TERRORISM FREQUEN CY 0 1/19 Terrorism Frequency Report Welcome to our fourth Terrorism Frequency Report /02 Non-Damage Business Interruption – the cost of terrorist attacks /04 Manchester Arena attack – a study into the impact on small businesses /08 Oct/18-Jan/19 – a review of significant incidents 09/ Severity of attacks /10 The increase of terrorism – article by Sir Mark Rowley QPM /12 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

In his article, Sir Mark Rowley observes that “Terrorism is increasing, it moves faster, and is harder to detect.” The velocity at which attacks are planned and executed presents a constant WELCOME challenge to CT agencies. Extremists, be they Welcome to our fourth Pool Re Terrorism Frequency Report and the first report in 2019. Islamist or Extreme Right Wing (XRW), continue to access compelling material online which, In this edition we look in some detail at the issues and challenges posed by terrorist attacks coupled with easy access to low-tech attack causing Non-Damage Business Interruption (NDBI). The recently passed Counter-Terrorism materials, makes bladed, vehicle and improvised and Border Security Bill 2018 will allow Pool Re to cover losses incurred if a business explosive devices (IEDs) incidents more likely. cannot trade or is prevented from accessing its premises in the wake of a terrorist attack. Monitoring, containing and, where necessary, Before the law was changed, Pool Re could only reinsure losses incurred if a company’s arresting over 3,000 subjects of specific interest premises had been physically damaged by terrorists. This is a significant development in and 20,000 former subjects of interest is one the company’s history. matter, detecting those individuals who are not known but have the intent to commit mass casualty attacks is another. With the further demise of Daesh in Syria and Iraq it is likely that we will see continued self-inspired attacks in Live CT 2019. The threat from al Qaeda (AQ) persists, investigations particularly in its heartland of the Federally Administered Tribal Areas (FATA) as well as in Iraq and Syria, and the risk of a spectacular attack cannot be discounted. 700 There is a widely recognised increase in the Subjects of specific interest threat posed by XRW individuals and groups. being monitored This was seen in 2018 through increasing arrests and convictions of XRW individuals in the UK, as well as an increase in referrals of individuals connected to the Far Right to Prevent initiatives k such as Channel. In December, the Home Office 3 announced that, for the first time, the number Former subjects of people receiving deradicalisation support for of interest being XRW and Islamist views were roughly equally monitored split. The Head of the West Midlands Counter We are very privileged to have Sir Mark Rowley Terrorism Unit, DCS Matt Ward, recently QPM share his thoughts and experiences on explained that the extreme right wing “makes up k his time as former National Lead for Counter around a fifth” of what they do and is continuing 20 Terrorism Policing. Also included is a synopsis to grow. of a larger report we commissioned into the Manchester Arena attack and the consequences this had on the small business community. Finally, and as before, we review the last four months of global terrorism events and how these might impact on our Members and insureds. Number of persons in custody for terrorism-related offences, by ideology Snapshot Threat Notwithstanding the knife attack in Manchester Victoria train station on New Year’s Eve, which Enhanced security 2018 resulted in three injuries and where the measures and CT perpetrator appears to have been motivated by Islamist extremism, 2018 was a very different year to 2017 when 36 people were killed and over efforts minimised 2017 300 injured by terrorists in Great Britain. On the attacks during 2018. surface it would be easy to say that the threat of terrorism in Europe has dissipated; there was only one other event in the UK (in Westminster on 2016 14 August 2018). The comparative lack of attacks in the UK could be largely put down to two causes: first, Daesh’s continual decline in Syria and Iraq leading to a general weakening of the principal threat (due to a reduced ability to directly 2015 inspire and sponsor attacks); and second, the Current UK enhanced security measures and CT efforts resulting in a consistently high level of interdictions threat level: and arrests. Conversely, the decline of Daesh 2014 has internalised the threat to the UK again due CRITICAL to the inability of radicalised individuals to travel. SEVERE Threat level from 2013 international terrorism Despite this, the threat level remains at SEVERE ! to the UK (meaning that an attack is ‘highly likely’) for good reason; over 700 live CT investigations are 0 50 100 150 200 250 SUBSTANTIAL being undertaken at any one time by the police MODERATE Threat level from and MI5 into over 3,000 subjects of specific Key interest. In 2017 the live investigations’ figure was -related Islamist Extremist ! terrorism to GB closer to 600. Furthermore, it is assessed that one-late stage attack plot is still being interdicted Far Right LOW every month. Other

Pool Re TERRORISM FREQUENCY Report 02 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

of incidents have exposed the vulnerabilities Amber Rudd was equally clear in her responses THREE BIG THEMATIC of business, in particular small and medium to questions on the panel about the key role that LESSONS HAD BEEN sized enterprises (SMEs), to incidents which business has to play, in particular the insurance IDENTIFIED BY THE POLICE. cause NDBI. Pool Re included NDBI in its industry, in risk mitigation and resilience. She Scheme in February 2019 which will allow reminded the audience of the threat posed by THESE INCLUDED: business to buy coverage that responds to all threat actors, including extremist groups, – BEING BETTER AT the threat of contemporary terrorism. However, and the rising threat of Domestic Extremism, COLLECTING, ANALYSING, for NDBI cover to be successful it must be both in particular the far right. affordable and accessible to small businesses PROCESSING, AND and Pool Re, in collaboration with other The key speeches from this event are available in MANAGING DATA; stakeholders and Members, continues to look a podcast and video available on the link below. – COLLABORATING WITH AND at ways and means of improving risk awareness and the incorporation of appropriate risk SHARING INFORMATION mitigation measures by its Members and WITH THE WIDEST RANGE insureds. As Eden Stewart’s article concludes, Summary OF PARTNERS, IN businesses can further improve their resilience In summary, Pool Re remains committed to to terrorist incidents by having government improving its understanding and knowledge PARTICULAR THE PRIVATE approved protective security measures as of the threat posed by all forms of terrorism SECTOR; well as resilience, business continuity and and the inclusion of NDBI into our cover – AND, DEALING WITH crisis management plans in place. will further increase business resilience to contemporary terrorist attack methodologies. DOMESTIC EXTREMISM Drones We will continue to examine the ways MORE EFFECTIVELY. Although not covered in this report (see previous and means of providing affordable and reports on this threat here), and not declared as a accessible terrorism cover, including to small terrorist incident, the closure of Gatwick Airport and medium sized businesses. We are proud for three days before Christmas reminds us of that our efforts to develop an ecosystem that the potential for terrorists to use drones to target aims to design, promote and share protective aviation directly or to use them as airborne IEDs security best practice is acknowledged by or to drop explosive material. The use of drones the CT Police and that we were recognised by Daesh in Syria and Iraq has been extremely in the 2018 CONTEST strategy review as an sophisticated, undertaking reconnaissance excellent example of how government and However, the far right continues to lag well as well as dropping IEDs on coalition forces. industry can work together to mitigate the behind the Islamists in terms of conducting The drone attacks in Venezuela and the recent effects of terrorist attacks in the UK. successful terrorist attacks. Part of this can incident in Yemen by Houthi rebels demonstrate be explained by the fact that the far right in that threat actors can be highly innovative in the UK lacks the equivalent of a group such circumventing traditional security measures. as Daesh to sponsor, co-ordinate and inspire Countering drones in built-up areas remains attacks, although it now appears that National extremely challenging from both a technical Action has an increasing role in mobilising and legal perspective, which will be of concern Ed Butler CBE DSO XRW activity and the promotion of hate crime. to insurers. Head of Risk Analysis, Pool Re In addition, the far right often lacks the sophistication and skills seen in other terrorist Risk Mitigation entities. This has resulted, to date, in a lower Pool Re was delighted by the attendance of level of successful attacks and plots, which nearly 300 guests at the launch of its 2018 in general have been easier to detect and Terrorism Threat and Mitigation Report (TMR) in disrupt; in this way the XRW may have more November and its proposed coverage of NDBI in in common with the Islamist threat than might its Scheme. We were privileged to have Assistant first appear. However, as some far-right Commissioner Neil Basu extremists have former military experience QPM as our keynote speaker and the Member and knowledge of weapons and explosives of Parliament, and former Home Secretary, (as seen with Anders Breivik’s attacks in Norway Amber Rudd as one of our panellists. We were in 2011) the potential for a mass casualty or also joined by counter-terrorism professionals IED attack in the UK cannot be discounted. from the Royal United Services Institute (RUSI) and Cranfield University as well as Conrad The explosion on 19 January in Londonderry Prince, our senior cyber terrorism advisor. Links to sources of further information: by a group calling itself the ‘IRA’ is a timely reminder of the threat posed by Northern Ireland Neil Basu informed the audience that the attack Channel guidance Related Terrorism (NIRT) and the use of vehicle by Khalid Masood on Westminster Bridge in Channel is part of the Prevent strategy. borne improvised explosive devices (VBIEDs). March 2017 had “lowered the bar for terrorists The process is a multi-agency approach Although the Police Service of Northern Ireland in this country and had established a momentum to identify and provide support to individuals (PSNI) described the device as “crude”, for those who had thought the UK too difficult who are at risk of being drawn into terrorism. “very unstable” and made using gas canisters, a target”. He went on to say, as part of the review www.gov.uk/government/publications/ there is speculation that Semtex could have of the 2017 attacks, that three big thematic channel-guidance been the detonator. Dissident Republican lessons had been identified by the police. These groups retain the capability to build sophisticated included: being better at collecting analysing, Terrorism Threat & Mitigation Report explosive devices. processing, and managing data; collaborating (TMR) 2016 with and sharing information with the widest Emerging Risk Report: Drones Non-Damage Business Interruption range of partners, in particular the private sector; www.poolre.co.uk/wp-content/ The threat landscape has clearly changed and, dealing with Domestic Extremism more uploads/2017/02/Pool-Re-Terrorism-Threat- since the attacks in Europe in 2015 and effectively. His consistent message throughout Mitigation-Report-Aug-Dec-2016.pdf terrorists’ preferred attack methodologies now was that there can be no “freedom and no involve knives, using vehicles as a weapon, prosperity without security” and that “every Terrorism Threat & Mitigation Report firearms and increasingly IEDs. As a result, responsible business also needs to be a CT (TMR) 2018 the majority of attacks over the last four years business”. He underlined these two points by www.trac.poolre.co.uk have resulted in a handful of property damage saying that businesses need to become as claims but significant non-damage business engaged in the protection of their communities Podcast interruption (NDBI) losses caused by denial as they are in focusing on their economic https://soundcloud.com/poolreinsurance/ of access and loss of attraction. These types well-being. pool-re-podcast

Pool Re TERRORISM FREQUENCY Report 03 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

BUSINESS ON PAUSE

NON-DAMAGE BUSINESS INTERRUPTION – THE COST OF TERRORIST ATTACKS

Pool Re TERRORISM FREQUENCY Report 04 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM NON-DAMAGE BUSINESS INTERRUPTION – THE COST OF TERRORIST ATTACKS

FROM 2014 ONWARDS, IT Eden Stewart The divergence from historic patterns of Senior Analyst targeting became particularly pronounced BECAME APPARENT THAT after 2014, when Daesh exhorted its followers A TERRORISM INSURANCE in the West to mount attacks using a variety of tactics, including unsophisticated GAP HAD EMERGED. ATTACKS methodologies like the use of vehicles and From 2014 onwards, it became apparent that a INCREASINGLY CAUSED knives as weapons. Following Daesh’s call to terrorism insurance gap had emerged. Attacks arms in mid-2014, Western Europe witnessed LITTLE OR NO PROPERTY increasingly caused little or no property damage 65 Islamist attacks, half of which employed but still resulted in significant losses. However, DAMAGE BUT STILL RESULTED low complexity methodologies. While capable for policies to respond, a direct physical IN SIGNIFICANT LOSSES. of causing large numbers of casualties and damage trigger was required, leaving insureds significant economic costs, these attacks without cover. The recently passed Counter- did not generally cause significant property Terrorism and Border Security Bill 2018 allows damage. For example, the 2016 Nice attack Pool Re to cover losses incurred if a business killed 84 people and cost the French economy cannot trade or is prevented from accessing an estimated €300m, but available evidence its premises in the wake of a terrorist attack. suggests there were no property claims (1). Following the 1992 bombing of the Baltic Subsequent attacks would further illustrate Exchange by the Provisional Irish Republican the gap between insured loss and actual cost Army (PIRA), terrorism exclusions were applied of terrorist attacks, and the limitations of existing to property policies, precipitating the creation terrorism cover. The investigation into the 2017 of Pool Re to ensure the availability of terrorism London Bridge attack was accompanied cover for commercial property. However, by a 10-day police cordon around the area. the threat landscape has evolved significantly Borough Market was closed, and the owners since then, and cover created to mitigate of its 153 stalls were prevented from accessing the risk of legacy threats may not respond TO CLOSE THE their premises. Estimated losses were £1.4m to the full range of methodologies employed at minimum (2). Few, if any, of the affected by today’s terrorists. PROTECTION businesses are believed to have had terrorism cover. However, there was very little damage Conceived against the backdrop of the militant GAP WHICH HAS to property as a result of the attack, so, in the Republican bombing campaign against financial absence of direct PD trigger, it is unlikely that and commercial infrastructure, Pool Re’s cover EMERGED IN any would have been able to claim for BI losses. was designed to respond to losses triggered by The London Bridge attack, and the protection material damage to commercial property (PD) RECENT YEARS, gap it highlighted, was the primary driver for the and attendant business interruption (BI) costs. amendment to Reinsurance (Acts of Terrorism) With the 2001 attacks on the World Trade POOL RE HAS Act 1993 provided by the Counter-terrorism and Center, Islamist extremism supplanted Northern Border Security Bill which will enable Pool Re to Ireland-related terrorism as the primary terror EXTENDED offer non-damage BI cover. threat to Great Britain. The intent of Islamist ITS COVER terrorists was (and remains) to maximise loss of life and societal disruption. Consequently, TO INCLUDE property is no longer the primary exposure at risk, with attacks today typically generating NON-DAMAGE much less PD than those mounted by PIRA two decades ago. Nonetheless, the economic cost BUSINESS of terrorism remains high. The 2016 Brussels Airport bombing resulted in total losses of INTERRUPTION approximately €200m. PD losses accounted only for an estimated €3m of this, while (NDBI) LOSSES. BI losses were estimated at €42m.

Pool Re TERRORISM FREQUENCY Report 05 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

This protection gap was not exclusive to To close the protection gap which has emerged “WE WILL NOT ALLOW low-complexity methodologies; half of Islamist in recent years, Pool Re will extend its cover to TERRORISTS TO CHANGE attacks involving firearms in Europe since include non-damage BI (NDBI) losses. This will OUR WAY OF LIFE. SO WHEN mid-2014 did not cause any PD. In total, allow Pool Re Members to opt into providing two-thirds of attacks in Western Europe during Pool Re-backed NDBI coverage, or to write such BUSINESSES RAISED THEIR the period would not have triggered property cover independently. Once they elect to join the CONCERNS ABOUT A GAP policies. The wave of Islamist violence also Pool Re NDBI solution, Members will be able to IN INSURANCE COVER demonstrated that terrorism risk was no longer offer NDBI cover to the extent such cover is concentrated in areas near high-profile targets. provided on their underlying BI policy. The FOLLOWING A TERROR Crowded locations of any sort became potential reinsurance cover available from Pool Re ATTACK, WE WORKED WITH targets, with civilians attacked at prosaic consists of two key elements; POOL RE TO COME UP locations like supermarkets, bus stops and churches. While targets of totemic value 1. Non-Damage Denial of Access – this WITH A SOLUTION. WE’VE accounted for the majority of attacks, these covers policyholders if access to their CHANGED THE LAW TO now included police officers on patrol and premises is denied or impaired, and they GIVE BUSINESSES PEACE ordinary Jewish institutions like schools and suffer loss of income or increased costs and delicatessens. The trend towards greater OF MIND, HELPING THEM diversity in targeting means the threat is more 2. Non-Damage Loss of Attraction – this TO INSURE THEMSELVES geographically dispersed than before; almost will cover loss of footfall caused by a AGAINST FINANCIAL LOSS 40% of Islamist attacks in Europe since terrorist incident in the immediate vicinity mid-2014 occurred in conurbations with fewer of the premises. AS A RESULT OF A TERRORIST than a million inhabitants. ATTACK, EVEN IF THERE Importantly the scope of cover offered is very IS NO PHYSICAL DAMAGE The change in threat means many more wide and would extend to incidents involving organisations may be exposed to terrorism chemical, biological, radiological and nuclear TO THEIR PROPERTY. THIS than previously, and that relative anonymity causes, so if the events in Salisbury had been MEANS BUSINESSES WILL or remoteness from symbolic targets are certified as an act of terrorism, Pool Re NDBI BE ABLE TO TAKE OUT now less likely to shelter them from either the cover would trigger. However, the NDBI cover direct or indirect effects of a terrorist attack. will not extend to incidents triggered by remote NEW AND COMPREHENSIVE Businesses close to the site of an attack are digital means (cyber terrorism). POLICIES TO PROTECT likely to face denial-of-access (DoA) and THEM IN THE FUTURE.” attendant business interruption due to police While the legislative amendment authorising cordons. While the size and length of cordons Pool Re to reinsure NDBI cover is an important JOHN GLEN MP, will likely vary considerably depending on the step to closing the protection gap and making ECONOMIC SECRETARY nature of attack, the 10-day cordon around cover affordable, more work is necessary to TO THE TREASURY London Bridge and Borough Market gives promote awareness of the threat and availability some indication. Most cordons are likely to of cover. Not only do we need to help businesses last days rather than hours and could extend make informed decisions on whether to buy for hundreds of metres around crime scenes. any type of terrorism coverage, but we can also provide insight and research to inform better Furthermore, businesses’ losses are unlikely these crucial decisions. to be confined to revenues and stock lost due to DoA. Attacks can depress trade in While the frequency of successful attacks in areas affected by terrorism for months after Europe declined significantly in 2018, the threat an incident; the Parisian regional tourism has not abated, and security services continue committee assessed that the tourism sector to work at capacity. Low complexity attacks suffered a 6.1% drop in revenues over the year remain likely, and there is ample evidence that following the November 2015 attacks (3). Islamist terrorists continue to devote resources to Tourism and hospitality sectors are particularly executing spectacular attacks involving explosive susceptible to loss-of-attraction (LoA), although devices against a range of targets. Furthermore, all consumer businesses are likely to suffer the increasing threat of extreme right-wing (XRW) from diminished footfall as a result of attacks. terrorism may exacerbate an already complex Experience from the 2017 attacks in England threat landscape. XRW terrorists will likely suggest that small and medium-sized employ similar methodologies to their Islamist businesses (SMEs) are especially vulnerable counterparts, but are likely to target ethnic and to BI losses, particularly cash flow interruption sexual minorities as well as politicians, increasing and loss of perishable stock. They are also the geographic spread of potential targets. likely to be more sensitive to supply chain Meanwhile, the increasing availability of disruptions and diminished footfall. To unconventional attack methodologies, like the understand fully the impact of attacks on use of drones, has the potential to cause both SMEs, Pool Re commissioned a study into destruction and significant disruption. the Manchester Arena attack and its effects on local businesses. The study’s key findings This dynamic threat environment means that Links to sources of further information: are detailed later in this report. a proactive approach to risk management, underpinned by appropriate insurance, is vital (1) 2016 Nice attack if businesses are to increase their resilience www.ft.com/content/436faa32-8e7f-11e8-bb8f- to terrorism. Organisations should develop a6a2f7bca546 and rehearse crisis management and business continuity plans to ensure they and their (2) 2017 London Bridge attack employees know how to respond in the event www.ft.com/content/70f1f014-2dc7-11e8-a34a- they are impacted by an attack. Pool Re 7e7563b0b0f4 continues to explore ways of increasing the UK’s resilience to terrorism through identifying (3) 2015 Paris attacks and closing insurance gaps, encouraging www.independent.co.uk/travel/paris-tourist- provision of cover by its Members, take-up numbers-drop-franch-terror-attacks-further- of cover by businesses, and promoting risk charlie-hebdo-bataclan-shooting-isis- mitigation initiatives in partnership with its a7592836.html stakeholders in industry and government.

Pool Re TERRORISM FREQUENCY Report 06 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

London Bridge and Borough Market attack 22 May 2017

Key Days of Police cordon Borough Market around the attack area Local businesses affected Police cordon 10 Stalls in Borough Market prevented from 153 accessing their premises Minimum estimated losses £1.4 m

London Bridge

Southwark Cathedral

Tooley Str eet

London Bridge Underground Station Borough Market

Southwark Street

eet

ough High Str Bor London Bridge Rail Station

Pool Re TERRORISM FREQUENCY Report 07 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

MANCHESTER ARENA Links to sources of further information: ATTACK, 22 MAY 2017 Action Counters Terrorism (ACT) A study into the impact on small businesses. Knowing how to recognise and report suspicious activity is important in keeping safe from terrorism. Read more on the ACT website, which offers advice and guidance on how to report concerns including both physical and online activity. David Evans 43% of businesses interviewed had no Founder, The Campaign Company continuity, disaster recovery or crisis plan in place. Small businesses, who lacked the resilience of larger organisations, found the consequences were profound, and few had Centre for the Protection of National Pool Re undertook a case study (1) into any crisis evaluation processes in place. Even Infrastructure (CPNI) the impact of the Manchester Arena attack fewer had had conversations about terrorism Their website offers a wide range of advice, not just on small businesses in the area. The study insurance cover. In some cases, businesses for national infrastructure assets. Read more on their also investigated what, if any, protective reported that they thought they would be guidance for disrupting hostile reconnaissance on measures in terms of insurance, businesses covered by their existing insurance but found their website. were aware of. Research revealed that some out post-event from their insurer that this was businesses suffered significant disruption, not the case. The Federation of Small and the attack gave rise to several key Businesses (FSB) suggested there was a gap considerations for insurers. between expectations and reality. An article produced by First Voice of Business, stated Cross-sector Safety and Security There were 19 businesses caught within that “Although SMEs, with tight budgets and Communications the inner cordon following the attack and small cash reserves, would be hard hit by the A partnership between law enforcement agencies, widespread closures affected businesses for disruption to business in the aftermath of a local and national government organisations and at least two days. Businesses that were more terrorist attack, few take up insurance cover,” private sector businesses. Register your business exposed to the Arena saw a reduction in their further suggesting that take-up of terrorism to receive security updates on the CSSC website. trade as a result of the Arena closing for several insurance was approximately 10% – reducing months. Those who derived income from the among businesses outside London, who Arena saw footfall and trade decrease. Indeed, may consider it a low risk or not a priority some reported that the level of business was on a tight budget. still not back to pre-attack levels due to a loss The UK threat levels are set by MI5 and of attraction and footfall. There were examples the Joint Terrorism Analysis Centre, JTAC Read more about them and international terrorism reported of unforeseen costs incurred and via the MI5 website. operational disruption. The need to support Conclusion staff both emotionally and practically following The recent passing of the Counter-Terrorism the attack was underlined, with concerns in and Border Security Bill 2018 will now enable some cases only becoming apparent weeks Pool Re to extend terrorism cover to include afterwards. Business interruption did not affect non-damage business interruption losses London Protect businesses exclusively, there was also evidence resulting from acts of terrorism. Run by the , London Protect of implications for subcontractors and other publishes monthly newsletters to provide regular parties reliant on the businesses. updates advising and informing businesses in the London region of relevant protective security One of the most striking results of the study information. Follow them on Twitter. revealed that the first 48 hours following an attack are decisive for businesses. The Arena “WE HAVE WORKED attack caused significant widespread disruption VERY CLOSELY WITH THE and those inside the cordon were closed GOVERNMENT, AND WITH completely for the period of initial investigations. See It, Say It, Sorted Businesses expressed that support needed to THE INDUSTRY SINCE IT A campaign to encourage train passengers and be quick, direct, well-designed and sensitively OPTED TO MUTUALISE station visitors to report any unusual items or activity. Text 61016 or call 0800 40 50 40 to help keep the delivered to meet their needs. Small businesses THE NON-DAMAGE RISK UK’s rail network safe. operating on tight margins in fiercely competitive retail or catering sectors described how a few IN 2017. PERHAPS MORE days’ denial of access could ‘send them under’. IMPORTANTLY, WE ARE In the face of this there was no scope for ALREADY COLLABORATING anything other than the urgency of reopening. WITH BUSINESS Run, Hide, Tell Information and resources to stay safe if you are FEDERATIONS, LOCAL caught up in a firearms and weapons incident in AUTHORITIES, BROKERS the UK. AND OUR MEMBER INSURERS, ALL OF WHOM NEED TO HAVE OPEN CONVERSATIONS National Cyber Security Centre (NCSC) WITH THEIR CUSTOMERS A part of GCHQ, the NCSC was set up to help protect ABOUT JUST HOW MUCH our critical services from cyber attacks, manage major incidents, and improve the underlying security of the MAY DEPEND ON HAVING UK Internet through technological improvement and (1) Case study THIS COVER IF THE WORST advice to citizens and organisations. Their vision is Pool Re commissioned The Campaign SHOULD HAPPEN.” to help make the UK the safest place to live and do Company (TCC), who spoke to over 50 business online. businesses who were directly or indirectly JULIAN ENOIZI, affected by the Manchester Arena attack. CHIEF EXECUTIVE

Pool Re TERRORISM FREQUENCY Report 08 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM OCT/18-JAN/19 A REVIEW OF SIGNIFICANT INCIDENTS

Camilla Scrimgeour Senior Analyst

Frequency of global terrorism

Total number 525 of attacks Total number 43 of countries

Key Europe 9 Latin America and the Caribbean 24 Middle East and North Africa 123 North America 0 Russia and CIS States 4 South Asia 188 South East Asia 37 South Pacific 1 Sub-Saharan Africa 139

Pool Re TERRORISM FREQUENCY Report 09 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

Q4/18-Q1/19 A review of significant incidents Continued

Severity of attacks There were 525 attacks between 1 October 2017 and 31 January 2019, causing at least 2,152 deaths and 2,954 injuries. The most lethal attack took place in Maidan Shar in Afghanistan. There were nine attacks in Europe, two of which took place in the United Kingdom.

October November December 2018 2018 2018 1 October 15 Cologne, Germany IED attack Killed: 0, Injured: 2

2 November 9 Melbourne, Australia Fatalities Bladed attack Killed: 1, 3 Injured: 2 December 11 Strasbourg, France Firearms attack Killed: 3, Injured: 13

Injuries

Source: TRAC Terrorism Database

Pool Re TERRORISM FREQUENCY Report 10 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

UK attacks and events Global attacks and events

1. December 31 3. October 15 5. December 11 Manchester, United Kingdom Cologne, Germany Strasbourg, France

Bladed attack IED attack Firearms attack Killed: 0, injured: 3 Killed: 0, injured: 2 Killed: 5, injured: 11

A 25-year-old man stabbed two civilians and a A Syrian man ignited an incendiary device in A lone gunman fired on crowds visiting the police officer at Victoria Station in Manchester. a fast-food restaurant in Cologne’s main train Grande Ile Christmas Market in Strasbourg, He reportedly shouted Islamist slogans during station, injuring at least one person. He then fled killing five people and injuring 11 more. The his arrest, and police are treating the attack to a nearby pharmacy, taking a woman hostage. attacker exchanged fire with responding security as terrorism. The victims were all hospitalised Police evacuated the train station and attempted forces, wounding one soldier, before hijacking but did not suffer life-threatening injuries. to negotiate with the suspect, but after a taxi and escaping the city centre. French The attacker is reportedly a Somali national two-hours stormed the pharmacy, shooting him and German authorities deployed additional who had moved to the UK from the Netherlands and freeing the hostage. Train services across resources to the area and closed off several as an adolescent. The police believe the man West Germany were disrupted by the incident. locations in the city, including the European acted alone. Parliament. The suspect was later recognised Unconfirmed reports indicate that the suspect by a police patrol in Strasbourg, fired on Individual attackers employing bladed weapons claimed to be a member of Daesh. As with officers and was shot and killed. against civilians in crowded places is consistent previous attacks in Europe, German authorities with the methodologies and targeting confirmed that he may have had Islamist In common with many other French terrorists, propagated by Daesh and its supporters in sympathies, but said there was no evidence the suspect had a history of violent criminality, the West. Victoria Station was cordoned off tying him to terrorism organisations. Common and had been flagged by authorities as a for the investigation but was reopened to to many other violent European Islamists, potential terror risk following his association the public the following morning. No property he also allegedly suffered from mental health with extremists while in prison. The police damage is believed to have occurred. problems and had a history of petty criminality. had raided his residence earlier that day in an Nonetheless, the incident underscores the Police also said that the suspect intended attempt to arrest him for suspected involvement realistic probability of terrorists successfully to cause an explosion using pressurised in an armed robbery, which may have attacking targets outside London. gas canisters. Other terrorists in Europe have precipitated the attack. Firearms, grenades attempted to employ similar methodologies and a video of the attacker pledging allegiance in recent years, although none successfully. to Daesh were found in his flat, indicating that 2. January 19 he may have undertaken attack planning prior Derry, Northern Ireland to the police raid. 4. November 9 VBIED attack Melbourne, Australia Festive locations are regularly identified as potential targets in Islamist extremist propaganda, A vehicle-borne improvised explosive device Bladed attack and Christmas markets in Europe have been (VBIED) exploded outside a courthouse in Derry. Killed: 1, injured: 2 successfully attacked by terrorists before. The The vehicle containing the device was reportedly weapon was reportedly obtained through the hijacked from the driver by armed men around A Somali-born Australian citizen set fire to his car attacker’s criminal connections. While firearms 1800. An hour and a half later, the VBIED was in Melbourne’s central business district before have been used in previous attacks in Great parked outside the courthouse on Bishop Street. attacking pedestrians with a knife. He wounded Britain, such as the murder of Jo Cox MP, they Shortly after, a warning was called into the three people, one of whom subsequently died, have traditionally proven more difficult to acquire West Midlands Samaritans, who passed the before being shot and killed by police. The than on the continent. Although they aspire information onto , who, in suspect was known to the Australian security to use firearms in an attack, in the UK, Islamist turn, informed the Northern Irish police (PSNI). service and had his passport confiscated in 2015 extremists are currently more likely to employ Nearby buildings were evacuated before the due to suspicions that he intended to travel to low sophistication attack methods. device detonated at 20:09. The vehicle was Syria to join Daesh. Daesh claimed responsibility parked outside the security perimeter of the for the attack via its Amaq news agency. courthouse, and the blast caused little damage to either the courthouse or surrounding buildings. This attack underscores the significant threat, It caused no injuries. common to Australia and Britain, posed by Daesh-sympathisers prevented from travelling The PSNI described the device as “crude” and abroad. Daesh’s claim is assessed to have been “very unstable” and was reportedly constructed opportunistic, and the group’s leadership is using gas canisters. Plots in Europe frequently unlikely to have been aware of the suspect prior feature the use of commercially-available gas to the attack. This is consistent with previous cylinders, however, using them to generate an Islamist attacks in the country since 2014, effective blast is difficult. Dissident Republican all eight of which were conducted by ‘inspired’ groups are believed to retain the capability to individuals. Australia remains an active build sophisticated explosive devices, and some participant in the coalition action against Daesh, continue to target figures of authority. The and future attacks by radicalised individuals in targeting of a courthouse is consistent with this; the country are likely. however, the telephoned warning suggests the attackers did not intend to cause loss of life. Nonetheless, the incident represented the first use of VBIEDs by dissident Republicans in several years. Further such attacks are possible in Northern Ireland, and the threat level for Northern Ireland-related terrorism (NIRT) remains at SEVERE (meaning an attack is highly likely). However, the NIRT threat level to Great Britain is unchanged at MODERATE, meaning an attack Links to sources of further information: on the mainland, while possible, is unlikely. Should the threat level for Great Britain be raised, Terrorism Threat & Mitigation Report it could be an indication of increased capabilities January to July 2017 of dissident Republicans on the mainland. Terrorism in the United Kingdom and Europe

Pool Re TERRORISM FREQUENCY Report 11 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM TERRORISM HAS INCREASED, IT MOVES FASTER, AND IT IS HARDER TO DETECT

Sir Mark Rowley My successor, Neil Basu has spoken very The old insurance methodology and original Sir Mark Rowley QPM, RUSI Fellow, recently about the continuing pace of the constitution of Pool Re was focused on the Chair and NED was until March 2018 threats faced with 18 attacks now foiled since large-scale high impact attacks against high National Head of Counter Terrorism Westminster and the continuing concerns profile targets that were at the core of Policing at Scotland Yard. across Islamist and extreme right-wing terror yesterday’s threat, where high-value damage groups. Indeed, incidents and arrests across was the biggest risk, and major businesses the Europe and the Manchester New Year’s Eve likely victims. Quite rightly, the increasing risk of attack evidence the continuing challenges. attacks on soft targets, where small businesses The private sector has to play a bigger role Further, the attack in Londonderry shows that operate (and which are much more sensitive than ever as part of a whole society effort to there remains Ireland-related terror threats. to short-term business interruption), has led counter today’s terrorism threat. I conveyed Preventing all attacks year after year is an Pool Re to propose extensions to its cover this message when delivering the ‘Colin impossible objective but it nevertheless remains to close the protection gap by including NDBI Cramphorn Memorial Lecture’ last year the aspiration of police and security agencies. in its scheme. Once the legislation is approved at the Policy Exchange. Today’s terrorism There were many dimensions of exceptionality all business, in particular small businesses, threat is fundamentally different to previous illustrated in the events mentioned above, which buy terrorism insurance will improve iterations. I am therefore pleased to be which are described in the panel opposite. their resilience to terrorist attacks. helping Pool Re review both its strategy against changing threats, and the new The consequences for business I finish by explaining why I believe there is real opportunities to close the current insurance are profound potential for a more proactive ‘risk reduction’ protection gaps, such as the ‘non-damage There are now less predictable and more rapidly approach where police, security services business interruption’ (NBDI) currently being evolving terrorist methodologies. Right-wing and the government utilise the leverage of considered by Parliament. terror groups are growing in the West and Pool Re and the insurance industry. Our threat are starting to connect, and with the history assessment models give a reasonable view The sustained intensity scale and pace of the of Islamist groups fragmenting and reshaping as to the likelihood of attacks, but I do believe threat is greater than seen for decades and regularly one cannot expect a stable picture. they are close to the upper limit of what indeed the threat level has been at SEVERE Across Europe, including in the UK, we should can be predicted of malign secretive actors. for over four years – the longest sustained expect the threat to remain at current levels from However, there are good, evidence-based period at this heightened state for decades. both Islamist and right-wing terror groups. The standards as to what works in relation to This could lead to the erroneous assumption military damage done to Daesh’s ability to run a protective measures and preparatory resilience. of simply more of the same. In reality we have ‘HQ’ will mean low-tech attack plans will remain Increased codification of these and access to to confront a dramatically changed and rapidly most common and we should not rule out them combined with premium-based incentives, evolving set of threats. I will illustrate this, draw the repetition in the West of methodologies that has the potential to better protect businesses, the threads together and then look at what have been seen in theatre such as use of drones reduce insurance costs and contribute to this means for insurance and risk management. and low sophistication chemical weapons. the resilience of the UK to counter terrorism.

Last year I stepped down after four extraordinary For all businesses there are a wider set of years leading the UK’s counter terror policing. threats and vulnerabilities to take into account, My tenure was bookended by the Daesh that require a more agile approach – one leader declaring the so-called Caliphate on where perhaps vigilance and resilience are my second day, and then on my penultimate of increasing importance alongside classic day, I instigated the investigation into the protective measures, such as hard landscaping Russian nerve agent attack in Salisbury. It was and bollards to protect against vehicles. my privilege to lead ten thousand officers and Vigilance provides a unique opportunity to police staff, who worked hand in glove with prevent attacks at the reconnaissance stage MI5 and other agencies during this period and and we have regularly seen even low complexity did extraordinary things to keep the public safe. attacks preceded by such preparations. Our strength drew heavily on learning from five We shouldn’t forget the risk from employees – The continuing pace decades of domestic terrorism but the pace of research shows that most family and friends of the change in threats was still a major challenge. attackers notice behaviour changes in advance. of the threats faced The resilience that comes from planning and Our efforts in 2017 were the most exceptional practice has the potential to significantly mitigate Attacks now foiled in decades – it was the best of years in so much the impact of any attack. In summary, all since Westminster, as we were able to prevent 14 late-stage attack sectors need to step up to these new challenges 22 March 2017 plans, but it was also the worst of years, with 36 individually and collectively such as investing in innocent citizens killed in five atrocious attacks. greater information exchange and collaboration Those deaths will always weigh heavily on me. with police and government. 18

Pool Re TERRORISM FREQUENCY Report 12 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

Connectivity Methodology I cannot recall a case where online material It has been widely commented upon that and/or communication were not a factor. terrorists are no longer focused solely on the One extraordinary case started in early 2015, high impact attacks. The ambition to conduct when I was briefed by detectives that a plot aviation or major marauding firearms attacks was surfacing where a 14-year-old in Blackburn continues but terror groups have also worked was directing young men in Melbourne, Australia hard to lower the bar of entry through to carry out an attack on Anzac Day. It was encouragement of simple low-tech attacks initially hard to believe this could be more than on soft targets that can still have a global teenage mischief, but the amassing evidence impact through exploitation of social media of their online introduction by a fighter in Syria, and the 24-hour global news cycle. the nature of the gruesome communications, and the extraordinarily violent instructions to Reach the Australian young men, was compelling. The Connectivity has enabled global terror exceptional relations with the Australian police networks to reach into communities like never led to a coordinated operation across the globe before. We saw the ability of Daesh to inspire and successful prosecutions in both countries. the vulnerable, including school-age boys Only a few years earlier, this new reality would and girls, to travel to the so-called Caliphate have seemed the stuff of Hollywood – too as well as to inspire them to commit attacks far-fetched to be believable. This showed that, in the UK. Fifteen years ago, if you were not only can terror groups direct attacks and angry and looking for a cause, terrorism inspire others through propaganda from afar, was inaccessible – getting to a training but that an individual can easily access camp in Afghanistan and planning an sophisticated propaganda material that will attack on an aeroplane almost unattainable. propel them towards violent ideology and Now, the vulnerable can be persuaded present them with ideas for targets and detailed to be a determined killer whilst barely instructions on how to conduct an attack. leaving their bedroom.

Sources Volatility Whilst most of cases were Daesh related; We have seen terrorists accelerate very five were extreme rightwing, and a number quickly towards attacks. You will have heard were linked to National Action, a home-grown police and MI5 talk about 20,000 former neo-Nazi white-supremacist terror group subjects of interest on top of around 3,000 proscribed by the Home Secretary in late 2016. others under different levels of investigation Khalid Ali, sentenced to 40 years, was a Taliban at one time. We have seen cases where bomb-maker who had returned to the UK from many years after being placed in this cohort, Afghanistan to launch attacks here and of changes in their life prompted a rapid course, the Manchester bombing has its roots acceleration towards launching an attack. in Libyan Islamist groups.

Conclusion So, in summary, today’s terrorism threat is wholly different to that of the earlier days of al Qaeda or the IRA – those were secret networks of terror cells operating as invisibly as they could. Now we see open-source terror cults reaching into our communities and radicalising through propaganda and the use of simple attack methods such as cars and knives. And we mustn’t forget that right-wing terror groups and their extremist apologists are also using these tactics.

Pool Re TERRORISM FREQUENCY Report 13 02 Introduction 08 Manchester Arena attack – a study into the 10 Severity of attacks impact on small businesses

04 Non-Damage Business Interruption 09 Oct/18-Jan/19 – a review of 12 The increase of terrorism – article by significant incidents Sir Mark Rowley QPM

OCT/18-JAN/19 SIGNIFICANT INCIDENTS FACTS SNAPSHOT

Region of attacks Global attack methodology Global attack target types

200 250 300

200 250 150 200 150 100 150 100 100 50 50 50

0 0 0 NI Asia North Africa South South South olice ID ID Paci c Middle N Europe ivilian laces eicle ilitar and the laded America roert East Asia East Asia mbolic East and Firearms roded Caribbean CIS States Russia and losives overnment North Africa Sub-Saharan Latin America The frequency of attacks was greatest Firearms were the most commonly used Police, Military and Government targets in South Asia in the reporting period, weapon in attacks, followed by explosives. remain the most frequently attacked sector, attributable mostly to Islamist extremism. followed by crowded places. About us NEXT STEPS: Pool Re is the UK’s terrorism reinsurance pool, providing effective protection for the UK economy and underwriting over £2 trillion of exposure to terrorism risk in commercial property across the UK mainland. Through its Terrorism Research and Analysis Centre (TRAC), Pool Re aims to improve the risk awareness of current and emerging terrorism perils for Members and other key stakeholders by highlighting the availability of terrorism cover for all UK mainland Commercial Insurance customers.

About this Terrorism Frequency Report The Terrorism Frequency Report provides an overview of significant acts of terrorism within the previous quarter as well as identifying key trends and themes that we believe are relevant to the terrorism (re)insurance market. Our methodology is based on the TRAC Terrorism Database, analysis of the wide range of publicly available open source material and collaboration with subject matter experts.

Disclaimer This document has been prepared by Pool Discover more Pool Re Terrorism Threat and Mitigation Reinsurance Company Limited (Pool Re). While Go online to discover more about us, our Report 2018: this information has been prepared in good faith, work, methodology and to download our www.tmr.poolre.co.uk no representation or warranty, expressed or latest publications. implied, is or will be made and no responsibility or liability is or will be accepted by Pool Re, or by any of its respective directors, officers, Pool Re hails Government action to close the employees or agents in relation to the accuracy Email terrorism insurance gap: or completeness of this document and any [email protected] www.poolre.co.uk/pool-re-hails-government- such liability is expressly disclaimed. action-close-terrorism-insurance-gap/ Call In particular, but without limitation, no +44 (0)20 7337 7170 representation or warranty is given as to Pool Re returns contingency cover against the reasonableness of future suggestions LinkedIn terrorist acts to the commercial reinsurance contained in this document. www.linkedin.com/company/1795229 market: www.poolre.co.uk/pool-re-returns-contingency- Pool Re is a company limited by guarantee Twitter cover-terrorist-acts-commercial-reinsurance- and registered in England and Wales under @poolreinsurance market/ company no. 02798901 having its registered office at Hanover House, 14 Hanover Square, Address London W1S 1HP. Pool Reinsurance Company Limited Equitable House Pool Re sponsored Airey Neave Book Prize © Pool Reinsurance Company Limited 2018 47 King William Street awarded to Christopher Andrew’s The London Secret World: A History of Intelligence: EC4R 9AF www.poolre.co.uk/christopher-andrews-secret- world-history-intelligence-wins-airey-neave- book-prize/