# UK Threat Levels

The United Kingdom Terror Threat Levels, often referred to as UK Threat Levels, are the alert states that have been in use since 1 August 2006 by the British government to warn of forms of terrorist activity. In September 2010 the threat levels for Northern Ireland-related terrorism were also made available. In July 2019 changes were made to the terrorism threat level system, to reflect the threat posed by all forms of terrorism, irrespective of ideology. There is now a single national threat level describing the threat to the UK, which includes Islamist, Northern Ireland, left-wing and right-wing terrorism. Before 2006, a colour-based alert scheme known as BIKINI state was used. The response indicates how government departments and agencies and their staffs should react to each threat level.

## Categories of threat

Since 23 July 2019, the Home Office has reported two different categories of terrorist threat:
* National Threat Level.
* Northern Ireland-related Threat Level to Northern Ireland
Previously, since 24 September 2010, the Home Office has reported three different categories of terrorist threat:
* Threat from international terrorism.
* Terrorism threat related to Northern Ireland in Northern Ireland itself.
* Terrorism threat related to Northern Ireland in Great Britain (i.e. excluding Northern Ireland).
A fourth category of terrorist threat is also assessed but is not disclosed, relating to threats to sectors of the UK's critical national infrastructure such as the London Underground, National Rail network and power stations.
The Joint Terrorism Analysis Centre (JTAC) is responsible for setting the threat level from international terrorism and the Security Service (MI5) is responsible for setting both threat levels related to Northern Ireland. The threat level informs decisions on protective security measures taken by public bodies, the police and the transport sector.

## Threat levels

| Threat level | Threat level | Response | Response |
| Critical | An attack is highly likely in the near future. | Exceptional | Maximum protective security. Critical measures to meet specific threats and to minimise vulnerability and risk. |
| Severe | An attack is highly likely. | Heightened | Additional and sustainable substantial and severe protective security measures reflecting the broad nature of the threat combined with specific business and geographical vulnerabilities and judgements on acceptable risk. |
| Substantial | An attack is likely. | Heightened | Additional and sustainable substantial and severe protective security measures reflecting the broad nature of the threat combined with specific business and geographical vulnerabilities and judgements on acceptable risk. |
| Moderate | An attack is possible, but not likely. | Normal | Routine protective security. Low and moderate measures appropriate to the business concerned. |
| Low | An attack is highly unlikely. | Normal | Routine protective security. Low and moderate measures appropriate to the business concerned. |
Threat Levels are decided using the following information:
* Available intelligence. It is rare that specific threat information is available and can be relied upon. More often, judgements about the threat will be based on a wide range of information, which is often fragmentary, including the level and nature of current terrorist activity, comparison with events in other countries and previous attacks. Intelligence is only ever likely to reveal part of the picture.
* Terrorist capability. An examination of what is known about the capabilities of the terrorists in question and the method they may use based on previous attacks or from intelligence. This would also analyse the potential scale of the attack.
* Terrorist intentions. Using intelligence and publicly available information to examine the overall aims of the terrorists and the ways they may achieve them including what sort of targets they would consider attacking.
* Timescale. The threat level expresses the likelihood of an attack in the near term. We know from past incidents that some attacks take years to plan, while others are put together more quickly. In the absence of specific intelligence, a judgement will need to be made about how close an attack might be to fruition. Threat levels do not have any set expiry date, but are regularly subject to review in order to ensure that they remain current.

## History

Threat levels were originally produced by MI5's Counter-Terrorism Analysis Centre for internal use within the British government. Assessments known as Security Service Threat Reports or Security Service Reports were issued to assess the level of threat to British interests in a given country or region. They had six levels: Imminent, High, Significant, Moderate, Low and Negligible. Following terrorist attacks in Indonesia in 2002, the system was criticised by the Intelligence and Security Committee of Parliament (ISC) as insufficiently clear and needing to be of greater use to "customer departments".
The 7 July 2005 London bombings prompted the government to update the threat level system following a recommendation from the ISC that it should deliver "a greater transparency of the threat level and alert systems as a whole, and in particular [it is recommended] that more thought is given to what is put in the public domain about the level of threat and required level of alert." The system was accordingly simplified and made easier to understand. Since 2006, MI5 and the Home Office have published international terrorism threat levels for the entire UK on their websites, and since 2010 they have also published threat levels for Northern Ireland, with separate threat levels for Northern Ireland and the rest of the UK.

### 2019 'New Reporting Format'

In July 2019 changes were made to the terrorism threat level system creating a 'New Format' of threat levels, to reflect the threat posed by all forms of terrorism, irrespective of ideology. There is now a single national threat level describing the threat to the UK, which includes Islamist, Northern Ireland, left-wing and right-wing terrorism.

## Changes to threat levels

The following table records changes to the threat levels from July 2019 – Present:
| Date | National Threat Level | Northern Ireland-related Threat Level to Northern Ireland |
| 23 July 2019 | Severe | Severe |
| 4 November 2019 | Substantial | Severe |
| 3 November 2020 | Severe | Severe |
| 4 February 2021 | Substantial | Severe |
| 15 November 2021 | Severe | Severe |
| 9 February 2022 | Substantial | Severe |
| 22 March 2022 | Substantial | Substantial |
| 28 March 2023 | Substantial | Severe |
| 6 March 2024 | Substantial | Substantial |

### Old-format historical threat levels

Since 2006, information about the national threat level has been available on the MI5 and Home Office websites. In September 2010 the threat levels for Northern Ireland-related terrorism were also made available. The following table records changes to the threat levels from August 2006 – July 2019 before the 'New Format' was put into place:
| Date | National Threat Level of International Terrorism | Threat from Northern Ireland-related terrorism | Threat from Northern Ireland-related terrorism |
| Date | National Threat Level of International Terrorism | in Northern Ireland | in Great Britain |
| 1 August 2006 | Severe | Not Reported | Not Reported |
| 10 August 2006 | Critical | Not Reported | Not Reported |
| 13 August 2006 | Severe | Not Reported | Not Reported |
| 30 June 2007 | Critical | Not Reported | Not Reported |
| 4 July 2007 | Severe | Not Reported | Not Reported |
| 20 July 2009 | Substantial | Not Reported | Not Reported |
| 22 January 2010 | Severe | Not Reported | Not Reported |
| 24 September 2010 | Severe | Severe | Substantial |
| 11 July 2011 | Substantial | Severe | Substantial |
| 24 October 2012 | Substantial | Severe | Moderate |
| 29 August 2014 | Severe | Severe | Moderate |
| 11 May 2016 | Severe | Severe | Substantial |
| 23 May 2017 | Critical | Severe | Substantial |
| 27 May 2017 | Severe | Severe | Substantial |
| 15 September 2017 | Critical | Severe | Substantial |
| 17 September 2017 | Severe | Severe | Substantial |
| 1 March 2018 | Severe | Severe | Moderate |
* ↑ Threat level increased following the 2020 Vienna attack.
* ↑ Threat level increased following the Liverpool Women's Hospital bombing.
* ↑ Threat level increased following the shooting of John Caldwell.
* ↑ Threat level increased following the 2006 transatlantic aircraft plot.
* ↑ Threat level increased following the 2007 Glasgow Airport attack.
* ↑ Threat level increased following the Manchester Arena bombing.
* ↑ Threat level increased following the Parsons Green bombing.