EU AI Act Article 50 live 2 Aug 2026 — C2PA passport ready | Get yours →
DEFONEOS × HO × CTP × Counter-Terrorism

Home Office Counter-Terrorism Policing AI Deep-Dive Pack

Sovereign AI governance of UK Home Office counter-terrorism policing — CONTEST strategy, Prevent programme, Pursue operations, Protect infrastructure, Prepare resilience, online terrorist content removal, ports policing, financial sanctions, mass casualty response, community engagement, proscription regime, and parliamentary oversight. 12 entry points × 8 transformation priorities × 6 MCPs. Audit-grade. Signed. UK-sovereign.

12
Entry Points
8
Transformation Priorities
6
MCP Servers
6
Red Lines

📋 12 Entry Points

CONTEST

CONTEST Strategy — Prevent, Pursue, Protect, Prepare

UK Counter-Terrorism Strategy (CONTEST) — four pillars: Prevent (stop people becoming terrorists), Pursue (stop terrorist attacks), Protect (strengthen protection against attack), Prepare (mitigate impact of attacks). Strategic threat assessment — Daesh, Al-Qaeda, Northern Ireland, extreme right-wing, lone actors. Threat Levels — MI5 system (LOW to CRITICAL). Annual CONTEST review — Home Secretary report to Parliament. Contest delivery — police, MI5, MI6, GCHQ, MOD coordination. International counter-terrorism cooperation. Counter-terrorism funding formula.

Prevent

Prevent Programme — Referral, Deradicalisation, Channel

Prevent duty — statutory duty on specified authorities (education, health, local authority, police) to have due regard to preventing people from being drawn into terrorism. Channel programme — voluntary support for individuals at risk of radicalisation. Prevent referrals — from teachers, health workers, social workers, community. Ideology coverage — Islamist, extreme right-wing, incel, environmental extremism. Educate Against Hate — school resources. Prevent monitoring and evaluation. Community-based prevention. Online Prevent. Prevent review — Shawcross review recommendations. CONTEST 2023 refresh.

Pursue

Pursue Operations — Investigation, Disruption, Prosecution

Counter-terrorism policing — 10+ regional Counter Terrorism Units (CTUs) and Counter Terrorism Policing HQ (CTPHQ). Investigation methodology — surveillance, CHIS (covert human intelligence sources), communications data, financial investigation. Disruption tactics — TPIMs (Terrorism Prevention and Investigation Measures), asset freezing, passport seizure. Prosecution — CPS Special Crime and Counter Terrorism Division. Arrest and detention — pre-charge detention up to 14 days. Terrorist offences — preparation, training, dissemination, membership. Joint Terrorism Analysis Centre (JTAC). MI5/police operational interface. International arrest warrants — Red Notices.

Protect

Protect Infrastructure — CTSA, Crowded Places, Transport

Protective security — Counter Terrorism Security Advisers (CTSAs) in every police force. Crowded places protection — Martyn's Law (Terrorism (Protection of Premises) Bill). Transport security — aviation (airside, landside), rail (stations, trains), maritime (ports, ferries). Critical national infrastructure (CNI) — 13 sectors, NPSA advice. Hostile Vehicle Mitigation (HVM) — bollards, barriers, streetscape. Building security — blast resistance, progressive collapse. Perimeter security — fencing, CCTV, access control. Security awareness training — Action Counters Terrorism (ACT). Vulnerability assessment methodology.

Prepare

Prepare Resilience — Major Incident, JESIP, Recovery

Counter-terrorism preparedness — multi-agency response to terrorist attacks. Joint Emergency Services Interoperability Principles (JESIP). Major incident response — Marauding Terrorist Firearms Attack (MTFA), Complex Coordinated Attack (CCA). Mass casualty triage — triage sieve/sort, hospital major incident plans. Explosive Ordnance Disposal (EOD) — Army, RAF bomb disposal. CBRN(e) response — chemical, biological, radiological, nuclear, explosives. Victim identification — DMORT, forensic recovery. Community recovery — post-attack resilience, memorialisation. Exercise programme — national exercises. Strategic coordination — COBR, Gold Command.

Online

Online Terrorist Content — Removal, Detection, OSINT

Online terrorist content removal — Internet Referral Unit (IRU), social media platform coordination. EU Crisis Protocol — rapid removal during attacks. Terrorist content detection — hash-sharing (GIFCT), AI classification. OSINT — open source intelligence, social media monitoring, dark web. Encrypted communications — lawful intercept debate, backdoor access. Online radicalisation pathways — platform-specific risk assessment. Influencer and propagandist identification. Content moderation support — tech company liaison. Online undercover operations — legal framework. Counter-narrative campaigns — Act Early, Educate Against Hate.

Ports

Ports Policing — Border Security, Passenger Data, Watchlists

Counter-terrorism at ports — ports policing, Border Force CT function. Advance Passenger Information (API) / Passenger Name Record (PNR) — travel data analysis. Watchlist management — Warnings Index, Schengen Information System (SIS II equivalent). Ports stops — Schedule 7 (Terrorism Act 2000) examination powers. E-gates and biometric verification. Freight and cargo security — container screening. Maritime security — small boats, pleasure craft. Airside access control — staff vetting, airside passes. Suspicious activity reporting at ports. Channel Tunnel security.

Finance

Counter-Terrorism Finance — Sanctions, Asset Freezing, Charity

Counter-terrorism financing — Terrorist Asset-Freezing etc Act 2010. Financial sanctions — UN, UK autonomous sanctions regimes. Suspicious Activity Reports (SARs) — NCA financial intelligence. Charity Commission — terrorist abuse of charities. Crowdfunding monitoring — online fundraising platforms. Cryptocurrency tracing — blockchain analysis for terrorist financing. Money service bureau regulation. Hawala and informal value transfer. Counter-terrorism financial investigation (CTFI). Proliferation financing. Cash seizure at ports — POCA powers.

Mass Casualty

Mass Casualty Response — NHS, Coroner, Victim Support

Mass casualty incident response — NHS major incident plans, hospital surge capacity. Emergency Department triage — chemical, blast, ballistic injuries. Burns and blast injuries — specialist centres. Coroner's role — inquests, Treasure trove, mass fatality management. Victim identification — dental records, DNA, fingerprints. Family Assistance Centre — disaster victim identification (DVI) coordination. Psychological support — trauma, PTSD, survivor guilt. Victim Support — national charity coordination. Compensation — Criminal Injuries Compensation Authority (CICA). Memorial and anniversary management.

Community

Community Engagement — Faith Groups, Youth, Vulnerability

Community counter-terrorism engagement — faith communities, schools, universities, youth organisations. Community tension monitoring — tension assessments, hate crime spikes post-attack. Independent Reviewer of Terrorism Legislation — statutory oversight. Muslim community engagement — Islamophobia, discrimination prevention. Youth vulnerability — county lines crossover, exploitation. Faith leader training — safeguarding, radicalisation awareness. Community resilience building — post-attack cohesion. Local authority Prevent coordinators. Community scrutiny panels — police use of CT powers. Trusted flaggers — community reporting.

Proscription

Proscription Regime — Banned Organisations, De-proscription

Proscription under Terrorism Act 2000 — listing criteria (commits, prepares, promotes terrorism). Proscribed organisations — 80+ groups (IRA, Daesh, National Action, etc.). Proscription offences — membership, support, wearing uniform. De-proscription process — application to Home Secretary. Parliamentary scrutiny — draft order procedure. Asset implications — freezing upon proscription. Online presence management — proscribed group content removal. Symbol and flag enforcement. International alignment — UN, EU proscription lists. Proscription review — periodic assessment.

Parliamentary

Parliamentary — ISC, Home Affairs Committee, CT Legislation

Intelligence and Security Committee (ISC) — oversight of MI5, MI6, GCHQ counter-terrorism operations. Home Affairs Select Committee — Prevent review, ports policing, online harms. Counter-terrorism legislation — Counter-Terrorism and Border Security Act 2019, Online Safety Act. Independent Reviewer of Terrorism Legislation — annual report. Terrorism Prevention and Investigation Measures (TPIMs) — parliamentary renewal. Detention without charge — 14-day limit, extension applications. Inquiries — Manchester Arena Inquiry, Fishmongers' Hall. Prevent review — William Shawcross. Annual terrorism statistics.

⚡ 8 Transformation Priorities

1. Prevent Referral Intelligence

AI-enhanced Prevent referral triage — risk scoring for Channel assessment, radicalisation pathway detection, multi-agency information sharing. Predict referral outcome and resource requirements. Target: Prevent referral processing time from 20 days to 5 days, Channel assessment accuracy above 90%, multi-agency information sharing compliance 100%.

2. Online Content Detection Acceleration

Machine learning for terrorist content detection — image/video classification, text analysis, network mapping. Hash-sharing (GIFCT) integration, crisis protocol automation. Dark web monitoring and attribution. Target: terrorist content detection time from 24 hours to 1 hour, platform removal compliance rate above 95%, hash-matching coverage 100% of known content.

3. Ports Intelligence Fusion

Automated ports risk assessment — API/PNR data analysis, watchlist matching, travel pattern detection, Schedule 7 examination prioritisation. Cross-reference travel data with intelligence holdings. Target: high-risk traveller identification accuracy above 90%, watchlist match processing time under 30 seconds, Schedule 7 examination intelligence yield increase 40%.

4. Crowded Places Vulnerability Assessment

AI-driven Martyn's Law compliance — automated venue risk assessment, vulnerability mapping, security measure recommendation. Real-time crowded places monitoring during heightened threat. Target: venue vulnerability assessment time from 2 weeks to 2 days, Martyn's Law compliance tracking 100%, crowded places protection coverage above 95%.

5. Counter-Terrorism Finance Detection

Advanced analytics for terrorist financing — SAR pattern detection, cryptocurrency tracing, crowdfunding monitoring, charity abuse identification. Cross-reference financial data with intelligence. Target: terrorist financing SAR analysis time from 30 days to 3 days, cryptocurrency tracing success rate above 80%, charity abuse detection accuracy above 95%.

6. Post-Attack Response Coordination

Automated multi-agency coordination during CT incidents — JESIP integration, resource deployment optimisation, casualty tracking, family assistance management. Real-time situation awareness. Target: multi-agency coordination response time from 30 minutes to 5 minutes, casualty tracking accuracy 100%, family assistance centre setup time from 12 hours to 4 hours.

7. Community Tension Prediction

Predictive community tension monitoring — social media sentiment, hate crime pattern detection, post-attack cohesion risk assessment. Support community engagement prioritisation. Target: community tension early warning 72 hours ahead, hate crime spike prediction accuracy above 85%, community engagement resource allocation optimisation 30%.

8. Pursue Investigation Analytics

Investigative analytics for CT policing — communications data pattern analysis, financial flow mapping, network analysis, surveillance prioritisation. Evidence package compilation. Target: investigation timeline prediction accuracy above 80%, evidence package compilation time reduction 40%, network analysis coverage increase 50%.

🔧 6 MCP Servers

Prevent

prevent-channel-mcp

Prevent referral and Channel case management — referral triage, risk assessment, multi-agency coordination. Deradicalisation programme tracking. Community engagement management. Prevent duty compliance monitoring. Online Prevent coordination. Counter-narrative campaign management.

Investigation

ct-investigation-mcp

Counter-terrorism investigation support — surveillance coordination, communications data analysis, financial investigation, evidence management. MI5/police interface. TPIM management. Arrest and detention tracking. Prosecution case building. International cooperation.

Protect

ct-protect-mcp

Protective security management — CTSA coordination, crowded places protection (Martyn's Law), transport security, CNI advisory. Vulnerability assessment automation. Hostile Vehicle Mitigation planning. Security awareness training tracking. Building security review.

Prepare

ct-prepare-mcp

Counter-terrorism preparedness — exercise coordination, multi-agency response planning, mass casualty triage support, CBRN(e) capability tracking. JESIP integration. Major incident plan management. EOD coordination. Victim identification support.

Online

ct-online-mcp

Online counter-terrorism — terrorist content detection, OSINT collection, platform liaison, counter-narrative deployment. Dark web monitoring. Encrypted communications analysis support. Hash-sharing management. Crisis Protocol coordination.

Finance

ct-finance-mcp

Counter-terrorism finance — asset freezing, SAR analysis, cryptocurrency tracing, charity monitoring, sanctions management. Financial investigation support. Crowdfunding monitoring. Money service bureau oversight. International financial cooperation.

🚫 Red Lines (Never Crossed)

🤝 5-Step Engagement Model

1
Discovery: Map counter-terrorism landscape — CONTEST delivery, Prevent programme, Pursue capability, Protect infrastructure, Prepare resilience. Assess online content removal pipeline, ports security, community engagement. Review parliamentary oversight mechanisms and independent reviewer recommendations.
2
Governance Design: Deploy DEFONEOS counter-terrorism MCP servers. Configure Prevent/Channel, investigation support, protective security, preparedness, online content detection, and financial investigation modules. Establish data feeds from CT policing, JTAC, Border Force, NCA.
3
Pilot: 90-day pilot across 2 CTUs and 1 regional policing area. Measure Prevent referral processing time, online content detection speed, ports risk assessment accuracy, community tension prediction. Collect feedback from CT officers, Prevent coordinators, CTSAs, community partners.
4
Scale: Roll out across national CT policing network — all CTUs, CTPHQ, ports policing, Prevent programme nationally. Integrate with MI5 systems, JTAC, Border Force. Deploy parliamentary reporting for Home Affairs Committee and ISC evidence.
5
Assure: Continuous audit-grade counter-terrorism governance. Real-time threat level monitoring. Prevent referral outcome tracking. Online content removal metrics. Ports security compliance. Community cohesion indicators. Annual CONTEST performance review.
DEFONEOS OWEM RFQ | Article 50 Passport