May 23, 2017

View of Manchester, UK with Manchester Arena in the foreground. The improvised explosive device detonated just out of this view to the lower right. (

Executive Summary

The UK government's threat level for international terrorism remains unchanged at "Severe" following an apparent suicide bomb attack at a pop concert in Manchester, UK, May 22. Although the Islamic State (IS) has claimed responsibility, it is unclear whether the attack was the work of a lone actor, or was directed by a larger terrorist organization; the perpetrator's methods indicate that he could have received technical guidance or material assistance. The incident demonstrates the latent terrorist threat across the UK, regardless of precedent. A highly visible security presence is probable in city centers and around likely targets in the coming weeks. Counterterrorism operations, as well as security scares and false alarms, are likely to prompt sporadic, localized disruptions in the medium term.

Key Judgments

  • The perpetrator's methods indicate increased sophistication and suggest possible technical guidance or material support from a wider terrorist network.
  • The nature of the target demonstrates that the terrorist threat is neither confined to London, nor to government or security facilities.
  • Security measures are likely to be ramped up at locations not previously considered to be at high risk from terrorism. 


At approximately 2235 May 22, an apparent suicide bomber detonated an improvised explosive device at the entrance of Manchester Arena, UK, killing at least 22 people and injuring at least 59 more. The blast occurred as concert goers were leaving the premises, and police believe the attack was timed to cause maximum casualties. Police have named the attacker as 22-year-old Salman Abedi; while no motivation has yet been confirmed, they are treating the incident as a terrorist attack. Surviving victims of the attack are being treated in hospitals around the city, though several people are unaccounted for. Security forces believe Abedi acted alone, but the focus of their investigations will center on confirming whether he was supported by a wider terrorist network, including where he sourced the explosives. A 23-year-old man has reportedly been arrested in connection with the attack following a raid on a flat in south Manchester May 23, though the extent of his involvement is unclear; further arrests are possible.

Islamic State (IS) has claimed responsibility for the bombing through its Amaq News Agency, and social media associated with the group have claimed that it was retaliation for the UK's military involvement in Iraq and Syria. It is possible that IS' claim is retrospective; on the day following the fatal March 22 vehicle and knife attack in Westminster, London, IS claimed that the perpetrator, British-born Khalid Masood, was one of its fighters. However, Masood's methods indicated that he was a "lone wolf" who was inspired, rather than directed, by IS, which in November called on supporters to use motor vehicles to cause mass casualties. On May 13, Al-Qaeda issued a similar call for lone-wolf attacks in the West. Such attacks, using readily available civilian items, require minimal preparation and are, therefore, less open to detection by security forces.

However, the latest attack, which echoed the IS-orchestrated attack on the Bataclan concert hall in Paris in November 2015, appears to differ from Westminster, and other, recent lone-wolf incidents in Western Europe, including the vehicular attacks in Nice, Berlin, and Stockholm in July, December, and April, respectively. Reports from eyewitnesses, and injuries consistent with flying shrapnel, suggest that the device was a "nail bomb," indicating that the perpetrator may have had technical guidance or material bomb-making support from an established terrorist organization. As Islamist strongholds in the Middle East are eliminated, Europe is preparing for the return of large numbers of radicalized nationals who have fought alongside IS and other groups. Authorities believe that as many as 760 British nationals could return to the UK. Such individuals - trained, experienced, and perhaps better supported by the wider jihadist network - are likely to pose a far greater threat than lone-wolf actors; former fighters will have the potential to enlist militants into new domestic networks, and share knowledge of terrorist tactics, bomb-construction, and weapons acquisition, considerably exacerbating the current terrorist threat and creating the conditions for more frequent high-profile, mass-casualty attacks.

The location of the latest bombing was an atypically "soft" target and signified a departure from previous terrorist attacks in the UK, which have targeted government, security forces, or transportation infrastructure, predominantly in London. The blast occurred at concert by US singer Ariana Grande, who is popular with teenaged girls and children; several children are confirmed to be among the victims. It is likely that security measures were relatively lax at the venue due to a perception that the event was at a lower risk of terrorist attack. Witnesses have claimed that security at the venue did not consist of thorough bag or personal checks, and security guards were not equipped with metal or explosives detectors. Nevertheless, it is likely that Abedi had not passed through security when he detonated the device because he did not attempt to enter the auditorium section of the venue where the concert portion of the event was occurring. Even at sites with high security, attacks at security checkpoints, where people are likely to gather when entering or leaving the premises, remain difficult to prevent.


Prime Minster Theresa May chaired an emergency Cabinet Office Briefing Room-A ("COBRA") committee meeting on the morning of May 23, and security is expected to be reviewed at major event venues in Britain and elsewhere. The government's terror alert level remains unchanged at "Severe," indicating that an attack is "highly likely." The UK has faced a latent threat from terrorism - including from Islamist, sectarian, and extremist political groups - for decades, and the country's security forces remain capable of detecting, deterring, and responding effectively to terrorist incidents.

British security forces have reportedly disrupted several Islamist terrorist plots since the March 22 Westminster incident, and further counterterrorism raids are possible in the days ahead. These incidents will probably cause limited commercial or transport disruptions, but could lead to street closures and brief communications disruptions in some communities while authorities search residences and/or make arrests. A highly visible police presence is likely in central Manchester and in downtown areas of other major UK cities in the days ahead. Increased security is likely at transport centers and other sensitive sites throughout the country. Tight security can also be expected at venues hosting cultural and sporting events that draw large crowds. The UK is set to hold a general election June 8; while campaigning has been suspended following the latest attack, political events could represent attractive targets for any further attacks once it resumes. Security measures are therefore likely to be extremely tight at high-profile political events in the short-to-medium term.

Heightened public sensitivity to the terrorist threat will likely prompt security alerts in the days and weeks ahead. Police in Manchester reportedly carried out controlled, precautionary detonations of suspect packages in the Cathedral Gardens and Fallowfield areas May 23; on the same day, security scares prompted evacuations at Victoria Coach Station, London, and at the Arndale Center shopping complex in Manchester before police gave the all clear. Further such incidents will also likely be false alarms, but significant disruptions are possible if they occur at airports, train stations, or in busy commercial areas.

Tactical Advice

Although it is impossible to predict where and when the next terrorist incident may occur, there are measures individuals can take to reduce the risk of becoming involved, as well as strategies to assist recovery efforts if an attack occurs. WorldAware's Security Operations team offers the following advice for consideration:

Before You Go:

  • Identify a friend or family member as a support person for your trip. Provide that individual with your itinerary and copies of your passport and visas. Save electronic copies of these documents that can reside in your phone, not in the cloud.
  • Photocopy the contents of your wallet ­ including credit cards, insurance information, travel documents, etc.  Email this information to yourself.
  • Prepare or review and update your will, power of attorney, and other related documents. Ensure your passport has five to ­10 pages left and is valid for at least six months.
  • Program into your phone contact information for your host, members of your party, nearest diplomatic mission, and other trusted local contacts. Print and carry a paper copy.
  • Schedule flights that arrive and depart during off-­peak travel times. These times may vary from airport to airport.
  • Be aware of and prepared to use alternative transportation options should flights be canceled. Prearrange airport transfers.
  • Have your transportation contact email you a picture of your driver, the vehicle to be used, and the license plate.
  • Select hotels that have been vetted by a reputable travel security company.
  • Prebook your first night's hotel stay. Request a room near the stairs or fire exit away from the street or entrance; ideally your room should be between the second and seventh floor.
  • If available, enroll in diplomatic mission travel security programs (e.g. STEP Program). At a minimum, register your trip with your diplomatic mission and include contact information and itinerary.
  • Print, carry, and learn to read maps of the cities/areas you will visit. Plan your routes.

Departure and Arrival:

  • Minimize your time in the common areas of airports, which are less protected.
  • Move quickly from the secured official and baggage claim areas through the lobby and to your transportation. Leave the airport as soon as possible.
  • Use airline lounges/clubs, if possible. Sit on the periphery of the club, away from food and drink areas.
  • Minimize time spent in public access areas, such as ticketing areas. Move to and through security checkpoints as quickly as possible.
  • Avoid nearby incidents of any kind, as situations can escalate without warning.
  • Avoid crowded areas. If you must be in a crowded area, position yourself near an exit or other egress point, preferably at the edge or on the periphery of a crowd.
  • Note sudden increases in security presence/activities.
  • Trust your instincts. Avoid people who appear suspicious or act differently than the crowd. Avoid using luggage tags identifying you as an obvious foreigner. Luggage tags should be covered to protect your contact information and address.
  • Maintain a low profile; avoid dress, including clothing with logos, and behavior identifying you as an obvious foreigner.
  • Maintain contact with other members of your party; call and text them upon arrival.

While at Your Destination:

  • Maintain situational awareness; always be prepared to run or hide from a threat. Know the room numbers of all of your colleagues.
  • Leave the TV on and place the Do Not Disturb sign on the door when leaving your room. Always lock the hotel room door, as well as any doors between adjacent rooms; use all available locks. Consider traveling with a rubber doorstop for added security on inward swinging doors.
  • Ask your hotel staff where foreigners usually congregate, and minimize time spent in those places, especially if there is known animosity in a country against your nationality or ethnicity. Be cautious about discussing personal matters, your itinerary, or arrangements with strangers or those who may overhear you.
  • Keep children close at hand at all times.
  • Be sure of the identity of visitors before opening the door of your hotel room.
  • Refuse unexpected packages or visits from unknown people, businesses, or organizations; have all packages and correspondence delivered to the reception desk.
  • Be aware of people following you or of loiterers observing your comings and goings.
  • Plot police stations, hospitals that treat foreigners, major hotels and other safe havens on your paper map and in your phone's GPS.
  • Do not meet strangers at unknown or remote locations; to the extent possible, select the meeting location yourself.
  • Enlist your hotel or host in helping you select and make arrangements for taxis. Do not enter a vehicle you believe to be a taxi unless it is clearly identified.
  • Before closing the door to a taxi, compare the face of the driver with the one posted on the displayed license; if the two do not match, do not accept the ride.

 If Involved in a Terrorist Incident:

  • Remain calm by breathing in for four seconds, holding for four seconds and exhaling for four seconds several times after an attack.
  • Silence your phone.
  • Physically check yourself and travel party for wounds or injuries prior to moving. If possible, contact your nearest diplomatic mission, and ask for guidance.
  • If there is a disturbance outside your hotel, keep your drapes closed, and stay away from the windows. Extinguish all lights. If you must have some light, turn on the bathroom light and crack the door. Assemble your traveling companions in one room.
  • If you hear an explosion, resist the urge to look out the window. A second, and usually more violent, explosion follows many bombings. Seek shelter in your bathroom or, if possible, an interior stairwell.
  • If gunfire occurs, drop to the floor, or get down as low as possible, and try to shield yourself behind or under a solid object such as a heavy piece of furniture.
  • Follow all instructions and orders from terrorists or responders.
  • Remain sheltered in a secure location until you are certain the danger has passed.

Do not attempt to help first responders, and do not pick up a weapon.