The threat was real. The men weren't

Three white vans on a farm lane in Whelford, 350 metres from a crash gate at RAF Fairford, at half past one on Sunday morning. One reportedly carried the livery of a fuel firm. A farmer driving home found the vans blocking her drive, saw hooded men scatter at her headlights, rang the base police and got no answer, then called 999.

Five men were arrested under the Explosives Act and later re-arrested on suspicion of preparing an act of terrorism. Around 85 households were evacuated. A bomb-disposal robot examined the vehicles on live television. COBRA met.

Then, after around 36 hours, all five were released on police bail: British nationals from London, aged 23 to 25, with the investigation continuing. Daniel Sandford, the BBC’s home affairs correspondent, described it as “not the plot some were fearing”.

That leaves two compelling narratives: the farmer who stumbled across something the security services had missed, or suspects who had already been under observation. The evidence currently available does not allow either to be stated with certainty.

Three readings, then a fourth

No officer has publicly said the operation was not intelligence-led. The BBC understands that it was not, which is not quite the same thing.

Against that sit President Trump’s comments that the group had been under investigation and “under view for a long time”, Wes Streeting’s description of the farmer’s account as only a “partial picture”, and reports of a specific Iranian threat several weeks earlier.

There are therefore several possible readings. The first is straightforward: the vans were discovered unexpectedly and the subsequent response followed from the farmer’s 999 call. The second is that some of those involved were already known to the authorities, but were not under active surveillance that night. A third possibility is that an intelligence operation was already under way and the farmer’s call accelerated or changed the response. The arrest sequence does not resolve which interpretation is right.

There is, however, an important question. If a group suspected of preparing an attack on a strategic military base were already under close surveillance, allowing three vans containing unexplained barrels to reach the approaches to that base would represent an unusually late point at which to intervene.

President Trump’s comments also leave open the question of who, if anyone, had been watching the group and what information had been shared with British authorities. There is currently no public evidence establishing that US agencies led or initiated any surveillance.

The subsequent bail decision adds another uncertainty: whether these five men represented the full threat picture that had prompted the heightened concern around Fairford.

What the clock says

Counter Terrorism Policing confirmed that the men were being held under the Police and Criminal Evidence Act (PACE), rather than the specific detention provisions available under Section 41 of the Terrorism Act. Public reporting therefore suggests investigators relied on ordinary PACE detention powers rather than beginning the separate Terrorism Act detention process. That distinction matters.

Section 41 is not the usual route in terrorism cases – 48 of 248 terrorism-related arrests in 2024 were made under it – but it provides considerably longer detention periods where investigators can demonstrate the necessity.

Fairford involved five suspects, multiple vehicles and electronic devices, alongside an apparent potential threat to a strategically important military base. Yet investigators ultimately released the men on bail rather than seeking significantly longer detention. It would be wrong to infer too much from that decision alone. We do not know what forensic results were available, what intelligence existed behind the scenes or what legal advice investigators had received. But the decision does tell us something important: whatever concerns justified the initial response, investigators did not consider continued detention necessary at that stage.

Suggestions that ministers simply ordered the men’s release are also difficult to reconcile with the legal process. Custody and detention decisions sit with police and, where extensions are sought, the courts. Political involvement would arise only in specific circumstances later in a case, such as where an Iran-linked prosecution required the Attorney General’s consent.

Another possibility is that release on bail serves a continuing intelligence investigation rather than marking its conclusion. That remains possible, but nothing currently in the public domain confirms it.

The wrong crew on the wrong lane

Remove the terrorism context for a moment and another possible explanation emerges. Three vans, barrels, men gathered on a rural lane in the early hours and people running when headlights appeared could also fit more conventional criminal activity.

One possibility is rural fuel theft. Such crimes can involve vans, containers and attempts to access diesel stored at isolated premises. There are obvious weaknesses in that theory. The number of people reportedly seen is unusually large, and choosing a location immediately beside a US bomber base operating under heightened security would be an extraordinary choice for thieves who had done any reconnaissance. So fuel theft should not be treated as an equally evidenced explanation. At present, it is simply one alternative that demonstrates how ambiguous the publicly available evidence remains.

Between conventional crime and a directed terrorist plot sits another possibility raised by Laurence Taylor, head of Counter Terrorism Policing: individuals acting “knowingly or unknowingly” on behalf of a foreign state. European security services have repeatedly warned about states using intermediaries or proxies who may know little about the ultimate purpose of the task they have been given.

A group hired to move or leave vehicles without understanding the wider purpose could therefore look superficially similar to ordinary criminals. The phones, communications and forensic examination of the barrels should help investigators distinguish between those possibilities.

The approach failed. It still matters.

Security around RAF Fairford had reportedly been heightened before the incident. Some observers suggested measures consistent with a very high force-protection posture, although there has been no official confirmation that the base had moved to FPCON Delta. Whatever the precise classification, the response indicates that the potential threat was being taken seriously. Outside the perimeter, however, questions remain. Police records reportedly show an initial call concerning the vans at 00:45. The farmer called at 01:36. That leaves 51 minutes which, on the information currently available publicly, remain unexplained.

Then there is the sky. A five-mile flying restriction was imposed at 14:40 on Sunday. That appears broader than the immediate cordon normally associated with examination of a suspect device and is consistent with the authorities taking wider base security seriously. The aerial footage raises separate questions. Images appeared to show the bomb-disposal operation taking place around the vans. Those pictures may have been captured from outside the cordon using a long lens, while police also routinely use their own drones during operations. Either way, the footage itself tells us relatively little about the assessment of what was inside the vehicles. The drums visible beside the vans appeared empty, but appearances from broadcast footage are not evidence. Until forensic findings are released, their contents and significance remain unknown.

One further point deserves attention. A sharpened image purporting to show the suspects circulated online after the incident. AI enhancement cannot recover facial information that was never captured by the original image. Generative enhancement instead creates plausible detail to fill what is missing. The result may look convincing while bearing little relationship to the actual faces involved. In a live terrorism investigation, that distinction matters.

What an Iranian hand would mean

Iran’s activity in Europe is well documented. MI5 has previously referred to more than 20 Iran-backed plots posing potentially lethal threats to British citizens and UK residents.

What is much less established is an Iranian-directed attack against a heavily defended military installation in Britain. An explosive attack on Europe’s only US heavy-bomber base would represent a significant escalation. Using intermediaries to conduct surveillance, test security or carry out a seemingly innocuous task would fit more readily with previously reported proxy methods.

The Financial Times reported in August that Tehran had assessed possible strikes on US military assets in Europe. Reports of a threat relating to Fairford emerged within a similar period. That context explains why unexplained activity around the base demanded an immediate and serious response. It does not, on the evidence currently available, connect these five men to an Iranian operation.

Where this lands

The threat surrounding RAF Fairford appears to have been taken seriously. Five men were subsequently found in circumstances sufficiently concerning to trigger arrests, evacuations and a major counter-terrorism response. What remains unclear is how – or whether – those two things connect.

The release of all five men on bail does not establish that they were innocent of any offence, nor does it prove that they were unrelated to the wider security concerns. The investigation remains open. But neither does the evidence currently available support a confident conclusion that police disrupted a state-directed terrorist cell preparing an attack on RAF Fairford.

That distinction matters. The police were right to treat unexplained vehicles and barrels beside a strategically important military base as a potentially serious threat. They were also right to release suspects when continued detention was no longer considered necessary. What follows now should be driven by evidence rather than by the dramatic imagery of the first 24 hours. A charge, forensic evidence of a viable device or further information about the intelligence picture could change that assessment substantially.

Until then, the farmer’s account remains an important part of what is publicly known – but, as Wes Streeting has already said, it may only be a partial picture.

Image for illustrative purposes only. This photograph was not taken at RAF Fairford and does not show the incident described in this article.