The Islamic State’s Fourth Attack in Britain in 2017

By Kyle Orton (@KyleWOrton) on 16 September 2017

“Bucket bomb” on the Parsons Green trube (image source)

At 8:20 on 15 September 2017, a bomb detonated in a rear carriage of a tube train at Parsons Green station in London. The passengers on the packed, rush-hour train described a flash “fireball” that travelled down the train. Thirty people were injured, some horribly burned, but there were no fatalities and the main explosive clearly did not detonate. The attack was claimed by the Islamic State (IS).

The creation of a bomb is a more sophisticated operation than a stabbing or vehicle-ramming attack, but it is important to maintain perspective: the device used in this case was primitive. On examination, the crude device—a bucket containing the mixed chemicals and nails, left in a Lidl bag—proved to contain triacetone triperoxide (TATP) and to have been on a timer. For reasons unclear, it is likely that “only the initiator or a fraction of the main charge had exploded”, leaving the bucket intact.

TATP is sometimes said to be an IS “signature”, which is not quite right. TATP has shown up in a number of IS attacks in Europe and it is evidently a competency of theirs to handle this notoriously-volatile substance. Still, similar devices have been seen before.

The 21 July 2005 attempted follow-on attack to the 7 July massacre on the London transport system by al-Qaeda saw four TATP-based devices not unlike the Parsons Green one detonated on three tube trains and a bus with results akin to what happened yesterday. The wiring used to create the timer on the bomb appeared to include fairy lights, of the kind used on Christmas trees, and this was seen in the Boston bombing on 15 April 2013.


A minor sub-story—of the kind that erupted after IS’s attack on the Ariana Grande concert in Manchester—has come to the fore, namely British displeasure with leaks of intelligence by the United States government. In May, the leaks were to the press and contained, among other things, the suicide-murderer’s name, Salman Abedi, at a time when British authorities were still wanting to keep it secret. This time it relates to President Donald Trump’s tweets.

By 10:00 (British time) it was clear this was a terrorist incident, and just before midday, Trump sent out three tweets in reaction. At 11:42 British time (6:42 U.S. time), Trump wrote: “Another attack in London by a loser terrorist. These are sick and demented people who were in the sights of Scotland Yard. Must be proactive!” [italics added]. Six minutes later, the President added: “Loser terrorists must be dealt with in a much tougher manner. The internet is their main recruitment tool which we must cut off & use better!” And finally, at 11:54, Trump tweeted: “The travel ban into the United States should be far larger, tougher and more specific—but stupidly, that would not be politically correct!”

The reference to it being attackers, plural; them being previously known to authorities; and the hint that they were of foreign origin was, and remains, information that has not been confirmed by the British government. Nick Timothy, a former chief of staff to Prime Minister Theresa May, attacked the tweets as “unhelpful from [the] leader of our ally and intelligence partner”. Mrs. May herself said it was “never … helpful for anybody to speculate on what is an ongoing investigation”. Whether Trump had inadvertently leaked intelligence, which he is alleged to have done previously, or whether he was regurgitating a stray comment from a cable news show, will become clear in time.


This is the fourth IS attack in Britain this year, following the 22 March car-ramming and stabbing outside Parliament by Khalid Masood; Abedi’s suicide bombing at the Manchester Arena on 22 May; and the 3 June London Bridge attack by Khuram Butt, Rachid Redouane, and Youssef Zaghba that followed the same design as Masood’s.

There have been three further terrorist attacks, or attempted terrorist attacks, in Britain this year. On 27 April, there was an attempted stabbing outside Parliament by Khalid Mohamed Omar Ali, whose motivations appear Islamist. The 19 June car ramming attack outside Finsbury Park Mosque by Darren Osborne appears to have been motivated by far-Right ideology. And Mohiussunnath Chowdhury is being charged under the terrorism laws after he shouted “Allahu Akbar” and attempted to rampage at Constitution Hill, near Buckingham Palace, with a sword on 25 August.

Between June 2013 and March 2017, British security forces prevented thirteen terrorist attacks. Over the two months between March and May 2017, another five plots were foiled. Just after the Manchester attack, Home Secretary Amber Rudd gave an interview in which she said that MI5 was investigating five-hundred different plots and had a list of 23,000 people regarded as a risk, the top 3,000 seriously so. Metropolitan Police Deputy Assistant Commissioner Neil Basu said earlier this month it had been a “summer like no other”, with sixty investigations opened since late July—about ten a week—and a 75% increase in the number of arrests. The Home Office’s quarterly report, released on Thursday, documented 379 arrests in terrorism cases between June 2016 and June 2017, a 68% increase over the 226 people arrested in the preceding year and the highest since 2001. Half were released without charge, eighteen were charged with non-terrorism crimes, and 105 have been charged with terrorism-related offences. Thirty-three were prosecuted and all-but one found guilty; sixty-eight are awaiting prosecution.

Before 2017, Britain had been the victim of eight domestic terrorist attacks by the IS movement over a period of ten years, going back to the 30 June 2007 attempted car bombing of Glasgow airport by Bilal Abdullah and Kafeel Ahmed, another instance where the terrorists’ incompetence saved lives.

These figures—eight attacks over the last ten years, four attacks in 2017—refute the notion that the loss of territory is damaging IS’s external operations capacity, a theory that has been one of the central justifications for the rushed operations to evict IS from Mosul and Raqqa, and the acceptance of dubious partners in getting it done. On the contrary, IS now possesses a mature international network it did not have before 2014, and on the ground—even after the losing its twin capitals—it is more powerful than it was after its last “defeat” in 2007-08 and in a very advantageous political situation.

The key issue now is unravelling whether the attack yesterday was directed from abroad and how many conspirators were involved. On this, IS has given some hints.


At around 20:00 on 15 September, twelve hours after the attack, IS claimed the bombing, as has become its routine, through Amaq. The Amaq statement followed the same structure as usual, quoting a “security source”, but the statement included novel language, saying the attack was carried “detachment affiliated to the Islamic State”.

An extended English-language statement was then—as has become standard procedure—issued by Nashir:

Seeking guidance from Allah and putting trust in Him the Almighty, the soldiers of the Caliphate were able to plant several explosive devices and detonate one of them amidst a gathering of Crusaders in a metro station (Parsons Green) in London. It resulted in the wounding [of] nearly 30 Crusaders, and what is coming is more devastating and bitter, Allah willing. Praise be to Allah, the Lord of the Worlds.

At least four things are noticeable about IS’s statements on the Parsons Green attack:

First, the statements do not include the usual formulation that frames the attacks as being “in response to calls to target citizens of the Crusader coalition”.

Second, the claim that “several explosive devices” were planted and only one detonated tallies with some early reports, subsequently dismissed, of a second device having been disarmed around Parsons Green. The truth in this matter could yield insights into how intimately IS was involved in this attack.

Third, to claim it at all—a botched operation, before there is any public detail about the would-be killer(s), who are still on the loose and thus could be captured and contradict IS—is a strong indication that IS had contact with the attacker(s) before the attack, and that this is therefore not a “lone wolf” incident.

A template developed where the operatives in IS’s guided attacks sent videos of themselves giving their bay’a (pledge of allegiance) to Abu Bakr al-Baghdadi to Amaq before attacks, for release after the attack when these men were usually dead. But this template is not obligatory. Bay’a can be given in private, via an encrypted messaging application for example, and it need not be between anybody except the individual and the IS amni. This allows IS to be sure an attack is theirs—and it allows the individual to deny any formal association with a terrorist group if he is arrested.

Fourth, the language is suggestive against the “lone wolf” thesis. Not only did the attacker likely have contact with IS, which would mean some form of guidance—whether operational, in assembling the explosive device, or emotional (IS coached the Ansbach suicide bomber right up to the moment of detonation, helping him overcome doubts)—but the use of the word “detachment” suggests this attack on the tube was the result of the exertions of a network, rather than a lone actor. When IS recognized its responsibility for the London Bridge attack, it said it was executed by “a detachment of fighters from Islamic State”. British police sources have said they are seeking multiple suspects.

Within half-an-hour of IS claiming the attack, the British threat level was raised to “critical”.

[UPDATE: The 98th edition of IS’s newsletter, Al-Naba, released on 22 September, contained reference to the attack being the work of “soldiers” of the caliphate.]


This morning, the Metropolitan police announced the arrest of an 18-year-old man in the port area of Dover, and said he would be transferred to a police station in south London.

Charges were brought on 22 September against Ahmed Hassan, 18, of Sunbury, Surrey. By 26 September, the other six people who had been arrested as part of the investigation had been released.


Originally published at The Henry Jackson Society

Leave a Reply