London — Senior British counterterrorism officials warned Thursday that technology and online platforms are being used more frequently to plan and carry out attacks against the United Kingdom, with hostile states, Islamic extremists and growing far-right networks exploiting messaging apps and social media.
Why police say platforms matter
Vicki Evans, a senior national coordinator for counterterrorism at the Metropolitan Police, described a "continual battle" to counter threats that increasingly begin and spread online. She said law enforcement cannot manage the challenge alone and is seeking greater cooperation from technology companies to trace and disrupt plots.
"it's not something we can do alone."
Laurence Taylor, head of counterterrorism police, said that while Islamic extremism remains the single largest threat, the last five years have seen a notable rise in activity from far-right groups and from hostile foreign states. Officials singled out Iran and Russia as particularly active.
Recent cases cited by police
Police pointed to a string of prosecutions and convictions this year that they say illustrate the range of threats:
- In July, two Romanian men were jailed in the stabbing of a journalist working for a Persian-language television outlet; a judge found the attack had been carried out on behalf of Iran's government.
- In June, two men — a Ukrainian and a Romanian — were convicted in a plot to burn property linked to U.K. Prime Minister Keir Starmer; police say the incident fits the pattern of Russian state-backed sabotage.
- In May, a U.K. border official and a former Hong Kong police officer were convicted of spying for China.
Evans told reporters that in 2025 British authorities detected more than 20 Iranian-backed plots that ranged from assassination and kidnapping plans to other serious criminal activity. Police are also probing whether recent arson attacks against Jewish sites have any connection to Iran.
State actors exploiting messaging apps
British officials described a concerted effort by Russia to recruit and task people through encrypted messaging services such as Telegram. Russia, they said, runs a steady stream of surveillance and sabotage campaigns aimed at infiltrating daily life, spreading narratives friendly to Moscow and directing proxy actors to commit vandalism or arson.
One high-profile case involved a group recruited on Telegram that set fire to a London warehouse storing communications equipment intended for Ukraine. Dylan Earl, identified by police as the ringleader, was recruited by the Wagner Group on the platform, according to investigators.
| Date | Incident | Alleged actor |
|---|---|---|
| May | Conviction for spying | U.K. border official, former Hong Kong officer — China |
| June | Arson of property linked to PM | Ukrainian man, Romanian man — tied to Russian-backed sabotage |
| July | Stabbing of Persian-language TV journalist | Two Romanian men — carried out on behalf of Iran |
Officials stressed that the model is often decentralized: recruitment, coordination and target identification happen in private groups or on encrypted channels, then flare into real-world violence. That mix complicates traditional policing, which relies on physical evidence and local investigations.
What this means for tech policy
The public framing from the Metropolitan Police underscores mounting pressure on platform operators to provide faster, more effective responses to threat intelligence and to enable lawful investigative access. For policymakers, the cases highlight tensions between encryption, privacy protections and national security when state and nonstate actors weaponize digital tools.
British authorities say they will continue to pursue both domestic extremists and foreign-directed campaigns, and they are urging closer technical collaboration with industry to map the online ecosystems that enable recruitment, radicalization and operational planning.
The message to platforms is explicit: the pathways from online communication to real-world harm are widening, and law enforcement wants clearer lines of cooperation to interrupt plots before they escalate.
