What Happens in the Minutes and Hours After a Major Terror Attack

The streets are cordoned off with police tape, and flashing lights bathe bystanders in red and blue. Dazed survivors are wrapped in silver blankets before being led away. Although the terrorist attacks in Manchester and now London were a fresh horror, we've all become familiar with the scenes. In the hours after an attack these images become ubiquitous, beamed to us on repeat through our phones and television screens.

When terror attacks take place, we tend to focus on the perpetrators. What was their motivation and their affiliation? How did they prepare? But there is a hidden side to these scenes that begins just minutes after an attack, a well-rehearsed sequence of events designed to mitigate the tragedy.

This is how the rescue effort unfolds.

It starts with a 999 call. Typically, it will be made by a member of the public who realises a terror attack is taking place. Emergency crews will be dispatched to the scene. If terrorism is suspected, armed police officers will be sent to respond.

They will usually arrive within a few minutes. When a suspected terrorist attack was reported after a mass stabbing in Russell Square in 2016, armed police arrived in just four minutes. After the murder of Lee Rigby in 2013, police arrived nine minutes after the 999 call and armed colleagues were on the scene around five minutes later. In London, plans are in place for armed units to attend by motorbike if roads are blocked to cars.

If the attack is still underway, it's these armed officers who will tackle the immediate threat. In light of terrorist attacks involving several gunmen, armed police in the UK have been told since December of 2015 to ignore casualties initially and focus their efforts on stopping any terrorists.

Other emergency responders must also be aware of risks, such as contamination in incidents involving chemical weapons or a dirty bomb. After the 2005 London bombings there were reports that the fire brigade's response was delayed over these concerns. David Lowe, principal lecturer at Liverpool John Moores University's Law School, says delays are frustrating but can also be necessary. "There'd be nothing worse than paramedics going in and it was contaminated, or you still have other [explosive] devices and paramedics then become casualties," he says.

In recent years, steps have been taken to reduce these delays. Every ambulance trust in England now has at least one Hazardous Area Response Team – a crew of six specially trained paramedics on 24-hour standby to deal with incidents involving risks such as flooding, dangerous structures and terrorists with firearms. Wales and Scotland have their own equivalent crews.

The first emergency crews on scene must assess the situation, including the scale of the incident and the potential risk to themselves. Gerry Byrne, head of capabilities at the National Ambulance Resilience Unit, says: "It's absolutely pivotal that this report is done as soon as possible. It's about the first crew on scene taking command and organising it for subsequent crews." According to Byrne, this should take between 30 seconds and three minutes.

Once the scale of the situation becomes clear, a major incident will be declared. Officially, these are defined as events requiring one or more of the emergency services to put "special arrangements" in place. Declaring a major incident sets a chain of events in motion, alerting everyone who may be called upon to help.

"Things will change fairly dramatically within a matter of seconds," says David Alexander, a professor in the Institute for Risk and Disaster Reduction at University College London. Emergency service control rooms will open communication lines to enable a joint response. Hospitals and neighbouring ambulance services will be put on standby. In the event of a terror attack, the Prime Minister and Home Secretary will be notified.

Liam Lehane, assistant director of operations at the London Ambulance Trust, says: "Once a major incident is declared, we will automatically send at least 12 officers, including incident commanders, 20 ambulance crews and our hazardous response team to the scene, alongside equipment and command support vehicles. A dedicated special operations centre is also set up to manage the incident from our control room. We will also dispatch other specialist response teams and mass casualty vehicles to incidents where they are required."

Plans have been drawn up and rehearsals conducted for all kinds of major incidents, ranging from fires and flooding to train crashes. "The terrorism scenario is the one that has been most exercised in planning, preparing and conducting simulations," says Alexander. "More so than any other form of disaster."

We've all seen movie scenes where emergency responders gather around the bonnet of a car to create a plan. As it turns out, Byrne says that's a fairly realistic picture of what tends to happen. However, major incidents require a more coordinated response, with a system set up to provide an overview of the situation and ensure there are enough resources to respond. This is known as the gold-silver-bronze system.

Put simply, the bronze level refers to the bonnet of a car. Bronze commanders are the people directing things on the ground. The silver level will typically be established at a nearby police station, offering directions to the bronze commanders and allocating resources. The gold level sets the overall strategy. All emergency services are located together at each level, with the police taking the lead coordinating role.

Treating casualties is clearly a key priority. But there are numerous other things that have to be considered as part of the wider response. Making sure vehicles can get to and from the incident is one of them. "For the ambulance services, as well as getting to the event we also need to get away from it," says Byrne. "The last thing you want is a load of ambulances cascading into the event and getting stuck." For this reason, rendezvous points may be established at a distance from the incident.

Paramedics will carry out triage assessments and create an evacuation plan for casualties, placing patients in order of priority and deciding where they should be sent based on hospital capacity and any specialist treatment that's required. "On a day-to-day basis, our control room have a picture of the availability of hospital beds across London to ensure patients are always taken to the most appropriate hospital for their care," says Lehane. "In the event of a major incident, the special operation centre will use this information to contact hospitals to alert them to the incident and confirm the number of patients they are able to treat."

Hospitals will have taken steps to free up capacity as soon as a major incident was declared. "The hospitals will go straight into emergency mode whether or not they are called upon," says Alexander. "They would shut down as many regular operations as they can without compromising people's safety, and they would call on extra staff." Often, the last step is unnecessary. Previous incidents have seen hospital staff make their way to work as soon as they see the news and it becomes clear an attack has taken place.

Sixty ambulances attended the attack at Manchester Arena last week, taking 59 patients to eight hospitals, and another 60 casualties were treated without the need for hospitalisation. West Midlands, Wales, Yorkshire and East Midlands ambulance services all provided assistance to ensure emergency calls elsewhere could still be answered.

The first focus of the emergency response is on saving lives. But in any terrorist incident there will also be a criminal investigation. The pace of the investigation will be driven by a desire to find who is responsible, but also by the need to assess the likelihood of further attacks.

Counter-terrorism officers and the intelligence services will open an investigation straight away. It will often only be hours before a suspect is identified. In many recent attacks, the perpetrators were already known to the authorities. In some cases, they were found to be carrying ID. An initial investigation will involve narrowing down suspects from a list of possible individuals, using additional evidence gathered from witness statements, CCTV and telecommunications records.

Evidence will also be gathered from the site of the attack. Byrne says: "Once the scene is completely cleared of live casualties it then becomes a scene for CSIs to do their work." This is a painstaking process. "They will be doing that millimetre by millimetre," says Alexander. "They collect everything from a railway carriage to tiny fragments. And they will do that with great detail. It is meticulous. It might take days. But it will begin more or less immediately."

Updates in the investigation will be shared almost immediately with intelligence partners. The UK is a member of the Five Eyes intelligence partnership alongside the US, Canada, New Zealand and Australia. "You're looking at an international attack, and so it's an international response," says Lowe. Each partner will feed back any possible intelligence which might help the investigation. However, as seen in the leaks which came from the US after the Manchester Arena attack, contributions from these partners are not always helpful.

In the hours after a terrorist incident, a COBRA meeting will be held. The name is derived from the meeting venue – Cabinet Office Briefing Room A. Alexander refers to this as the "platinum" level of the incident command structure, trumping gold, silver and bronze.

COBRA meetings involve senior government ministers, civil servants, the emergency services and any other relevant agencies. They are held to discuss the national implications of a terrorist incident (they are also held for other incidents requiring an emergency response). "What preparations do we have and are they sufficient?" says Alexander. "They will be reviewing that attack and the potential for future attacks."

One item on the agenda will be to review the current terrorist threat level, based on advice from the government's Joint Terrorism Analysis Centre. At the COBRA meeting held the morning after the Manchester Arena bombing, a decision was taken to raise the threat level from "severe" to "critical" – the highest possible level, meaning an attack is expected imminently. It was the first time the threat level had been at its highest for almost 10 years.

The meeting also marked another first, when Operation Temperer came into effect, which allows up to 5,100 troops to be mobilised on the streets of Britain. An initial 984 soldiers were deployed after a request from the police. Metropolitan Police assistant commissioner Mark Rowley said: "This will free up armed officers from certain guarding duties to release our officers to support the wider response. This is part of an agreed and well-rehearsed plan, and military personnel will remain under the command and control of the police service."

Four days later, after a police operation in which 11 suspects were arrested, the terrorist threat level was reduced once more to "severe". After the Bank Holiday weekend, troops were withdrawn from the streets.

Terrorism works through its disproportionate effect – it takes just a handful of individuals to make us see danger everywhere. The emergency response involves hundreds, sometimes thousands, of people. You will have seen them last week as they rushed to the scene of the Manchester Arena bombing. But they are there the rest of the time as well – planning, preparing, waiting for when they're needed next.

@mark_wilding