Security experts have told BuzzFeed News that the Manchester attack showed a level of expertise and planning that made it likely the suicide bomber had wider assistance.
Prime minister Theresa May confirmed on Tuesday morning that the attack was carried out by one man, whose identity is known but is not being released. The security services are now trying to establish whether he had help, she said.
"We now know that a single terrorist detonated his improvised explosive device (IED) near one of the exits of the venue, deliberately choosing the time and place to cause maximum carnage and to kill and injure indiscriminately,” May said, speaking outside Number 10.
“The police and security services believe the attack was carried out by one man. But they now need to whether he was acting alone, or was part of a wider group. It will take some time to establish these facts, and the investigation will continue. The police and security services will be given all the resources they need to complete that task.”
In an unusual public statement, the head of the UK's domestic intelligence agency MI5 confirmed the agency was working with police on investigating the Manchester attack.
"Everyone at MI5 is revolted by the disgusting terrorist attack in Manchester last night. Our hearts go out to the families of the victims, the injured and everyone affected by it," said MI5 director-general Andrew Parker.
"Our teams have been working with the police through the night to assist the investigation. We remain relentlessly focussed, in numerous current operations, on doing all we can to combat the scourge of terrorism and keep the country safe."
By Tuesday lunchtime, ISIS publicity channels had claimed responsibility for the attack, saying it had detonated explosives in the "shameless concert area", killing and injuring "crusaders". However, such announcements in previous attacks have not always indicated any degree of international coordination or cooperation, and sometimes are largely a public relations exercise.
The US director of national intelligence Dan Coats said on Tuesday he was aware ISIS had claimed responsibility for the attack, but added his agencies "have not yet verified the connection".
Former senior intelligence officials and counter-terrorism officers say the focus of the ongoing police investigation will be on establishing how the attacker obtained the explosives used in the device and the expertise to build it, and how he selected and scouted his target.
Baroness Pauline Neville-Jones, a former chair of the UK's joint intelligence committee and security minister under David Cameron, told BuzzFeed News the use of an explosive device suggested a "reversion" to previous terrorism tactics, away from that of recent attacks that have focused on low-sophistication attack methods using vehicles and knives in so-called "lone wolf" attacks.
"It is the biggest attack for 12 years," she said. "It is not so difficult to build a body IED – but it does require knowledge and expertise and thus some organisation. I don’t think the lone wolf thesis has ever been espoused by the security services or police.
"It looks like a reversion to earlier methodology and may tell the intelligence services something about the background of those involved.”
Other security sources said there would be significant questions around how the attacker gained access to the area around the arena to conduct the attack, either targeting a vulnerable area easier to reach than the main arena or else using ID to gain access.
"The attacker only detonated at after 10pm when the concert had finished, or more likely had access – perhaps as a casual member of staff, an usher, or security who would not necessarily be subject to the same security checks," a former intelligence officer told BuzzFeed News.
The same source added that given the sophistication of an IED attack, they thought it likely the attacker would have had outside help.
“Explosives are sophisticated and prone to failing, so whoever prepared the device knew what they were doing," the source said. "Don't assume co-conspirators have to be in the UK. The web has rendered physical cells redundant in modern-day terrorism."
Brian Painter, a private security consultant, said the choice of attack location – seemingly a foyer in between the arena and Manchester Victoria station – suggested the attacker had engaged in serious planning efforts beforehand, and showed more sophistication than other recent attacks.
"The difference in MO [modus operandi] is a shift from the lo-fi attacks we have witnessed over the past year or so," he said.
"The location of the attack also indicates that this would have been subject to some degree of hostile surveillance, targeting a weak point (between the arena and train station) in the security cordon at the Manchester Arena, which is also a bottleneck and most likely to cause maximum damage. This coupled with the ensuing panic, which would have a caused numerous injuries.
“The swift response of the emergency services last night, in securing large areas of the city and dealing with the dispersal of an estimated 20,000 persons and dozens of injured, is worthy of praise.”
That ISIS (sometimes also referred to as IS) claimed responsibility for the attack is not in itself enough to show the attacker was working with others, explained Charlie Winter, a fellow at the ICSR, a thinktank studying radicalisation and political violence.
“IS terrorism is first and foremost propaganda. In that sense, it’s the aftermath of these attacks that matters most - how they are reported, discussed, and analysed. It’s for that reason that the claim of responsibility is so important," he told BuzzFeed News.
"The fact that it originated from the central media office and not the Amaq News Agency could be taken to indicate that IS wants this attack to be considered 'directed'. However, past precedents are not enough to provide any certainty, so, even at this stage, we need to withhold judgment until the authorities release more information on the attacker.”
Shashank Joshi, a research fellow at the security think tank RUSI, told BuzzFeed News the attack would be unlikely to change the overall threat assessment facing UK security services.
"The use of a bomb indicates greater sophistication than a vehicular, knife, or gun attack, but not necessarily an unusually advanced plot unless the device suggests otherwise," he said. "This was directed at a soft target, and that too outside the main arena, which indicates that the attacker was not able to penetrate layers of security. All in all, I see more continuity than novelty here.
"The UK threat level was already at ‘severe’ and the UK had disrupted a dozen terrorist plots in the past four years, so this attack doesn’t change the security environment in any fundamental way. If it turns out that the attacker had a link to Iraq or Syria, it will only reinforce assumptions that UK authorities have been working off for years anyway."
Joshi added that one factor UK authorities may need to address after the attack was a series of apparent leaks by US intelligence sources of information obtained from the UK, hours before its official release.
"UK officials will have other priorities at the moment, but when the dust settles they will be concerned by the way in which British information was leaked by US officials, sometimes hours ahead of its confirmation," he said. "Police and intelligence officials would have had their reasons to hold back on key details, such as casualty figures and the method of attack, but this was impossible in a more international, free-wheeling media environment."
Earlier on Tuesday, the former MI6 director of global counter-terror operations told the Today programme of the difficulty of tracking potential terror suspects while maintaining UK values.
"You’ve got the returnees from Iraq and Syria, there are over 400 of those, there are all the people who wanted to go to Iraq or Syria but were stopped – we heard some time ago there were 600 of those. So already you’re up to 1,000 before you even start on the people who live here and maybe never expressed any or didn’t knowingly express any intention to go to Syria, so what do you do about that?" he asked.
"We value our society, we talk about freedom of assembly, freedom of expression, and all this sort of thing, and we really do want to preserve those values against the attacks or terrorism, and if we’re following around 1,000 people or something I think we’re losing those values. So I don’t think anyone’s expecting the security services or police to monitor the population here on the scale of perhaps what was done in East Germany."