Defence Committee

Oral evidence: UK Response to Hybrid Threats, HC 1816

Tuesday 2 July 2019

Ordered by the House of Commons to be published on 2 July 2019.

Watch the meeting

Members present: Dr Julian Lewis (Chair); Martin Docherty-Hughes; Mr Mark Francois; Johnny Mercer; John Spellar; Phil Wilson.

Questions 123-206

Witnesses

I: Duncan Allan, Associate Fellow of the Russia and Eurasia Programme, Chatham House, Georgina Collins, Deputy Director Floods, Water and CBRN Emergencies, DEFRA, Alistair Cunningham, Executive Director, Growth, Investment and Place, Wiltshire Council, and Paul Mills, Deputy Chief Constable, Wiltshire Police.

Examination of witnesses

Witnesses: Duncan Allan, Associate Fellow of the Russia and Eurasia Programme, Chatham House, Georgina Collins, Deputy Director Floods, #Water and CBRN Emergencies, DEFRA, Alistair Cunningham, Executive Director, Growth, Investment and Place, Wiltshire Council, and Paul Mills, Deputy Chief Constable, Wiltshire Police.

Q123       Chair: Good morning, and welcome to the third oral evidence session of our inquiry into the UK response to hybrid threats. Even by the normal high standard of Defence Committee witnesses, we have a particularly interesting collection today. I ask each of you to briefly introduce yourselves—say a word or two about who you are and your area of expertise.

Georgina Collins: I am Georgina Collins, deputy director in DEFRA for floods, water and CBRN—chemical, biological, radiological and nuclear—emergencies.

Duncan Allan: Good morning. I am Duncan Allan. I am a private consultant and an associate fellow at Chatham House on the Russia and Eurasia programme, and I was for 28 years a member of the Foreign Office research analyst cadre, working on Russia.

Alistair Cunningham: Good morning. I am Alistair Cunningham, an executive director of Wiltshire Council. I was Gold commander in the response and chaired the recovery co-ordinating group.

Paul Mills: Good morning. I am Paul Mills, deputy chief constable of Wiltshire Police. I was the strategic co-ordinating group chair for the response phase of both the Salisbury and Amesbury incidents.

Chair: Obviously, two of our experts specifically relate to that episode. As you will appreciate, several of the questions go much wider, but if you feel the urge to come in on those, please indicate. Mark Francois will start us off.

Q124       Mr Francois: Lady and gentlemen, good morning. How well prepared was Wiltshire for dealing with a chemical attack such as this?

Alistair Cunningham: Paul and I are Box and Cox, I suppose.

Paul Mills: The main legislation relating to this is the Civil Contingencies Act 2004, which you may be familiar with. It puts an onus on local areas to prepare and plan for a range of different incidences. To inform that process, every two years there is an assessment process, which looks to identify threats and risks. That is then overseen by local resilience forums.

In Wiltshire and Swindon, we have a local resilience forum and a manager, and linked to that we have a number of plans related to things such as flooding, animal welfare, human welfare and so on, but also potential counter-terrorism incidents. A key part of that approach is making sure that, first, we identify incidents generically, but also that we are routinely exercising, coming together as respective partners around the table, as category 1 and 2 responders, to make sure that we are actually putting into place, in practice, the processes needed to respond to an incident such as the two that we had.

Alistair Cunningham: I think it is worth saying that in Wiltshire, because Porton Down is within our patch, we have prepared and modelled CBRN emergencies on a number of occasions, and our response to them. With the military in such close proximity and in large numbers, the relationship between partners and the military is exceptionally good.

One thing that set out our response to this was how quickly and effectively partners could work together and build that trust, because we had already been doing so beforehand. For the council, in terms of both the response and then the recovery, we are a very large unitary authority and so had the capacity to respond to this issue. That is one lesson that we have been disseminating to other partners. I think smaller local authorities would have struggled with the level of commitment required.

Q125       Mr Francois: We might come on to that. Had you actually exercised the scenario even vaguely familiar to this in advance, by chance?

Alistair Cunningham: We had recently exercised a plane crash on to the Porton facilities and, therefore, the release of harmful substances into the surrounding area, in the past couple of years—probably a year prior to this.

Paul Mills: Yes. A big part of local resilience forums is exercising. A range of the issues that we had exercised in in the couple of years before this included counter-terrorism related incidences, fire, train crashes, CBRN-specific incidences such as Alistair alluded to, and cyber-attacks. We exercise those at a local level but also regionally and nationally with key Government agencies.

To an extent with this, although we hadn’t prepared for Novichok specifically, very much the structure and principles, which I am sure we will go on to talk about, are the same around what you put into place. The key thing is then bringing the respective partners to the table that bring their expertise to be able to respond to what you have got in front of you.

Q126       Mr Francois: Thank you. I don’t expect you to name an individual county or metropolitan authority, but you made a good case on why you are particularly well prepared—fortunately, as luck would have it. Are there types of authorities that are far less well prepared than yourselves?

Alistair Cunningham: I think there will be a geographic distribution of how well they have done the work that we have done with a local resilience forum. There will be capacity issues if you look to the small districts trying to lead this. In the two-tier, you have got that obvious separation of roles.

Q127       Mr Francois: Is Wiltshire one-tier?

Alistair Cunningham: Wiltshire is one big rural unitary. That also plays into the local resilience forum. There is a much greater, cohesive core group of players, who work very collectively. There was no difficulty in Paul leading on the response and me leading on the recovery; it was very easy. During that time, we almost had a discussion in the meetings about which parts were response and which parts were recovery. It could have been more complex if there were a different local governance structure.

Paul Mills: If I may add to that, Wiltshire police is the third least funded police force in the country. So, this was actually a very good test because, routinely, with CT incidents that we have sadly seen, they have tended to be in bigger cities. Although we clearly would not have chosen for it to happen in Wiltshire, the fact that it did was a very good test of the network, from the counter terrorism policing network down to a small rural provincial force, actually responding to an incident such as this.

Q128       Mr Francois: What lessons have you learned? It sounds as if you were really quite well prepared, fortunately, but you must have learned some lessons. Secondly, what activities have you been involved in to disseminate what you have learned to other similar authorities around the country, to encourage best practice?

Paul Mills: Policing-wise, in the policing network, we have undertaken 16 separate debriefs, from local Wiltshire police through to the counter terrorism policing network, the national CBRN centre, and also across the local resilience forum. Key areas of learning—I am conscious, obviously, that this is in the public domain—there are some heads of terms really: the CBRN response and how that could be improved for the future; the use and supply of protective equipment and how we use that, which you will be familiar with from the pictures that you saw on television. There is also how we could improve comms and intelligence flow going forward.

The meeting structure and battle rhythm was very important, particularly from a local perspective up to the national, and making sure that that functioned as it should. How we mobilised national assets was another point of learning and, sadly, how to deal with the recovery of someone deceased due to a CBRN incident.

Those were the main heads of terms. In total, across the policing network there were 140 recommendations. They have been split at a national level and then down to local owners. They are being overseen by Chief Constable John Campbell, who is national lead for CBRN incidents on the National Police Chiefs Council.

On your wider point about disseminating, I think personally the last tally was 15 conferences that I have attended, both within policing and the local resilience forum, both nationally and planned internationally, to spread that learning, so that others who may have to deal with an incident such as this are aware of the key learning that we have taken from this incident. I’ll pass over to Alistair.

Alistair Cunningham: Paul and I have double-hatted at a number of conferences recently, including at the Emergency Planning Society and local resilience forums nationally, and I am doing the local government chief execs tomorrow. There has been a whole series of invites to local resilience forums across the country. We are actually planning our own conference in the autumn of this year, so that we can bring everyone into Wiltshire and properly disseminate our lessons learned. We have also been involved in a number of lessons learned exercises.

We always plan for full recovery, but we don’t often actually war-game it, as it were. In this instance, we learned a lot of lessons about response and recovery not being a linear process; one doesn’t end and the other start, particularly when you have an ongoing police investigation. I suppose that, at one point, we wrote a new chapter in the rulebook around re-establishing the strategic co-ordinating group to do tasks on our behalf, as the recovery co-ordinating group, which was a different approach.

For us, the biggest learning points were around engaging with our communities and how we actually ensured that we were properly giving what information we could and in a timely manner, particularly when other information sources were seeking to divert attention. We will pick that up.

Q129       Mr Francois: I am sorry; one more question has occurred to me: what was the key lesson that you learned going through this process?

Paul Mills: Certainly from a local perspective—I take it back to a small, rural police force—it was the ability of a local force with local partners to call upon the national infrastructure, which was identified as one thing that actually went well. At its height, we had 26 different partner agencies and representatives around the table within two days. The ability for all those resources to actually come together and bring their requisite skills and expertise to what was a very complex and unprecedented set of circumstances was the key bit of learning that came out for me, as was drawing upon those assets to deal with what was a very complex set of circumstances in front of us.

Q130       Chair: Before we move on to the next question, could our other two witnesses—who have heard how, in a sense, Salisbury was probably the best prepared that any part of the country could have been—say how they feel this incident would have played out in other parts of the country, looking at it from a national perspective?

Georgina Collins: DEFRA is the lead Government Department for CBRN incidents. We do a lot of work with local resilience forums, in terms of planning and training workshops, which we hold jointly with the national CBRN policing centre. That is our opportunity to get people who would potentially be in Paul’s position—chairing the strategic co-ordination group—to really understand some of those challenges and think about how they might plan for the recovery from a CBRN incident.

We know, from our work with various LRFs across the country, that those who have things like a nuclear facility, a COMAH-regulated site or other sorts of hazardous waste management or things like that within their patch are more likely to be engaged in thinking about these things. As Alistair said, Salisbury has Porton Down on its doorstep and a big military presence, so it is very CBRN-aware. We have found, when we go out and engage more widely with LRFs across the country, that those are the ones who are already thinking about it.

For us, the challenge is reaching out and making sure that we actually engage those who are not necessarily thinking about it from the outset. We engage with LRFs that have major infrastructure, such as an airport or things such as that, and do exercising around thinking about not only how they would respond to an incident, but that longer tail of recovery and some of the challenges that the recovery process throws up.

Q131       Chair: I obviously wouldn’t want to ask you to identify in public whether there were any weak links in the national chain, so far as this is concerned, but are you reasonably confident that there is a uniformly adequate standard throughout the country?

Georgina Collins: Yes—I think yes, but it is an area where we can always improve. Luckily, we do not have CBRN incidents very often, but local areas do have experience of having to deal with major accidental releases of chemicals or chemical fires, so we know that there is a level of planning and resilience already there. However, now that we have had an incident, it is important that we learn the lessons and communicate them more widely, because there are definitely things that worked well, which were within the doctrine, but that we flexed and adapted for the situation in Salisbury, which we would want to share more widely.

Q132       Chair: Given your expertise, Duncan, how do you think the Russians view the effectiveness of what happened in Salisbury? Even with such a well-prepared environment, it nevertheless caused massive disruption. To what extent do you think they anticipated that, and to what extent do you think they cared about it?

Duncan Allan: On the latter point, I don’t think they cared very much at all. That is, unfortunately, a sad commentary on any state that can carry out an outrageous action like this. That issue was of no consequence at all to Russian policy makers. In terms of how they viewed the effectiveness of the responsiveness on the ground, I cannot offer much of an insight, I am afraid.

To the extent that Russian actions abroad cause disruption and concern, and intimidate foreign audiences, all of those things are part and parcel of some of the things that Russia does abroad these days. To the extent that those things happened and were noticed in Salisbury, from the Russian perspective, they would have been anticipated and would have been seen as potential benefits.

Q133       Chair: If they had wanted to be sure of killing the person that they were targeting, they could have used much less dramatic means, which would have been much more certain. These means clearly seem to have been designed to create some sort of effect, and send some sort of signal. In the end an innocent person died and the person they were targeting survived. Have you any observations about what they were trying to achieve by using these very dramatic methods of assassination?

Duncan Allan: There is a parallel, of course, to the way in which Alexander Litvinenko was murdered in London in 2006. Unfortunately, there is a history on the part of the Russian and before them the Soviet security services of using poison and chemicals to assassinate specific individuals abroad. I am having to speculate, because we simply do not know what the answer to your question is on the Russian side. It is certainly plausible that one of the intentions was to send a message, first of all to individuals who might be tempted on the Russian side to betray their country—as the Kremlin sees it—and work for Western Governments: “This is the kind of punishment that will come your way at some point. Be in no doubt about that.”

But also I think there is a wider demonstration effect here. This is something that I will perhaps come to later on. It seems to me that the current Russian leadership seems to want to intimidate Western countries, Western Governments and Western audiences, in order to command respect and even fear, the belief being that that is the way you defend and promote your interests, at a time of crisis and confrontation with the leading Western powers. To the extent that actions like this can intimidate audiences and other countries, it is seen as welcome.

Q134       Chair: Because in the case of exiled Russian oligarchs, a disproportionately high number of whom have died under unexplained circumstances or apparent suicides unexpectedly, there is a question mark as to whether Russia was exacting vengeance. Using a method of this sort, presumably, leaves no doubt whatsoever of the message that is being sent.

Duncan Allan: It leaves no doubt whatsoever.

Chair: Thank you.

Q135       Martin Docherty-Hughes: I am going to turn this question on its head slightly. How would we cope with multiple concurrent incidents?

Georgina Collins: The Cabinet Office oversees the Government’s preparedness for a wide range of incidents, hazards and threats facing the UK. That is based around a system of working out what the reasonable worst-case scenario might be for those particular hazards and threats. That is what we set out in the national security risk assessment, or the public-facing document, which is the national risk register. As part of that we can prepare around those risks.

Given the number of variables and how complicated things can get, that gives us a basis on which to start our planning and preparedness. As part of that we also look at our ability to respond to concurrent incidents. My team is based in DEFRA, and we were going through mass water supply disruption caused by the “beast from the east” when we received notification that we potentially had a CBRN incident in Salisbury. Just on a local team basis, our ability to split the team so that we could still provide the national support needed for the water supply disruption, and then start thinking about what assistance we might need to provide for the recovery in Salisbury, was something that we had planned and prepared for, and we have that in place.

Although Salisbury was one incident, for us the incident in Amesbury happened concurrently because we were still starting decontamination following the first incident. If you look at Salisbury and the number of sites we had to deal with, and the different timings—we knew that places potentially had the risk of contamination, and the way we approached it gave us some insight into the stretch of dealing with concurrent incidents of that nature.

Paul Mills: I would go back and build on my previous answer about the local resilience forum network. Through the risk process, which Georgina has outlined, locally we have 34 different plans for different incidents. We have spoken about CBRN, but there could be a cyber-attack, flooding and so on. Those are all elements that you can go to for the local response. The key point for me would be then building on the national infrastructure that you have in place. In policing we have the National Police Coordination Centre. To bring that that back down to Salisbury, in the first incident we had nine scenes, and 11 in the second one. A significant number of police officers were involved in just cordoning off those scenes, and we were able to call on the national infrastructure, through the National Police Coordination Centre. Of the 43 forces in the country, we were assisted by 40, just to help with that task. Probably the biggest challenge with the Salisbury incident was its sustained long-term nature, which clearly had an impact on the balance of how we service business as usual as an emergency service, as well as dealing with the incident. I think the infrastructure is there, but clearly the more multiple incidents we have, the more tests there will be for the local and national network.

Q136       Martin Docherty-Hughes: You mentioned two incidents. Are you talking about flooding?

Georgina Collins: No, it was the mass water supply disruption caused by the “beast from the east.” Basically we had a period of cold weather and a rapid thaw, and unfortunately lots of water pipes burst and lots of people were off supply. It think it affected six water companies, so it was a large area not just in south-east England but up into the midlands. As Paul was saying, the really important thing is the mutual aid that we have in place. He spoke about mutual aid in a police force, but it got to a point where we could also consider the use of the private sector for cordoning as well. We used private sector security guarding at sites when we were in the decontamination phase. When the site was not still under police investigation but we wanted to keep it cordoned off for public health reasons, we were able to use private sector security guarding that took the pressure off the police, and that was really effective.

Alistair Cunningham: One thing we have been briefing partners on is the potential for any attack to turn into a hybrid attack. Because of the visibility of what was happening in Salisbury, we saw significant growth and interest in trying to penetrate our internet and email accounts. We anticipated that and got a national cyber-security programme to come and join us, and it effectively put a wrap around our system. We also uniquely run the system for Wiltshire police, and we saw the denial of service attacks going up and the number of people trying to get passwords increasing tenfold, peaking at 90,000 a day. That meant that staff—particularly Paul and myself—would come out of meetings in which we were not using IT but could not log in because someone had just tried it three times and failed.

We also saw the external firewall interface being attacked, and again that went up to about 90,000 hits a day at its peak, which was a twentyfold increase on normal. What we are saying is that, if you have flooding or any other disaster and become visible, you will have people seeking to penetrate your system. In our case, a lot of these were foreign actors trying to get in. We assume that there is a link between the incident itself and people trying to disrupt and bring down our systems.

Q137       Martin Docherty-Hughes: What impact would you say that years of austerity had on the ability to deal with hybrid threats? Georgina, you mentioned bringing in private security, which is kind of related to how policing is financed and so on. Does anyone want to have a quick go at that before we move on to the main question?

Paul Mills: There is a contextual element there as well. As was touched on by Georgina, the first incident was in March. As we went through into the second incident, which was pretty much a year ago to the day, we were obviously into the height of the summer period, with lots of policing demand, including because of a visit from Mr Trump. It was clear that because of the resource needed at a local level to deal with those cordons, where we had been able to draw on that mutual aid before, the police service was quite stretched by this point.

Again, I think it is a real testament to the partnership working that took place. We had conversations with DEFRA and looked to learn from some of their experience around using private security guards, and we were able to go for a hybrid approach to lessen the demands on policing, which was actually very effective. Sometimes with these things you have to overcome the slightly philosophical position around “Should it not just be police officers?” but in this particular circumstance I think it was really sensible and worked very well.

Alistair Cunningham: As Georgina said, we had quite a significant impact from the “beast from the East”, so we had mobilised a lot of staff over that weekend around highways and vulnerable people. We were just standing down and thinking about giving them time to recover when this incident took place. We were able to deploy a lot of staff into it for the year, as Paul says, both on response and recovery.

However, business as usual suffered significantly, because we weren’t able to backfill. We got a lot of support for Government funding for things we were doing, and we spent a couple of million of our own reserves, but we were left with a £5 million deficit for staff, because we had not made the savings that we needed to bring our budget into balance because of this sort of austerity. It has had, and still has, a long-term impact on our ability to manage within budget.

Q138       Martin Docherty-Hughes: The overlapping question: how well prepared, at a local level, is the UK for more widespread hybrid incidents, such as on computer networks or national infrastructure, as well as chemical and biological? When I say the UK, I mean the United Kingdom of Great Britain and Northern Ireland.

Paul Mills: Again, I come back to the local resilience forum network undertaking that threat assessment process, understanding what those threats are and developing plans. The plans can only ever be skeletal. As we saw with the Novichok attack, those plans have to be tailored to what you are actually dealing with.

Martin Docherty-Hughes: Paul mentioned that he is going to the Local Government Association tomorrow. I think the Local Government Association technically only covers England.

Paul Mills: Yes.

Q139       Martin Docherty-Hughes: There is also the Welsh Local Government Association, the Northern Ireland Local Government Association and, of course, COSLA—the Convention of Scottish Local Authorities. I would be keen to see them giving evidence at some point. How do you see that local government picture across the rest of the UK, if you have any way to inform that?

Paul Mills: The only thing that we can do, going back to the learning that we have tried to disseminate, is to talk about the experiences that we have actually had. The question mark for all local bodies at the end of that should hopefully be: if this were to happen here, what would that look like, in terms of the infrastructure that we actually have in place? We have that responsibility to share that learning.

Q140       Martin Docherty-Hughes: Finally, Georgina, DEFRA covers England and parts of Wales. There is also Environment Agency Wales, SEPA in Scotland and an agency in Northern Ireland.

Georgina Collins: Yes. For CBRN recovery, we take a UK-wide approach. We work very closely with colleagues, and we run workshops in Belfast, Scotland and Wales.

Q141       Martin Docherty-Hughes: How many workshops, if you don’t mind my asking? Can you provide that at a later time?

Georgina Collins: I can provide that at a later time. The last ones we did were in Edinburgh on 5 June 2017 and in Cardiff on 24 October 2017. We had a programme all planned for 2018 but, like others, that business as usual work had to stop while we did the actual recovery work in Salisbury. We also regularly take part in meetings with colleagues who lead on CBRN and national security issues in Scotland, Wales and Northern Ireland. People in my team participate in those. The Government approach to CBRN recovery has always been to have some central Government expertise, but to then look at using private sector capability to do the actual clean-up work. We do a lot of work with colleagues in the devolved Administrations looking at what that capability might be, and what might be available to use in these sorts of situations.

Q142       Martin Docherty-Hughes: And would that cover also the computer infrastructure, and the national infrastructure such as rail, the NHS and so on?

Georgina Collins: I think you will have representatives from the Cabinet Office at your next session who will be able to talk more generally about the wider programme. My team and my work is very much on the CBRN recovery side. There are Government strategies in place, and it is very much about looking at what would be different if this incident occurred in Edinburgh, or how it would affect how we work and the procedures and processes we have in place.

Q143       Martin Docherty-Hughes: Finally, Duncan, you referred in the previous question to the impact of the attack by the Russian State. Do you think they targeted Salisbury for a specific reason, given that it might have been slightly more resilient? Did they think that they would not carry out an attack, but do something that they would perceive as having a limited impact, and then walk away from? That might sound weird, but did they want to go in, create an issue, create a situation and target the individuals in place, knowing that the teams involved would be able to physically deal with it, whereas had it been done somewhere else it might not have been that straightforward?

Duncan Allan: My assumption—

Martin Docherty-Hughes: Or are they not that intelligent?

Duncan Allan: It is not a question of not being intelligent; it is a question of focusing on one issue, which was to kill Sergei Skripal—full stop. If there is wider disruption or wider alarm, so be it. That is potentially beneficial, but no consideration would have been given to possible secondary effects.

Q144       Martin Docherty-Hughes: It would have been no consolation to the Skripals that the incident occurred in Salisbury for the benefit of the wider community. Had it happened anywhere else, it would have had a more long-term impact, as people might not have been able to deal with it so effectively.

Duncan Allan: indicated assent.

Georgina Collins: I don’t know if that is really the case. Obviously, we have the fact that Porton Down is in close proximity, but the role and how we would have responded would have been the same. The role of the Defence Science and Technology Laboratory would have been the same, no matter where it happened in the country. Maybe you would have a slight time lag with sampling coming from one part of the country down to Porton Down, but it would only be a matter of hours. It takes a bit of time to get it up and running, but once you have started your sampling process, once you have that run-rate of things coming through, and once you are in the process and the cycle, then you are going. From that side of things, it shouldn’t make it a difference. Some of the challenges would be more around the political leadership.

Alistair Cunningham: A very personal observation that did come out in the disruption around the comms was the proximity of Porton and Winterbourne Gunner. It could have been about the vector chosen to carry out the attack, so it was easy to then say in Salisbury that it probably leaked locally rather than being brought in. It could have been more about the method, in relation to Salisbury. That is a personal thought.

Q145       Chair: Duncan, do you think that there is any significance in the fact that both Litvinenko and Skripal were somewhat unusual in that they were people who had not only been double agents—as it were—or spies, but who were perceived by the Russians as continuing to work with the British authorities, and that these bizarre ways of trying to kill them were chosen for those two individuals, rather than other people whom the Russians had cause to want eliminated, such as oligarchs who had gone rogue?

Duncan Allan: That may well be part of the explanation, but I would add, as I said earlier, that there is a long history of the Russian and the Soviet intelligence and security services using poison—using exotic chemicals—to assassinate people abroad. This is a long-standing practice.  

Q146       John Spellar: Following on briefly from the previous questioning, you said you quickly mobilised private security guards to backfill for the police. Was that on the basis of an existing contract for security work, or did you have to procure a new contract for that?

Paul Mills: That was in incident No. 2. In incident No. 1, we purely used police officers. In incident No. 2, due to the context that I set out around things going on nationally that were putting extra demands there, we realised it was going to be a stretch. So that is where, through some of the network we had established, I was having a conversation with Georgina and other colleagues. They already had a contract in place so, thankfully, common sense prevailed and we were able to piggyback on the back of that. That was a really sensible way of doing business at a time that was quite fraught around resourcing.

Q147       John Spellar: Indeed. It makes sense and streams into the next bit, which is that you mentioned mobilising national assets. Were the central Government arrangements effective and timely, and how did the relationship between the strategic co-ordinating group and COBRA—both national agencies and Ministries—actually work?

Paul Mills: Do you want to lead off and perhaps set the context?

Georgina Collins: Obviously, with a major incident, our standard procedures kick in. While Paul was leading and chairing the co-ordination group at the local level, within and across Government we had a cross-Government ministerial group set up.

Q148       John Spellar: Timescale?

Georgina Collins: On Monday 5 March, we heard that there had been, potentially, a major incident declared in Salisbury. We did not know at that point what it was because, at first, it was a suspected fentanyl overdose. Tuesday 6 March was the first senior officials’ meeting convened by the Cabinet Office, where we were informed of the situation. Still at that point, the actual chemical had not been formally identified, but preliminary indications were that it was a potential nerve agent. On Wednesday 7 March, that was when the first cross-Government ministerial meeting was held. That meeting was chaired by the Home Secretary. That was how quickly that was set up.

Q149       Mr Francois: That was COBRA, was it?

Georgina Collins: I am not sure if it was formally called COBRA but yes, it was the equivalent of COBRA. That then met and the supporting senior officials’ meeting also happened. Those were happening on a daily basis at officials’ level, and depending on when information was coming through. It happened quickly as soon as we knew and we had the confirmation about what chemical had been used at the incident.

Q150       John Spellar: Do we think the time scale was the appropriate one or should that have been speeded up? In other words, what were the lessons learned out of that response?

Georgina Collins: Ministers were informed on Monday, but until we had confirmation that the cause was not Fentanyl and was an organophosphate nerve agent, there was nothing for Ministers to convene and come together to discuss. Cabinet Office has done a lessons learned review and the timing of those processes worked. At a working level, all the key Government Departments co-located and worked out of the Home Office so that information flow and information sharing and decision making could happen very quickly and we could all provide consistent advice to Ministers as well. That all happened in that first week too, so by the Thursday we were all co-located and working together in that way.

Q151       John Spellar: What about your interaction with the local agencies—police, council and others? How effective was that and how timely was it in the implementing?

Georgina Collins: Right from the start, Government liaison officers were involved in the first calls that the local resilience forum held—that is the first strategic co-ordination group, which Paul would have chaired. Government officials were very much there at the start, as information was starting to be known about what the potential situation might be. They were then feeding that back to national Government, so that we understood what was emerging at the local level.

The security classification changed once it was confirmed that it was a Novichok. That meant that people could no longer dial into meetings; at DEFRA we deployed people locally to work in Salisbury and to start working with Wiltshire Council, to think about recovery and remediation, and how that would look, and to set up the remediation cell, which we led from the local level.

Q152       John Spellar: Are there any lessons that you think should be taken in order to improve that, either in process or in training and exercising?

Georgina Collins: Yes. For me, what was really important was embedding locally, and being there with Wiltshire Council and local partners to really understand the impact it was having on the community, the site and the environment. It helped with the information flow, so it didn’t feel that Whitehall had a different picture to what was being discussed at the local level; I think that was really important and is definitely a model I would want my team to continue to use in the future.

What worked really well was that Paul would dial into the COBRA meetings and give an update from the Wiltshire police perspective, as well as having Gold command and CT policing in the room, talking about the police investigation and that side of things. I thought that worked really well. I don’t know if you found that, Paul?

Paul Mills: Yes. We have heard from the national side, so perhaps I can talk from the other end, which is the local side. If we think about the first incident occurring on 4 March, I can talk about how the local works with the national, if that is helpful.

Even on that first evening, you’ve got the local police working with the hospital, with Porton Down and with the national CBRN centre. At this point, we’ve got a number of hypotheses around what may have happened to the Skripals. By the time you get to the Monday morning, I’ve declared a major incident. We bring the local resilience forum together under my command, as strategic co-ordinating group chair. As I alluded to, within the space of 48 hours you’ve got 26 different partner agencies and representatives around the table, assisting me at the local level.

One of the things that was also put in place—this was a number of days in, I think on day 6 or 7—was the health emergency response cell, which made a bridge from the national scientific down to the local. We were meeting twice daily virtually to have conversations with Georgina and other key Government colleagues, to advise us at a local level. COBRA overlaid that. Also on day 2, there was a conversation between us and the counter terrorism policing network, around where the primacy sat for the investigation. They were down with us within 24 hours, so that local to national link worked very effectively from my perspective.

Q153       Mr Francois: Just quickly, from a previous inquiry we know that when we had all the chaos at Gatwick over drones, COBRA never met to co-ordinate any kind of intergovernmental response. In this case, COBRA met very quickly. Was the fact that it was a nerve agent that completely changed the situation?

Georgina Collins: Cabinet Office support the COBRA process and provide the secretariat to that. They will have discussed with No.10 how to approach the situation. The key is whether or not an incident requires a cross-Government national support response.

Mr Francois: You could have argued that Gatwick did, but it never happened.

Georgina Collins: DEFRA wasn’t involved in the drone incident at Gatwick. Obviously, there was mostly a transport-led concern there.

Mr Francois: In quotes, yes. I am trying to draw the distinction between situations; in this situation, by the sound of it, it all worked pretty much as it should have done, but with the Gatwick situation pretty much nothing worked as it should have done.

Georgina Collins: There are different triggers around what is a major incident that requires national Government co-ordination response and what can be dealt with by the lead Government Departments. We have flooding; quite often that doesn’t have COBRA involved in the response to it, because it is not so widespread or at such a mass scale that DEFRA needs to be involved.

Mr Francois: Sorry—it did in 2014. I lived in COBRA for a month.

Georgina Collins: Yes, but other flooding incidents don’t have that because we are confident that the local level will be able to manage it and deal with it, with a bit of support from the Environment Agency and DEFRA, and thinking about impacts on infrastructure, such as transport. When you have a completely novel situation and the unprecedented use of a chemical weapon in a part of fairly rural England, that is not something where we would say, “That’s over to the local level.”

Q154       Phil Wilson: How did Russia’s denials of responsibility affect your responses to the attack?

Georgina Collins: From a recovery perspective it didn’t. I’ll be very honest—I was very much thinking about the people of Salisbury and public confidence and health, and ensuring that Salisbury could get back to whatever the new normal was for the city. We worked closely with Wiltshire Council and Wiltshire police and partners to help that happen. The Russia element placed high levels of security on our information sharing and made us much more aware. That meant that we weren’t openly sending things by email or having open telephone conversations, but we were very much focused on the people who had been impacted—the victims—rather than thinking about the adversaries.

Q155       Phil Wilson: So operationally you don’t think it had any effect.

Georgina Collins: It had the effect that we looked to using the military capability for the work, rather than the private sector. For the recovery, that was the major big thing for us. We were dealing with an agent that not much is known about in the public domain and there are national security interests around that. We were not able to be as open and share as much information with a potential private sector contractor about what they would be cleaning up, so we looked at using military capability to do that.

Q156       Phil Wilson: How did it affect the police operation?

Paul Mills: It comes back to the structure that is put in place. I spoke about the establishment of the strategic co-ordinating group. One key cell that is set up is a multi-agency media cell, and that was established on day 1. That is led by the police with other key partner agencies contributing, and it had a national link into Government communications across Departments on a daily basis. A conversation was going on about what was to be responded to locally regarding reassurance public health messaging, and the degree of requests for information from counter-terrorism policing networks—that links with the wider element of Russia.

A key pinch-point for me was the second incident. Two members of the public who had no reference back to Russia at all clearly became ill, and there was all the propaganda and so on going on at that point. There was talk of a potential rogue action from Porton Down, and we had to be clear with our messaging to try to reassure the public that that was not the case.

Q157       Phil Wilson: How did you ensure that UK authorities provided a consistent and accurate message and narrative?

Georgina Collins: A national security communications group was set up, which co-ordinated that message across the Government. We had public health and scientific advice coming through from the Scientific Advisory Group for Emergencies, which provides advice to COBRA or the equivalent. That helped to set out what we could say publicly so that we were able to give people confidence about Salisbury being safe, and that the areas of risk were cordoned off to protect them. That was a really important message.

Q158       Phil Wilson: How important were the local, national and international media? Was there any difficulty in getting sign-off on press releases, or quotes or information that would be put out from the operation?

Paul Mills: It goes back to the infrastructure of local messaging and my responsibility, as the commander locally, to sign off those messages. Clearly there was a potential crossover around national messaging, so what I have described about the infrastructure that was put in place was very effective. That meant meeting on a daily basis to share those messages, and we developed a rolling national script of what the messaging was. There is always a danger that people are getting messages that are at cross purposes. As you will have seen, we were besieged by the media. One of the other key things that we put in place at a local level with that local focus was that Alistair and I and other key bodies held local meetings with the public. We heavily invested in that, with key people who are operationally involved—such as ourselves—having a constant ongoing narrative with the public. We saw meetings with up to 200 local residents coming and were able to talk through factually and share what we could concerning where we were at any given stage of the operation.

The most challenging bit here, without a shadow of doubt, was the fact that you had an investigation ongoing which was in the secret space. I was just reflecting on the timescale last night. If you think of incident No. 1 on 4 March, it was not until 5 September that the counter terrorism policing network were able to talk about the progress that they had made with the investigation. Alistair will recall that in certain public meetings we had to ask the public to trust in British policing that we could not tell them a great deal around the investigation, but we were making progress. I guess it is testament to the people locally in Salisbury and Amesbury that they kept with us.

Q159       Phil Wilson: They were willing to accept that?

Paul Mills: It was difficult on occasions. If I had been a member of the public, particularly with incident No. 2, which was at a critical point, thinking: “Well, three months on, by the sound of it you haven’t caught anybody, we now have—“

Q160       Phil Wilson: I suppose from the public’s point of view, they didn’t know if there was going to be an incident No. 3.

Paul Mills: No, absolutely. Probably the most difficult messaging was with the intelligence that we had. We had to say to the public on incident No. 2, if they didn’t drop something, they should not pick it up. If you think of the practical ramifications of that where you have a very engaged community that goes out to things like litter-picking, how long do you keep that messaging in place on a practical basis?

Q161       Phil Wilson: So you think you were able to keep a consistent message to people at a local level and nationally as well?

Paul Mills: Yes, I believe so. Going back to the question that was raised earlier, certainly the learning identified in the communications, both in terms of traditional briefings to the media, but also the use of social media, worked very effectively.

Q162       Phil Wilson: How important was it to rebut effectively all the Russian disinformation that was coming out?

Paul Mills: I probably go back to that local element. We felt it was not really our role, to do that. It goes back to Georgina at national Government level.

Georgina Collins: Yes, it was very much national security comms lead. I was not closely involved in that. My comms colleagues were, so we embedded a press officer from DEFRA at the local level to work particularly with Wiltshire Council. We were involved in the media cell set-up under the strategic co-ordination group. That was a really good link back to the national security comms work as well. Obviously, so many disinformation messages and stories were running at the time, it was very much national security comms.

Q163       Phil Wilson: I have seen the figures; there were dozens.

Georgina Collins: Yes, and they have led in prioritising which ones to rebut. They did a lot of work around thinking about what was most effective on that.

Q164       Phil Wilson: Did you have to sift through all the different scenarios of different disinformation laid before you, because there were dozens of different types of messages? They talked about whether it was the UK that actually did it; that other European nations did it; that it was Iran. Did you have to sift through all those messages to try to get a coherent one, or did you have to rebut every one individually?

Georgina Collins: It wasn’t the work of me or my team. When you have someone from the Cabinet Office here, they will explain the approach they took. They have a lot of work around doing strategic comms and they took an approach to that issue.

Alistair Cunningham: It is worth saying on that whole piece on the disinformation, at a local level and leading the recovery and the comms and those events, we decided to be open, transparent and honest and brief as much as we could, both to the wider public and to what we called the strategic leaders—the MP, the local councils, all those things—to make sure that everyone would see the information was aligned and we could release it.

We found that by having that good relation with the community and with the media—the media were broadly very supportive, because they had a lot of access. We ensured that when we ran press conferences and media briefings, I would sit there, Paul would be there, and we would have people who knew what was happening. As Paul talked about, a critical point after the Amesbury incident was when Neil Basu came down and sat on the panel and was able to say what he could on the policing aspect for the counter-terrorism. While it was shocking to hear about things that we did not know, it certainly calmed it down. We had that livestreamed, and 1.2 million people saw it on social media over the whole period. Certainly for the residents, the fact that they had people leading all those various elements from DEFRA and the police meant that they understood that we were on top of it and were not pulling the wool over their eyes, and that really helped us to keep the community on side.

Q165       Phil Wilson: This inquiry is into hybrid threats. The disinformation aspect is well documented. You may not be able to answer this, but were there any other ways in which the Russians tried to interfere with the inquiry?

Paul Mills: Alistair touched on the cyber elements and the assumptions that have come out from that. I am not sure that I can add anything greatly different to that. Clearly for the counter terrorism policing network’s investigation, when it was ongoing, some of the media reporting was challenging. That direct question would be better posed to somebody from the counter terrorism policing network.

Q166       Chair: Very good, Phil. Am I right in thinking that the publicising of the CCTV footage of the two Russians was pretty much a turning point in the propaganda dimension of all this? Can you remind us at what stage that footage came through? Do any of you know whether it was just good luck that they were captured on CCTV? Were they captured on, as it were, private CCTV that was made available by a public-spirited shopkeeper, or was it more systematic than that?

Paul Mills: I will start, and then Alistair can perhaps talk about the infrastructure of Salisbury CCTV. From day 1, a key strand of the counter terrorism policing network would have been CCTV. We are fortunate to have a system within Salisbury, and as we see the mass growth of private CCTV, that consisted of hours’ worth of footage gathered from both state-owned CCTV and also private individuals and businesses.

Q167       Chair: On that specific point, did you have a system in place to scoop up this potential source of vital information from private sources, or was it just a question of making a public appeal, saying, “For goodness’ sake hang on to any CCTV from the last 48 hours”?

Paul Mills: Clearly, in all police service investigations now, whether of a normal crime or a crime of this magnitude, CCTV is a key investigative strategy. From day 1, the counter terrorism policing network’s senior investigating officer would have set a strategy around gathering CCTV, which is routine to them. They have certain methods and mechanisms around how they do that trawl. Clearly an element of that is in the communications out to people. We know that CCTV can often be wiped after a period of time, so we have to encourage people to make sure that they keep hold of it, because it may be used for evidential purposes.

If I can return to the second part of your question around the time element, incident No. 1 was on 4 March. By the time the counter terrorism policing network were able to reveal the investigative progress they had made, that was on 5 September, so there was almost a six-month period between incident No. 1 and their going public with that.

Q168       Chair: Am I right in remembering that it was quite soon after the footage was made public that the real identities of the two GRU members were revealed?

Paul Mills: Again, I have to be careful in this setting. That is a question for the counter terrorism policing network. Through the counter terrorism policing network, we have only made one announcement around the identification of those individuals. Clearly you will be aware of media speculation around the names of those individuals, but the police service has not commented on those individuals and their names at this point in time.

Q169       Chair: But you do agree, don’t you, that this was a turning point? Of course, it was that that provoked the Russians into their very heavy-handed production of these two individuals, with their rather unlikely admiration for the spire of Salisbury cathedral.

Paul Mills: Yes.

Q170       Chair: From then on, I think it was pretty much a third-class effort from the Russian disinformers.

Paul Mills: Yes, indeed. That period of six months and the not being able to comment due to the fact that the investigation was in a secret space was clearly a co-ordinated approach by the counter terrorism policing network to reassure the public that progress had actually been made in their investigation.

Q171       Chair: Duncan, you said earlier that you thought the Russians were not at all bothered about the ripple effect, to put it mildly, on others—on innocent citizens and our relations with them—of doing what they did, but they obviously felt it necessary to engage in a very extensive disinformation effort. Why do you think they took all that trouble if they didn’t care? If they thought it was worth winning a disinformation war, presumably they will have been rather disappointed at the way it went wrong once these two characters were identified on film and their true identities disclosed and they then made a laughing stock—if that is not an inappropriate way of describing it in such grim circumstances—with their televised performance.

Duncan Allan: On the first point, I think, again, that disinformation is nothing new as an arm of Russian policy. If we explore back to the aftermath of the murder of Alexander Litvinenko, we saw the same thing happening, arguably on a smaller scale and perhaps in some ways a less sophisticated scale. During the intervening period, this is a policy arm of the Russian state that has been honed in a pretty serious way, including by having very large resource invested in it. So there is nothing new here.

We have to understand what the objective is here—there are several objectives. One of the objectives is simply to sow confusion, to create chaos and doubt, partly to discredit what a target Government is trying to say at a particular moment—in this case, the UK Government. But that feeds in, I think, to a wider objective, which is to undermine the authority more broadly of target Governments in the eyes of their populations and electorates. There is no secret here about what the Russians are doing. In the immediate aftermath of the events in Salisbury last year, we saw the Russian disinformation machinery really going into overdrive—an indication, I think, of the extent to which it can be focused and put into high gear at fairly short notice.

Q172       Chair: But who were they trying to impress with this disinformation? They clearly didn’t care much about what people in the United Kingdom thought. Were they just trying to sow doubts in other parts of the world as to who might have been responsible?

Duncan Allan: Sow doubts in other parts of the world, but sow doubts in the UK. I have been very struck since the events in Salisbury by the extent to which these Russian messages are picked up and find a ready home in some quarters.

John Spellar: In the UK?

Duncan Allan: In the UK. That I find depressing, but an important point that we need to acknowledge is that there are audiences in the UK who are receptive to some of these messages, for a variety of reasons. That will have been an objective of Russian disinformation activity from the outset, I suggest.

Chair: Thank you. Johnny—segueing beautifully.

Q173       Johnny Mercer: We are looking at the response of civil authorities to these immensely difficult attacks. First, it goes without saying, a huge thank you to you guys for all your work. It is an immensely complicated scenario to deal with and I thought the way in which the information war, if you like—war is too strong a word—was conducted was brilliant and an example going forward. I am trying to understand our response. Paul, how do you go from finding two individuals unconscious on a park bench in Salisbury to triggering the response mechanism of the state around chemical warfare? I imagine that the police officers or the ambulance staff who find them will go through their initial procedures, but at what stage do you start thinking into the strategic space around what might be going on around these individuals?

Paul Mills: If I take us back to the March incident, you are absolutely right that that was a response in good faith—something the emergency services always do. I have said publicly that I am amazed that more people, particularly emergency responders, did not become ill as a result of attending to the Skripals.

The way that works is that we will develop at the very start a number of hypotheses around what could have happened. At one end of the spectrum, you go with food poisoning through to, ultimately, what we ended up dealing with. It is fair to say that that end of the spectrum around what we ended up dealing with was not there on day 1.

I ended up getting a call on the Sunday evening when the incident occurred to brief me on what had actually happened. Critically, the intelligence is so central here. At that point in time, we made the link around Mr Skripal’s background and that is when the national infrastructure starts to come into play at two levels: on that first evening, around what was the potential public health risk around the treatment of the Skripals, but also officers and other responders. That took place with support on the evening from the CBRN national centre and Porton Down. Importantly, from an intelligence perspective, that is where we get into the counter terrorism policing network. We start to have those conversations on the Sunday evening. By the time we got through to 6 o’clock on the Monday morning, I am having conversations with the counter terrorism policing network’s strategic leaders around what we have got here, and the hypothesis starts to move towards “Actually, something here really isn’t quite right.” That is how the machinery then comes in and I declare a major incident.

Q174       Johnny Mercer: You war-gamed previous scenarios; you talked about a plane crashing into Porton Down. You had exercises where you had thought that this was in the envelope of operational possibility, I suppose.

Paul Mills: The CT threat is clearly a threat, as we know. Certainly, the brilliance of the local resilience forum is the ability to strategically understand what potential threats are. Did we have a particular threat around Novichok per se? No, but that skeletal infrastructure to be able to say “There’s a CBRN threat here. Specifically, it has manifested itself in this way” then enables me to press the button, declare a major incident and get the right partners around the table; and then we structure the response relative to what we have got with those key agencies there.

Q175       Johnny Mercer: Great. I imagine, at the time, the residents of Salisbury, with their confidence in the authorities initially, did not really pick up on what was going on. From the outside, it seemed like they had complete confidence in you and what was going on and an element of trust there that was admirable in a way. Did you feel that? Or did you, at any stage, feel that it was getting away from you in terms of people’s confidence in what was going on and their patience in what was, clearly, a very complex investigation?

Paul Mills: A little bit comes back to the structures of the media cell that we put in place and, as Alistair alluded to, being as open and transparent as we could around the information that we had—lots of public reassurance work from the meetings I have alluded to, but we also had lots of people on the ground with leaflets. A real practical point is that where you have those cordons, you have two options: you can have police officers just stood on the cordons or you can actively use them to engage with members of the public. That is the response we took with that, with all the overlaying stuff around public meetings and ongoing media. Probably the potential tipping point was incident No. 2, but I am still amazed to this day—because I put myself as a Wiltshire resident—that going back to the six-month point before we could talk about who we believed had committed this atrocity, through those public engagements the Wiltshire public stayed with us. I pay great testament to their resilience as a local community to support us both in Salisbury and Amesbury.

Alistair Cunningham: It is probably worth saying that after the first incident, I suppose at the end of March when recovery took over, footfall was down by 16% in the city.

Q176       Johnny Mercer: Sixteen—one six?

Alistair Cunningham: Sixteen—one six. That’s year-on-year but adjusted for the decline nationally, so that was significant. It climbed back to just 4% down before the Amesbury incident, and then has dropped to 12% down again and stayed there and is still there now.

One thing that came out of it was, in terms of the disinformation piece, after the second incident we surveyed the residents of the city. Eighty-five percent of them were unconcerned because they had engaged with us and knew what was happening. However, around Salisbury, where we have lost that confidence is people within a two-mile travel area who no longer come. They go to Bath, they go to Winchester, they go to Southampton. Outside of the city bubble, where they were engaging very closely with recovery and the police and national partners, that concern about Salisbury has had more of an impact.

Q177       Johnny Mercer: That’s interesting because it is exactly the same in Plymouth with the nuclear submarines. People who live close to them have no concerns whatsoever, but disinformation reaches out beyond that. You have kind of answered my question about the impact of Russian disinformation. Nationally, there is a bit of a flowerbed where this stuff can grow up and people talk about it. Did you find any of it locally? Did any of that translate off the internet forums and into presenting itself at the cordons or anything like that?

Paul Mills: Remarkably, no. Again, there were points of continuity for both incidents, particularly in the public meetings. Yes, on occasions there were questions about Russia, but predominantly they were locally based questions. To put that into perspective, when you have all those cordons there, and you are seeing people in CBRN suits, that is so out of the norm for people’s normal frame of reference. I think we were fortunate with the military—we are a military county—and there was a huge exercise to recover many of the assets from police cars and ambulances that had to be abandoned, all back to Porton Down. Notwithstanding the Russia element and all that going on, through that communication process the community was able to go on that journey with us and understand what we were doing.

Q178       Johnny Mercer: Obviously I would say this, but do you think that because it was a military community, that played in its favour a little bit?

Alistair Cunningham: I think we found exactly that point—it played into the wider consideration. In Salisbury and Amesbury, having the military on the scene and visible in the streets was a greater comfort because we are a military place. How that would play out in a non-military location, and how it played out nationally on the television scene, I think would be from a different perspective. The Salisbury residents were pleased to see the military, and they responded well to their local teams who were dealing with the issue.

Q179       Johnny Mercer: When you practised for this sort of thing, and war-gamed it and did exercises, did you get local businesses and residents involved, or was it something you worked up with the security and local authority elements?

Alistair Cunningham: That is something that we worked up and are addressing. There is a need for our major business to look beyond IT issues in terms of how they respond. We certainly found that the larger multiples were better able to respond as they could deploy staff elsewhere, and the smaller businesses really suffered. A lot of the support that we got from the Government went into those processes to keep those businesses open. Behind the cordons there was a 100% trade drop—some saw their trade drop by 85%, and some were unaffected. There was a big programme of not allowing businesses to go to the wall. Now we are talking to businesses about how they respond, because it is not just about flooding and the IT going down—I think most businesses focus on those things.

Q180       Johnny Mercer: Has a business gone under because of this?

Alistair Cunningham: Not directly. I think there were businesses that were struggling, and it hastened their end. The funding we used was very much about keeping those businesses open, and some investment so that they could trade effectively afterwards.

Q181       Martin Docherty-Hughes: Duncan, you described the attack on the Skripals as a UK policy failure. Can you tell us what you mean by that? Do you regard the attack on the Skripals as part of a wider Russian strategy?

Duncan Allan: Yes, I did describe the Skripal attack as a UK policy failure in a paper that I published at Chatham House last October. Simply put, following the murder of Litvinenko in 2006, the UK failed to deter another life-threatening attack on a UK national on UK territory by Russian state organs. It is really that simple. In my judgment, I do not think that Russian policy makers took the UK seriously enough, particularly following the publication of the Litvinenko inquiry report in January 2016, which concluded that “probably” President Putin had authorised that assassination. There was a gap between what the Government were saying publicly, which was pretty tough, and their actions, which were pretty minimal. As far as I am aware, the only new measure taken by the Government following the publication of the inquiry report was a freezing order on the UK-based assets of the two prime suspects who were being sought for the murder of Litvinenko. I don’t even know whether they had any assets in the UK. There was a gap, and that is a dangerous situation to put yourself in when you are dealing with a state like the Russian state, because there is a real possibility that you are not going to be taken seriously. There is a real possibility, it seems to me, that Russian policy makers will doubt your resolve.

Q182       Martin Docherty-Hughes: Would you say, therefore, that part of the hybrid warfare also goes into the legislation? You might have heard of Scottish limited partnerships. This method of governance, in terms of finance, is utilised to facilitate that dark money be moved around from various places, whether it is the Russian Federation, Ukraine or wherever, to seep into the political discourse. Do you think that that is part of it as well?

Duncan Allan: It is part of it, yes. The issue of illicit capital flow and money laundering is much wider than Russian state policy.

Q183       Martin Docherty-Hughes: But it facilitates this hybrid approach.

Duncan Allan: It can do. There is a danger that money that is laundered through Western jurisdictions, becoming respectable in formal terms, can then be turned to nefarious purposes.

Q184       Martin Docherty-Hughes: Okay. Can I also ask you whether you have heard of the Russian military archive at Shrivenham?

Duncan Allan: Yes.

Q185       Martin Docherty-Hughes: In the post-incident narrative that these guys all had to deal with, in terms of the Government here in Westminster, if they had been aware that in the Russian military archive there was a whole range of information that would have told them about Novichok and where it came from, and how the Russian Federation, based on its former strategies, and those of the Soviet Union, would utilise it, do you think that they should have been all over that like a rash? Forgive the analogy.

Duncan Allan: I can’t comment. I don’t know whether or not they did access that material.

Q186       Martin Docherty-Hughes: What if they didn’t?

Duncan Allan: Put it this way: all sources of reliable information should be used. There is a tremendous amount of expertise in Government. Perhaps it is not always used to the best possible extent, but all reliable sources of information, publicly available and confidential, should be used.

Q187       Martin Docherty-Hughes: You spoke earlier about the lack of sophistication in the Russian Federation’s approach to the attack. Do you also think that that lack of sophistication fits the modern social media narrative? For instance, it is not just about targeting those who live in the location or across the UK; it is also about utilising the attack for your audience at home. That very unsophisticated, bolshy approach works very well within the media in the Russian Federation.

Duncan Allan: That is definitely a dimension. I would suggest that part of the Russian information response to Salisbury did, to some extent, target the Russian domestic audience. The narrative that was being put out to some extent fed the narrative of Russia as a besieged fortress, under constant unjustified attack from the West, and that Russians therefore needed to rally around the authorities and President Putin—but that is only one audience.

You used the term unsophisticated. In some ways, yes—the messages and narratives that the Russians were disseminating were unsophisticated, but even so they were being, in some quarters at least, received here by some audiences in the West. I don’t think that Russian audiences are necessarily less sophisticated than Western audiences.

Q188       Martin Docherty-Hughes: I only used the word unsophisticated because you had used it in answer to a previous question. If you are looking at social media, whether it be Facebook, Instagram, Twitter or a range of other online platforms, the best way to utilise them is to be short, sharp, focused and some would say—not unsophisticated; that is certainly not the term—easy to take in. Let’s put it that way.

Duncan Allan: Also a barrage tactic. Throw a lot of stuff out there in the hope that some of it will stick and lodge. I would suggest that large parts of this narrative do lodge, and then get recycled through social media and the internet, in such a way that after a while it becomes almost impossible to attribute it to Russian actions.

Q189       Martin Docherty-Hughes: Yes, and we are not really very good at countering that, are we?

Duncan Allan: It is very difficult to counter. It would be frankly self-defeating to try to rebut every single false story that is put out there. There is an issue of prioritisation and of resourcing. There is also an issue about dealing with this over the longer term. That takes us into some quite complex and often quite contested issues of domestic policy—things like media training, literacy training, regulation of social media platforms, and addressing issues of why certain audiences in the UK, I would suggest, feel alienated from their Governments.

Q190       Martin Docherty-Hughes: I am conscious of time, but as part of this inquiry, the Committee visited Estonia. Estonians are on the frontline, but given the attack that happened in Salisbury, so is the UK. Estonia seems to be doing pretty well in trying not only to rebut, but also to educate. Forgive me, but it has no natural resources and a population of 1.5 million, and it has a centre of cyber-resilience excellence. Something is wrong here.

Duncan Allan: That is partly the answer. Estonia is small and has a small population. It is right on the border with Russia. Because of their history, they are well versed in some of these challenges and threats, and they have felt threatened pretty much throughout their independent history. That means that there is an audience that is more willing to accept official narratives in Estonia.

Q191       Chair: Thank you, Martin. Duncan, we have a few more for you, I am afraid, about this aspect of Russia’s behaviour. You are someone with very long experience and who is an expert on Russia, both inside the Foreign and Commonwealth Office and now with Chatham House. In the recent interviews to do with the next leadership of the Conservative party and the next Prime Minister, one of them was asked, “What is the biggest mistake that Foreign Secretaries have made in recent times?” That was including himself. He said, interestingly, that it was the belief you can just press a button and have a reset in the United Kingdom’s relations with Russia. I experienced that in a small way myself at the Munich security conference a year or two ago. I had a conversation with a Russian official who was expressing disquiet about the poor state of relations with the UK. I said, “Well, when things happen like the assassination of Litvinenko on our soil, what do you expect?” Far from having any beneficial effect, they have now done it all over again, as we can see. Do you think, with your long experience in the Foreign and Commonwealth Office, that there is too much of a tendency to wish to be optimistic about how Russia will respond to the hand of friendship, and that the former policy of standing up to Russia is the best way to have a businesslike relationship with them that reduces the danger of incidents of this sort?

Duncan Allan: I think in terms of your first question, that unfortunately has been a tendency in the past. There has been an element of wishful thinking, despite the evidence. To my mind, that predates the Ukraine crisis and Russia’s invasion of Ukraine. I would argue that there was plenty of evidence prior to 2014 that relations with Russia were going badly off kilter, and that the UK and other Western Governments were likely to have a long-standing problem here. That was specifically around the question of Ukraine, which to my mind is probably the issue where there is least possibility for any sort of meaningful co-operation with Russia that is consistent with our values and interests. That has been a tendency over the years.

Since 2014 and the events of last year in Salisbury, official thinking has clearly moved on quite a long way, which is good. I still worry that sometimes, even now, people do not fully understand the real nature of the relationship. It seems to me that as far as the UK is concerned—it has been for some time, frankly—this is a fundamentally adversarial relationship. I use that term not in any pejorative or polemical sense; that is simply an analytical proposition. I struggle to think of many areas where the UK and Russia have convergent interests. There are some, but they are few and far between. Moreover, when we are talking about murderous attacks by Russian state organs on UK nationals on UK territory, it seems to me to be difficult to describe the relationship between the UK and Russia as anything other than adversarial. If we are really serious about dealing with Russia, we have to start from that premise, and policy will tend to flow from that.

Q192       Chair: Sometimes it is said that instead of the traditional form of deterrence by the threat of punishment, which is how I have always understood the concept, there is something called deterrence by denial—by showing that if you are resilient enough, their attacks on you will not be very effective. That is one way of warning them off. Do you lay much store by that?

Duncan Allan: I think both elements of deterrence are really important. If we look back at how the UK Government responded last year to the Salisbury attack, most of what the UK Government did could be categorised as deterrence by denial. In other words, they made the UK an environment in which it was more difficult for Russian operatives to carry out this kind of attack in future. Most notably, we have the mass expulsions.

Chair: But that is a punishment.

Duncan Allan: It can be seen in that way, but my reading was that that was aimed at disrupting the kind of infrastructure that could be used in order to support future attacks of this kind. That was given added weight by the co-ordination with friendly Governments. There were other measures that could be broadly described as deterrence by denial. But deterrence by punishment barely featured in the UK Government’s response, other than largely symbolic steps such as saying that Ministers and members of the Royal family would not attend the football World cup. Russia paid a price as a result of that, but it was pretty minimal and symbolic. My view is that the UK should be thinking much more seriously about using financial and supervisory policy tools to make deterrence by punishment a more credible threat.

Q193       Chair: I know that Phil, after me, will come on to the financial aspects. I know that that is a particular area of concern—that you feel there is a lot of potential there. I hope that we will give some thought to the temptations to accept Russian dirty money in the United Kingdom, whether from oligarchs who have fallen out with the Kremlin or people who are Putin’s continuing cronies.

There has been a dismantling of a lot of Russia’s diplomatically covered spying networks, both in the UK and beyond. Surely the element beyond the UK must be considered punishment, because the other countries were not attacked, and they have degraded Russia’s ability to operate in their own countries out of solidarity with us. Despite that, what other steps would you recommend—other than the financial register, which Phil will address with you—that we could be taking in order to deter, in the more traditional sense, Russian misbehaviour of this sort?

Duncan Allan: In the specific case of the Salisbury attack last year, my view is that the UK should have looked seriously at boycotting the football World cup. I believe that what happened in Salisbury was such an extreme event that measures such as that really should have been given serious consideration, for example. In broad terms, the package of measures that were adopted last year by the Government were necessary—I would say that they were essential. You are right to argue that there would have been a cost to Russia, which Russia would have felt as a result of these measures being adopted. But the primary emphasis, as I understood it, was to make the UK a more difficult place to operate in the future.

Q194       Chair: I am old enough to remember a similar argument about the Moscow Olympic games, which I think took place in 1980—can you remind me?—just after the invasion of Afghanistan.

Duncan Allan: It was 1980.

Q195       Chair: Was there much of a boycott in the end and if so, was it effective?

Duncan Allan: The US boycotted and the Soviet Union responded likewise in 1984.

Chair: I seem to remember only a small number of UK equestrians.

Duncan Allan: I think there were UK athletes there as well.

Q196       Chair: It is difficult to inflict boycotts of that sort, is it not?

Duncan Allan: It is difficult, but we are dealing with such an extreme event last year—such an appalling event—that my view is that all options should be on the table.

Q197       Phil Wilson: You have been fairly critical of the UK’s response as far as financial sanctions are concerned. Do you not think that the UK has adequately exploited the enforcement of financial sanctions?

Duncan Allan: There are two issues here, potentially. One is the use of financial sanctions on Russia and the other is the question of tightening the supervision and regulation of the UK financial sector and the financial sectors of Crown dependencies and overseas territories.

With regard to the imposition of sanctions, because the UK is still a member of the EU, it has very limited independent sanctioning capability. It tends to operate in support of EU-agreed and UN-agreed sanctions. There are some minor exceptions to that rule, but at the moment, the UK has limited independent sanctioning capability. Once the UK has finally left the EU, there is now a new statutory instrument, the Sanctions and Anti-Money Laundering Act 2018, which was adopted last year, which aims to address that issue. I would argue that the UK Government should now already be giving serious consideration to using that instrument to warn countries such as Russia, or any other country that might be minded to attack UK nationals, that the UK will give serious consideration to using that instrument in future with a view to inflicting a material cost.

There are a number of important policy questions that would need to be thought through before that law was used. For example, we would have to make sure that we had serious sanctions implementation machinery in Whitehall—for example, how we would designate individuals and entities. We would have to have the evidential base that could be defensible in court. All that presupposes quite considerable intelligence and analytical capabilities, so there are some serious policy issues that would need to be thought through before using that instrument. In the current circumstances, however, we need to think about it as a possibility.

The other issue, which is related but distinct, is more rigorously supervising the UK’s financial sector and related industries. This can have two deterrent effects. First, it can have a deterrence-by-punishment effect, because if we did that—if we regulated our financial sector more rigorously—there would be a material cost imposed on individuals and entities close to the Russian state who currently take advantage of Western jurisdictions such as the UK. There would also be a wider deterrence-by-denial effect, because more rigorous supervision of the financial sector would, I think, improve the resilience, credibility and authority of UK public institutions, which at the moment are at threat from the potentially corrupting effects of illicit capital coming from Russia and other countries as well.

Q198       Phil Wilson: What would be the advantages of implementing such a regime? Are there drawbacks as well? It is not just that you might be affecting commercialism within Russia, or whatever state, but what if there is an impact on the commercial interests of the UK? Where do you strike the balance, and how effectively would the advantages of having such a regime in place help us?

Duncan Allan: There are two advantages. One is that more rigorous use of financial and supervisory instruments would strike at one of the key features of Russia’s post-communist system which is the intertwining of the political and economic spheres. In short, the people who rule Russia are, by and large, the people who own it. We need to understand that that interlocking of the political and economic spheres in Russia extends to Western jurisdictions.

What do I mean by that? I mean that, almost certainly, there are individuals and corporate entities who hold Russian assets abroad and who act as intermediaries—who hold those assets on behalf of members of Russia’s political leadership. I see that as a key vulnerability, because that is one of the reasons why the Russian economy is so slow to grow and why it is so prone to corruption. That is one advantage: it strikes at a key feature of the Putinist system.

The second advantage is that it is weighted to our advantage. This is an asymmetry that we could exploit. The importance of the City of London gives the UK leverage with regard to Russia that most other countries lack. Russia’s elite value their access to the City, related industries and the UK’s services sector. By contrast, Russia is not crucial to the future wellbeing of these sectors—in 2017, Russia accounted for 1.8% of exports of UK services, so this is a small fraction of the export market for UK services—or a crucial source of investment for the UK. I am not going to sit here and pretend there would not be any drawbacks. We have to acknowledge that, if the UK went down this path, it would pay an economic price. I suggest in the interests of national security that that would be a price worth paying.

We seem to have got ourselves into an untenable situation in some ways, both ethically and in terms of practical policy. On one hand, for a number of years, Governments in the UK have been defining the Russian state as a direct threat to core UK interests. Yet, on the other hand, we are actively facilitating the enrichment of some of that state’s elite. That is untenable. That undermines the authority and credibility of the UK.

If the UK imposes sanctions on Russia, as day follows night, Russia would retaliate. But let us think this through carefully, because sometimes some rather exaggerated fears are expressed. I think it questionable, at least, that Russia would retaliate against companies such as BP and Shell, which operate multi-billion pound investments in Russia. Why? Because that would have a direct effect on their partners’ operations—the operations of Rosneft and Gazprom, which are key generators of revenue for the Russian state and also create wealth for leading members of the Russian leadership.

There may well be Russian counter-sanctions imposed on UK companies—in which case, let’s be honest, certain UK companies would suffer. But Russia accounts for less than 1% of exports and goods exported by the UK, so, again, Russia is not a large commercial entity in this sense.

Tighter financial supervision would presumably choke off financial flows coming from a country like Russia. I would imagine that plausibly some of those would be of questionable provenance, in which case we are better off without them. I would suggest as well that tighter financial regulation would have all sorts of other benefits. For example, over time the building of a stronger rule of law in the UK—the building of stronger, more credible public institutions—would surely be a great win over the long term, in terms of the UK’s external reputation and its soft power, with greater credibility with allies and partners.

That is also a very good long-term way to challenge this very damaging charge that the UK is guilty of double standards: on one hand advocating legality, rule of law, transparency and accountability while on the other hand at the same time—seemingly, in the opinion of many people—turning a blind eye to money laundering. That is a very damaging charge that undermines the UK’s reputation abroad and its ability to project influence and promote its interests.

Q199       Phil Wilson: Dr Rob Dover has said that some of this money has powered inward investment, especially in property. He says that you could say it is actually very effective hybrid grey warfare to make your adversary entirely dependent on your money. You would obviously agree with that.

Duncan Allan: That is a danger. This is one of the most insidious aspects of the whole issue of dark money or illicit capital flow, because it can over time create interest groups in a country who have an interest in seeing the preservation of ties with a country like Russia, which perhaps are inappropriate. It can also lead to the corruption of individuals and organisations. That, over the long term, seems to have a clear national security dimension, to the extent that it undermines the rule of law and democratic institutions.

Q200       Chair: I think the same could be said of several other countries besides just Russia, in terms of our dependency.

Duncan Allan: This is a really important point to make. I am talking about Russia because this is a Russia-focused discussion, but this is an important point. We are not singling out Russia. There is an underlying issue that needs to be tackled here.

Q201       Chair: China being another obvious example, perhaps.

Duncan Allan: And others.

Chair: Before I ask John to ask the last question on our list, I want to give a warning to the whole panel. After he does so, I am going to ask each of you if you have got any closing thoughts on any aspects of what we’ve been discussing today. So, you have a little bit of thinking time.

Q202       John Spellar: You have given us some very interesting analysis of how you handled this incident. Do you think there are lessons for other countries to be derived from that? Indeed, have any of them engaged with you or with the UK Government to draw on that experience?

Georgina Collins: Shall I start? The UK Government has presented at the OPCW in The Hague and talked through the recovery aspects of Salisbury and what we learned from that, how we went about it and some of the challenges. I think international partners found that very useful. We have also had colleagues from the US Environmental Protection Agency over on a visit and talked through some of the challenges and what we did for the decontamination work. There are ongoing different conferences and things such as that within the CBRN community, because while, thankfully, these things do not happen very often, when they do it is important that we share the lessons.

Duncan Allan: Unquestionably, others can learn from the UK experience. There are two positive things on the UK side: the co-ordinated response last year, particularly in terms of expulsions, and the co-ordinated release of information to shine a light on the activities of the GRU, Russia’s military intelligence agency. To my mind, those demonstrate the real and continuing importance of alliance unity, and the importance of maintaining that. As we know, in the current circumstances, the Western alliance faces arguably greater challenges to its internal unity than at any time in decades, but the effectiveness of what the UK did last year should act as a reminder to everybody—ourselves and our allies—of just how effective co-ordinated action continues to be.

Picking up a point that Alistair and Paul made on information, a related point is that the co-ordinated exposure of GRU activities in the wake of Salisbury, and the exposure of GRU activities in the United States and attempts by the GRU to hack the computer systems of the OPCW in the Netherlands, made life much more difficult for the Russian authorities than I think they were expecting, and they did not welcome that. That is an important lesson; it was very difficult for Russia to respond credibly to clear, targeted information. I will stop there.

Q203       Chair: Any last observations? We have had four experts in three distinct fields. Alistair and Paul, thank you for listening patiently through those last few questions, which were obviously in a different area. What last thoughts would you like to share with us?

Alistair Cunningham: I will start with my last thoughts. This has been, by and large, an effective public sector response to an unprecedented incident, which has lasted from response through to recovery and is still ongoing, working for the long-term economic wellbeing. Over the past number of years, concerns have been raised about the capacity of the public sector when these incidents arise, and hopefully the work done between the national Government, local government, the police and particularly the military has shown that if partnerships are working well, we can respond and protect the wellbeing of our communities.

Paul Mills: I will just build on that. If we take ourselves back to 4 March, we have often used this word unprecedented, and indeed it was unprecedented, but it has been a very good test of the ability through the Civil Contingencies Act 2004 for local resilience forums to respond in the first instance, then call upon regional and national assets and colleagues to respond and then recover in a co-ordinated manner. It has been an unwanted but very successful test of those infrastructures.

Q204       Chair: Can I just ask: were there any gaps, for example in the numbers of specialist personnel, that you noticed as a result of all this?

Paul Mills: I don’t think there were gaps per se. There were potential resilience challenges as we went into incident No. 2, which again have been picked up through the learning. The other gap, I guess, but also a strength from the way response and recovery worked, was that Novichok is very unique. Notwithstanding its uniqueness, one of the strengths for me was the ability to respond with quite a coarse evidence base and develop new techniques and processes across the different partners to ensure that the public were kept safe. That was a real strength, from what I witnessed through my role in this incident.

Georgina Collins: For me, the point to reflect on is that planning and preparing for the recovery in an incident like this, which is low likelihood but high impact, remains a challenge, in terms of what is proportionate and what we expect national and local government to plan and prepare for. Given that there will generally be a novel incident and it will be hard to predict the scale and the impact, and it will be something that we haven't dealt with before, how do we make sure that we have plans and processes in place that are adaptable and flexible and make sure at a national level that we are really thinking about and challenging ourselves around what could be the circumstances of a particular incident? For Novichok, it was the fact that it was a persistent material. It was something that we could not easily detect in the same way that we could do with something that is radioactive, for example.

I think we need to challenge ourselves and think about what those different characteristics might be, so that we are all happy that our plans are as robust as they can be. Paul is right—there weren’t gaps, but it does kind of hammer home the need for us to continue to maintain expertise and resilience at national and local levels, so that we can, if something like this ever happens again, respond and recover as quickly as possible.

Q205       Chair: Thank you. Duncan?

Duncan Allan: For me, the point that we could perhaps reflect on more is the need to think more rigorously and imaginatively about how to deter hostile state action against the UK and against UK interests. I am not persuaded that the UK Government are doing that to the extent that they could do. I am well aware, having been a civil servant and no longer being a civil servant, that there will be all sorts of discussions happening that I am not aware of. I haven't seen a great deal of evidence so far to suggest that there is yet as much willingness as there perhaps ought to be to use finance and supervisory tools in order to deter a repetition of what happened in Salisbury last year. I hope I am wrong on that, but that is my impression.

Q206       Chair: So, you feel, for example, that the Magnitsky Act has been an effective tool and we ought to be looking at measures analogous to that.

Duncan Allan: That is one possibility. I understand there is a Magnitsky clause in the Sanctions and Anti-Money Laundering Act. But before we can even get to the point where we use that particular legal instrument, there is already out there the current issue of more rigorous regulation and supervision of the financial sector. There is a great deal of work to be done there.

Chair: Thank you all very much. We frequently have experts on the panels, but to have four who all are at the top of their game in one go is of great benefit to the Committee. I ask those of you who are dealing with frontline services to pass on our appreciation to the people who, at no small risk to themselves, had to clean up this terrifying incident.