By Dr David Lowe, Senior Research Fellow, Leeds Beckett University Law School


In the evening of the 22nd May 2017 in the Manchester Arena attendees, mainly young people, had just enjoyed a concert by Ariana Grande. Making their way through the Arena’s large foyer towards the exits, where many parents were waiting to collect their children who attended the concert, Salman Abedi, who entered the foyer as the concert was ending, detonated a bomb contained in a rucksack he was wearing killing 22, with 139 physically injured and many more suffering psychological injury. This was the first successful terrorist bombing using an Improvised Explosive Device (IED) in the UK since the July 7th 2005 London bombings on the Underground and a bus in Tavistock Square that killed 52 people and injured over 700. Since the cessation of violence of the 1968-1998 Irish Troubles that saw the Real IRA detonate a car bomb in Omagh on the 15th August 1998 killing 29 (including a woman pregnant with twins) and injuring 220 people, the UK has been fortunate not to suffer many IED terrorist attacks. As attempts have been made in recent years to cause death and destruction using IEDs, vigilance against terrorists’ use of IEDs must be maintained. Examples include the Parsons Green bomb on the London Underground train on the 15th September 2017 that fortunately failed to detonate and when the New IRA planted a car bomb that exploded outside the Bishop Street Courthouse in Derry on the 20th January 2019 that fortuitously only caused minimal damage and did not kill or injure anyone.

This article will examine the emergency services’ response to the Manchester Arena bombing by examining and considering the points raised in the Kerslake Report focusing on the actions of the police, ambulance and fire services following the attack. Here the article will assess what lessons were learnt regarding the emergency services’ response. The final part of the article will examine the conduct of the investigation by the Greater Manchester Police, assisted by the UK’s Counter-Terrorism Units and, regarding intelligence on Salman Abedi, the findings in the 2017 Anderson Report.


Following the detonation of Abedi’s IED in Manchester Arena’s foyer, at 22.33 hours a call was made to Greater Manchester Police’s (GMP) force control room that an explosion had occurred at the Arena. Being associated with Manchester’s Victoria rail station, the Arena comes under the control of the British Transport Police (BTP) and four BTP officers were deployed to police the Ariana Grande concert. Within 30 seconds of the explosion occurring they were the first officers at the scene. Within ten minutes they were supported by further BTP officers in and around the foyer.

Police in the aftermath of the Manchester Arena bomb. (Source: Manchester Evening News. Image credit: Joel Goodman)

Recognising the sheer scale of the explosion, the BTP sergeant present at the scene realised the potential vulnerability if there was a follow-on attack such as a marauding terrorist attack and or a secondary IED.

Within a short time GMP officers attended the scene where a GMP inspector became the police Bronze Commander. At any emergency or major incident, the emergency services deploy a Gold, Silver and Bronze Command structure, which for the police is:

  1. Gold Command – has overall strategic command of the operation. They set the overarching strategy that all other plans must take account of;
  2. Silver Command – co-ordinates individual strategies developed by Bronze Command to ensure they reflect and contribute to Gold Command’s overarching strategy. Silver Command must be operationally and occupationally competent in the relevant disciplines in this role;
  3. Bronze Command Operations – Responsible for the command of a group of resources and carrying out functional and geographical responsibilities related to the tactical plan;
  4. Bronze Command Firearms – Responsible for developing firearms strategy and ensuring their tactical plans are developed and implemented to support it. Being a specialist knowledge role, operationally and occupationally, Bronze Command Firearms must be qualified and competent in this discipline.

This command structure is role, not rank, specific. The person taking the command role must be trained and have the necessary knowledge and expertise in the area they are carrying out that role. At the time the GMP inspector became Bronze Commander, Arena staff, BTP and GMP officers, paramedics and members of the public began triaging the casualties, using improvised stretchers to carry the injured to the rail station concourse into a Casualty Clearing Station.

By 22.35 hours the first GMP Armed Response Vehicle arrived at the scene. At that time, it was still not totally confirmed that an explosion occurred. Within minutes more Armed Response Vehicles arrived at the scene and by 22.51 hours twelve armed officers attended the scene. From the incoming information it was thought that even though an IED had been used, some of the injuries sustained by the casualties were gunshot wounds. This led the Bronze Command Force Duty Officer to suspect that a ‘Paris-style’ attack was in progress. Acting on this information he declared that Operation PLATO contingency be deployed. Developed by the UK’s Home Office and emergency services, at the time of this attack Operation PLATO was the contingency plan for dealing with a marauding terrorist attack. A marauding terrorist attack is a fast-moving attack where the terrorists, armed with firearms, move though a location aiming to find and kill or injure as many people as possible.

Armed Police at the scene. (Source: BBC news)

While other agencies were notified of the declaration of Operation PLATO, the Northwest Ambulance Service and the Greater Manchester Fire and Rescue Service (GMFRS) were not informed of this declaration. Declaring Operation PLATO enabled GMP to initiate mutual aid from neighbouring forces and within one hour 106 authorised firearms officers were deployed to assist GMP. By this time explosives detection search police dogs were at the scene to check for secondary IEDs.

In relation to the ambulance service, 56 ambulances and seven Rapid Response Vehicles, six Advanced Paramedics, three Consultant Paramedics and five doctors were deployed to the scene. Yorkshire and West Midlands Ambulance Service provided mutual aid to cover the Northwest Ambulance Service’s core business.

In relation to Greater Manchester Fire and Rescue Service (GMFRS), they only received three calls regarding the Arena attack, one from GMP, one from the Ambulance Service and one from a member of the public. As no information was coming directly to them from the scene, this led to GMFRS being reliant on the interpretation of events GMP and the Ambulance Service passed onto them. GMP nominated Manchester Cathedral car park as the fire engines’ rendezvous point, which is close to the Arena. Suspecting a marauding terrorist attack was escalating, the Fire Liaison Officer feared that the Cathedral car park would not provide enough protection for the firefighters and nominated Philips Park Fire Station as the rendezvous point. Complicating the Fire Liaison Officer’s role was that he tried to speak to the GMP Force Duty Officer, but he could not get through to him on the phone. At 00.12 hours no fire service resources were at the scene leading to the Chief Fire Officer contacting the senior Northwest Ambulance Service officer, where they discussed what GMFRS assets were required.

Two hours after the attack four fire engines attended the scene at Victoria station entrance. Even after their arrival, there were further delays before the fire engine crews entered the Arena’s concourse.

What these facts reveal is how complex the operation carried out by the initial responders is and, amid the chaotic scenes, how vital communications between the various services’ responders are in providing an effective response. It also highlights how important that information passed onto the command structure is accurate, thereby enabling the various command officers to make informed decisions ensuring that responders’ actions are appropriate and more effective to what they are facing. Communications were one of the important issues the Kerslake Review examined and made a number of recommendations on.


A former Head of the Civil Service and President of the Local Government Association, Lord Kerslake and a team of four qualified panel members carried out the independent review into the Manchester Arena bombing. Many recommendations were made covering a wide remit of roles including health and social care partnership, family liaison and support, community resilience, the media and mental health support. Focusing on the recommendations regarding the emergency services’ response they included:

  1. All Fire Rescue Services utilising the Northwest Fire Control Room (which is a separate agency to the fire rescue services) build contingencies and capabilities to enhance the development of multi-agency situational awareness;
  2. Messages should be shared directly between partner agencies’ control rooms immediately upon receipt of a message from the incident scene.

This came out of two issues, one in relation to the communication failure between GMFRS and the Northwest Fire Control. Also, the Report was concerned that police and ambulance service cultures have developed differently from the fire service. While the former have greater autonomy to carry out their duties, firefighters are much more defined by their position as part of a team and adherence to protocol based over decades to ensure the safety of firefighters.

Regarding communications, the Report recom-mended that agencies should explore the use of encrypted social media to improve the initial emergency arrangements, together with the internal communications systems for updating staff in an emergency. There are two reasons for this recommendation, one being to monitor social media in order to respond via their own social media to inaccuracies and ‘warn and inform’ by promoting and passing on their own, accurate messages. Secondly, as some of the official agency communications channels were not user friendly, unofficial means such as WhatsApp groups were used by emergency services staff during the response to the attack. The creation of official social media groups would enhance the communications during a response to a terrorist attack or major incident. As the Vodaphone system failed for a couple of hours just after the first responders attended the Arena, the Report recommended that to safeguard the future integrity of the National Aid Telephony System, the Home Office should secure appropriate guarantees from the company Vodaphone to ensure the necessary fall-back and disaster recovery arrangements are in place to address the failures that occurred.

The Report recommended Operation PLATO be reviewed and modified to cover any form of terrorist attack. The Report saw that a strict adherence to the relationship between a marauding terrorist firearms attack and Operation PLATO can lead to confusion, a lack of common situational awareness or can inhibit the dynamic application of capabilities to deal with the critical situation presented to the responders. Consequently, Operation PLATO was modified to include contingency plans for responses to terrorist attacks where sharply bladed weapons, vehicles, explosives or firearms are used.

Salman Abedi minutes before he detonated the bomb that killed 22 people at Manchester Arena.
(Source: Daily Star. Image credit: PA)


Following the Arena attack the UK terrorist threat level went to level four, which is critical where it is believed an attack is imminent. Although Salman Abedi died when he triggered the IED, knowing that knowledge and experience in the use of explosives are required, the detectives investigating the attack reasonably believed that Abedi had help and support from others. It was found Abedi had assistance from his brother Hashem Abedi who was living in Libya with the brothers’ parents. This led to the terrorist threat level being lowered to severe where an attack is highly likely.

As revealed during Hashem Abedi’s trial in 2020, the brothers planned the attack in January 2017 when they purchased nuts and screws to act as shrapnel and ordered chemicals from Amazon. The chemicals were used to make TATP (Triacetone Triperoxide often referred to as acetone peroxide) explosives and is an explosive made from commonly available ingredients. Being surveillance conscious, the Abedi brothers regularly switched mobile phones (eleven in five months) and used several vehicles to transport components around Manchester. They leased two addresses away from the family home in Fallowfield, Manchester. One of the addresses was used to take delivery of components they ordered, with the second address used as a bomb making factory. In April 2017 the brothers’ parents insisted they join them in Libya. This forced the brothers to stockpile their stash in a second-hand Nissan Micra they purchased before joining their parents in Libya. Later that month Salman Abedi returned alone to Manchester where he rented a flat in central Manchester, bought a rucksack, more shrapnel and constructed the bomb in the flat. During the investigation, Hashem Abedi’s fingerprints were found at the addresses of the premises they used, and, in the Nissan Micra, that still contained traces of the explosives used in the attack. One problem for the investigators due to the ongoing civil war in Libya, was getting Hashem Abedi extradited from the country. Although Libyan militiamen arrested him in 2017, Hashem Abedi’s extradition was achieved in 2019 and in 2020 he was found guilty of terrorist offences and the murder of the 22 victims killed in the attack. In August 2020 he began serving a custodial sentence after being sentenced to serve a minimum of 55 years before being eligible for parole.


In 2017 the former independent reviewer of terrorism legislation, David Anderson QC, was requested by the Home Secretary to conduct an independent review into the 2017 terrorist attacks in London and Manchester with the remit to ascertain what was known about the attackers prior to the attacks and review assessments and decisions made on the attackers by the security services and the police. Being a closed subject of interest (SOI) at the time of the Arena attack, Salman Abedi was not under close investigation. He had a criminal record for theft and handling stolen goods, but nothing terrorist related. Based on supposed contact with an Islamic State figure, in October 2015 he became an SOI, but as the contact was not direct, he became a closed SOI. In the months prior to the attack intelligence was received on Abedi, the significance of which MI5 did not appreciate at the time, but they arranged a meeting to be held on the 31st May 2017. Before they could make any decision on Abedi, unfortunately, the attack happened on the 22nd May. Whether more could have been done to stop the attack, Anderson concluded there is a high degree of uncertainty in speculating as to what might or might not have happened. He did add that on his return to the UK in April 2017 an opportunity was missed by MI5 to place Abedi on a ports action as it would have enabled him to have been questioned and searched at the airport by counter-terrorism detectives under a Schedule 7 Terrorism Act 2000 port stop.


A terrorist attack results in a traumatic and chaotic scene that emergency services face and deal with. This was evident in the Manchester Arena attack, especially as most of the victims were under the age of 14 years. This article does not aim to denigrate the emergency services’ response, conversely, as recognised in the Kerslake Report, many good procedures were conducted that night. This is about lessons learned and key ones, as covered in the Kerslake Report, centred on improving communications, improving the accuracy of information and reform of Operation PLATO, which have all been addressed. In relation to the investigation, being known or on intelligence systems is a criticism raised, especially by the media following an attack. Salman Abedi was a closed SOI and even though MI5 thought his actions prior to the attack warranted a meeting to discuss the threat he posed, as the Anderson Review found, hindsight is a wonderful thing and one cannot state categorically that if the meeting was held earlier it would have prevented the attack. To end on a positive note, the police investigation was complex, compounded by Hashem Abedi having to be extradited from Libya. The tenacity demonstrated by GMP and the National Counter-Terrorism Units, along with the Crown Prosecution Service prevailed, resulting in his conviction and 55-year minimum prison sentence.

In September 2020 the Public Inquiry into the Manchester Arena bombing commenced. Chaired by Sir John Saunders at Manchester Magistrates’ Court, the inquiry will have a wider scope than the Kerslake review, with a focus on exploring the circumstances leading up to and surrounding the attack. No doubt the issues raised here regarding the communications issue and MI5’s intelligence on Salman Abedi will be revisited. It will be interesting to see if the Public Inquiry makes further recommendations regarding intelligence on SOI’s, even if they are closed SOI’s, and the emergency services’ response to terrorist incidents.

While it is easy to criticise aspects, as the Kerslake Report revealed there were many examples of good practice carried out and should a similar attack occur in the future, assisting our emergency services is a more constructive response that we can all take. ■


  1. Report by Lord Kerslake on the Review into the Manchester Arena Attack
  2. Attacks in London and Manchester, March-June 2017, Independent Assessment of MI5 and police internal reviews by David Anderson Q.C Attacks_in_London_and_Manchester_Open_Report.pdf



Dr David Lowe is a retired police officer and is currently a senior research fellow at Leeds Beckett University Law School researching terrorism & security, policing and criminal law. He has many publications in this area including his recent books ‘Terrorism and State Surveillance of Communications’ and ‘Terrorism: Law and Policy’, both published by Routledge. David is regularly requested to provide expert commentary to UK national and international mainstream media on issues related to his research areas and provides an expert witness service.

Download the article:

Counter-IED Report, Autumn 2020