The suicide bombing outside of an Ariana Grande concert at the Manchester Arena piqued concern around the globe about vulnerable points in venue security plans, and the ongoing public inquiry into the attack has exposed what happened that night with the intent to highlight what more can be done to stop such incidents in the future.
But what can the public, who is told to say something when they see something, take away from the case of a lone bomber who waited for young concert-goers and their parents to pour out of an arena after the show? What can security personnel learn from the case in which a few people thought something was a bit strange but the dots weren’t connected in time? And what can operators of venues, from a neighborhood café to a large arena, take away from the bombing in which the perpetrator lurked and surveilled the landscape before putting his deadly plan into action?
This fall the independent inquiry was launched into the Manchester attack, a stream of testimony and analysis expected to last until spring. Recent evidence has focused on the venue security and the vulnerabilities that the terrorist exploited in order to detonate his bomb. The lessons from the inquiry can be applied to security for public events and in public spaces as terrorists will inevitably try tested as well as novel tactics to target obvious and more obscure points in a nation’s infrastructure.
The bomber
On May 22, 2017, 22-year-old UK native Salman Abedi detonated an improvised explosive device packed with nuts-and-bolts shrapnel and concealed in his backpack outside the doors of the concert – an interior area known as the City Room – attended by more than 14,000 people. Abedi killed 22 people and injured more than 800. After the attack, a picture unfolded of a college dropout who was known to police as a petty criminal, who eventually radicalized and learned bomb-making – even using student loans to finance the terror plot.
After the blast, ISIS hailed it as a harbinger of how it was going to “shift its focus towards carrying out attacks on Crusader soil.” The terror group would go on to encourage more attacks at musical venues in line with its broader threat focus on pinpointing infrastructure vulnerabilities, with propaganda posters from pro-ISIS media outlets encouraging tactical variety including knife attacks on concert-goers.
Mohammed Ali Agha, who worked part-time as a venue security guard, said fans arrived at the concert between 6 p.m. and 7 p.m. that night, by which time “the majority of the persons attending the concert had arrived, but there were still a slow stream of people passing through this area going to Victoria Station,” Agha said in his witness statement to the inquiry. It was at this time that he noticed a man in his twenties with a short beard, glasses, wearing a ball cap and jacket, and a “large camping type” backpack on his back. The man went and sat at the top of a flight of stairs, not within eyesight of Agha at all times as he guarded the arena’s doors at the City Room, and stayed there until 8 p.m. when “he then walked towards Victoria Station area and across the bridge out of my sight.” The man returned to the perch on the stairs about 15 minutes later.
At 8:50 p.m., a man approached Agha and reported the man with the backpack as suspicious. “I immediately told the male not to worry, I would report his concerns as soon as possible,” Agha told the inquiry. He reported the concerns “several moments later” to colleague Kyle Lawler, who had approached from the Victoria Station bridge area. “Kyle and I stood staring at this male for about a minute. Kyle watched him for a longer period than me; the male was aware that we were watching him and as a result became nervous and began to fidgeting with his hands. Kyle then told me that he would radio the concerns raised about this male into control,” Agha said, adding that Lawler returned to his Victoria Station position. As the number of people waiting for concert attendees and foot traffic grew at 10:30 p.m., Agha noticed the man with the backpack walking toward crowds.
“The male had his phone in his right hand; he was talking on his phone and was smiling as though he was very happy to be talking to the person on the phone. I assumed he was meeting someone and had found his friend; at this point, people starting pouring out of the concert. I stood looking for this male but he was lost to me in the crowds exiting the arena,” Agha continued. “I then started looking for him standing on my tiptoes, trying to look over the heads of the exiting crowds, I couldn’t see him; seconds later there was a loud explosion and deafening noise, followed by an orange bright light; I was then hit by a great force that lifted me off the floor, throwing me back against the east doors where I ended up lay on the floor. Initially I was unable to see or hear anything; my ears were also ringing.”
William Drysdale, who was working at the arena on the night of the bombing as part of a security company operation against counterfeit concert merchandise, noticed the bomber that night because the large backpack could have stored bootleg items to be hawked to concert fans. “As I looked for a little bit longer I saw him rocking back and forward. I couldn’t tell if he was kneeling or sitting, because he was quite low behind a 3-foot wall which he was behind, as we were just at a slight angle from him. I knew he wasn’t standing, because the wall is only very small,” Drysdale told the inquiry in his witness statement. “…I saw him and thought to myself, ‘He’s just praying, it’s not a bootlegger.’” A couple of minutes later, the concert finished and he went to meet up with his colleague Julie Merchant in the foyer area outside the arena. They talked for only a minute or two before Drysdale “heard a single huge ‘boom’ coming from where I had just been.”
Merchant told the inquiry that when she first saw Abedi she thought he was overdressed for the weather but didn’t think his large backpack was a concern because it was a “not unusual thing to see at Victoria Station.” Merchant saw him praying in the location on an upstairs level a short flight of stairs above the City Room – a CCTV blind spot. Although she said she assumed he was a traveler instead of a terrorist, she said she reported Abedi to a passing British Transport Police (BTP) officer “because he was in an area he should not have been, an area that is all tucked away.” She referred to him as a “nutter” and said police “didn’t seem that interested – none of us were suspicious of him and I think we were aware of being overtly un-PC.” The officer has told the inquiry that she did not recall the conversation.
Neither Drysdale nor Merchant had seen anyone praying outside the arena in all their time working events but said they didn’t consider the behavior suspicious – just unusual.
The venue
In a place so busy, so patrolled, and so seemingly wide open, Abedi found the blind spots and the weak spots. He was even off camera for an hour, hanging out where there was no video surveillance but where he could see when people started coming out of the concert. When he was on CCTV he was largely alone, with a few other people about.
And even though Abedi couldn’t access the concert itself, and didn’t try, his choice of the City Room – both a walk-through and a waiting area – meant he was able to essentially pin down all these emerging concert-goers and their waiting parents in this large lobby between the train station and the parking garage.
Showsec supervisor David Middleton told the inquiry that the mezzanine blind spot where Abedi waited for so long was not checked by security staff: “We were to keep the steps clear but above the steps was not our domain,” he said.
“Access control roles were monitoring ingress from outside of the City Room doors – looking for individuals who do not fit the audience demographic, for example lone males, people with large bags, but remembering also that it’s a thoroughfare for a major railway station and car park, so you do get people walking through all the time with suitcases and large bags,” Middleton said. “Access Control don’t stop individuals with luggage or back packs, if they don’t make their way to the Arena doors. If they do make their way to the Arena doors, Access Control would approach them before they get to the doors. If they are coming through to the concert, Access Control would, before they get to the doors, search the bags.”
Showsec, the company in charge of security during the concert, told the inquiry that its “staff had no right or power to stop, search or detain those members of the public in this area unless they were queuing to enter the Arena,” and “neither would a young man carrying a rucksack and passing though that area necessarily and obviously stand out as representing a possible threat to concert goers.” The company stressed that it is “not and has never held itself out to be a company that specialises in combatting the risks of terrorism.”
The surveillance
British Transport Police said that in the five days after Abedi had returned from a trip to Libya and before the attack he “made three reconnaissance visits to the Arena” but “nothing that he did on those occasions drew him to the attention of BTP officers,” and “at the time when he detonated his weapon Salman Abedi was still not known to BTP.”
In CCTV footage from four days before the bombing, Abedi was seen watching lines at the arena box office for a Take That concert. He walked the arena perimeter and loitered in the City Room for a short time before leaving the arena and heading to a nearby shopping center to buy a suitcase that would be used to transport bomb-making materials that had been stored in his car.
On the night of the bombing, Abedi was witnessed on camera footage arriving at Manchester Victoria station at 8:30 p.m. CCTV caught him on the railway station concourse, going into the station’s bathroom, taking the elevator to the arena level, and loitering in the arena foyer between 8:51p.m. and 9:10 p.m. and between 9:33 p.m. and 10:31 p.m. None of the four uniformed BTP officers on duty at Victoria Station noticed him; cameras did catch moments when Abedi narrowly avoided running into officers.
The response
Agha said that after the blast Lawler came running from the Victoria Station area and the two “started evacuating people from this area which at this time was chaotic, people were screaming and running in all different directions.”
“At this time we did not know which way to send people, we had no idea which areas were safe, the emergency services had not yet arrived at the scene,” he noted.
BTP officers began helping with first aid within minutes. The fire service would not arrive at the scene until two hours later, and only one paramedic – who had arrived in the arena foyer 18 minutes before the bomb detonated – was on scene for the first 40 minutes after the blast. Peter O’Reilly, the former chief fire officer at Greater Manchester Fire and Rescue Service (GMFRS), told the inquiry that he feared firefighters could be in danger if they responded to the scene; the Greater Manchester Combined Authority said in a statement apologizing to families of those who died in the attack that previous complex coordinated attacks in Europe “fed into local training and, with hindsight, perhaps encouraged personnel in all emergency responding agencies to assume a worst-case scenario that other components to the attack were likely.” Communication failures also left responders with “a lack of situational awareness.”
“Silence from partner agencies as the night went on fed and maintained the assumption that the police were dealing with an ongoing armed threat,” the GMCA statement continued. “No responsible fire officer could send unarmed and unprotected personnel into what they understood to be an ongoing gun or bomb attack and indeed to do so would have been contrary to the established guidance for dealing with such incidents.”
The inquiry also heard that a 2014 counterterrorism training exercise – without the inclusion of law enforcement – at the arena focused on the scenario of one or more active shooters at the venue. “The 2014 exercise was based around a scenario which begins with gunfire in Victoria Station (attached to the venue) followed by gunmen approaching the doors to the venue through crowds of waiting people,” said a “learning outcomes” document from Manchester Arena, adding that “although the attacks in Paris were dreadful and the fact that it hit our industry makes it all the more significant to us, our Police advice is that the threat level has not changed.”
“As we know, if an attack is going to happen, it is going to happen. We have to trust that our national security services are on the intelligence case and can stop scenarios such as this before they become a reality,” said the memo on the tabletop exercise from Miriam Stone, senior events manager at Manchester Arena, adding, “Since stopping a shooting gunman who isn’t concerned about the consequences to himself is impossible, making ourselves into a less attractive target in terms of impact and numbers is key… our aim is to get as many people out of the way as we can and that we cannot stop a man with a gun.”
The takeaways
The Manchester Arena attack underscores the importance of collaborative training for multiple threat scenarios, hardening weak spots – however seemingly innocuous they may be – in infrastructure security, and training everyone from security guards to observant citizens that terrorists are usually not revealed by glaring, blinking signs, but as the sum of their parts: things on their own may not seem like a threat, but when you add these elements together it could indicate an attack in the making.
“If you see something, say something” isn’t just about catching a terrorist in the execution of an attack, but planning and preparation as well. It’s often the little factors that add up, and unfortunately these bits and details that create a suspicious individual are often witnessed by different people who may be relaying that information to different, non-communicative security personnel or stakeholders. Abdei, for example, was witnessed praying – public prayer in and of itself isn’t necessarily an indicator of anything nefarious, but add in the factor that it was occurring in a surveillance blind spot outside of an Ariana Grande concert by a guy with a large backpack. Someone observing this could surmise that he may have been praying for the souls of the singer or her fans, or was looking for a shady spot to conduct regular prayer after disembarking a train, but it was also an action never before witnessed by security officials who had worked hundreds of events at the arena. The security officer who said she reported Abedi to a BTP officer said she thought he was a “nutter” but didn’t think he was a terror threat, yet she also said he was in a location that heightened suspicion – “nutter” plus restricted or unusual location plus big backpack plus unusual prayer activity equals cause for further investigation.
Terror propaganda stresses to would-be jihadists that they have to blend in during their operations, and such guidance likely would have also advised that Abedi should have prayed before he got to the arena and not drawn attention to himself before detonating his device. But he followed protocol drummed into the heads of attackers in other ways: conducting surveillance beforehand, finding and utilizing a blind spot, and planting himself in a venue – at the junction of a train station and arena, two infrastructure targets that he expected to be well-patrolled but the former gave him an excuse for the big backpack – that created confusion about his justification for being there.
The inquiry has also emphasized other critical considerations for protection of venue infrastructure:
- The mezzanine level was not checked before the end of the concert because of where the jurisdiction of the security company ended. Security plans should ensure that all areas receive coverage, especially before crowds are about to flood out of a packed arena and turn an otherwise quiet lobby area into a crowded, attractive target. If there’s a spot that could pose a threat to a venue but falls outside of an established perimeter, cooperation with an agency or private company that does or can handle security for that area should be hammered out before the event. Leaving areas unpatrolled is not an option.
- Counterterrorism exercises should account for multiple scenarios – including ones that may not have been tried yet by terrorists in similar venues – that span the breadth of tactics, perpetrator(s), complex coordinated attacks, types of events, dates and times, weather conditions, and other variables. Cooperation between the private sector and responding agencies is critical. Refresher training for staff should not be static but incorporate the shifting threat landscape and tactics that may have been attempted or succeeded between the last training time and the current one.
- Concern about a copycat of the 2015 complex coordinated attacks in Paris, in which the Bataclan concert hall was one of the targets when the venue was packed for an Eagles of Death Metal concert, cropped up multiple times in the inquiry in regard to how security was approached at the Manchester Arena. This underscores how venues and other potential infrastructure targets, from malls to hotels and hospitals, can benefit from the intelligence and insight provided by sector-specific Information Sharing and Analysis Centers (ISACs) and Organizations (ISAOs).
- Partner agencies have to ensure that their communications are excellent and they are prepared for any type of attack and compounding response factors. Resources, curriculum, command considerations and more like those offered by Northern Virginia High Threat Response Program can help improve agencies’ strategies to respond to an attack like Manchester – keeping first responders safe, ensuring that the wounded receive rapid critical care, and maintaining an alert posture for the possibility of follow-on attacks.
- The Cybersecurity and Infrastructure Security Agency at the Department of Homeland Security guides venues of all types and sizes through bombing prevention, active shooting threats, and more with a library of resources and workshops for the utmost preparedness. Take advantage of these government resources to learn about timely threats and enhance security in an era of evolving threats.
Preventing another attack like Manchester means interrupting the path of the terrorist somewhere along the way. Hardening a target could prove frustrating for a would-be terrorist and make him move on to the next idea on their list for an ideal attack location. Fingering a suspect during surveillance or pre-attack stages means being alert to the sum of suspicious actions, behaviors or items, and being able to report suspicions to a place where the reports will be given due consideration and where multiple reports will not fall between the cracks. And collaboration between agencies as well as with the private sector is essential from conducting event security to attack response.
Attractive targets for terrorists need not be easy targets as well – and it’s through education and training, communication, and cooperation that infrastructure security gets there.
