The Special Risks Report

April 2019

casework 2 global kidnapping trends 3 africa 4 americas 5 asia and pacific 6 middle east and north africa 7 focus on china 8 The Special Risks Report Casework January - March 2019

Location of cases Breakdown of cases

30% Threat 3% Hostage 26% Threat extortion 3% International problem 21% Kidnap 2% Missing person 8% Cyber 2% Bomb Number of cases per country 5% Detention

In the event of a kidnap or another special risks crisis covered by Hiscox, including a detention, extortion or threat, clients will benefit from Control Risks’ services as part of their insurance policy.

Since its foundation in 1975, Control Risks has advised clients on the resolution of more than 3,570 cases of kidnap and other special risks crises in 144 countries, with more than 51,900 person-days aggregate duration. Control Risks has a full time team of Response Consultants available for immediate deployment in response to a covered crisis anywhere in the world as well as a team of ‘handholders’ located at Control Risks’ 37 offices worldwide. For more information about Control Risks please visit:www.controlrisks.com

Hiscox is the world’s largest provider of specialist kidnap, detention and extortion insurance. Hiscox clients include multinational companies operating in high risk regions of the world, key executives working in commercially sensitive positions and individuals whose wealth or fame may attract the attention of criminals. Hiscox kidnap and ransom underwriters - based in Guernsey, France, Germany, the US, and at Lloyds of London - are the most experienced in the field. Our knowledge of the sector enables us to make quick decisions on cover, no matter how unusual the request.

2 The Special Risks Report Global Kidnapping Trends January - March 2019

Key trends: open source Perpetrator types

Incidents involving local and foreign nationals 100 %

80% 17%

3% 2% 60% 32% 2% Europe & CIS

MENA Asia Paciﬁc 8% 29% 1% 40%

Americas 39% Sub-Saharan Africa 20% 22% Region

Local nationals Foreign nationals 0% a

MENA Americas

Asia and EuropePaciﬁc and CIS ub-Saharan Afric S

53% 92% 96% 29 Criminal of abductions of abductions of global victims resolved in less sectors happened in were local affected transit than 7 days nationals Islamist extremist

Other armed groups

Control Risks maintains a dedicated team of special risks analysts who track kidnap-for-ransom and other extortive crime trends around the world. The five analysts carry out research in multiple languages, including English, French, Spanish, German, Portuguese, Arabic and Hebrew. They maintain a database of cases believed to be the largest commercial database of its kind, currently containing details of more than 56,800 kidnaps for ransom. The team provides analytical support to deployed consultants on live kidnap-for-ransom cases. Using their understanding of local kidnap dynamics they are able to help predict the likely perpetrators of a specific incident, their motivations for carrying out the abduction as well as providing tactical information about the average length of cases and typical concessions required for release. They also write all kidnap analysis on an online platform brought to assureds by Hiscox called Global Risk Data. In addition, the team is able to provide bespoke kidnap consulting analysis tailored to clients’ individual exposures.

3 The Special Risks Report Africa

KEY DEVELOPMENTS

• The high-profile kidnap of a US national in westernUganda near the border with Congo (DRC) serves as a reminder of the capability and intent of Congo (DRC)-based armed groups and criminals to conduct cross-border kidnaps

• The expansion of rural kidnapping by dahalo bandits continues in many of Madagascar’s regions, with Betsiboka Region particularly affected in the last quarter

• The deteriorating security situation in northern Nigeria has produced a spike in the kidnapping rates in Zamfara and Katsina states, and several kidnaps of foreigners have been recorded

The abduction of a US tourist and her local guide on 2 April highlighted the kidnapping-for-ransom threat along Uganda’s border with Congo (DRC). Four armed men stopped a car carrying the victims and two Canadian tourists in Queen Elizabeth National Park. The latter were left behind by the kidnappers. The two victims were held for five days before being released, reportedly following a negotiated settlement. Initial media reports suggested a USD 500,000 ransom demand was made, but there was no mention of a settlement amount. Further kidnap attempts on the Ugandan side of the shared border are likely, given that kidnapping-for-ransom is a central revenue stream for armed groups operating in the province of North Kivu. The Ugandan side is frequented by large numbers of foreign tourists and many international NGOs are also present, both representing attractive targets for kidnappers.

In Madagascar, a spate of abductions by armed bandits since the beginning of the year demonstrated the growing threat of kidnapping in Betsiboka Region, with the trend already well-established in neighbouring regions. Control Risks has recorded several multi-victim kidnaps in Betsiboka Region since the beginning of 2019, including an incident in mid-February in which armed dahalo bandits abducted four locals in Tsaratanana. Dahalo bandits previously abducted a woman of South Asian descent in the town, as well as a group of mine workers in the wider area in July 2018. Dahalo bandits continue to present the biggest threat to foreign personnel or tourists during road movements in rural and semi-rural areas. They use roadside ambushes as a favoured tactic, and there is potential for armed robberies to evolve into kidnaps if the bandits consider the occupants of a vehicle likely to fetch a cash ransom.

A series of kidnaps of foreign nationals in northern Nigeria occurred amid an increase in incidents in several states. Kidnapping rates have been rising steadily in the states of the Middle Belt and northern Nigeria since 2017, driven by increased levels of banditry and inter- communal strife. This was particularly the case in neighbouring Katsina and Zamfara states, which in 2018 accounted for 10% of all kidnaps in the country, according to our data. In the past six months, Control Risks has recorded kidnaps of Lebanese, German and Chinese nationals in northern Nigeria. Foreign nationals remain highly visible in urban and rural areas of northern Nigeria, with kidnapping gangs able to rely on local intelligence to locate potential victims and plan abductions. Most of the kidnaps of foreigners recorded in northern Nigeria in the past year occurred when the victims were at an outdoor worksite – including road works, quarries and construction sites – or in transit. The presence of armed bandits in many areas of northern Nigeria and the relative impunity with which they operate ensures that the threat of kidnapping will persist.

53% 92% 15 of abductions of abductions sectors happened in resolved in less affected transit than 7 days

4 The Special Risks Report Americas

KEY DEVELOPMENTS

• Nuevo Leon will remain one of the worst affected states in Mexico for kidnapping-for-ransom

• Despite efforts by authorities, tiger kidnapping will remain a threat in Brazil’s Minas Gerais state

• Rise in telephone extortion incidents highlights ongoing threat to Chinese nationals in the US

Nuevo Leon remains one of Mexico’s kidnapping-for-ransom hotspots, accounting for over 10% of all incidents recorded by Control Risks in Mexico in 2018. In 2018, 26 incidents were recorded in the state, a fall from the 35 incidents reported in 2017, according to the National System for Public Security (SNSP). However, the majority of incidents go unreported to the authorities and the actual figure is likely to be much higher. Due to the prevalence of the main drivers of kidnapping-for-ransom and the permissive security environment in the state, Nuevo Leon will continue to be a flashpoint for the crime in Mexico.

The abduction of an 18-year-old woman on 24 March underscored the HIGH kidnapping risk in the state. Kidnappers abducted the victim from her home, demonstrating the targeted nature of the crime. They demanded a ransom payment of MXN 200,000 (USD 10,500) for her safe release. The victim was found tied to a tree on the side of a nearby road in the early hours of 25 March. It was unknown if a ransom payment had been made.

Despite numerous arrests of members of three different groups involved in tiger kidnaps in Brazil’s Minas Gerais state, the threat will continue to grow as criminals look to capitalise on the lucrative nature of the crime. Groups typically target bank managers, though incidents have been recorded in which the perpetrators have targeted bank treasurers, petrol (gas) station managers and business owners. Any business with large sums of money or valuables onsite is a potential target for gangs engaging in the crime.

According to Control Risks’ records, Minas Gerais state accounted for more than twice the number of incidents than any other state in the country in 2018, though incidents were also recorded in Sao Paulo, Pernambuco, Bahia, Maranhao and Piaui. The crime will continue to pose a threat in the 12-month outlook, despite the authorities making occasional arrests and sporadically disbanding groups engaging in the crime, as previous arrests have not resulted in a significant reduction in the number of incidents in the region.

On 28 March, the Federal Bureau of Investigation (FBI) posted a warning highlighting the ongoing threat stemming from the “Chinese Embassy Scam”, which has affected victims across the US. Between December 2017 and February 2019, the FBI received over 350 complaints about the scam, stating that the victims had lost a total of USD 40m. The average loss per incident was a reported USD 150,000 and the highest amount lost in a single incident was USD 2.8m.

The crime involves perpetrators, many based in China, contacting the victim by telephone and convincing them that they are implicated in a crime and must pay a fine to the caller. Some cases have evolved into virtual kidnaps, in which the extortionists claim to have kidnapped a loved one of the victim and demand a ransom payment for their release. Many victims reportedly had names of Asian origin and were students visiting from China who had seemingly previously been victims of data breaches at organisations based in the US and China.

of abductions of abductions sectors happened in resolved in less affected transit than 7 days

5 The Special Risks Report Asia and Pacific

KEY DEVELOPMENTS

• The kidnap risk in Malaysia, where the crime regularly affects businesspeople, employees and their families, will remain MEDIUM

• Reports of express kidnapping in India will continue to increase as reliance on electronic banking rises and public awareness of the threat remains low

• While few foreign nationals are targeted annually in Afghanistan, they will remain attractive targets for both criminal and militant groups, which can hold victims for long durations

The abduction of a local businessman in Johor state, Malaysia, in late January underscored the MEDIUM kidnap risk in the country. According to local media outlets, the victim was jogging with a friend when the abduction took place. The kidnappers demanded USD 500,000 and an additional MYR 300,000 (USD 73,000) from the victim’s family. The kidnappers released the victim on 1 February after the alleged payment of MYR 1m (USD 244,000). Since the 1961 Kidnapping Act makes all ransom payments illegal, it is highly likely that the negotiations were conducted under police supervision. Officers later arrested 16 suspects.

Cases such as this occur relatively frequently in urban areas, where financially motivated criminal groups of varying capability operate. Foreign nationals also sporadically fall victim to the crime. These victims are often nationals of Asian countries who are targeted by compatriots.

Reports of express kidnapping in India will continue to increase throughout 2019 as the country moves towards greater reliance on electronic banking and public awareness of the crime remains low. In one example, local media outlets on 18 March reported the 25th express kidnap recorded in 2019 along the Gurugram-Faridabad highway (Haryana state). The victim, like many others, was targeted when he entered a shared taxi at a pick-up point along the highway. Thinking that the other passengers were commuters, the victim willingly entered the vehicle. The gang stole his wallet and other valuables before driving him to a cash point (automated teller machine – ATM) to withdraw INR 8,000 (USD 115), which secured his release. The incidents drew attention to this particular road, but the use of shared taxis as cover for carrying out express kidnaps is a common tactic, and commuters in all major cities should be vigilant.

The Indian Ministry of Foreign Affairs on 18 March announced the release of one of the seven Indian engineers kidnapped, reportedly by the Taliban, in May 2017 in Baghlan province, Afghanistan. The other six victims remain in captivity. According to our records, almost 98% of the victims kidnapped in Afghanistan in 2018 were local nationals. However, the few foreign nationals who operate in the country remain attractive targets for both financially motivated criminal groups and militant groups. Foreign nationals are likely to yield higher financial ransom payments than local nationals and provide opportunities for political concessions. Our records indicate that 70% of incidents involving foreigners since 2014 occurred between March and October, with an additional 7% in November. During these warmer months it is likely easier for kidnappers to access remote safe havens where victims can be held.

of abductions of abductions sectors happened in resolved in less affected transit than 7 days

6 The Special Risks Report Middle East and North Africa

KEY DEVELOPMENTS

• Armed clashes will raise the risk of detention and kidnapping in Libya’s Tripoli district, while kidnaps along Tripoli-Tunisia road are likely to continue

• Islamic State (IS) will continue to pose a kidnapping threat in Iraq – both in al Anbar and Nineveh provinces, and in some western parts of Salahuddin and Kirkuk – mainly to NGOs and other organisations working on reconstruction projects

• The recent release of a US national underscores the involvement of multiple parties in resolving complex kidnaps in Yemen

The advance on Tripoli, Libya, by Libyan National Army (LNA) forces loyal to General Khalifa Hafter and the Tobruk government in April resulted in clashes on the city’s outskirts. Continued fighting and broader insecurity will lead to an increase in the kidnapping and detention threat in the city. Criminal groups are likely to be emboldened to carry out kidnaps-for-ransom as neighbourhood militias are called to the front lines. Meanwhile, the impact of fighting on resources and the local economy could result in an increase in low-level kidnapping as living conditions deteriorate.

The kidnap of 14 Tunisian nationals on 17 February by an armed group on the coastal road between Tripoli and the Tunisian border demonstrates the continued intent and capability of groups based along the axis. The demand for the release of one of the group held in Tunisia highlights the potential for non-financial concessions in the local context. The kidnappers released the 14 victims after three days, though the delivery of the concession was unconfirmed. The towns along the coastal road are controlled by a patchwork of militias presenting varying levels of risk to multinational operations. Criminal groups are also present.

According to February statements by US and Iraqi officials, at least 1,000 Islamic State (IS) militants have fled the Syrian village of Baghouz (Deir Al Zor province), the group’s last enclave in Syria, and crossed the border into federal Iraq’s northern governorates, where they reportedly aim to use kidnapping-for-ransom and other extortive tactics to finance the group’s survival. This development underscores the EXTREME kidnap risk in Anbar and Nineveh, as well as in some western parts of Salahuddin and Kirkuk. Kidnapping will continue to pose a threat to organisations with operations in these areas, particularly to NGOs and companies working on the reconstruction of areas formerly under IS control.

US President Donald Trump on 25 February announced the release of a US national who was kidnapped in Yemen’s capital Sanaa (Sanaa governorate) 17 months ago. Trump said that he appreciated “the support of the UAE in bringing the victim home”. According to media outlets, the victim was held captive by a financially motivated criminal group in Marib governorate. He was reportedly freed in a rescue operation led by the UAE in February, highlighting the involvement of multiple parties in resolving complex kidnaps in Yemen.

The few foreigners who remain in Yemen tend to employ security measures that deter most perpetrators from targeting them. Nevertheless, both financially motivated criminal groups and militant groups consider foreign nationals highly attractive targets, as they are likely to yield higher ransom payments than local nationals.

of abductions of abductions sectors happened in resolved in less affected transit than 7 days

7 The Special Risks Report Focus on China

Preparing to do business in China The National People’s Congress (NPC) on 15 March passed a new foreign investment law that emphasises the promotion and protection of foreign investment in the People’s Republic of China. The law, which grants foreign companies equal standing with state-owned businesses, signals the country’s latest round of comprehensive and high-level opening-up. China presents a range of investment opportunities for foreign companies, but the business environment can differ substantially from other environments where companies may have more experience, and includes a range of unique but manageable extortive crime threats.

Commercial detention The termination of a business partnership, the renegotiation of employees’ packages and the investigation of malpractice, among myriad other issues, can result in commercial detention, or “boss-napping” – the act of taking hostage members of the management team of an organisation. This form of detention is very rarely reported, as public knowledge of such incidents can result in financial losses or adverse reputational consequences. However, Control Risks is aware that these incidents do happen in China.

Control Risks’ records reveal that “boss-napping” can affect both the local and foreign personnel of multinational companies operating in China, and those who have the authority to make budget and/or personnel-related decisions are more likely to be targeted. Incidents can take place both at the company premises or at supposedly neutral locations like hotels. In some cases, envoys who have been sent to assist at a later stage in negotiations have also been detained, compounding the issue. In incidents involving foreign nationals, the “boss-nappers” have sometimes withheld the victims’ passports to impede their escape until an agreement is reached. Most incidents last between one and two days, though in some rare cases they can extend beyond one week. Nearly all cases are resolved following a series of negotiations. Although threats to harm hostages in these negotiations are common, actual violence is rare.

It is important to note that police are rarely able to intervene in incidents of boss-napping. Public security in China is broken into two areas: minshi and xingshi, translated loosely as civil and criminal issues, respectively. Police generally consider boss-napping incidents to be a minshi issue, since the root cause is often a contractual or financial dispute. Police also rely on the company to maintain “social harmony”, which typically means it is the responsibility of the company to prevent public disturbances caused by commercial or business disputes.

Boss-napping and extortive threats are often accompanied by significant interruptions to a company’s supply chain and operations. While incidents remain typically non-violent, the impact of business continuity interruption is often a more significant and longer-term challenge.

Workplace threat and threat extortion According to Control Risks’ records, workplace threat and threat extortion can affect multinational companies in China. The most common issues to affect multinational companies often follow the termination of an employee’s contract (as above with commercial detention) or contractual disputes. The latter often arise following a disagreement over fulfilment of the terms of a contract (including payment) or when a contract is put out to tender for renewal. In some cases, individuals threaten to cause physical or financial harm if the contract is awarded to another party or if there is a perception that the terms of a contract are not enacted. On rare occasions these threats can result in actual violence. It has become increasingly common for individuals to claim they have evidence of activities that are not compliant with Chinese laws and regulations, and threaten to expose the company to Chinese regulatory investigations.

Extortion of employees In addition to workplace threat and threat extortions levelled at a company, employees in China can experience particular types of extortion. Virtual kidnapping, for example, regularly affects local employees and foreign nationals with a firm grasp of Mandarin and other local languages. Virtual kidnappers in China are not yet known to carry out the scam in English.

In these cases, the extortionists usually contact a potential target via telephone and convince them that a loved one has been kidnapped-for-ransom and that they must pay a ransom. In reality, no abduction has taken place. In the most sophisticated cases, the extortionists gather information about

8 The Special Risks Report Focus on China the target from online media platforms to make more credible claims. This is particularly the case for employees who have a loved one living abroad, when virtual kidnappers take advantage of the geographical distance and time zones to target family members at home, convincing them that their loved one has been kidnapped. They simultaneously target the expatriate, forcing both sides to pay false ransoms.

The extortionist demands a payment, and that the target The extortionist demands a avoids all contact with ransom payment from the his/her family in China target’s family

The extortionist contacts a The extortionist then contacts the In reality, the target is not Chinese target living abroad target’s family members in China under investigation and no and convinces him/her that and convinces them that their abduction has taken place he/she is under investigation loved one has been kidnapped

Anatomy of a virtual kidnap - employees who have a loved one living abroad

Despite authorities’ efforts, levels of public awareness of virtual kidnapping remains low. The crime will continue to pose a threat to employees who have not been trained to spot the differences between a virtual kidnap and a kidnap-for-ransom.

On the other hand, low-level street scams mainly affect foreign nationals, particularly business travellers whose awareness is likely to be lower than that of expatriates. Common forms in big cities are extortions such as the “tea scam” in which local individuals approach foreign nationals, befriend them and invite them for tea. They then go to restaurants where the proprietors are aware of the scam. When the bill (cheque) arrives, it amounts to several hundred dollars. Resistance to pay can result in violence. Increasing the awareness of these scams prior to business travel can significantly reduce the risk of business travellers and other foreign nationals falling victim to them.

Outlook These issues will remain a low-level hazard for multinational companies that take advantage of the myriad investment opportunities in China. Over time, most businesses will go through periods where it is necessary to renegotiate a business or employee contract, and being prepared to anticipate the range of possible responses that could occur will allow for more effective management of a situation should it escalate. Furthermore, the threats to personnel from virtual kidnapping and street scams will be effectively managed by disseminating among the workforce information that can prepare employees to confidently repel any contact by extortionists.

9 The Special Risks Report

Should you wish to discuss any of the analysis in this report, or Control Risks’ Response services, please contact [email protected]

If you would like to provide us with feedback on The Special Risks Report or inform us of your interest in a specific country or theme that you would like us to cover in a subsequent issue, please contact your broker: [email protected] | [email protected] (or another member of the Marsh Special Risks Team)

Copyright © Control Risks. All rights reserved. This report is for distribution by Hiscox only and must not be reproduced or disclosed to any other party (“Third Party”) without the express prior written consent of Control Risks or Hiscox. Any reproduction or disclosure without authorisation shall be considered an infringement of Control Risks’ intellectual property rights (including copyright). If authorised, disclosure by an authorised party (“Authorised Party”) must be subject to the following conditions: (i) the Authorised Party will not change the wording or alter the meaning given in any part of this report; (ii) all extracts from this report will be individually attributed to Control Risks with the reference “Source: Control Risks” at the end of such extract; and (iii) save as otherwise agreed in writing by Control Risks, the Authorised Party will not broadcast, publish, resell or otherwise disclose this report to any Third Party without the prior written consent of Control Risks. This report is based on information available at the time of writing. No express or implied warranty is given in respect of any judgment made or to changes or any unforeseen escalation of any factors affecting any such judgment. The issues covered by this report and the emphasis placed on them may not necessarily address all the issues of concern in relation to its subject matter. Analysis provided in this report does not in any way constitute recommendations or advice, nor constitute a warranty of future results by any company in the Control Risks group of companies (“Control Risks”) nor an assurance against risk. Control Risks disclaims all liability arising from the disclosure and use of this report.