Don’t Assume the Westminster Terrorist is a ‘Lone Wolf’

By Kyle Orton (@KyleWOrton) on 18 April 2017

The 22 March attack outside Westminster by Khalid Masood is the most significant act of Islamist terrorism since the 7 July 2005 bombing by al-Qaeda of the London public transport system. Masood’s attack highlights a number of historic trends in British jihadism and starkly poses the question of the extent of IS’s penetration of the United Kingdom.

Though no definitive connection has yet been found between Masood and IS, the evidence is that, in the majority of IS-claimed attacks, operatives from IS’s Amn al-Kharji, its foreign intelligence service, had a role as a guide, and there are some suggestive signs in Masood’s own story that he did not act alone. Even without a direct external connection to the IS organization, it was often found that IS terrorists had internal accomplices as part of a broader network. Only 15% of attacks could be classified as “lone wolf” attacks.


Around 14:30 on the afternoon of 22 March 2017, the 52-year-old Khalid Masood drove a car across Westminster Bridge toward Parliament, mowing down pedestrians as he went. Masood injured fifty people, including a group of French schoolchildren, and murdered four in this way:

  • Leslie Rhodes, a 75-year-old man from south London, who had been visiting a hospital
  • Aysha Frade, 43, a British national of Cypriot-Spanish origins, worked in administration at a local sixth form and was walking to collect her two daughters from school
  • Kurt Cochran, 54, from Utah in the United States, died at the scene from multiple injuries. Cochran was in London as part of a holiday—his first trip abroad—to celebrate twenty-five years of marriage to his wife, Melissa, who had her leg and rib broken by Masood’s ramming attack.
  • Andreea Cristea, 31, a Romanian tourist, died in hospital on 6 April after being struck by Masood’s vehicle and plunging into the Thames. Cristea was in London with her boyfriend, Andrei Burnaz, to celebrate Burnaz’s birthday and he had been planning to propose to Cristea that day.

When Masood stopped the car outside the Houses of Parliament, he jumped out and stabbed an unarmed member of the parliamentary and diplomatic protection squad, PC Keith Palmer, in the chest, mortally wounding him.

Masood was then shot dead.


Masood was born Adrian Russell Elms in 1966 and brought up in a £300,000 house in Rye, a seaside town in East Sussex, and later in an upmarket area of Kent, Tunbridge Wells. When his mother remarried he became Adrian Russell Ajao, and he took on the name Khalid Masood when he converted to Islam.

Masood had a history of petty criminality, first convicted for criminal damage at age 18 in November 1983. In July 2000, Masood, then-35, was living in Northiam, a quiet village in Sussex, where he attacked the owner of a café, Piers Mott, slashing the seat covers in Mott’s car with a knife and catching Mott himself in the face with the knife, causing a wound that needed twenty stiches to close. The dispute reportedly had “racial overtones”.

It was around this time, in 2000, that Masood broke from his first wife, Jane Harvey, whom he had met where they worked at Aaron Chemicals, where she is still working, now as a managing director. Masood had two daughters with Ms. Harvey.

Imprisoned for two years until 2002, in 2003 Masood was accused of stabbing a man in the nose in Eastbourne, leaving him needing cosmetic surgery, and he was sent back to jail for another six months for possession of an offensive weapon.

Masood had been imprisoned at Lewes jail, East Sussex, Wayland prison in Norfolk, and Ford open prison, West Sussex. “He was known to police and has a range of previous convictions for assaults, including GBH, possession of offensive weapons and public order offences,” the Metropolitan Police said.

Masood was never convicted for terrorism-related offences. Prime Minister Theresa May said that Masood was “once investigated in relation to concerns about violent extremism. He was a peripheral figure. The case is historic—he was not part of the current intelligence picture. There was no prior intelligence of his intent or of the plot.” The case that triggered the investigation into Masood related to a car bomb plot against an Army base in Luton in 2011.

In 2004, Masood married, Farzana Malik, a Muslim woman. “It is unclear what became of their marriage and whether Masood converted to Islam at the time,” The Telegraph reports. The same year, according to Masood’s CV, he gained a TESOL certificate, allowing him to teach English to foreigners.

By 2005, Masood was in Saudi Arabia, working in Yanbu, teaching workers at the General Authority of Civil Aviation (GACA) in Jeddah.

Masood returned to Britain in the spring of 2009, and, after a five-month gap, joined a TEFL college in Luton as a “senior English teacher”.

Within this period, Masood had remarried, to Rohey Hydara, and by the time he had a son and a daughter with Ms. Hydara.

Between 2011 and 2013, Masood lived in Luton. While some believe that Masood was radicalized during one of his stints in prison, an alternative thesis looks to the Luton Islamic Centre. Luton was the base for al-Muhajiroun, the extremist organization led by Anjem Choudary, a man registered as a terrorist by the United States, who is now in prison in the U.K. for inviting support for IS, an organization he secretly gave bay’a (an oath of allegiance) to. It was in Luton that the 7/7 killers met before undertaking their mission. Taimur Abdulwahab al-Abdaly, who blew himself up in a car bomb attack in Stockholm, Sweden, on 11 December 2010, was radicalized in Luton. In July 2015, another man from Luton, Junead Khan, 25, of Marlow Avenue, and his uncle, Shazib Khan, 23, were arrested as they planned to attack American troops stationed at Lakenheath, in an IS-led plot guided by Junaid Hussain.

In 2014, Masood moved his family to Forest Gate, an area of East London that was the site of a disastrous June 2006 counter-terrorism operation. It was also the home base for Sabbir Miah, 23, who was arrested in December for distributing terrorist propaganda.


At some point, Masood’s wife moved to a new property on the site of the Olympic Village, and over the past year Masood moved his family to a block of flats at Quayside in Winson Green, Birmingham. There is no clarity about why he did this. Around Christmas 2016, Ms. Hydara moved back to east London to care for her disabled mother: Masood remained in Birmingham.

On 20 or 21 March, Masood went to the Spring Hill, Birmingham, depot of Enterprise, a car-hiring company, and rented the Hyundai SUV he used in the attack. The address he gave to Enterprise was a nearby flat on Hagley Road, close to Edgbaston, which he had rented.

Within twenty-four hours of the attack, eight people had been arrested, seven in Birmingham and one (a woman) in east London. All were released by mid-April, and an investigator said, “The indications are he acted on his own, and that is rare.” Police declared that while Masood had “an interest in jihad,” his motive might remain a mystery in perpetuity.

This rush to the “lone wolf” thesis, despite noting (correctly) that it is “rare,” was odd, not only because the record has been clear for some time that these attacks usually are not. There were signs from the start that there was more to this. Likewise, there are indications that the question of motive was not so impenetrable as all that.

The most obvious starting point was the WhatsApp message Masood was known to have sent moments before the attack. Given that encrypted platforms like WhatsApp and Telegram are IS’s favoured means of communicating with its foreign operatives, this seemed worthy of investigation with regard to both the questions of motive and accomplices.

The contents of the WhatsApp message are now known: Masood said he was on jihad in revenge for Western actions in the Middle East. Masood is also reported to have told a family member living in the south-east, a week before the attack, “You will soon hear of my death, but don’t worry, be happy, because I will be in a better place, I will be in paradise”. These offer some hints to construct a working thesis about Masood’s motive.

The recipient of the WhatsApp message has been cleared of any involvement in the attack, but this by no means exhausts the question of co-conspirators.


Birmingham, like Luton and East London, has a well-founded reputation as an area of concern, and Masood was clearly keen to be there—even at the expense of distance from his family.

It was in Birmingham that the “Trojan Horse plot“ took place, by which Islamists sought to subvert the secular curriculum of schools and spread their ideology, which included conspiracy theories such as that the May 2013 murder of Lee Rigby was a “hoax”. And there has long been a lively scene of extremist da’wa (proselytization) in Birmingham, from people like Begg, who established the Azzam Publications bookshop, and Muhammad Surur, with his the Center for Islamic Studies.

Maulana Masood Azhar

The roots of jihadism in Birmingham date back to the 1990s and the central figure is Maulana Masood Azhar, a Pakistani Deobandi preacher who drove the Islamization of the insurgency in Kashmir, partly by gathering funding streams from Britain that allowed the Islamists to outcompete the secular separatists. Azhar visited Britain in the early 1990s and stopped in both Birmingham and East London. The Arab “Wahhabist” preachers like Mustafa Kamel Mustafa (Abu Hamza al-Masri) and Umar Bakri Muhammad were blamed for the spread of extremism in Britain’s Muslim populations, and they surely mattered, but it was these more mainstream Deobandi mosques aligned to the Kashmiri cause that played the greater role in incubating this menace. As described by Raffaello Pantucci, the resource streams from Britain to Kashmir would come to include young men, such as Mohammed Bilal, who blew himself up outside an army barracks in Srinagar in December 2000. In time, some of these men were redirected to al-Qaeda, and the two-way nature of this connection culminated in the 7/7 attack.

Umar Sheikh, a graduate of the London School of Economics (LSE), is best-known for his role in the video butchery of The Wall Street Journal reporter Daniel Pearl in 2002, a crime for which he sits on death row in Pakistan. In late 1993, Sheikh first arrived in Pakistan, near Miramshah, the administration centre of North Waziristan in the Federally Administered Tribal Areas (FATA). Sheikh had first tried to join the jihad in Bosnia, but been redirected to Kashmir by a militant from Harakat-ul-Mujahedeen (HuM), the group Azhar was associated with at the time.

When Azhar met Sheikh in the FATA, Azhar told Sheikh to enter India, which Sheikh was prevented from doing on his Pakistani passport (he was a dual Pakistani-British national). Returning to Britain and acquiring a British passport, Sheikh got a Indian visa and “helped HuM attempt a number of kidnappings of foreigners to be held hostage in exchange for detained HuM fighters, until he was caught by Indian police,” Pantucci explains. Both Azhar and Sheikh were imprisoned in 1994 and released—alongside a third jihadist, Mushtaq Ahmed Zargar—in December 1999 as part of the hostage exchange for Indian Airlines Flight 814.

Shortly before Azhar’s imprisonment, HuM had merged with Harkat-ul-Jihad al-Islami to form Harakat-ul-Ansar (HuA), which Azhar led. In 1997, HuA was designated a terrorist organization for its links with Bin Ladin, and reverted to the name HuM. Upon release, in early 2000, Azhar founded Jaysh-e-Muhammad (JeM) as a splinter from HuM. Though JeM is on the United Nations’ terrorism list, and though Azhar was supposedly arrested after the January 2016 raid on India’s Pathankot military airport, he remains at large in Pakistan, not unlike the pattern of Hafiz Muhammad Saeed, the leader of Lashkar-e-Tayyiba.

Rashid Rauf

It was a Birmingham man, Rashid Rauf (b. 1981), who talent-spotted Mohammed Siddique Khan and Shehzad Tanweer, two of the four 7/7 killers, directing them to al-Qaeda training camps, and Khan had earlier trained with HuM. Rauf would continue to direct and assist the 7/7 cell in Britain via contact with Khan. Rauf had met Azhar during Azhar’s trip to the U.K. in the early 1990s. Rauf’s father had felt his wayward son could do with a mentor. In April 2002, Rauf fled the U.K. with a university friend (and Birmingham native) Mohammed Gulzar under a cloud of suspicion after the murder of an uncle. Rauf went straight to Azhar’s hometown, Bahawalpur, married Azhar’s sister-in-law, and connected to al-Qaeda via JeM member Amjad Hussein Farooqi. It was Rauf who stood behind the 2006 transatlantic airlines plot, which were averted by arrests in Birmingham, among other places, and Rauf would deploy his old friend, Gulzar, to watch over cells in Britain. Another major plot, thwarted by Operation PITSFORD, was Birmingham-centric. It was in Birmingham in 2008 that Parviz Khan tried to kidnap and behead a British soldier on video.

It was these old networks and their offshoots that rejuvenated when the jihadists began to exploit the Syrian rebellion and its desperate struggle against the regime of Bashar al-Assad and his backers, notably Russia, Iran, and a foreign legion of Shi’a jihadists, who were inflicting large-scale sectarian atrocities against Sunni civilians. Deprivation and communal segregation are crucial preconditions for recruiters—but there do have to be recruiters and their networks to get people to jihadi theatres.


Between 1998 and 2015, as documented by Hannah Stuart in a report for The Henry Jackson Society, there were thirty-nine terrorism-related convictions from Birmingham, 14% of the total, second only to London, which had 117 offences (43%). The convictions were highly localized, with six of Birmingham’s twenty-three wards—Springfield, Sparkbrook, and Moseley & Kings Heath in the Hall Green constituency, and Hodge Hill, Washwood Heath, and Bordesley Green in the Hodge Hill constituency—accounting for twenty-nine of the thirty-nine (74%) of the convictions. Masood’s property and rented apartment in Birmingham were in the Ladywood constituency, where there were two convictions in this period.

Several of these cases deserve closer attention.

Mohamed Abrini

In December 2016, Mohamed Ali Ahmed of Birmingham and Zakaria Bouffassil, a Belgian national, were convicted for helping preparing acts of terrorism, namely providing £3,000 to Mohamed Abrini (“the man in the hat”) when he visited Britain in July 2015. Abrini is the Belgian IS operative of Moroccan background currently in prison on the Continent for his involvement in both the November 2015 Paris attacks and the March 2016 attacks in Brussels.

Abrini had visited Britain at the instruction of Abdelhamid Abaaoud, the then-head of Amn al-Kharji’s Europe section and the man who led the Paris attacks on the ground that night. Abrini visited three cities in Britain. Abrini landed in London on 9 July 2015 and intended to fly out of Manchester but for logistics reasons did not, travelling back to Birmingham to catch a flight to Paris on 16 July. Arriving in one city, meeting in another, and (intending) to leave from another city is tradecraft, as is Abrini travelling using cash and one-way tickets bought at short notice.

There are suggestive signs of an IS presence in Manchester. There is a Libyan community in Manchester that contains members with historical links to the Libyan Islamic Fighting Group (LIFG), al-Qaeda’s branch in Libya, which was defeated in its attempt to overthrow Muammar al-Qaddafi in the 1990s. Many LIFG went to Afghanistan and became senior deputies to Usama bin Ladin; others went elsewhere, including some senior figures who took refuge in Britain, in Manchester and London. LIFG mobilized these old networks when the 2011 rebellion erupted against Qaddafi, and some of those who joined that struggle ended up involved with jihadi-salafist and terrorist groups in Syria. A prominent recent case was Abdal Raouf Abdallah, who was paralyzed in Libya while fighting as part of the insurrection in 2011 and returned to the U.K. to act as a facilitator for IS in Syria. [UPDATE: It was from this milieu that Salman Abedi, the suicide-murderer at the Manchester Arena on 22 May 2017, emerged, quite possibly from overlapping networks.] Manchester also produced Ronald Fiddler (Jamal Udeen al-Harith), who blew himself up in Mosul in February.

Still, Abrini’s mission was specifically to Birmingham. Ahmed had been part of a network of IS supporters in Birmingham. Gabriel Rasmus had been arrested in April 2015 in the company of five other people on the back of a lorry; it was later determined that he and one other man, Anas Abdalla, had been trying to join IS (the others were involved in ordinary criminality), and they were imprisoned on preparing terrorism charges. Humza Ali, from Bromford Lane in a zone covering Hodge Hill, is the son of Shahid Ali, who was arrested as part of the terrorist cell led by Parviz Khan and convicted in 2009 for supplying equipment to the Taliban. Humza was convicted in the same month as Ahmed for trying to join IS. “Rasmus, Ahmed and Ali … had taken photographs of themselves alongside Abdelatif Gaini (who is believed to have travelled to Syria) attending a paintballing session in Solihull, West Midlands, in June 2014, which the prosecution in Ali’s trial alleged the men considered ‘training’,” Stuart notes.

The direct connection between IS and Birmingham shown in the Abrini trip has also shown up in the case of Rasheed Salah Benyahia, who was 19-years-old when he disappeared from his home on 29 May 2015. When Benyahia left early in the morning, his mother Nicola has said, not a thing was moved, down to the socks left in the corner, which meant nobody realized he was missing. When spotted on CCTV as he boarded a flight to Turkey, Benyahia had a hooded top that was not his and a suitcase that likewise did not belong to him and which was evidently full of clothes. There were also several hours unaccounted for between leaving his home and arriving at the airport, which were clearly spent with somebody. Benyahia’s mother also emphasizes that her son was incapable of planning something like this—even just the journey to Turkey would have been troublesome enough, let alone the tradecraft involved. Of course, people can’t just enter IS-held areas: somebody has to vouch for them.

Perhaps Benyahia met the IS facilitator at the Green Lane Mosque, which came under scrutiny in the aftermath of Benyahia’s defection. Some mosques really do have radical preachers who support extremism; in many other cases mosques, like universities, provide a social setting in which propagandist-recruiters can work. The other option—not necessarily mutually exclusive with the former—is that Benyahia was connected with the operative by an Amn al-Kharji guide. The precedent for this can be seen in the assault on the church in Rouen in June 2016, where IS’s Rachid Kassim connected the murderers, Adel Kermiche and Abdelmalik Petitjean, who had not previously known each other and lived at opposite ends of France. As Nicola Benyahia insists: the online component to IS is real and serious—but it is a complement to, not a replacement of, the old model of person-to-person contact and networks.

Masood’s choice of target suggests coaching for media-political purposes—a lot more people could have been killed in a less high-profile and well-defended area—and, as Jytte Klausen of Brandeis University noted, “it takes time and preparation for someone to develop the capacity to carry out a terrorist act”. With the closing of the Benyahia case after the boy was killed on 10 November 2015 it might never be known who the facilitator in Birmingham was, but he is still there, leaving open the potential of an overlap between him—or an associate(s)—and Masood. Likewise, there is no certainty that the network around Mohamed Ali Ahmed that helped Abrini has been completely rolled up.

The authorities in Britain have been quick to declare that Masood acted alone. A similar verdict was reached about the 7/7 attacks by an official inquiry in May 2006. Having noted the various trips of the 7/7 killers to Pakistan, the reports of contacts with Islamist militants while they were there, and an attack that was “typical” of al-Qaeda, the report concluded that it was impossible to say “if there was any” al-Qaeda involvement. This conclusion was spectacularly refuted two months later when Mohammed Siddique Khan appeared in a martyrdom video put out by al-Qaeda, conclusively demonstrating not only the 7/7 cell’s contact with al-Qaeda, which the report had doubted, but the cell acting at al-Qaeda’s behest.

IS claimed the Westminster attack via Amaq: “The attacker … in front of the British parliament in London was a soldier of the Islamic State, executing the operation in response to calls to target citizens of coalition nations.” This followed the pattern of many previous IS external attacks, but deviated in one crucial aspect: no video of Masood giving bay’a to the caliph, Ibrahim al-Badri (Abu Bakr al-Baghdadi), was posted on Amaq, as occurred with the very similar case carried out by Anis Amri in Berlin on 19 December, nor even a picture of Masood emerged on Amaq.

This does not mean Masood had no contact, guidance, and/or permission for his attack, however. Contrary to an inexplicably-widespread myth, IS does not claim every violent incident in a Western city; it takes care to know that those it adopts under its brand—the most precious asset it has in its quest for its very survival—are its own, having contact with a vast majority of them.

IS “supporters can give bay’a privately, and they don’t even need to tell anyone else,” Jade Parker, a Senior Research Associate focused on violent non-state actors’ (VNSA) use of cybersecurity and terrorist use of the Internet at TAPSTRI. “It’s seen as a matter between the individual and Allah, so external validation isn’t required.” Parker noted that the advantage of this method works in both directions: “If a would-be attacker is caught beforehand, authorities can’t use a pledge statement to IS as evidence of group membership [in prosecutions] … and if successful … Amaq can claim it was one of their ‘soldiers’ with little risk of being proven definitively wrong.”

IS claimed the Westminster attack in its newsletter, Al-Naba, a week after the attack, but otherwise has thus far not made very much of the Westminster attack in its official propaganda.


Originally published at The Henry Jackson Society

5 thoughts on “Don’t Assume the Westminster Terrorist is a ‘Lone Wolf’

  1. Pingback: The Islamic State’s Fourth Attack in Britain in 2017 | The Syrian Intifada

  2. Pingback: The Islamic State Spokesman Directs His Fury At Regional Governments | The Syrian Intifada

  3. Pingback: American Islamic State Jihadist Plotted to Bomb Trump’s First Presidents’ Day | Kyle Orton's Blog

  4. Pingback: Jihadist Terror Remains a Significant Problem for Britain | Kyle Orton's Blog

  5. Pingback: The Special Risks to Britain from the Jihadist Takeover of Afghanistan - Kyle Orton's Blog

Leave a Reply