MI5 investigators were 'struggling to cope with a significant increase and change in workload' in the years before the Manchester Arena attack, the public inquiry into the 2017 bombing atrocity heard.
One security service witness said he raised concerns over the 'triaging of intelligence' from 2015, saying he was 'worried something could potentially get through' due to the amount of information they had to consider, a document reveals.
The increased workload was said to have been the result of Islamic State declaring its 'caliphate' in 2014 in Iraq and Syria.
A senior MI5 witness - known as 'Witness J' - said the security service 'appreciated' before the declaration it should take steps to 'pre-empt a shift to extremism in Syria', but he was 'surprised by the pace of the change'.
The witness, however, said he was 'not aware of any examples of resources having an impact on any decisions or judgements relating to' suicide bomber Salman Abedi.
Behind closed doors hearings of the inquiry not open to the bereaved families, the public or the media took place over 10 days in November last year to protect national security.
The hearings assessed what was, or wasn't, known about Abedi, and others, and how intelligence was acted on. Five MI5 and seven counter-terror policing witnesses gave evidence, and a report by an expert witness was considered.
A 'gist' document of evidence heard which has been assessed as able to be publicly reported has now been revealed. The document runs to 15 pages over 55 paragraphs.
Bereaved families said in a statement after its release they were 'deeply shocked and appalled' to hear the MI5 North West investigative team were struggling to cope from 2015.
"To hear that concerns had apparently been raised with superiors regarding the triaging of intelligence, including worries that something could get through due to the volumes of documents being considered is difficult to swallow," they added.
The families said the development was 'exacerbated' by learning that in April 2017, a month before the bomb, the team went into 'amber'.
Paul Greaney QC, reading out the gisted evidence, said it meant work was 'redistributed' to other MI5 investigators across the country.
Some case work, he added, 'had been suspended' in the days leading up to the Arena bombing on May 22, 2017.
The QC said: "By 2 May 2017 assistance was being provided to the NW investigative team, but the benefit of that assistance had not yet been felt.
"By 15 May much of the work had been taken up by another regional station. Witness J agreed that that investigative team was overstretched but that MI5 was under pressure across the board."
The inquiry, however, heard that in evidence, Witness J said MI5 had allocated its resource accordingly, 'overstretch was unavoidable' and the service was still able to focus on high-priority investigations.
"Anti-terrorism work should never be under-resourced," added 12 of the bereaved families in the statement issued through Kim Harrison, Principal Lawyer and Head of Operations for Abuse and Public Inquiries at Slater and Gordon. "If further resources are needed to keep our country safe, it is essential that they are provided as a matter of urgency."
It emerged that MI5 had intelligence that Abedi supported ISIS before the attack.
Abedi was twice opened and closed as a 'subject of interest' - SOI - by MI5 from 2014 and on May 1, 2017, MI5 assessed he met a 'threshold' for further investigation. A meeting was scheduled for May 31 - tragically 11 days after the attack - to consider the issue further.
Because of 'priority investigations', MI5 investigators had limited time to consider wider 'leads work' and manage intelligence in relation to closed SOIs, the inquiry heard.
The expert, meanwhile, said in his report decisions to close investigations into Abedi in 2014 and 2015, and not to reprioritise him in the first half of 2017, 'while finely balanced in some cases...were understandable and reasonable in most cases when judged against the criteria of necessity and proportionality, and the need to ensure that other, apparently higher risk elements of the investigative portfolio were properly resourced'.
Witness J said the system in place between 2014 and 2017 to triage new information not part of an existing operation 'was not as effective as it might have been'. The system was described as 'haphazard' and has now been changed, the inquiry was told.
It emerged that in late 2016, counter-terror policing 'did a piece of analysis' on 'fighting age boys and men' who travelled from Manchester to Libya over a three-month period, which wasn't specified.
The gist document said: "The outcome was that there were 544 such individuals, all of whom were reviewed by the fixed intelligence management unit of counter-terror policing, but none of whom was a subject of interest. Salman Abedi was not one of the 544 individuals because he did not travel out of the UK within the three-month window."
The inquiry has already heard intelligence about Abedi received by MI5 in the months before the bombing was 'not fully appreciated' at the time, but was later classed as being 'highly relevant' to the attack.
It also emerged MI5 didn't tell counter-terror police about that intelligence. What, exactly, the intelligence was wasn't revealed in the evidence gisted.
But based on its current policy MI5 would, now, investigate Abedi on receipt of the first of the two pieces of intelligence, it was said.
"On two separate occasions in the months prior to the attack, intelligence was received by MI5 the significance of which was not fully appreciated at the time.
"Evidence was given to the effect that if MI5 was to receive today the first of these pieces of intelligence, based on current policy it is likely that Salman Abedi would have been opened as a low-level lead. The opening of such a lead would have led to the making of low-level investigative enquiries, in conjunction with the police.
"Two of the MI5 witnesses were of the view that if further context had been provided with the intelligence received on two occasions prior to the 22 May 2017, this might have led to further investigative steps being taken."
The gist went on: "MI5 had intelligence that Salman Abedi supported Islamic State, but noted that there were a large number of people during this period who expressed such support who did not pose a threat to UK national security and that there were some inconsistencies in the intelligence about the extent to which he supported the aims of Islamic State and what, if anything, he would do to achieve its aims through his actions."
Intelligence of 'attack planning', MI5 said, would result in an investigation and quick police action to address the threat.
Witness J said that if MI5 had assessed there was credible intelligence that Abedi was about to mount an attack - and had been aware that he was returning to the UK on May 18, 2017, before the bombing - 'it is likely that they would have been in a position to disrupt the attack' and use covert surveillance.
Sadly, he said neither was the case.
