife and was not bothered by the prospects of prison.

Reviewer comments – This information is recorded within PCMT notes as part of the update from the OIC during the strategy meeting where the CTCO was present. The comment ‘and finish him off’ is potentially contradictory to his previous statement provided during the police interview, where he claimed no intention to use the knife. It has not been recorded when, where and to whom he made the comment ‘and finish him off’.

Following AMR’s permanent exclusion from the school for carrying a knife to injure fellow students (and carrying a knife on 10 previous occasions) the school made a Child and Adolescent Mental Health Services (CAMHS) referral.

An update was given by Mental Health Services while AMR was in custody. They believed AMR has Autism Spectrum Disorder (ASD – also referred to as Autism Spectrum Condition – ASC).

Reviewer comment – CAMHS have not been approached as part of this review as it fell out of scope, the precise details of the updates are not known to the Reviewer. The relevant information above is taken from PCMT notes regarding the strategy meeting that took place.

Forensic Child and Adolescent Mental Health Services (FCAMHS) appointment was made for ‘21/01/2019’ (believed to be 21/01/2020) and AMR was on a waiting list for an ASD assessment.

An update was given by the Early Help team. In summary, they advised that AMR was assessed and visited at home. [There was discussion of AMR’s home environment and relationship with family members]. Early Help Team felt AMR had ASD due to his personality traits. [Family members are accessing support services to an extent] and AMR is receiving counselling every 2 weeks. There was a current Section 47 Investigation underway (child at risk of significant harm). No neglect issues apparent. AMR is at risk of further criminality but unknown what the triggers may be. AMR was adhering to his bail conditions.

Reviewer comment – The early help assessment is not recorded within PCMT, only the update from the strategy meeting. This information fell out of scope for this review and has been listed as a potential follow-up to understand Early Help’s involvement. The early help assessment and support is likely to have commenced prior to Prevent involvement but this will need to be verified as it is not recorded within PCMT. It has not been recorded who attended the strategy meeting from Early Help and who gave the updates.

An action was given to CTP Prevent to visit the subject the following week.

Reviewer comment – Neither the purpose of this visit nor any CTP Prevent related updates were recorded on the notes within PCMT from the strategy meeting.

18/12/2019

[CTCO] recorded as arranging a visit to AMR the following week.

20/12/2019

FIMU assessment – very little known about AMR.

Initial notes state PNC No Trace.

Reviewer comment – It appears from the notes within PCMT that AMR was arrested for the assault and weapons charges on 11/12/2019 some 5 -6 days after the Prevent referral. This shows a potential escalation in his behaviour risk levels. The full FIMU assessment has been requested but is yet to be provided. In the absence of the full FIMU assessment it cannot be ascertained when this assessment took place. However, it can be assumed that the FIMU assessment took place between the initial referral being received and the date of the entry on the notes.

Policy comment – The FIMU assessment has been completed in accordance with policy on assessments at the time and has been conducted in a timely manner.

Learning point B – It is not clear if the FIMU provided full details of all research and assessments conducted by them to CTP Prevent.

Policy/Guidance – This research and assessment, formed part of minimum standards for FIMUs laid down in the [policy on intelligence] and included the results from the following checks. Some FIMUs complete more checks, but these were the minimum standards:

• [CT Police intelligence system]
• Local Intelligence and crime systems
• Police National Computer (PNC)
• Police National Database (PND)
• [Other Police systems]

The Policy for Prevent Practitioners and the [policy on intelligence] Annex B guidance all refer to the need for Prevent to feedback to the FIMUs (the intelligence cycle) but do not mention what the FIMU should feed to Prevent teams.

Request for document – The [policy on intelligence] guidance covering 2019 was requested but has not been provided. Annex B from the [policy on intelligence] guidance has been shared with the Reviewer as has the definition of CT relevance.

Reviewer comment – As the [policy on intelligence] guidance is not a CTPHQ owned document, permission from the owner may need to be sought before it can be shared. Embedded in the [policy on intelligence] guidance are definitions and policy regarding the term ‘CT/DE relevant’ and policy regarding minimum standards, and decision making within the FIMU. It has not been possible to scrutinise the FIMU policy to establish if there was a requirement to share the findings from the FIMU assessments with key stakeholders such as CTP Prevent.

Recommendation 1 – It is recommended that a standardised sharing of information product be considered for national use by all FIMUs when sharing the results of checks conducted for Prevent. This product should be agreed nationally, its use mandated and written into [the policy on intelligence].

20/12/2019

GATEWAY ASSESSMENT – case moved from Gateway Assessment to PLP.

Reviewer comment – The rationale stated on the notes within PCMT for moving to PLP is for a visit to be conducted with the individual to carry out a risk assessment and determine the appropriate course of action. This is recorded in the ‘history’ section within PCMT for the case.

Learning Point C – In 2019 the policy concerning visits to individuals, bearing in mind the Dovetail Pilot ^{[footnote 1]} was running in the CTPNW, was that visits to individuals should be limited and not conducted unless by exception. This places the police in a challenging situation when assessing individuals without the opportunity to speak directly to them regarding the contents of a referral. A visit was necessary in this case as so little was known about AMR and ideology was unknown. The police have indicated that to achieve the visit, the referral was moved into PLP. This seems unnecessary as the policy allowed for visits to take place during the PGA process if appropriate and by exception.

This learning point is not regarding whether a visit took place, but regarding the ability to conduct visits to individuals without feeling the need to move a referral into PLP to enable this.

Recommendation 2 – Further training should be considered regarding the circumstances where visits to individuals during the initial assessment can be conducted. The policy in 2019 and currently remains visiting by exception, which could make the officers conducting the assessment feel constrained at this stage of the process. A review of how this is framed in the CTCO policy coupled with further training, may help CTCO’s with regards to the decision to visit an individual at the initial assessment phase, without the need to progress the referral into PLP to achieve this.

Policy – Policy for Prevent Practitioners 2018 covers visits during the PGA stage. It states that visits should not be necessary but does not preclude them. It also states that CTCO’s should consider the best person to conduct this visit (partner service) or a combined visit with a partner service. The CTCO was complying with policy in conducting the visit at this time. Current CTCO Guidance on visiting individuals remains the same as 2018 and is by exception only.

Reviewer comment – The footnote is a synopsis of the Dovetail pilot provided by the Home Office for context. Dovetail policy and guidance were written at the time by the Home Office and CTPHQ. The Dovetail Pilot did not change the Prevent process for managing referrals, only the organisation responsible for elements of the process. CTP Prevent retained responsibility for the initial assessment and if Channel was the chosen option, the referral was handed over to a dedicated Channel Coordinator within the Local Authority to continue the process.

23/12/2019

Police Gateway Assessment (PGA) –

Complex needs have been identified and a referral to the Vulnerability Support Hub (VSH) is to be submitted.

Grievances PGA stated there were no grievances.

Reviewer comment – it is evident from previous notes on PCMT that grievance narratives exist around bullying from AMR’s previous school, and these may be driving his behaviour. The PGA does state that grievances need to be explored during the visit to AMR.

Learning point D – Grievances are one of the most significant factors that motivate an individual’s mobilisation towards violence. The presence of AMR’s grievances has not been mentioned in the PGA and as a result a potential motivating factor may have been overlooked.

Recommendation 3 – A review of current training for supervisors should be considered to strengthen that when signing off assessments as complete, all behavioural factors and motivations for behaviours have been captured on the assessments, whether deemed Prevent relevant or not. Current assessments do not include a Prevent ‘relevancy’ element to factors. The new Prevent Assessment Framework (PAF) due to go live in September 2024 goes some way to addressing the Prevent relevancy for each of the susceptibility factors.

Engagement – undiagnosed ASD may add to AMR vulnerability to engage with extremism or CT related issues.

Ideology – AMR has been researching school shootings, has been talking about stabbing people and that the terrorist attack on the MEN was a good thing. At this stage it is not clear if he has an ideology.

Individuals Groups Institutions – no evidence of AMR engaging with any groups causes or ideology.

Capabilities – AMR has accessed weapons and committed assault therefore has some violent capabilities.

Intent – individual has intent to harm people that have bullied him but there is no evidence of that bullying taking place. He has a hit list of people he wishes to do harm to which is uncorroborated and shows ‘hate’ towards [a family member] and those on his list.

Opportunity – AMR has already attended his previous school in order to mount an attack on some individuals.

Internet and social media – AMR devices were seized by police and will be examined.

Reviewer comment – Devices seized as part of an investigation are examined by specialist teams within the police force the investigation is taking place in. It has not been recorded within PCMT that the results from this examination were requested or shared with Prevent.

Learning point E – It is unclear from the PCMT notes if AMR’s devices were then examined. It has not been recorded that 1) the examination was completed and 2) the results were shared with Prevent Police. It is also unclear if there were attempts to obtain AMR’s search history from school, his previous school, from which he was excluded, or his home (with consent from parents) or if open-source research was conducted at this stage.

Policy – In 2019, the CTP Prevent Practitioners policy was not as prescriptive as the current CTCO guidance. Ensuring all relevant information is gathered relating to internet searches or enquiries is not specifically mentioned.

Current CTCO guidance describes a level of professional curiosity when conducting the PGA stage and refers to corroborating information wherever possible, which includes open-source checks but does not specifically mention internet search history.

Recommendation 4 – Consider whether CTCO guidance could be strengthened where internet usage / search history or other online activity is relevant. This could ensure CTCOs are proactive in obtaining and recording internet search results in order to adequately assess the referral and make sure the information does not remain unknown. However, this will need to be balanced against the limited capabilities for police to conduct intrusive surveillance within the Prevent process. The mandating of open-source research should be considered at the PGA initial assessment.

Suspicious travel – no evidence of suspicious travel.

Premises – no evidence AMR is visiting suspicious extremist related premises.

Escalation in baseline behaviour – evidence shows AMR is escalating in his behaviour having now gone to his previous school and attacked another pupil.

Mobilisation towards finishing – AMR is becoming more violent and aggressive due to him going to his old school and attacking a pupil.

CTCO recommendation – PLP. The rationale for this is recorded as to allow a Prevent visit to take place to determine if there is a CT/DE ideology and to assess any further vulnerabilities or safeguarding concerns and put the appropriate support in place. A referral was also to be made to the Vulnerability Support Hub (VSH), with Prevent to attend the next strategy meeting on 06/01/2020.

Reviewer comment – The above comments from the recommendation to move the case into PLP have been summarised by the Reviewer and can be found on the notes within PCMT.

Reviewer comment – VSH have been approached and it appears no VSH referral was received. It is not known if one was made but not received, or if it was never made.

CTCO Supervisor recommendations – Agrees with CTCO recommendations for PLP as the preferred option and states that there are safeguarding and vulnerabilities to be addressed, in particular the ongoing investigation and his vulnerability to radicalisation.

Reviewer comment – The above CTCO Supervisor recommendations are a summary of the comments and not a transcript. The exact comments can be found on the note within PCMT.

Policy – The Policy for Prevent practitioners 2018 mentions the Mental Health hubs and consideration should be given to a referral to the hub where appropriate. The mental health hubs were renamed at some point after this policy and before the CTCO guidance of 2020 as the Vulnerability Support Hubs. In the 2020 guidance, it refers to the VSH as evolving and a standardised national process is being developed.

In 2019 the PGA had 3 options on completion:

• multi-agency led (Channel)
• police Led
• closure

Learning point F – in this instance there were a number of factors present to have concerns regarding AMR and his potential vulnerability to being drawn into terrorism. The researching of school shootings, talking about stabbing people, stating the terrorist attack on the ‘MEN’ was a good thing, may have shown a real interest in terrorism. ‘MEN’ probably refers to the Manchester Arena attack in 2017, Manchester arena was known as the ‘MEN’ Arena between 1998 and 2011. The question at the time for the CTCO was to consider whether AMR was engaging with a group, cause or ideology and what this means given AMR’s vulnerability, complex needs and behaviours. The CTCO chose to move the case to PLP on this occasion.

It is the opinion of the Reviewer that there was sufficient information to refer this case to Channel, especially given AMR’s age and complex needs. His engagement with an ideology was unknown and this work should have been carried out under the umbrella of Channel and the case referred to the Dovetail Channel Coordinator to complete the multiagency information gathering. This would have allowed the multi-agency partnership to convene to discuss the case within the context of AMR’s vulnerability to being drawn into terrorism.

By holding the case in PLP this indicates that the CTCO and supervisors thought there were sufficient Prevent concerns not to choose the closure route – the Reviewer would agree with this. Due to the age and complex needs, Channel would seem the more appropriate option over PLP. The PGA clearly articulates a range of concerns that would add to an individual’s vulnerability to being drawn into terrorism, and so closure would not be an option at this stage.

Recommendation 5 – Policy and guidance should be considered whereby referrals involving children and / or complex needs should be routinely referred to Channel unless immediate closure is the chosen option, or the CT risks are deemed too high for Channel.

Policy note – The CTCO guidance 2020 has a change in process where options at the initial assessment phase have been simplified. In 2019 the guidance stipulated there were 3 options from the initial assessment phase i) Closure ii) Multi-agency led iii) Police Led. The CTCO guidance of 2020 has simplified this to 2 options i) Closure ii) Multi-agency information gathering.

Policies in place at this time –

• Policy for Prevent Practitioners 2018
• Dovetail Police Operational Guidance 2016
• Channel Dovetail Regional Hub Pilot 2018

Learning point G – Business assurance and confidence in process requires the relevant independent scrutiny to be in place. Currently the Police are the sole recipients for Prevent referrals in many areas of the country, the sole decision makers at this early stage of the process, and have sole access to the recording system (PCMT). The Home Office have a quality assurance function to oversee Prevent delivery. It is important that scrutiny is applied to all areas of Prevent delivery to monitor compliance, understand the national perspective on all elements of Prevent delivery, and enable studies to take place where events have indicated gaps in practice so policy and guidance can be developed. Currently the Home Office as owners of the Prevent strategy only have selected limited access to certain areas on the PCMT. The multiple referral policy introduced in 2023 will strengthen how repeat referrals are viewed by CTCO’s, but current arrangement for accessing the system would preclude the Home Office from analysing this directly.

Recommendation 6 – Full access to the current PCMT system is restricted to police only. While the Home Office has limited access, this should be reviewed, enabling scrutiny at all levels of Prevent delivery as part of quality and business assurance processes. This access will enable studies to be conducted of all parts of the process which will inform changes in policy and guidance and be able to hold key stakeholders to account.

Learning point H – Timescales for the PGA completion was a minor issue for the first referral. From the date the case was received by Prevent (DMM 17/12/2019) the CTCO had 5 working days to carry out the PGA assessment. In this instance the time taken to complete the assessment has probably fallen just outside the timeframe as a copy of the PGA assessment has been uploaded to the PCMT on 23/12/2019 (6 days). I have been unable to obtain the original copy of the PGA documentation to determine the precise date this was written.

23/12/2019

Supervisors tasking and review recorded which is a direct copy from the PGA supervisor’s comments which is dated the same day as the PGA.

Learning point I – When making new entries onto the PCMT system, copy and pasting previous comments for a new fresh comment is not best practice. This practice has been used on several occasions over the course of this case.

Recommendation 7 – Each new comment on PCMT should be unique showing the officer has considered their views again. If there is no new information or no further updates, then this should be articulated rather than copying a previous entry.

31/12/2019

A risk assessment note recorded in PCMT as supplementary case information details precautions to be taken by officers due to the risk of weapons. Included in the note is the [CT Police intelligence system] results, which were ‘no trace’. Also recorded was a refresh of the Police National Computer search (PNC) which now showed his previous arrest history since the referral.

Reviewer comment – It is not known if information was put onto the [CT Police intelligence system] and when. It is possible, as this case was assessed by the FIMU as [risk assessment outcome no CT/DE relevance] then no record was created on [the CT Police intelligence system] for the referral despite a FIMU assessment having been conducted. This will need to be checked with the FIMU.

31/12/2019

Two CTCO’s visited the address of AMR. AMR’s [family member] asked them to return on 03/01/2020 as the [family member] was a shift worker and currently working a night shift.

Reviewer comment – it was not recorded by the CTCO whether AMR was present at the time or whether the officers just spoke to AMR’s [family member].

03/01/2020

Visit conducted by two CTCO’s and AMR’s [family member] was also present. AMR was asked about his searches online at school. AMR thought this had been taken out of context and said he had been interested in a news article and been led to the page via a link. He stated that he had searched for a weapon ‘Num chucks’ (probably Nun Chaku, Japanese fighting sticks, which are an offensive weapon in the UK) as part of research for a lesson on ‘building things’. He also seemed aggrieved that this had been recorded by the school and felt he was being persecuted by his teachers who were trying to get him into trouble. He stated that he hated it at school and didn’t like any of his teachers as they picked on him. He was asked about carrying the weapons into school and stated this was a result of being bullied. [There was discussion of AMR’s relationship with another family member]. AMR did not display any extremist views or ideology: the violence had been directed towards the people that had allegedly been bullying him.

Reviewer comment – above is a synopsis of the entry on PCMT dated 06/01/2020 and describes the conversation that took place between AMR and the officers when they visited on 03/01/2020. The PCMT entry can be viewed in full if required.

Learning point J – AMR gave an account for his internet searches to officers which lacked credibility. This account needed to be verified as it could be an indication of disguised compliance.

06/01/2020

Strategy meeting attended by the CTCO case officer. Readout from the notes:

AMR has had his first CAMHS assessment which confirmed no mental health illness, but Autism was apparent. AMR was not able to return to school and an alternative educational provision be considered. The school feels that pupils and teachers would be at risk without the correct risk assessments in place. Concerns that AMR had made previous comments regarding getting teachers murdered and displaying extreme dislike or hatred. Social care to conduct a continuing assessment and apply for a Special Educational Needs and Disability (SEND) Assessment. No further requirement for the Section 47 investigation from Social Care as all the relevant agencies are in place. No charging decision as yet regarding the assault and AMR’s devices are still being examined. The internet history is yet to be provided.

Reviewer comment – This strategy meeting is possibly the second one arranged [that the CTCO attended, which will be considered as part of the Child Safeguarding Practice Review.] It has been recorded as a strategy meeting within PCMT. Meeting notes have been recorded on the same day as the meeting took place which is good practice. At this point there is mention of the information contained on AMR’s devices and internet search history from the school. Nothing was recorded to say these search results have been provided to Prevent.

08/01/2020

An entry on PCMT states that the FIMU have assessed that the case can be closed to Prevent as there are no CT/DE concerns and all the relevant agencies are in place.

Learning point K – The remit of the FIMU needs to be clear to ensure the FIMU assessor does not stray into Case management territory. [My understanding of the FIMU role is that of an Intelligence management function.] Once a case has been passed to Prevent then it is for Prevent to determine closure and not the FIMU, [except in exceptional circumstances]. There is a risk that if a FIMU assess that the referral/case can be closed by Prevent, then this may influence Prevent to close prematurely before going through due process. [The policy on intelligence] ‘Annex B’ covers how Prevent related intelligence should be handled. This guidance references that a FIMU assessment [of risk assessment outcome no CT/DE relevance] can be considered by Prevent teams as CT/DE relevant and becoming a Prevent case.

Recommendation 8 – It should be considered that Annex B be embedded into [the policy on intelligence] and not sit as an appendix. The policy should be explicit that it is for Prevent to determine closure once the referral has been handed to Prevent for action and initial assessment. It should be made clear that FIMU should refrain from suggesting Prevent outcomes as this may influence decisions made by CTCOs or support closure prematurely from Prevent.

Learning point L – The term ‘CT/DE relevance or concern’ is used repeatedly throughout all the Prevent referrals relating to AMR. The term is used in the IMU’s to describe whether a piece of intelligence should be recorded on [the CT Police intelligence] computer system or not. This is to avoid over burdening the system; the decision for this is subjective and sits with an IMU assessor. Each assessor will have a slightly different perspective on what they think is CT/DE relevant. The term can be commonly confused with a more literal meaning of the phrase i.e. that there is no ‘Counter Terrorism Relevance’ to the referral / case. In this case, [the risk assessment outcome no CT/DE relevance] was used within a Prevent context and used to support decision making where the meaning may have been misinterpreted by the CTCO. This term has been more recently replaced by ‘CTP relevant’.

Recommendation 9(i)– Consider a terminology change in Prevent management. CTP relevant should be replaced by the term ‘Prevent Relevant’. This differentiates it from the term used in the IMU which may have a slightly different meaning.

Recommendation 9(ii) – Currently Prevent referrals are assessed [under general risk assessment outcomes] by the FIMUs. Consideration should be given to Prevent having its own [risk assessment] outcome specifically which is clearly defined in policy. The current CTCO guidance coupled with [the policy on intelligence] Annex B guidance defines the roles of CTP Prevent.

Recommendation 9(iii) – [The policy on intelligence] Annex B appears a little dated and consideration should be given to a review / refresh. E.g the guidance refers to the purpose of Prevent is to ‘protect vulnerable people from being drawn into terrorism’ which is not an accurate term to describe Prevent.

Recommendations 9(iv) – Training for FIMU staff on Prevent should be reviewed to ensure a full current understanding of Prevent delivery and regular training refreshes delivered as part of continued professional development (CPD). Where training is deemed to be inadequate then the appropriate courses are built and delivered.

Recommendation 9(v) – Training for Prevent staff on [the policy on intelligence] guidance and FIMU delivery should be reviewed and where training is identified as inadequate the appropriate courses created and delivered, and regular training refreshers.

15/01/2020

Case moved from PLP to Pending Closure. Rationale given as: no CT/DE concerns. There are clear vulnerabilities that need support but agencies are already in place. The case will be closed pending any further information from the devices or internet search history or a rereferral.

Reviewer comment – The terms CT/DE relevant and CT/DE concerns have potentially been used interchangeably by officers recording information on PCMT. While CT/DE relevance has a particular meaning within the FIMU, the term CT/DE concern is not defined in policy but is used frequently. Speaking directly with officers fell out of scope for this review so it is not known what the officers understanding was for these terms.

Learning point M – It is the Reviewer’s opinion that closure at this point is premature as there was some key information not yet known regarding what was held on his devices and the internet search history. It cannot be anticipated whether a piece of information may have a significant impact on decision making so it would be prudent to wait until all lines of information gathering have been completed.

Other vulnerabilities and evidence presented in the PGA are indicating Channel at this point. This would have kept the case active while the additional information is gathered, the case would then have a multi-agency perspective applied with regards to radicalisation.

Recommendation 10 – CTCO policy should be reviewed to ensure all outstanding enquiries or information gathering is completed prior to closure.

Policy – CTCO guidance now has reference to corroborating information during the PGA stage, but this language could be reviewed and tightened up to ensure all outstanding enquiries are completed.

Learning point N – From the PGA the officer has highlighted a number of risk areas that are present as well as an unknown ideology. The PGA did not record that AMR had a grievance even though there is evidence he had grievances against his fellow pupils, his teachers, and his family (and bearing in mind he was searching for mass school attacks on the internet). Some of these were explained as part of his Autistic behaviour traits by the CTCO - this may well be the case but they are still relevant to his vulnerability to being drawn into terrorism. The decision to close the referral at this point is questionable, bearing in mind the violent act already committed, the static vulnerabilities of AMR, his potential interest with mass killings and other internet searches. The static vulnerabilities of AMR and ideology are entwined and should be considered together when making decisions. There is evidence in the notes that these two issues were considered separately.

Reviewer comment – CTCO’s will need to be spoken to directly to obtain their views at the time, which unfortunately was not in scope for this review.

Recommendation 11 – Static vulnerabilities can make an individual highly susceptible. Additional training should be considered for those conducting assessments, on the importance of understanding the impact of static vulnerabilities on altering the risks of radicalisation. Where there are cases of limited engagement and complex needs, such as Autism in this case, then decisions to refer to Channel should be seriously considered. This would enable a professional perspective on the impact of the static vulnerabilities and a multi-agency approach to managing the susceptibility to being drawn into terrorism. This recommendation should be viewed alongside recommendation 5.

Policy – During the decision-making process to progress the case from initial assessment to PLP the CTCO’s did not act outside of the policy at the time and, in fact, followed policy very closely. The policy is not being questioned but the final decision not to take the Channel route is.

Current CTCO guidance covers this decision-making point and describes reasonable suspicion and not belief applies at this stage of the process.

31/01/2020

Case recorded as moving from pending closure to closed. Same rationale used for the pending closure rationale: There is no CT/DE concerns although AMR is extremely vulnerable. There is no record on whether Prevent received the results from AMR’s devices nor the list of internet usage from the school. The outcome for closure was categorised as Non CT concern referred on to Social Services.

Learning point O – by moving the referral to closed at this point, the referral effectively drops off the radar and the PCMT system no longer flags inactivity on the record.

Recommendation 10 applies to this learning point.

15/05/2020

PCMT entry states [CTCO] has referred for open-source checks –

Reviewer comment – The Reviewer is unsure if open-source research checks have been requested at this point and why, this is some time after closure.

03/08/2020

6-month review held. No further concerns recorded, and checks were recorded having been completed on Connect and PNC.

Reviewer comment – In 2019 there was no requirement in policy to review referrals closed at initial assessment or for PLP cases. This suggests that the CTCO added in their own checks and balances into the process. No further information at this point and no update / follow up on the device information and list of websites from the school. There is no other narrative recorded for this review.

Learning point P – although the case had an additional review which was not required in policy, it has not been recorded that the outstanding actions regarding device search results or internet usage from the school were completed.

Recommendation 10 applies to this learning point.

15/01/2021

12-month review conducted. Checks were recorded having been completed on Connect and PNC. No further information has come to light, and it states that a 24 month review is due on 15/01/2022 – this is not in any policy or guidance and the review was either not conducted or not recorded.

Summary from 1st referral

PCMT is a workflow system so the CTCO’s completing it is led from one stage to the next. The Policy for Prevent Practitioners 2018 describes actions / minimum standards at each stage of the process and this case has complied with that policy. There was a high level of compliance with policy and process. The timeliness for completing actions set out in policy are of a high standard, assessments completed swiftly, and the progress of the case mirrored timescales laid down in policy at the time.

There is a potential issue with regards to FIMU terminology being used by Prevent CTCO’s and taken out of context from the original meaning inside the FIMU, namely the use of the term CT/DE relevant. This has the potential for CTCO’s to pre-empt decisions prior to completing enquiries and assessments and can be used to validate that the case in question has no concerns. This concern has been alluded to in CTCO guidance and cautioned against.

The decision making in the 1st referral hinged on whether AMR had an Ideology. The focus on ideology can overlook that individuals can also be highly susceptible and may only display very limited engagement with ideology. This is exacerbated when the two issues, static vulnerabilities and ideology, are then considered in isolation and the impact of one on the other is not fully considered. It is the Reviewer’s opinion that this emphasis on ideology created a gap where a highly vulnerable individual, whose vulnerabilities may have also made him highly susceptible, has been closed to Prevent without consideration for support through Channel.  Although out of scope for this review, if a change in thinking is to be considered to plug this gap, the increased scope for Prevent will need to be seriously considered and parameters clearly stated to stop the landscape opening so wide that everyone with a complex need is referred to Prevent and Channel.

In the Reviewer’s opinion, and this is highly subjective, this referral had enough concerns to move towards the Channel space and enact the multi-agency information gathering process followed by a decision to refer to the Channel Panel. All these concerns, which include researching school shootings and stating the attack on the ‘MEN’ was a good thing, are documented by the CTCO and Supervisor in the notes and assessments. This opinion may have been shared by the CTCO and supervisor as the referral was not immediately closed but moved into PLP. Due to the time constraints of this review, it has not been possible to speak directly with the officers concerned. This critical decision may have impacted on how the subsequent referrals were viewed and assessed for AMR. Comments and views by the FIMU assessors may have pre-empted / influenced decision making and been used to validate the officers’ views. There were lines of enquiry that were not completed at the point of closure which could have changed the outcome of the assessment.

Current policy / guidance has been strengthened on how PLP cases should be managed with the creation of the Police Led Partnership Panel Meeting Plan. A structure has now been created to manage cases in PLP to draw together and oversee case management, this will reduce instances of cases being closed prematurely and allow the questioning of decisions made by CTCO’s and Supervisors. The standardised approach across the UK will hopefully create and promote consistent practices in the way PLP cases are managed. There are also mandatory requirements to supervise certain tasks baked into the PCMT system, such as PGA, Dynamic Investigation Framework (DIF), and Vulnerability Assessment Framework (VAF) completion.

Recommendation 12 – Consideration should be given to reviewing and strengthening the formalised structure of PLP case management in Policy / Guidance, and how this structure can be enforced across the different CTP regions in the country to ensure each PLP Panel meeting is run in a consistent manner. This could include Chairing oversight by a senior ranking officer, recording of those in attendance, minute taking, frequency of meetings, Case Management Plan creation, review of plans and potential for a live review of information placed onto PCMT where appropriate.

2nd Prevent Referral of AMR

Name different – different spelling Axel RUDUKUBANA

Reviewer comment – It is not known why this has occurred, there is potential that previous referrals will not show up in searches.

01/02/2021

Referral received by Lancashire police in the form of a ‘Concerns Form’ emailed to [the Lancashire Police concerns mailbox] from the designated safeguarding lead (DSL) at Acorns school. Note – surname is spelt as per 1st referral. The concerns form referenced an email from the DSL at the Range High School (where AMR was originally excluded for carrying a knife, then returned to attack the pupil in 2019). The referral states that a pupil brought to the attention of the DSL that AMR was posting on [social media] and the pupil was concerned about potential radicalisation content. Two screen shots were shared between the two schools and police. These images have been requested but were not made available to view. The PCMT system was not capable of handling file uploads at that time so no images were saved on PCMT.

Reviewer comment – The current PCMT system is now capable of storing uploaded files onto cases. These images have been requested and have yet to be provided, it is not known if these images were stored on [the CT Police intelligence system] at the time.

It was confirmed by the acting head at Acorns school that AMR was still on roll at the school.

08/02/2021

Referral recorded on PCMT.

Reviewer comment – Creation of record on PCMT – ref 37556. Case summary has linked the 1st referral to the 2nd referral despite spelling the surname differently.

Recorded as vulnerability present with no ideology.

09/02/2021

FIMU assessment – connection between the 1st and 2nd referral made by the FIMU. It is recorded that the new intelligence does not meet the thresholds for adoption at Channel and does not suggest he holds any extremist ideology. Recommendation is the case is suitable for closure.

Reviewer comment – it is believed that the FIMU has made this assessment which is on the notes within PCMT. The full FIMU assessment has been requested but has yet to be provided.

Learning point Q – As mentioned in the 1st referral the role of the FIMU is to fulfil the [risk assessment] and determine the route the case should take. Having an opinion on the final outcome of a Prevent referral or case can lead a CTCO to believe that the case is suitable for closure from the outset and influence future decision making.

Recommendation 8 applies to this learning point.

09/02/2021

[CTCO] contacted referrer by email to clarify if there were any other concerns regarding AMR. PCMT has recorded that there were no other concerns except those articulated in the referral.

15/02/2021

Case moved from Gateway Assessment to pending closure.

Reviewer comment – it is noted from the case history that the case has been progressed from initial assessment to pending closure prior to the assessment being completed. It is not known why this has occurred without speaking with the officer.

Learning point R – the 1st referral has static vulnerabilities identified, these have not been identified on this occasion.

Recommendation 13 – Considerations should be given to guidance with regards to how repeat referrals are combined with previous ones to reflect the repeat nature. A review of the multiple referral policy addendum should be conducted to consider whether learning points from this review should be included and whether the policy could be strengthened with regards to the actions required to be taken in light of the repeat referral.

Policy – there is now a Police multiple referral Policy in existence from January 2023. This articulates potential elevated risks for repeat referrals and particularly mentions the risks associated with referrals closed early in the process. The policy strengthens supervisory oversight and sign off in the event of multiple referrals.

15/02/2021

Reviewer comment – PGA – noted name spelt correctly as per the referral and 1st referral but not as per the subject entity created on PCMT for this 2nd referral.

Complex needs – Non evident at this stage

Grievances – non evident at this stage.

Learning point S – there is no reference to previous grievances from the previous referral.

Recommendation 3 applies to this point.

Engagement – non evident at this stage.

Reviewer comment – Foreign policy and Libya may be an indication of engagement at this time and needed further exploration.

Ideology – non evident at this stage

Individual groups and institutions – non evident at this stage

Capabilities – non evident at this stage

Intent – non evident at this stage

Opportunity – non evident at this stage

Internet and Social Media – The subject has commented on [social media] posts relating to Gaddafi. This has been assessed by FIMU as not new intelligence it does not suggest he holds any extremist ideology.

Learning point T – there is a reliance again on the opinions of the FIMU regarding the context of the referral. This point has been mentioned previously in learning point M.

Suspicious travel – non evident at this stage

Premises – non evident at this stage

Escalation Trigger Warning – non evident at this stage

Mobilisation or finishing behaviours – non evident at this stage

Assessed as – suitable for closure by CTCO. Conducted open-source research to attribute accounts to AMR and found none and spoken to the source of the referral to understand if there were any other concerns.

Reviewer comment – From the case notes the CTCO has reviewed the images in question. These have been requested by the Reviewer but have yet to be provided.

Supervisor comments – Comments that there is a distinct lack of additional information and agrees with the closure route.

Reviewer comment – this extract from the PCMT notes has been paraphrased by the Reviewer, the full comments can be viewed on the screen shots.

17/02/2021

Case moved from pending closure to closed. Rationale given to close is that there is a lack of information in all areas. Concerns were regarding posts online which are not deemed to be CT/DE relevant. No further safeguarding required, and that the supervisor is unable to see the previous referral on PCMT. A CTCO would expect to see all referrals and cases listed under the same person on the PCMT.

Reviewer comment – The supervisor may not have been able to see the previous referral on PCMT because the 1st case record was created under a slightly different spelling. The above case note reference is paraphrased but an accurate reflection of the comments recorded on the notes within PCMT, these can be seen on the screen shots provided to the Reviewer.

Learning point U – As the supervisor was unable to find the previous referral on PCMT this may have caused the case to be closed quickly on minimal information. This may be due to the 2nd referral being created on a new subject/individual entity due to the misspelling of AMR’s surname.

Recommendation 14 – A review of the current PCMT prompt screens should be considered to see if these prompts are sufficient to negate the need for a full data inputting standards manual and policy. If not, a data inputting standards manual should be considered and embedded into policy. Inaccurate recording of data (names, dates of birth, and data missing) can lead to previous information not being found by CTCO’s assessing a new referral and a potential failure to join the dots between referrals. A policy in this area may make it easier to hold users to account for their inputting standards.

23/08/2021

6-month review conducted – Connect, Morse and PNC checks conducted all yielding no new information.

Policy - CTCO guidance 2018 was now in place by the time of the 2nd referral. In this revised policy and guidance there was a shift in thinking with regards conducting post closure reviews. Reviews were to be conducted after a case had been either managed in PLP or Channel and minimum standards were to conduct these reviews at 6 months and 12 months post closure. There was no requirement for reviews to be conducted for referrals closed at initial assessment.

Reviewer comment – as per the 1st referral, a post closure review has been conducted. The review conducted fell outside of the review criteria as the case was neither adopted into PLP nor Channel. This review was beyond the requirements laid down in policy.

Summary of 2nd Referral

This second referral for AMR was dealt with swiftly. It is not known without speaking to officers making the decisions if opinions from the FIMU may have been influential in their decision making. The 1st referral was considered as well by both the FIMU and the CTCO, but it seems the Supervisor was unable to find the 1st referral to review.

As this was a second referral there were a number of potential lines of enquiry that have not been conducted so the assessment has been made on minimal information. These additional lines of enquiry could have been:

• Speaking directly with the source of the referral rather than asking a direct question by email.
• Obtaining a list of internet searches from the school.
• Speaking directly to the pupil who reported the concerns. This may have created an opportunity to view other material posted by AMR on [social media] and establish a user account to aid open-source research. CTCO knew there was [social media] but couldn’t find it by open-source research.
• Speaking to AMR’s parents.

The PGA is missing key information that was recorded in the 1st referral / PGA and which would still be relevant for this second referral, including on complex needs. This may have impacted on the decisions made.

This referral was closed without the level of professional curiosity expected bearing in mind this was a second referral. There were no policies in place or guidance regarding repeat or multiple referrals at the time although it was widely considered to be a potential increase in risk. From the Reviewer’s own experience, the repeat referral issue was being discussed as far back as 2014.

There is a potential that reliance on the 1st referral outcome has influenced how this 2nd referral has been dealt with.

As with the 1st referral, all the timescales and policy have been adhered to with regards to conducting assessments, both in the FIMU and Prevent.

3rd Prevent Referral of AMR

26/04/2021 – 3rd referral created on PCMT – PCM case ref 38648

Name misspelt, different to referral 1 and 2, individual created as Axel Muganwa RUDAKABANA –

Reviewer Comment – this is the second instance where the CTCO did not create a new case on the original subject entity within PCMT. However, the CTCO was cognisant of the repeat referral as it was referenced by both the FIMU and the CTCO on the notes within PCMT.

Policy note – A new national referral form has been launched in 2024 and Channel and Prevent duty guidance updated in 2023, which together help standardise how Prevent referrals are made and the referral pathways.

Primary activity recorded as ‘Radicalised’ and Ideology listed as ‘Vulnerability present but no ideology’.

Note added to the PCMT by [a police officer] describing all 3 referrals so far and the outcomes of each, recognising that AMR had been subject to repeat referrals. CTCO describes the 3rd referral as a potential ‘knee jerk’ reaction to advice given to the school that they can re-refer if they have further concerns. CTCO also states that AMR is awaiting an Educational, Health and Care Plan (EHCP), the referral is well intentioned and the new referral holds no CT/DE vulnerability and highlights AMR’s interest in world news and current affairs.

Policy – The multiple referral policy 2023 has now strengthened this area considerably.

FIMU assessment is captured in the PGA under the ‘Recommended Route’.

29/04/2021

Checks were recorded on PCMT, AMR has no other police contact except the incident on 11/12/2019.

Case moved from FIMU assessment to Gateway Assessment. Rationale recorded as having been assessed by FIMU as non CT/DE and vulnerabilities will be addressed by the EHCP.

Learning point V – Although the issue regarding FIMU assessments has been raised before it is worth noting this has occurred again. Previous learning points K and M apply.

Learning point W – FIMU check results do not appear to be recorded in detail on PCMT. This is challenging for anyone wishing to review case history, especially when making new assessments for repeat referrals.

Recommendation 1 applies.

07/05/2021

Case moved from Gateway assessment to pending closure. Rationale given as no CT/DE concerns and AMR is currently waiting for an EHCP and specialist education placement.

Reviewer comment – PGA copied into notes field on PCMT – noted that the date of the referral shown on the PGA is the same date as the 2nd referral for AMR, the PCM reference number is also that of 2nd referral. This suggests that the previous PGA (from the 2nd referral) was used in part for this new assessment.

Learning point X – CTCOs need to be mindful of accuracy when re-using forms previously completed or reusing previous entries / information. Due diligence needs to be exercised by both CTCO and supervisors to check details such as name spellings, dates of birth, dates of referrals and reference numbers are accurate.

Context is given regarding the referral and conversations between AMR and his teacher when [they] saw him with internet tabs open during lessons with ‘London Bridge’ being visible to the teacher. The teacher described the conversation with AMR as animated and passionate as though these topics were of great interest to him.

Complex needs – The subject has an ASD diagnosis and awaiting a EHCP and specialist educational placement.

Grievances – non evident at this stage.

Engagement – non evident at this stage.

Ideology – non evident at this stage

Individual groups and institutions – non evident at this stage

Capabilities – non evident at this stage

Intent – non evident at this stage

Opportunity – non evident at this stage

Internet and Social Media – The subject has commented on [social media] posts relating to Gaddafi. This has been assessed by FIMU as not new intelligence it does not suggest he holds any extremist ideology. Has been assessed as no CT/DE vulnerability and only highlights an interest in world news and current affairs which is a trait of ASD.

Suspicious travel – non evident at this stage

Premises – non evident at this stage

Escalation Trigger Warning – non evident at this stage

Mobilisation or finishing behaviours – non evident at this stage

Assessed as / Recommended Route – Closure

Reviewer comment – below is some content from the recommended route and assessment. Some of this shows a ‘FIMU assessment’ but due to the format of information cut and pasted onto the notes within PCMT it is difficult to determine the FIMU assessment from the CTCO’s comments.

CTCO acknowledges the previous referrals and looks holistically across all three referrals.

FIMU acknowledges all 3 referrals and gives a synopsis of each one and states that the 1st referral was closed with no CT DE concerns after a visit by Prevent officers and vulnerabilities lied elsewhere in a potential ASD diagnosis.

Learning point Y – The term used above to describe that AMR’s vulnerabilities lay elsewhere in a potential ASD diagnosis, may be overlooking that ASD (neurodiversity) forms part of the factors captured in the Vulnerability Assessment Framework used for Channel and should not be viewed as a separate issue to the vulnerability to being drawn into terrorism. AMR’s potential ASD and ‘special interest’, which frequently are combined, are part of the reasons that make him susceptible to being drawn into terrorism. When taken in context the potential special interests in mass killings, terrorist acts, and a capability to commit violence, then there is a potential vulnerability to being drawn into terrorism.

FIMU assessment continued – 2nd referral is described including the pictures sent to another pupil via [social media]. This was closed as no CTDE.

FIMU assessment continued – 3rd referral is described including the viewing of terrorist related reports, London Bridge being one of them, and speaking about Israel, Palestine, MI5 and the IRA. [An assessment was undertaken].

Reviewer comment– [A risk assessment was undertaken.]

After further recapping by [CTCO] the recommendation was to close the case.

Supervisor recommended route – Closure

Supervisor recommended comments - Agreed with [CTCO] assessment and recommendation to close the case as the individual has an interest in many different historical events and current affairs and displays no extremist rhetoric. Confirms that previous concerns have been sufficiently addressed and all levels of support from partners is currently in place.

Learning point Z – given the 3 referrals, the unknown nature of the engagement, and the high level of susceptibility, this should have been referred to Channel and not closed. The repeat nature to the referrals should indicate that more time is needed to assess this individual and a recognition that unknown risks / vulnerabilities may be apparent. These are now covered in the Multiple Referrals Policy that was published in January 2023.

10/05/2021

Case moved from pending closure to closed. Rationale given is that although AMR has been showing an interest in a recent London bomb and other news articles, CTCO conversation with the referrer has added some context to this. AMR is generally interested in history and current affairs which include Israel/Palestine conflict, IRA and London attacks. There are no extreme views, or CT/DE rhetoric and AMR shows a developing level of critical thinking regarding different viewpoints. The previous referrals were noted but did not feel that changed the outcome of the assessment and there was already support in place for AMR. The assessing officer felt that on the information currently held there was no risk of radicalisation and agreed to close the case.

Reviewer comment – the Reviewer has paraphrased from the note within PCMT.

Case closed as ‘Initial assessment Non-CT concern referred on’ and the case was referred back to the school.

This was the last entry on PCMT.

Conclusions

Overall, the Reviewer considers there to have been a high level of compliance by the Prevent officers with process timescales, assessment completion and adherence to policy that were in place at the time. But although processes and polices have been largely followed correctly, it is the subjective decisions that have come into focus. Identified throughout the review are a number of factors that may have impacted on decision making by CTCO’s:

1. The assessments made and opinions of the FIMU

While accurate in the context of [the policy on intelligence] guidance and assessor standards, the FIMU assessments were potentially used out of context in Prevent. This can lead to pre-empting or influencing of decision making within Prevent by both CTCO and their supervisors.

2. The question of ideology and the lack of it is the central theme throughout the handling of all 3 referrals

There may have been an over-emphasis on the presence of ideology to the detriment of considering AMR’s susceptibility. These two elements may have been separated and addressed in isolation rather than considered together. The joint HO/CTP letter sent to the Prevent network (Appendix C) detailing how mixed unclear and unstable referrals could be viewed encapsulates this point. However, it should also be noted that this letter has been viewed by some as ambiguous. The CTCO’s knowledge and understanding of this letter has not been established.

This emphasis on ideology can exist today and careful consideration needs to be given to referrals and cases where individuals are highly susceptible / easily influenced but lack a defined ideology. Since April 2024, there has been a change in categorisation of ideologies for all referrals and cases. If these new categories were applied today, his case could now fall into one of two new categories, either ‘No ideology – other susceptibility to radicalisation identified’ or ‘Fascination with extreme violence or mass casualty attacks.’

3. There were lines of enquiry that were not completed

As a result, they were not included in the assessments, which could have had an influence on the decisions made at the time. These enquiries should have been completed before key outcome decisions were made.

4. Potential risk from repeat referrals

The nature of multiple (3) referrals for the same person over a 17-month period, all with potential content that could be seen as Prevent relevant and high levels of susceptibility should have warranted increased scrutiny. As a result of the decision not to refer to Channel, all subsequent referrals were potentially viewed similarly. [There was a consistency in thinking throughout].

5. Assurance

The previous Prevent Case Management Tracker (PCMT) System in 2019 was closed to all personnel other than authorised police users. The current enhanced PCMT is a semi-closed system where the Home Office can access Channel cases after the Section 36(3) decision has been made by CTCO’s to refer the case to the Channel Panel, and up to the point of Channel closure and review. These limitations can make it challenging for the Home Office to scrutinise delivery or conduct urgent reviews. These challenges are pertinent to future Prevent Learning Reviews, studies into delivery, business assurance and compliance oversight. In this particular case, if the Home Office now wished to conduct research and analysis into repeat referrals to understand the national context and draw out learning, under current system restrictions, none of these referrals would be visible.

6. Police led partnerships

This case also raises questions regarding the initial use of Police led Partnerships instead of referring to Channel. This was done to enable a visit to AMR to take place. This seems unnecessary as the policy allowed for visits to take place during the PGA process if appropriate and by exception.

Considering all of the above, in the Reviewer’s opinion, there were sufficient concerns with the 1st referral to warrant the case remaining open and being referred to Channel, especially in light of the condoning of the ‘MEN’ attack. Channel is available to support individuals vulnerable or susceptible to being drawn into terrorism. There is not a need to prove a definitive terrorism connection for Channel, only that the individual is potentially at risk of being drawn into terrorism.

Suggested areas for future review

In conducting this Review, there were several areas not within scope which were identified for potential further research:

• Mental health interventions – what assessments and support were or could have been provided by the Vulnerability Support Hub, Child and Adolescent Mental Health Services, and Forensic Child and Adolescent Mental Health Services.
• FIMU training – what training is given for FIMU officers regarding Prevent, and what training is given to CTCOs regarding FIMU and [the policy on intelligence] guidance.
• Ideology – review of ideology as the sole/main focus for Prevent when complex needs are also identified.
• Trend analysis – thematic study of Prevent footprint cases to understand the correlation between how the cases were handled by police and Channel with regards to pre-Section 36 closure, PLP and Channel.
• Legislation – is the current test laid out in CTSA 2015 Section 36(3) of ‘reasonable grounds to believe’ too high a burden for an initial Channel referral, and could it be lowered to ‘reasonable grounds to suspect’.

Recommendations

Recommendation 1 – It is recommended that a standardised sharing of information product be considered for national use by all FIMUs when sharing the results of checks conducted for Prevent. This product should be agreed nationally, its use mandated and written into [the policy on intelligence].

Recommendation 2 – Further training should be considered regarding the circumstances where visits to individuals during the initial assessment can be conducted. The policy in 2019 and currently remains as visiting by exception, which could make the officers conducting the assessment feel constrained at this stage of the process. A review of how this is framed in the CTCO policy coupled with further training may help CTCO’s with regards to the decision to visit an individual at the initial assessment phase, without the need to progress the referral into PLP to achieve this.

Recommendation 3 – A review of current training for supervisors should be considered to strengthen that when signing off assessments as complete, all behavioural factors and motivations for behaviours have been captured on the assessments, whether deemed Prevent relevant or not. Current assessments do not include a Prevent ‘relevancy’ element to factors. The new Prevent Assessment Framework (PAF) due to go live in September 2024 goes some way to addressing the Prevent relevancy for each of the susceptibility factors.

Recommendation 4 – Consider whether CTCO guidance could be strengthened where internet usage / search history or other online activity is relevant. This could ensure CTCOs are proactive in obtaining and recording internet search results in order to adequately assess the referral and make sure the information does not remain unknown. However, this will need to be balanced against the limited capabilities for police to conduct intrusive surveillance within the Prevent process. The mandating of open-source research should be considered at the PGA initial assessment.

Recommendation 5 – Policy and guidance should be considered whereby referrals involving children and / or complex needs should be routinely referred to Channel unless immediate closure is the chosen option, or the CT risks are deemed too high for Channel.

Recommendation 6 – Full access to the current PCMT system is restricted to police only. While the Home Office has limited access, this should be reviewed, enabling scrutiny at all levels of Prevent delivery as part of quality and business assurance processes. This access will enable studies to be conducted of all parts of the process which will inform changes in policy and guidance and be able to hold key stakeholders to account.

Recommendation 7 - Each new comment on PCMT should be unique showing the officer has considered their views again. If there is no new information or no further updates then this should be articulated rather than copying a previous entry.

Recommendation 8 – It should be considered that Annex B be embedded into [the policy on intelligence] and not sit as an appendix. The policy should be explicit that it is for Prevent to determine closure once the referral has been handed to Prevent for action and initial assessment. It should be made clear that FIMU should refrain from suggesting Prevent outcomes as this may influence decisions made by CTCOs or support closure prematurely from Prevent.

Recommendation 9(i)– Consider a terminology change in Prevent management. CTP relevant should be replaced by the term ‘Prevent Relevant’. This differentiates it from the term used in the IMU which may have a slightly different meaning.

Recommendation 9(ii) - Currently Prevent referrals are assessed [under general risk assessment outcomes] by the FIMUs. Consideration should be given to Prevent having its own [risk assessment] outcome specifically which is clearly defined in policy. The current CTCO guidance coupled with [the policy on intelligence] Annex B guidance defines the roles of CTP Prevent.

Recommendation 9(iii) – [The policy on intelligence] Annex B appears a little dated and consideration should be given to a review / refresh. E.g the guidance refers to the purpose of Prevent is to ‘protect vulnerable people from being drawn into terrorism’ which is not an accurate term to describe Prevent.

Recommendations 9(iv) – Training for FIMU staff on Prevent should be reviewed to ensure a full current understanding of Prevent delivery and regular training refreshes delivered as part of continued professional development (CPD). Where training is deemed to be inadequate then the appropriate courses are built and delivered.

Recommendation 9(v) – Training for Prevent staff on [the policy on intelligence] guidance and FIMU delivery should be reviewed and where training is identified as inadequate the appropriate courses created and delivered, and regular training refreshers.

Recommendation 10 – CTCO policy should be reviewed to ensure all outstanding enquiries or information gathering is completed prior to closure.

Recommendation 11 – Static vulnerabilities can make an individual highly susceptible. Additional training should be considered, for those conducting assessments, on the importance of understanding the impact of static vulnerabilities on altering the risks of radicalisation. Where there are cases of limited engagement and complex needs, such as Autism in this case, then decisions to refer to Channel should be seriously considered. This would enable a professional perspective on the impact of the static vulnerabilities and a multi-agency approach to managing the susceptibility to being drawn into terrorism. This recommendation should be viewed alongside recommendation 5.

Recommendation 12 – Consideration should be given to reviewing and strengthening the formalised structure of PLP case management in Policy / Guidance, and how this structure can be enforced across the different CTP regions in the country to ensure each PLP Panel meeting is run in a consistent manner. This could include Chairing oversight by a senior ranking officer, recording of those in attendance, minute taking, frequency of meetings, Case Management Plan creation, review of plans and potential for a live review of information placed onto PCMT where appropriate.

Recommendation 13 – Considerations should be given to guidance with regards to how repeat referrals are combined with previous ones to reflect the repeat nature. A review of the multiple referral policy addendum should be conducted to consider whether learning points from this review should be included and whether the policy could be strengthened with regards to the actions required to be taken in light of the repeat referral.

Recommendation 14 – A review of the current PCMT prompt screens should be considered to see if these prompts are sufficient to negate the need for a full data inputting standards manual and policy. If not, a data inputting standards manual should be considered and embedded into policy. Inaccurate recording of data (names, dates of birth and data missing) can lead to previous information not being found by CTCO’s assessing a new referral and a potential failure to join the dots between referrals. A policy in this area may make it easier to hold users to account for their inputting standards.

Appendix A – Terms of Reference

Security classification: OFFICIAL - SENSITIVE

Suitable for publication scheme? No

Handling: Not to be distributed without permission of owners.

The review is taking place sub judice and is therefore potentially disclosable in criminal and other proceedings. It must not be publicly commented on or published by any party until such time as it is disclosed in open inquest/court proceedings.

Senior clearance: Cleared by Home Office and CTPHQ seniors:

• Cathryn Ellsmore – Prevent Deputy Director DSU
• Maria Lovegrove - Head of Interventions

Force/organisation: CTPHQ

OCU/Unit: Interventions HQ

Date created: 29/08/24

Version: V2

Axel Muganwa Rudakubana Case Review

Review of Prevent engagement 

Version 2 reflects further provisions made with the SIO Merseyside and CPS as part of the review’s commitment to not jeopardising the justice process or compromising the accused’s right to a fair trial. Timings and provision for an oversight reviewer also updated.

Background

Name: Axel Muganwa Rudakubana

Address at point of referral: [Home address]

Date of Birth: 07/08/2006

Period under review: The period under review is December 2019 – April 2021 inclusive. This covers the period of the three Prevent referrals received:

*December 2019

*February 2021

*April 2021

PCMT Ref: PCM-31490; PCM-37556; PCM-38648

On 29 July 2024, eleven children and two adults were attacked with a bladed weapon by a 17-year-old, British national male in Southport, who was detained by police at the scene. It has been confirmed by Merseyside Police that three of the victims have died: Bebe (a six-year-old girl), Elsie (a seven-year-old girl) and Alice (a nine-year-old girl). The alleged perpetrator, Axel Muganwa Rudakubana, was referred to Prevent for assessment three times between 2019 and 2021. All Prevent referrals are subject to an initial assessment by Counter Terrorism Policing (CT Police). This falls within the North West CTU. Each time he was deemed unsuitable for intervention at that initial assessment stage; he was not referred to Channel. As AMR had been referred into Prevent prior to the alleged incident the thresholds for commencing a PLR were met, which has triggered an internal case review to determine the engagement of Axel Muganwa Rudakubana with Prevent, during the period 2019 – 2021.

The alleged perpetrator has been arrested and faces three murder charges, 10 attempted murder charges, and a charge of possession of a bladed article. This matter is ‘Sub Judice’. This review process must be mindful of, and not hinder or jeopardise any ongoing police investigations or judicial proceedings linked to this case. We will liaise with the SIO to ensure the integrity of the investigation is preserved.

Purpose, aims and objectives of the review

Purpose

To undertake an independent Prevent case review, jointly commissioned by Homeland Security Group (HSG) and Counter Terrorism Policing Headquarters (CTPHQ) to identify whether and how national policy may be improved or operational learning identified following a terrorist attack (domestic or international), a TACT offence or a serious violence non-TACT offence with a Prevent footprint.

The Prevent Learning Review (PLR) structure exists to identify opportunities for improvement and effective practice in the Prevent system (including the Prevent pathway and case management systems) throughout the CT network, ensuring that any identified organisational learning is captured, assessed and acted upon.

The reviewer must be cognisant of any ongoing criminal investigations and proceedings. Any review must articulate clear parameters and good governance to ensure it does not hinder nor jeopardise the investigation or judicial proceedings linked to this case.

The reviewer has been appointed based on their expert knowledge of the current and developing Prevent system.

Jonathan Hall KC was initially proposed as providing independent oversight, scrutiny and credibility of the PLR process, and this was reflected in initial Terms of Reference. A copy of the draft PLR was provided to him on 23 August 2024. However it was subsequently agreed that it would be impossible for Mr Hall to fulfil this role in the time proposed and without sight of the underlying documents. Given the importance of identification of significant learning points quickly some documents have not been located within the demanding timescales and some owned outside the Prevent systems have not yet been cleared for release to the technical Reviewer.

Mr Hall met with the Technical Reviewer, on 28 August 2024 in a critical friend capacity and discussed the report with the Technical Reviewer to provide suggestions and feedback for the Technical Reviewer to consider. Mr Hall has indicated he would be happy to have further critical friend engagement if that were useful.

Aim

To review the Prevent footprint of the alleged perpetrator AMR through the information available from 2019-2021 (the ‘Review Period’), including any known vulnerabilities and risk factors, and the operationalisation of Prevent policy. This may include existing agency involvement with the alleged perpetrator AMR (e.g safeguarding, educational support and assessment of mental health), including Prevent handoffs to these support systems to identify any evident missed opportunities in this case.

To perform a review to identify effective practice, organisational learning opportunities and highlight any further areas for development.

Objective

The thematic areas to be considered during the review are:

• To review the extent and nature of engagement by Prevent within the context of the legislation, policies and procedures in place during the Review Period.
• To review the extent to which the alleged perpetrator AMR engaged with Prevent and the decisions made during the Prevent Gateway Assessments.
• To explore the alternative multi-agency support received by the alleged perpetrator AMR during the Review Period and whether these informed Prevent decisions. In particular, to capture:
  • Onward referrals post NFA.
  • Any ongoing support systems in place.
• To review what tactical options for the assessment and the mitigation of risk, threat and vulnerability were available during the Review Period.
• Explore any missed opportunities in this case, if evident.
• Identify organisational learning opportunities arising from the review for implementation across Prevent policies and processes.

The objectives within each of the thematic areas are:

• What learning is there from this case that may require action by the Home Office to develop recommendations for current Prevent policy?
• What learning can be identified requiring action by CTPHQ/CTPNW to develop recommendations for current CT police policy nationally?
• Is there evidence of good practice pertinent to the context of Prevent delivery at the time?
• Were the assessments of risk and decisions made at the Prevent Gateway Assessments proportionate to the referrals received?
• Are the range of Prevent improvements and best practice applied since the Review Period sufficient in addressing the learning identified, or are further improvements required?

Process and timescales

Expectations

No activity should take place that might compromise, jeopardise or in any way undermine the integrity of ongoing criminal investigations or judicial proceedings. We will liaise with the SIO to ensure the integrity of the investigation is preserved.

All participating services shall prioritise the release of identified staff to attend meetings as required by the reviewer and overseeing reviewer.

Confidentiality must be maintained by all participants involved in this review. The reviewer and all other participants must sign and adhere to a confidentiality agreement and a declaration of interests prior to attendance. If deemed evidentially relevant by the SIO, the reviewer/overseeing reviewer will share information with the police to support any investigations and prosecutions in line with appropriate processes.

Both the report and the information therein may be subject to requests for disclosure under the Freedom of Information Act 2000 or rights of access under the Data protection Act 2018. The availability of any exemptions or restrictions to disclosure will depend on the nature of the information requested. Any request to disclose information will not be actioned before it has been considered by the reviewer/overseeing reviewer and appropriate legal advice sought as needed.

Any request to disclose information under FOIA will be forwarded without delay to CTPHQ’s FOIA Mailbox and the Homeland Security’s FOIA SPOC at:             

[Police FOI emails].

Any right of access request under the DPA will be passed without delay to the CTPHQ’s RoAR mailbox and the Homeland Security’s DPA SPOC at: [Police and Home Office FOI emails].

CTPHQ and HSG will determine who will reply to any request and will, where appropriate, consult with the reviewer/overseeing reviewer prior to any response to a request under FOIA or a right of access request under the DPA/UK GDPR.

As the review has been jointly commissioned by the Home Office and CTPHQ for internal use only rather than external publication, the resulting report is jointly owned. No party can publish without agreement from the other party.

The following principles will form the basis for the core of this review:

• objectivity and independence
• evidence-based
• to learn lessons, not blame individuals or organisations, to prevent future harm
• respecting inclusion, equality and diversity
• openness and transparency whilst safeguarding confidential information

Below is a non-exhaustive list of potential resources to support the review. The timescale for responding to requests for the submission of documentation/records for inclusion is the same day the request came in or, at maximum, within one working day.

Review of policy, procedure and guidance:

• CTPHQ referral and assessment documentation recorded on PCMT

• Home Office - National Counter Terrorism Strategy Prevent strategy documents for England and Wales for the period of 2019 to 2021. 

• Home Office - policy and guidance documentations for partner and agency involvement in Prevent. 

• Home Office - policy and guidance documentation on the assessment of risk and vulnerability used within Prevent. 

• CTPHQ - policy and guidance documentation for Prevent policing in England and Wales enacted during 2019 to 2021, plus current doctrine for comparison.  

Methodology:

• Collation of key policy and guidance documents in place at the time of each referral.
• Collation of key case specific documents relating to each referral made and the Prevent journey taken. These to include but not exclusively, Referral documents, Intelligence Management Unit assessments [risk assessments], any separate triage and assessments that took place for each referral during or directly after the [risk assessments], Police Gateway Assessment (PGA) and all data contained on the Prevent Case Management Tracker (PCMT).
• Review of all documents collated and benchmark processes against policy and guidance.
• Identify any gaps in available documents.
• Identify and scrutinise key decision-making points for each referral (Making a Referral, [risk assessment], PGA) to understand practitioner thinking and rationales for decisions.
• Identify from collated documents potential further areas for review once this initial PLR is concluded.
• Compile a report of findings to be reviewed by HSG and CTPHQ including where best practice has been identified along with areas of learning.
• No interviews with practitioners will take place to protect the integrity of Police and Coroners Investigations.

The estimated timescales are:

• Terms of Reference agreed by 6th August.
• Debriefs and policy/case information provided by 7th August.
• Doctrine reviewed and any key lines of enquiry identified by 9th August.
• Key lines of enquiry responded to by 13th August.
• Draft report forwarded to agreed distribution list and checked for factual accuracy by 15th August.
• Further amendments and completion of final report by 23rd August. Submission to the Jonathan Hall KC by 23rd August.
• Jonathan Hall KC to provide suggestions and feedback, if required, by 30th August.
• Final report to be provided to CTPHQ and HSG by 2nd September.

This timeline has been agreed between CTPHQ and HSG. This may be subject to change if any CT or other significant incident occurs during this period.

Disclosure / sensitivities

The review may be subject to CPIA. A process must be agreed for regular liaison with the SIO of the ongoing criminal investigation so that documents produced by the review can be assessed for relevance and CPIA compliance. This is a current live investigation, and all parties must be aware that documents may be subject to disclosure.

This case has a lot of sensitivities, and it is vital that the case and details of the Prevent history are handled sensitively and securely.

Handling and disclaimers

• This is intended as an independent review to provide an objective, neutral and impartial understanding of Prevent processes and decisions.
• It is fully recognised that at commencement of this review, prosecution has commenced with authorisation of charges. Criminal proceedings are therefore active (sub judice). It should be recognised, therefore, that any review of any element of that case or of any of the circumstances leading to the incident could impact the prosecution profoundly. 

• To protect the justice process and ensure that the review does not compromise a fair trial:

  • The review will have strict handling instructions and a limited circulation list, with handling caveats. It will not be shared widely and we will retain details of who it is disclosed to.
  • The review will not be publicly published or commented on publicly by any party until such time as it is disclosed in open inquest/court proceedings. This includes making any reference to it in media interviews, or to wider audience.
  • The review will be appropriately disclosed to the SIO via the usual disclosure processes to ensure it can be considered under CPIA.

• The scope of this Review should remain focused to the work-streams suggested above and is not in any way intended to impact, review, or link to the live investigation. 

• Whilst the final document may attract a GMPS of SECRET there may be a need to prepare an Official Sensitive version to inform internal HSG and CTPHQ processes and policy. The reviewer must also prepare a public-facing report.  Any redactions to a public-facing report will be determined by CTPHQ in consultation with HSG.

• Any Organisational Learning recommendations will be progressed by CTPHQ/HSG.
• In light of information brought to the reviewer’s/overseeing reviewer’s attention, these terms of reference may be subject to review and revision at the discretion of the reviewer/overseeing reviewer.
• The participants will sign a confidentiality agreement as set out above.
• All participants will ensure that information provided as part of the review are only used for the purpose of the review, are not disseminated further, and are deleted on completion of the review.

Participants and distribution list

CT Policing

DSU Maria Lovegrove Head of Interventions (Prevent and Nominal Management)

SNC Vicki Evans

[Other relevant junior police staff]

Home Office, Homeland Security

Michael Stewart, Director of Prevent Directorate

Cathryn Ellsmore - Deputy Director Prevent

[Other relevant junior Home Office staff]

Appointed Independent Reviewer

Anthony Jenkyn

Appendix B – List of documents requested

Documents requested and supplied and those requested and not supplied.

Below is a list of documents requested by the reviewer.

Some documents have not been supplied due to various constraints:

• The timescale for the review and the restraints that has created.
• There is an active Murder investigation ongoing and Senior Investigating Officers (SIO) approval will need to be sourced prior to the release of documents. This was not able to be done due to the time constraints for this review.
• The reviewer is also cognisant of an active Coroners Investigation which could be jeopardised by the unauthorised release of information relevant to the Coroners enquiries.

As a result of the missing information this review needs to be considered in the context that it was completed based on all the available information at the time.

Documents requested and supplied

Resource	Resource type
Referral form (information on PCMT) x3 – for each referral	Case
AMR criminal history	Case
All records listed on PCMT (including referrals, decisions and rationale) for AMR	Case
DIF completed for each of the three referrals (one, two, three) – screenshots of PCMT	Case
Blank DIF with explanatory notes (2019 and 2021 versions)	Policy
Relevant section of [the policy on intelligence] v4 (concerning CTP relevance definition)	Policy
FIMU policy ([the policy on intelligence] Annex B received - v3 from 2018, v4 from January 2021, current version from 2024)	Policy
Vulnerability support hubs policy (built into CTCO guide)	Policy
Prevent referrals for AMR	Case
CTCO Guidance (Prevent for Police Practitioners 2018 then CTCO Guide 2020)	Policy
CTPHQ Prevent Policy (Prevent for Police Practitioners 2018 then CTP Prevent Policy 2020)	Policy
CTPHQ Counter Terrorism Case Officer Guide (this is the same as the CTCO guide)	Policy
Prevent Gateway Assessment (included within the Prevent Policy and the CTCO guide)	Policy
Dynamic Investigation Framework (included within the Prevent Policy and the CTCO guide)	Policy
PDG 2015 (original and revised) and PDG 2023	Policy
CDG 2015 (original and revised) and CDG 2023	Policy
CTSA 2015	Legislation
Criminal Procedure and Investigations Act (CPIA) 1996	Legislation
2019 Letter to practitioners on MUU ideology category	Correspondence
Training for CTCOs between 2019 and 2021 (overview and records)	Training
Current policy on re-referrals	Policy
Dovetail policy (Home Office version and CTPHQ version)	Policy
Prevent Assessment Framework (PAF) form	Policy
PLP information, panel meeting structure and confidentiality statement	Policy

Documents requested and not supplied

Resource	Resource type
Referral form (original) x3 – for each referral	Case
FIMU assessments for each referral	Case
DIF completed for each of the three referrals (one, two, three) – originals	Case
Information gathered prior to s36 for AMR	Case
Case management plan for PLP of first referral	Case
Vulnerability support hubs involvement (footprint, triaging, supporting documentation for assessments) for AMR for the first referral*
(*the system was checked and there did not appear to be any footprint or referral)	Case
List of ‘inappropriate searches’ conducted by AMR using the school computer (in relation to the first referral)	Case
Results of device examination by police (in relation to the first referral)	Case
Photos connected with second referral ([social media])	Case
Any open-source research conducted in relation to each referral	Case
Operation policy for North West early triage system	Policy
Methodology and meeting notes for NW triage system (discussion points, outcomes) for AMR	Case
Full [policy on intelligence] guidance	Policy

Appendix C – Joint letter from HSG and CTPHQ in 2019 regarding MUU

OFFICIAL-SENSITIVE

25 June 2019

Sara Skodbo                                                      
Director Prevent, RICU and JEXU                                                              
OSCT, Home Office                                                                        

Chief Superintendent Nik Adams
National Coordinator for Prevent
Counter Terrorism Policing Headquarters

Dear Police RPCs, Channel Panel Chairs, Local Authority Prevent Coordinators, Higher and Further Education Prevent Coordinators, Prevent Education Officers, and Health Prevent Coordinators,

We write to you to set out our joint position on managing individuals with unclear, mixed or unstable ideologies, as the National Coordinator of Prevent for CT Policing and Director of Prevent in OSCT.

The changing terrorist threat to the UK is well documented. The shift in scale has been accompanied by a diversification in the nature of the threat, with an increased threat of attacks using less complex methods by small groups or individuals. This has led to a number of stakeholders asking how they should manage individuals with unclear ideological motivations.

In some cases, the ideology is obvious, well embedded and appears to be the primary factor that is drawing an individual towards supporting or engaging in Terrorism Act (TACT) offences. In these circumstances identifying and challenging that ideology is likely to be an essential part of how you would seek to reduce that individual’s vulnerability, and the risk posed to themselves and to the public.

However, for an increasing number of individuals being referred to Prevent, ideological drivers can appear mixed, unclear or unstable (from about 700 referrals in 2016-17 to almost 2,000 in 2017-18). Anecdotal evidence suggests that this group commonly present with multiple and complex vulnerabilities (such as criminality, substance misuse, social isolation and poor mental or emotional health, and so on). In such cases it often appears that people are being drawn towards an extremist ideology, group or cause because it seems to provide them with a ‘solution’ to the other problems in their lives, or an outlet to express problematic and dangerous behaviours that they may have developed.

We have seen many similar and often overlapping Prevent case examples, including individuals who:

• demonstrate an interest in multiple extremist ideologies in parallel, such as Salafist militant jihadism and ‘white supremacy’
• switch from one ideology to another over time

• target a ‘perceived other’ of some kind (perhaps based upon gender or another protected characteristic), but do not otherwise identify with one particular terrorist ideology or cause

• are obsessed with massacre, or extreme or mass violence, without specifically targeting a particular group (e.g. high school shootings)
• may be vulnerable to being drawn into terrorism out of a sense of duty, or a desire for belonging, rather than out of any strongly held beliefs

It may be helpful to recap what differentiates terrorism from other forms of violence. The Terrorism Act 2000 defines terrorism as:

(1)  … the use or threat of action where:

(a) the action falls within subsection (2)

(b) the use or threat is designed to influence the government [or an international governmental organisation] or to intimidate the public or a section of the public and

(c) the use or threat is made for the purpose of advancing a political, religious, racial or ideological cause

(2) Action falls within this subsection if it:

(a) involves serious violence against a person

(b) involves serious damage to property

(c) endangers a person’s life, other than that of the person committing the action

(d) creates a serious risk to the health or safety of the public or a section of the public or (e) is designed seriously to interfere with or seriously to disrupt an electronic system.

(3) The use or threat of action falling within subsection (2) which involves the use of firearms or explosives is terrorism whether or not subsection (1)(b) is satisfied.

Note that the Act does not define or limit what is meant by “political, religious, racial or ideological cause”, nor does it restrict “ideological cause” to being political, religious or racial, or to being solely those ideologies held or promoted by proscribed organisations. The Act certainly does not stipulate that a perpetrator has to have a long-standing and deep-seated belief in the ideology or cause that he or she is ostensibly supporting by committing a TACT offence.

Also, it’s worth noting that the “threat” of relevant “action” is technically enough to complete a TACT offence, and that where this “action” involves the “use or threat” of firearms or explosives, there need be no specific intention on the perpetrator’s part to “influence” (or intimidate) the government or public.

Some individuals seek to support or enact TACT offences without a clear understanding of the ideology or cause they are ostensibly supporting. Therefore individuals whose ideological motivations are unclear, mixed or unstable, but who demonstrate a connection to, or personal interest in, extremism, terrorism or massacre, should be given the same consideration for support as those whose concerning ideological motivations are more consistent and obvious.

This letter may raise the question of whether we are seeking to expand the remit of Prevent. We are not.

We are providing clarification of our responsibilities in relation to the Terrorism Act, and seeking to ensure that everyone who needs support receives it, and of course to protect the public from the risk of all vulnerable people who are being groomed, coerced or self-propelled towards TACT offences.

In 2017-18, 8% individuals referred to Prevent due to concerns around Islamist extremism or right-wing extremism ultimately received support via Channel. The

corresponding figure for individuals referred due to concerns about ‘mixed, unstable or unclear’ ideologies was less than 1%. While there are likely to be many reasons for this, as we have seen in recent tragic attacks, the motivations of the terrorists responsible sometimes remain unclear even after the event, so we need to pay due regard to this complex issue in order to better protect the public.

We have received a number of questions from across the country about how to manage such individuals. Our guidance in response to these questions is to ensure that people receive the support they need if they are vulnerable to being drawn into any form of terrorism described within the Act.

When it comes to preventing people being drawn into terrorism, our responsibility is to offer interventions and support to all individuals who are at risk, irrespective of whether that risk is being driven by a true belief in an ideological cause or group, or whether an involvement to either of these is being driven by other vulnerabilities and complex needs.

The power of Prevent lies in tackling vulnerability early to prevent future harm. Oversimplifying the assessment of risk to offer support only to those with a very clear or embedded extremist ideology risks missing opportunities to support those with perhaps less obvious, but no less relevant or urgent, vulnerabilities.

Experience has demonstrated that preventing people being drawn into terrorism can be very challenging, often involving complex individual needs that have no simple or single-service answer. We therefore recommend that the content of this letter is discussed within your local Contest and/or Prevent Boards and within your Channel Panel meetings. We ask you to consider carefully the following:

• Draw on the professional judgement and experience of your colleagues, and ensure those making decisions understand their specialist area in the context of CT risk. This is to ensure individual interventions are considered in the context of their impact on the overall risk;

• do not restrict your preventative work only to individuals associated with the ideologies of formally proscribed organisations;

• consider those individuals who appear to have an interest in multiple, concurrent, and even contradictory extremist ideologies or causes, or who seem to shift from one extremist ideology / cause to another;

• do not necessarily rely on vulnerable individuals to be able to identify, understand or describe with coherence their own ideological motivations as a measure of the risk of being vulnerable to being drawn into terrorism; and,

• consider the possibility of an individual’s obsessive interest in public massacres of any kind as a possible signal of vulnerability.

Our teams within CTPHQ and OSCT are happy to discuss any cases where further guidance is required, and we thank you for your continued support and determination to protect vulnerable people and keep our communities safe from terrorism.

Yours sincerely,

Sara Skodbo, OSCT                                                                                   

Nik Adams, CTPHQ

Appendix D - Prevent referral process

Making a Prevent referral

A Prevent referral can be made by anyone who is concerned about someone they believe to be at risk of radicalisation or being drawn into terrorism. This could be a family member, friend, colleague, or a professional. Before making a referral, an individual might choose to seek advice from a safeguarding professional, the police, or from their local authority. It is important that the full context of an individual’s behaviour is considered where a radicalisation concern is identified.   

Once a concern has been raised with the Local Authority, safeguarding lead, police, or an equivalent person, they will consider whether the concern warrants a referral to Prevent, or whether a different intervention is required, such as a referral to a local authority multi-agency safeguarding hub. If they consider a Prevent referral to be appropriate, they will complete the Prevent National Referral Form. This documents biographical information on the individual of concern, the behaviours that have been noted, and any wider information that is known about the individual’s vulnerabilities or wider risk factors. Once complete, the referral will be sent to CT Police for assessment.  

CT Police risk assessment

CT Police assess each Prevent referral. They will check if there is an immediate security threat and gather information from safeguarding partners and other agencies to determine if there is a genuine risk of radicalisation. Only those referrals meeting the Counter Terrorism and Security Act 2015 (“CTSA”) threshold of ‘reasonable grounds to suspect that an individual is vulnerable to being drawn into terrorism’ are progressed beyond this stage. This initial screening of referrals is known as the Prevent Gateway Assessment and uses the Dynamic Investigation Framework (DIF) to triage and assess referrals. The DIF will be replaced in late-September 2024, by the Prevent Assessment Framework – a triage and risk assessment tool developed by experts within the Ministry of Justice’s CT Assessment and Rehabilitation Centre. 

If at this stage, CT Police assess that the person is not at risk of radicalisation, the case is not progressed further for Prevent. To close a referral at the Prevent Gateway Assessment stage requires a high standard of justification – the police officer must hold a “reasonable belief” that there is no Prevent issue present. Where appropriate, the individual may instead be offered other support, for example being referred to mental health services or social services. If referred to other services at this point, their involvement with Prevent ends, their case is not progressed, and Prevent does not track their future outcomes. Individuals can be referred to Prevent again, should there be concerns over their susceptibility to radicalisation.  

Prevent case management 

If CT Police assess there to be a risk of radicalisation, the referral is forwarded for consideration by the local Channel panel (a statutory requirement for each local authority). Channel multi-agency panels meet monthly, are chaired by the local authority, and include a wide range of partners, including CT Police, social services, education professionals, mental health professionals, and other partners that the panel consider relevant to the case (i.e. housing, immigration, third sector partners).   

The Channel panel will assess and discuss the referral. The Vulnerability Assessment Framework (VAF) is the mandated assessment tool used within Channel. It assesses an individual’s susceptibility to being drawn into terrorism against 22+ factors, divided into engagement, intent and capability. This tool will be replaced by the Prevent Assessment Framework in late-September 2024. The Channel panel will use the assessment to collectively decide on a tailored package of support that can be offered to the person to help them move away from harmful activities and ideas. This can include education and health support, mentoring from a specialist in countering extremist ideologies, or support in making connections in the local community. 

Channel is voluntary and people who are referred to Prevent must give consent (via a parent or guardian if they are underage) before they can receive support. If a person does not engage with Channel, alternative forms of support may be available from the local authority or other providers. Any risks are then carefully managed by the police. 

Individuals will exit support once the Channel panel considers there to be no remaining radicalisation risk. After exiting, each case is reviewed at the six-month and twelve-month points to ensure that no further radicalisation risks have emerged. They are then closed to Channel.

Police-led partnerships 

If the police assess the CT risk an individual poses is too high for Channel, the case will be managed by Police-led Partnerships (PLP). CTP can also manage the case in PLP if they determine there is a CT risk that needs addressing. 

Police-led Partnerships operate in a similar way to Channel and draw on support from statutory multi-agency partners. A case can be escalated to PLP or Pursue at any point in the process.  

Only a relatively small number of cases are managed by Police-led Partnerships. Channel is the preferred route for the management and support of Prevent cases as it is a statutory requirement, there is strong multi-agency participation, and it offers the widest range of interventions.

Footnotes

1. Dovetail is the collective term used to cover the piloting of the Channel case management function by local authorities (between 2016-2024), normally undertaken by Counter-Terrorism policing (CTP). Designated local authority (single) sites were introduced in 2016, with a North West regional site (spanning the NWCTU region) introduced in 2019. The Counter-Terrorism and Border Security Act 2019 extended provision for local authorities designated by the Home Office to make the section 36 decision, however, the Prevent Gateway Assessment function in Dovetail areas was retained by CTP in line with national practice. ↩