London attack ringleader was under active investigation at time of assault

The London Bridge attack ringleader Khuram Butt was considered a potential threat to British security and was still under active investigation at the time he carried out the deadly assault, UK counter-terrorism sources have told CNN.

Butt was still one of 3,000 "subjects of interest" considered the most dangerous potential threats in the country and was a figure in one of just 500 active counter-terrorism investigations, the sources said.

Police said on Monday that an intense investigation was launched into Butt in 2015 but that it was moved to a lower priority level after there were no indications Butt was considering or plotting an attack. Police typically shift investigations to a lower priority level in such circumstances to free up resources for what they regard as more imminent threats.

Eight people were killed when Butt and two other men rammed a vehicle into pedestrians on London Bridge and then went on a stabbing spree at bars and restaurants at nearby Borough Market.

"Khuram Shazad Butt was known to the police and MI5," the Metropolitan Police said in a statement on Monday. "However, there was no intelligence to suggest that this attack was being planned and the investigation had been prioritised accordingly."

The new developments emerge amid a heated public debate, ahead of Thursday's general election, on whether the British police are sufficiently resourced. Prime Minister Theresa May has said that the UK security services will launch a review into their handling of the suspects' cases before the attack.

Cressida Dick, the commissioner of London's Metropolitan Police Service, said on Monday that she wanted more resources to counter the terror threat. "In the face of this changing and changed threat, absolutely I will be seeking for London and for policing generally more resourcing," she told ITV.

Slipping off the radar?

It appears that British security services are themselves concerned that they could be losing track of potential threats -- sources said that after the Manchester bombing, security agencies began re-evaluating the risk level of individuals categorized as former subjects of interest.

Counter-terrorism have at times been overwhelmed by the numbers of individuals on the radar, and British officials are now looking at ways to improve their management of risks. One approach under consideration is to create systems for counter-terrorism agencies to share information about former subjects of interest with local police not currently involved in counter-terrorism work. This would take advantage of the general police's greater numbers and their eyes and ears into communities.

An additional 20,000 individuals who were at some point subjects of interest of British counter-terrorism investigations in the years since 9/11 are no longer under active investigation, but are still considered "residual threats."

British counter-terrorism police and MI5 have procedures in place for moving individuals from the "active risk" bucket of investigations into the "residual risk" bucket.

Westminster attacker Khalid Masood and Manchester attacker Salman Abedi were classified as "former subjects of interest" at the time they carried out their assaults and were no longer under active investigation, the sources told CNN. They were among the 20,000 considered residual threats.

One counter-terrorism source told CNN Masood was on the periphery of an investigation into an al Qaeda suicide bomb plot thwarted in Birmingham in 2011.

The investigation into Butt

British counter-terrorism services have four tiers of priority when it comes to subjects under active investigation, ranging from P1, the highest priority, to P4, the lowest. Individuals classified P1 are subject to the greatest amount of surveillance and attention by security services.

While it was not clear what priority level Butt fell in, the investigation into him involved a "full package" of measures, including covert surveillance, counter-terrorism sources told CNN on Tuesday.

Butt was seen as a heavyweight figure in the organization al-Muhajiroun, whose hardline views made him potentially one of the most dangerous extremists in the UK, sources told CNN on Tuesday.

Each counter-terrorism investigation is given a name by British authorities. For example the investigation into a 2006 al Qaeda plot targeting transatlantic airliners leaving from Heathrow was called "Operation Overt." The 2011 al Qaeda suicide bomb plot in Birmingham was thwarted by "Operation Pitsford."

New details on Manchester investigation

The sources who spoke to CNN also revealed new details about the investigation into the Manchester attack.

Authorities have not yet found evidence others in the UK knowingly helped Abedi plan his attack, the sources said.

Given the relative sophistication of the device detonated in the Manchester arena and the fact it contained the high explosive TATP, which is tricky to make, investigators believe Abedi likely received bomb-making training at some point in Libya, and are looking into whether he could have received instruction during a three-week trip he made to Libya shortly before the attack.

One key question for investigators is whether he was trained by figures in ISIS or learned how to make TATP while fighting with one of the country's many militias, the sources told CNN. It is currently not thought likely Abedi traveled to Syria, the sources said, though it has not been ruled out.

Investigators are examining a number of online purchases made by friends and family of Abedi while he was in Libya. They believe they may have unwittingly helped him obtain some components used in the device after he asked them to make the purchases. A member of the Abedi family in Manchester told CNN that one of these unwitting purchases was a car part from Amazon.

Abedi appeared to be laser focused on building the bomb when he returned to the UK, the sources said. The high volatility of TATP -- the quick speed at which it evaporates or sublimes and thus becomes useless as an explosive -- means he almost certainly made the explosive substance in the three days between his return from Libya and the attack, the sources told CNN.