In a memo from November, which was leaked on Tuesday to The Times, it was revealed that operator Govia Thameslink Railway (GTR) had failed a security test carried out by the Department for Transport in which staff had failed to notice an unattended bag containing a suspicious item.