SIAM

Security Impact Assessment

Measures

Past Events & Threat Scenarios

Deliverable D 6.1 Past Events & Threat Scenarios

Project number 261826

Call (part) identifier Interdisciplinary FP7-Security-2010-1 Center for Technology Funding scheme Analysis & Forecasting At Tel Aviv University Collaborative Project

1 13. 04. 2 0 1 2 Table of Contents

Executive Summary ...... 3 General Introduction ...... 6 Past events & Threat Scenarios ...... 8 Methodology ...... 8 Background ...... 10 Worldwide Past Security Events ...... 15 Country Reports - Past Security Events ...... 20 Germany...... 20 Israel ...... 43 Italy...... 64 UK ...... 73 Threat Scenarios ...... 90 Findings & Conclusions ...... 113 References ...... 116

2 Executive Summary

In this report we present a summary of the efforts done in task 1 of WP6. In this task we described past threat events which occurred in mass transportation systems as air traffic systems and train platforms, covering the five threat categories our research deals with – terror (T), illegal immigration (II), cyber (C), white collar (WC) and organized crime (OC).

We have covered some worldwide events, but focused on events collected by the partners, each in its country, and specifically related to each of the four case studies we base our research on – BGIA (Ben-Gurion International Airport), BER (the soon to be opened new Berlin's Airport), London's Underground and Turino's Train System.

The following table maps the partners country's collected events divided by each of the threat categories:

Table No. 1: Collected Past Events Categorization

3 The following table lists the threat scenarios as offered by SIAM partners:

Table No. 2: Threat Scenarios List Terror (T), Illegal Immigration (II), Cyber (C), White Collar (WC) and Organized Crime (OC).

No. Threat Category Scenario 1 T Toxic Gas Attack on a subway train 2 T Sniper attack 3 T Suitcase bombs, self made explosives 4 T Gun rampage 5 T Dirty bomb

6 T Missile attack on a starting/landing passenger aircraft (train..?) 7 T The junky's mummy 1 – coffin contains corpse filled with explosives (similar to #17) 8 T The deadly porter – hotel porter plants explosives/explosive device in an innocent resident 9 T The leaky passenger – terrorist with explosives in his guts

10 T Terror on a railway – remote control / pressure activated explosive device 11 T Contamination injected into fuel supply chain

12 T Armed cell trained commandos (native born) seizes control on a main station 13 T Detonation a massive Ammonium nitrate fertilizer bomb on a train in central London during 2012 Olympics 14 C / T Hacking an underground computer by a loose network of highly skilled individuals. 15 C / T Total shutdown of airport radio communication by terrorists armed with high-power radio transmitters 16 C /WC Same like #15, but caused by pirate radio nearby 17 OC The junky's mummy 2 – coffin contains corpse filled with drugs (similar to #7) 18 Other (D.O) The human flotilla – combine efforts of many people to reach certain location in order to demonstrate

4 The following table maps the offered scenarios based on the above collected country events, similarly divided by each of the threats categories:

Table No. 3: Country's Threat Scenarios Map based on the collected events

The data was analyzed and a list of various scenarios was obtained for further investigation. As can be seen, most of the events as well as most of the presented scenarios are related to the Terrorism category. While Cyber can be referred to as terror attack or as a crime, the three other crime categories are rarely covered and were found less relevant in relation to the mass transportation security.

During the work done, certain issues were raised, regarding the five challenges that SIAM is focusing on. The first issue was about the question whether or not Illegal Immigration should be one of the challenges. An additional challenge that arose was whether the project should also focus on civil disorders in transportation systems. At this stage, the five base challenges were left as is, without change.

5 General Introduction

The objective of work package 6 is to provide scenarios that give insights about possible targets for selected crimes. One of the key objectives in WP6 is to come to a deeper understanding of the security challenges that were selected in SIAM, and the impact these challenges might have on concrete targets or contexts. Work in WP6 until now has shown that such expertise is available in literature: global or regional threat assessments already exist. They provide valuable information about emerging and developing security threats on a global or regional level. But these expert reports do not provide information about likelihood or probable outcomes of security threats (occurrence, location, societal and economic cost) and it is beyond the scope of SIAM to calculate the relevant probabilities.

The main objective of WP6 is to create a knowledge base of threat scenarios and security incidents representing security challenges to mass transportation systems. The focus is on airports and subways systems, which are in the core of the SIAM projects. The preparation of this knowledge base will be based on six steps: a. Collection of information on specific relevant security events, based on media discourses, interviews, etc. b. A literature review survey of current scientific research and threat analysis. c. Expert workshops to discuss the security events, scenarios, SMT's role. d. Expert workshops to discuss scenario's building techniques and risk analysis. e. Processing and integrating the security events collected into a series of structured generic threat scenarios report. f. Integration of the scenarios into SIAM's database.

Security events or incidents refer to past incidents which occurred in public transportation systems (airports, undergrounds, trains, etc.) that included acts of terror, illegal immigration, or crime (cyber, white collar, organized): a. The events we were looking for could be those which happened IN transportation systems (e.g. carrying drugs through airports or using trains for illegal immigration) or those which where aimed AT the transportation systems themselves.(e.g. suicide bombing, hijacking planes) b. The above categories appeared in the proposal but we were not limited to them.

The impact of the past events was expected to cover the following issues:  Economy – High cost damages, potential damages to economic growth, markets, fiscal policies, taxation, industries, banks, insurance companies;  Environment – potential damages to biodiversity, materials, resources, climate, pollution, wastes;  Infrastructures – potential damage to energy supply, transportation systems, communications systems, etc.;  People – potential damage to individuals, groups, mass populations;  Political systems – Impact on the political system, potential damage to political structures, activities, leadership, power relations, stakeholders, policies;  Values - Threat events might lead to changes of values, such as changing attitudes towards ethnic minorities, impact on privacy changing of the sense of safety.

WP6 has begun in M1 of SIAM (2/11).

6 Following our first plan for WP6 and the discussion that took place during the kickoff meeting in Berlin, ICTAF issued guidelines to the partners for carrying out the abovementioned relevant tasks. This was later revised after the first consortium meeting in New Castle.

7 Past events & Threat Scenarios

This report is a summary of the efforts done in task 1, collecting and describing past events and offering a list of suitable scenarios. These scenarios are expected to cover the five security challenges addressed by the SIAM project: acts of terror, illegal immigration, or crime (cyber, white collar, organized).

In this context we use the following definitions: a. A security event - A specific event that happened in the past in which a breach of security happened in its broad sense including criminal acts, terrorism, illegal activities and others.

b. Security threat scenario - A generic anticipated event, which will breach security in its broad sense. A scenario includes descriptions of all stages needed to realize the potential event and the anticipated impacts of it.

Methodology The following methodologies have been used to collect and list the events and related scenarios: a. Past security events literature review of 15-20 worldwide incidents that have occurred in the last 20 years. The review was based on sources such as published articles, books, websites and the like. The review focused on worldwide security events that didn’t occur in Europe (European events have been collected in the case studies (Main task for VUB). To limit the scope the review focused on events related to airports, airplanes and public transport. b. Past events country reviews. Each partner in the case study countries (Israel, GB, Italy, and Germany) prepared a report on past events that have occurred in the last 20 years in his country. The report is based on internal sources including governmental, public and private sources that may provide a complete picture on relevant past events. This was achieved by surveying published reports and media sources such as newspapers, TV, radio etc. (Main task for ICTAF, SiTi, UNEW and UNIKASSEL). c. Interviews. Partners have conducted face-to-face interviews with relevant experts who described additional threat events or provide more insight to events that were already collected. The Interviewees included security experts, research institutes (focusing on security transportation), police sources, journalists and so on. d. Two sets of country workshops for discussing the collected events, developing scenarios and their risk analysis technique. e. Each partner has developed threat scenarios based on the worldwide and the country security events collected. By scenario we mean in this stage, an anticipated incident that may happen in the future, and which is based on past events and current technologies. f. Both the past events and their related threat scenarios were listed according to the following template:

8 Event Summary

1 Name Give a nick name 2 Category of security event* Terrorism, illegal immigration…* 3 Type of event* Smuggling, suicide, hijacking, 4 Date When did it happen 5 Where - Field / Area Ben Gurion air port / terminal area 6 Who short description of the perpetrators Detailed as possible - e.g. How the perpetrators were organized 7 Event Description and prepared for the event, means used,

Direct and long terms on people, infrastructure, environment, 8 Effects and impacts economic, values , political systems and others

9 SMT / CIT involved Existing systems and method applied during the event 10 Other issues involved Gender, legal… operational lessons learnt, technological needs identified, 11 Security Challenges methods needed…. Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

The first stage of the work done was to map past security events, in order to develop suitable set of scenarios based of. Each of the partners who had case study to base on, e.g. BGIA for ICTAF, focused their collected events on their country experience, and concentrated mainly on such related to their case study. Another partner has collected general past security events worldwide. The later developed scenarios will serve the SIAM data base.

9 Backgroundi

The objective of this deliverable is to build a list of security threat scenarios for the five security challenges SIAM is dealing with. As described in the methodology chapter above, the work was focused on collecting a list of events and related scenarios rather than discussing the definitions of each challenge. Even though as a background only, some common definitions will be mentioned in order to demonstrate the differences between the different challenges.

Terrorismii Most common definitions of terrorism refer to those violent acts which are intended to create fear (terror), are perpetrated for a religious, political or ideological goal, deliberately target or disregard the safety of non-combatants (civilians), and are committed by non-government agencies. A definition proposed by Carsten Bockstette at the George C. Marshall Center for European Security Studies iii underlines the psychological and tactical aspects of terrorism: “Terrorism is defined as political violence in an asymmetrical conflict that is designed to induce terror and psychic fear (sometimes indiscriminate) through the violent victimization and destruction of noncombatant targets (sometimes iconic symbols). Such acts are meant to send a message from an illicit clandestine organization. The purpose of terrorism is to exploit the media in order to achieve maximum attainable publicity as an amplifying force multiplier in order to influence the targeted audience(s) in order to reach short and midterm political goals and/or desired long-term end states”iv. Terrorism actions can be classified into six categories:  Political terrorism – violent criminal behavior designed primarily to generate fear in the community, or substantial segment of it, for political purposes.  Non-Political terrorism – terrorism that is not aimed at political purposes but which exhibits “conscious design to create and maintain a high degree of fear for coercive purposes, but the end is individual or collective gain rather than the achievement of a political objective.”v  Quasi-terrorism – the activities incidental to the commission of crimes of violence that are similar in form and method to ‘genuine‘ terrorism but which nevertheless lack its essential ingredient. It is not the main purpose of the quasi-terrorists to induce terror in the immediate victim as in the case of genuine terrorism, but the quasi-terrorist uses the modalities and techniques of the genuine terrorist and produces similar consequences and reaction. For example, the fleeing felon who takes hostages is a quasi-terrorist, whose methods are similar to those of the genuine terrorist but whose purposes are quite different.  Limited political terrorism – acts committed for ideological or political motives but which are not part of a concerted campaign to capture control of the state.  Official or state terrorism – acts committed by Nations whose rule is based upon fear and oppression that reach similar to terrorism or such proportions. It may also be referred to as Structural Terrorism defined broadly as terrorist acts carried out by governments in pursuit of political objectives, often as part of their foreign policy.

Terrorist attacks are usually carried out to maximize the severity and duration of the psychological impact. Terrorists typically attack national symbols, to attempt to shake the foundation of the country or society they are opposed to. This clearly negatively affects governments, increasing community’s fear and the reputation of the given terrorist organization and/or ideology behind a terrorist act.

Cyber crime Cybercrime (computer crime) has been defined as 'criminal acts committed using electronic communications networks and information systems or against such networks and systems' (European

10 Commission 2007 vi). With the increased use of and reliance on the internet and information and communications technology, cybercrime is a growing international problem which affects all sectors of society - critical infrastructures, business and the general public. Organized crime groups are increasingly sophisticated in the way they use technology and exploit communications systems. Cybercrime can cross borders in fractions of a second and touch several people in different countries at the same time. It can involve a broad range of activities which are generally divided into three categories: traditional forms of crime, illegal content and crimes unique to electronic networks (European Commission 2007). a) Traditional forms of Crime using Computers as a Tool Identity theftvii, phishingviii, spamsix, and malicious codesx, may be used to commit fraud or forgery. Other traditional crimes conducted using computers as a tool include the storage of illegal images, or illegal downloads, or internet-based trade in illegal goods. b) Publication of illegal content over electronic communications networks There has been a growth on international markets in the number of illegal content electronic sites with, inter alia, child pornography, displays of violence, incitement to racial hatred and incitement to terrorism. Action against such sites is difficult because site owners and administrators are often located in different countries from the target one, and moreover sites can be hidden or moved to another domain very quickly. c) Crimes unique to electronic networks Cybercrime also includes electronic attacks against information systems or organisations and individuals. 'Denial of Service attacks' prevent computer resources being available to intended users by flooding web servers with more data than they can process, forcing the websites to go offline. Other such crimes can be committed by gaining unauthorised access to a computer system (hacking), or writing a virus (a type of malicious software to delete stored data). The aims of these attacks may be toxi: - access information stored on a computer; information may have a monetary value (corporate espionage), may be valuable to the owner (ransom opportunity) or may be useful for further illegal activity such as fraud; - impede or alter the functioning of the computer itself; - Control a computer and utilize it to send spam, host illegal content, or conduct further attacks.

Transnational organized crime The term “organized crime” entails a wide range of crime categories, such as Drugs Trafficking, Money Laundering, Intellectual Property Crime, and Human Smuggling/Trafficking. In the following paragraphs these categories are discussed and analyzed.

11 Drugs Trafficking The trafficking and supply of drugs is one of the most prominent and lucrative of organized crime activities. The Europol Organized Crime Threat Assessment (2009) xii reports that drug trafficking into and across Europe is made possible by various trans-national organized criminal groups. As example, the Netherlands is Europe's main distribution centre for both cocaine, originating from South America, via Spain and West Africa, and heroin, the Netherlands is also the world's largest producer of ecstasy, although production in Eastern Europe is growing. Morocco is originating from Afghanistan, mainly via Turkey. Together with Belgium, the main supplier of cannabis resin, while there is also an increasing European trend in local indoor cannabis cultivation.

Intellectual Property Crime Intellectual Property (IP) refers to the legal rights owned by individuals and organizations in inventions, designs, goods and other creations, produced by intellectual activity in the industrial, scientific and artistic fields. Intellectual property rights protect the creators and makers of such products through patents on inventions, trademarks, industrial designs, as well as copyright on artistic works like books, films, music and paintings. Just like physical property, intellectual property can be stolen. IP crime is committed when products are copied and marketed for profit, as if made by the owner but without their consent.

There are two types of IP crime: counterfeiting and piracy. 'Counterfeiting involves the illegal copying of trade marks on products such as clothing and pharmaceuticals. Piracy involves the illegal copying of content such as music, film, sports events, literary works, broadcasts, computer games and software for commercial gain, also including illegal copying and downloading of digital content.'

Organized crime groups use the trade in fake goods to generate profit and to fund other forms of organized crime, such as human trafficking, money laundering, and illegal drugs. The internet and digital technology have presented criminals with an efficient, high speed and anonymous way to conduct IP crime across borders and continents. While luxury goods have traditionally been targeted for counterfeiting and piracy, today a wider variety of mass consumption goods (e.g. foodstuffs, cosmetics, spare parts for cars toys and various types of technical or electrical equipment) are affected. Due to the clandestine nature of many counterfeiting and piracy activities it is difficult to accurately assess their scale. The OECD estimate that, in 2007, global trade in fake goods was worth up to $250 billion and that does not include goods produced and consumed within countries. The real figure is, therefore, far higher.

Money Laundering Money laundering is the process of creating an appearance that large amounts of money obtained from criminal activity originated from a legitimate source. As organized criminal activity is generally aimed at making money, the ability to launder this money in order to conceal its origins and prevent it being associated with criminal activity is a major concern for all organized crime groups. It is also a means of maximizing the disposal of illegal profits and reducing the risk of exposure to law enforcement agencies and rival criminals which holding large quantities of cash can present. It is an international concern and international bodies and national governments have been taking major steps in recent decades to combat it. Europol view money laundering as the common denominator of all organized criminal activities.

12 Human Smuggling/Trafficking Human smuggling and the trafficking of human beings are profitable forms of crime, involving both individuals and organized criminal networks both within and outside the Countries. According to Europol (2009) human traffickers and smugglers are likely to be involved in other types of crime like drug trafficking, identity fraud, counterfeiting and money laundering. Both the trafficking of human beings and people smuggling may involve the use of forged travel documents and the abuse of legal forms of entry, although people legally entered in EU countries may also become victims of human trafficking.

Human trafficking is often described as a modern form of slavery (Walsh 2009 xiii). While people smuggling and the trafficking of human beings are linked and can involve the same networks, there are fundamental differences between the two. Human smuggling involves migrants being facilitated with entry into a State through illegal means. The trafficking of human beings is defined as "procuring, recruiting, ... transporting ... or providing a person with accommodation or employment by means of the threat or use of force or other forms of coercion, of abduction, of fraud, of deception....for the purpose of exploitation... for sexual exploitation, forced labor ...or the removal of organsxiv". In the case of adults, there must be an action (procuring or transporting or harboring), means (coercion or deception, etc.) and purpose (for sexual or labor exploitation or removal of body organs) for human trafficking to occur. In the case of trafficking of children there only needs to be the action and purpose elements present to meet the definition for human trafficking, irrespective of the means used. Human smuggling can lead to trafficking if, for example, the circumstances of the smuggled persons change during the journey or on arrival in the State leading to them becoming victims of violence and exploitation.

Illegal immigration Illegal immigration is the migration of foreign citizens into a Country in circumstances where people do not meet the legal requirements for immigrating in that country, that is, when they are violating the immigration laws of that jurisdiction. It is important to note that the status of "unauthorized immigrant" may be replaced by the status of "asylum seeker" for emigrants who have escaped a war or repression and have unlawfully crossed their State's borders. If they are recognized as "legitimate" asylum-seekers by the destination state, they gain an official legal status. The Article 31 of Convention Relating to the Status of Refugees prohibits the Contracting States to impose penalties on refugees for their illegal enter or presence, who come directly from a territory where their life or freedom are threatened. However, if potential asylum-seekers are unwilling to apply or have been denied of asylum status, are categorized as "unauthorized immigrants" and may be subject to punishment.

Illegal immigration has many complex causes. The most common motivation for illegal immigrants is the pursuit of greater economic opportunities and quality of life in the destination state, and the net flow of illegal immigration pattern is almost entirely from countries of lower socioeconomic levels to countries of higher socioeconomic levels. Under the basic cost/benefit argument for illegal immigration, potential immigrants believe the probability and benefits of successfully migrating to the destination country are greater than the costs. These costs may include restrictions living as an illegal immigrant in the destination country, leaving family and ways of life behind, and the probability of being caught and resulting sanctions.

Illegal immigration has a heavy impact on many political, economical, social and ethical issues. Moreover, there are many relevant dangers that unauthorized immigrants expose themselves to, while engaged in travelling to another country. Aside from the possibility that they may be intercepted and deported, unauthorized immigrants may be trafficked for exploitation (slavery

13 and/or sexual exploitation) or exposed to death while travelling in unsecured/uncontrolled conditions.

White collar crime White-collar crime has been defined by Edwin Sutherland as "a crime committed by a person of respectability and high social status in the course of his occupation". White-collar crime includes fraud, bribery, insider trading, embezzlement, copyright infringement, money laundering, identity theft, and forgery.

The harm caused by these crimes, directly or indirectly, can be quite substantial. A major fraud, for example, can have more relevant long-term impacts on individuals and economies than the offences of many street criminalsxv. Over the past years, debate on the response of the criminal justice system to white collar crime has moved to centre stage, in large part due to the fallout from the international financial crisis. The general public has become more sensitive to white collar crime and also media attention has increased significantly. Much of the debate focuses on the view that white collar offenders are treated differently to 'street' criminals, with particular concerns expressed about the length of time required to investigate allegations of white collar crime as well as a historical tendency for sanctions to be more lenient.

One reason for the lower rate of prosecution and conviction in white collar crime is the difficulty in defining, detecting and investigating it. For some types of white collar crime, such as fraud or embezzlement, the criminal intent is unambiguous. In other instances, the intent is less straightforward, and the persons under investigation may argue that they believed their actions were legal and that they have been guilty, at worst, of misinterpreting complex accounting regulations or having made poor business decisions.

Even where criminal intent is clear, white collar crime is typically committed in privacy, unlike 'street crime'. The victim will often be unaware of the crime, or occasionally, may be reluctant to report the crime. There is often no eyewitness other than the perpetrator. In the absence of eyewitness testimony, proof is more likely to depend upon evidence amassed from a complex trail of data. Modern technology generates enormous amounts of material, including on computer hard-drives, telephone records and emails, which need to be assessed and evaluated. Therefore, the investigation of white collar cases such as sophisticated fraud, money laundering or other financial crimes are resource intensive, both in terms of duration and expertise.

14 Worldwide Past Security Events

As mentioned above, part of the work done, was to collect past security events to base develop scenarios based on. The following presents some typical worldwide collected past events of each of the five threats categories covered by SIAM:

Terrorism 1. Name 9/11 Category of security event Terrorism Type of event Suicide attack Date 11-09-2001 Where-field/area USA – World Trade Center, NY City; the Pentagon in Arlington, Virginia; Shanksville, Pennsylvania. Who Al-Qaeda Event description On September 11, 2001 19 members of the terrorist network al- Qaeda executed a coordinated suicide attack on targets in the USA. 4 passenger jets were hijacked. Two jets were flown into the World Trade Center in NY City. One jet was flown into the Pentagon. The fourth jet crashed near Shanksville, Pennsylvania. The attacks resulted in 2996 fatalities.

2. Name SuperFerry 14 bombing Category of security event Terrorism Type of event Bombing Date February 27, 2004 Where-field/area Manila Bay, Philippines / sea-ferry transport Who Abu Sayyaf Event description “SuperFerry 14” was a 10,192-ton ferry that sailed out on the night of the 27th of February for Cagayan de Oro City with 899 recorded passengers and crew aboard. Redondo Cain Dellosa, a Rajah Sulaiman Movement member working for the Abu Sayyaf group, had placed 3,6 kgs of TNT in a television set in the lower decks of the ferry. +- 1hr after departure, the bomb exploded. Total fatalities: 116 people. The SuperFerry 14 bombing is the world’s deadliest terrorist attack at sea.

3. Name Madrid 4/11 Category of security event Terrorism Type of event Backpack bombings Date 11 March 2004 Where-field/area Madrid Commuter Train System Who A collective of Moroccan, Syrian, and Algerian Muslims and two Guardia Civil and Spanish police informants Event description In the morning of March 11, 2004, a coordinated attack was executed at the Madrid Commuter Train System, using backpack

15 bombs. Total fatalities: 191. Injured: 2050.

Transnational organized crime

4. Name Operation “Ramp Rats” Category of security event Organized crime Type of event Drugs smuggling, arms and explosives trafficking Date August 25, 1999 – September 9, 1999 Where-field/area Miami International Airport USA Who Airline employees Event description Operation Ramp Rats I was a DEA – operation that ended on august 25, 1999 with the arrest of 59 individuals associated with American Airlines. The investigations disclosed large-scale smuggling of heroin and cocaine into the United States by these employees along with the distribution of drugs, weapons and explosives throughout the United States. One significant result of the investigation was the disclosure of serious security breaches at MIA.

Operation Ramp Rats II was concluded on September 9, 1999, with the arrests by DEA and U.S. Customs of 15 ramp workers associated with airlines other than American Airlines. Further security breaches were disclosed by this operation.

5. Name Operation “Maxim” Category of security event Organized crime Type of event Human trafficking Date 4-11-2004 Where-field/area Surrey, South-west and south-east London, Hamburg, Cologne Who Snakeheads Event description On November 4, 2004, Scotland Yard broke a human trafficking ring thought responsible for smuggling hundreds of Turkish people into Britain in the last few years. The illegal immigrants were brought in by air, road and sea through Germany, France and Belgium to provide cheap labour in London.

16 Illegal migration

6. Name Illegal aliens working at Dulles International Airport Category of security Illegal Migration event Type of event Illegal residency / unlawful employment Date 13-08-2008 Where-field/area Dulles International Airport Who 42 illegal residents Event description In the morning of 13/08/2008, the U.S. Immigration and Customs Enforcement (ICE) arrested 42 illegal residents at Dulles International Airport as part of a critical infrastructure protection (CIP) operation. ICE agents interviewed more than 200 individuals to verify their identities, immigration status, and eligibility for lawful employment in the U.S. Most of the individuals arrested by ICE agents, with support of airport security agencies, worked on construction projects at the airport.

7. Name Air China Category of security event Illegal Migration Type of event Illegal Migration Date 27-12-1997 Where-field/area Shanghai International Airport Who Unknown Event description December 27, 1997, 8 Fujianese individuals,who were about to board Air China flight, were detained by chinese customs to further inspect their Chinese passports and US Immigration VISA’s. All VISA’s were found to be false.

Cybercrime

8. Name Sasser Category of security Cyber crime event Type of event Computer worm Date April 30, 2004 Where-field/area Rotenburg, Lower Saxony, Germany Who 18-year old German computer science student Sven Jaschan Event description Sasser was a computer worm, designed by Sven Jaschan, that affects the Microsoft operating systems Windows XP and Windows 2000. One of the effects was that Delta Air Lines had to cancel several trans-atlantic flights because its computer systems had been swamped by the worm.

17 9. Name 'Anonymous' hackers launch cyber attack on San Francisco's BART website Category of security Cyber crime event Type of event Hacking Date August 15, 2011 Where-field/area San Francisco Bay Area Rapid Transit (BART) Who hacker collective Anonymous Event description ‘Anonymous’ launched a cyberattack in response to the BART's decision to block wireless service in several of its San Francisco stations. BART officials intended to block wireless access to disrupt the organization of a demonstration protesting the July 3 shooting death of a 45-year-old man by BART police, who said the victim was wielding a knife. BART officials argued that the protest had been designed to disrupt the evening commute. Anonymous hacked the website and exposed the personal contact information of over 2,000 customers.

10. Name Juvenile Computer Hacker Cuts Off FAA Tower at Regional Airport Category of security Cyber crime event Type of event Hacking Date March 10, 1997 Where-field/area Worcester Airport, Massachusetts, USA Who Juvenile hacker Event description A computer hacker disabled a key telephone company computer servicing the Worcester airport. As a result of a series of commands sent from the hacker's personal computer, vital services to the FAA control tower were disabled for six hours in March of 1997. At +- 9:00 a.m., the juvenile computer hacker accessed the loop carrier system servicing the Worcester Airport. He then sent a series of computer commands to it that altered and impaired the integrity of data on which the system relied, thereby disabling it. Public health and safety were threatened by the outage which resulted in the loss of telephone service, until approximately 3:30 p.m., to the Federal Aviation Administration Tower at the Worcester Airport, to the Worcester Airport Fire Department and to other related concerns such as airport security, the weather service, and various private airfreight companies. Further, as a result of the outage, both the main radio transmitter, which is connected to the tower by the loop carrier system, and a circuit which enables aircraft to send an electric signal to activate the runway lights on approach were not operational for this same period of time.

18 Transnational white-collar crime

11. Name Corruption in South-Africa Category of security event White-collar crime Type of event Fraud and corruption Date May 2011 Where-field/area South-Africa Who Government officials Event description The Department of Home Affairs, and its Anti-Corruption Unit, arrested 12 of its employees for facilitating the illegal entry and stay of foreign immigrants in South Africa, registering hundreds of fraudulent marriages involving foreign nationals and South African citizens, and issuing a marriage certificate to a deceased person at the OR Tambo Airport, Durban, Grahamstown and Mount Frere.

19 Country Reports - Past Security Events

Each of the partners who had case study to base on, e.g. BGIA for ICTAF, focused their collected events on their country experience, and concentrated mainly on such related to their case study.

Germany A review of media sources shows that most major events in the Federal Republic of Germany predated the specified timeframe and did not involve public transport.

The most severe terrorist bombing in post-war Germany was the “Oktoberfestattentat” (Oktoberfest bombing) in Munich on September 26th 1980, when thirteen people died in the explosion of a pipe bomb set by rightist extremist Gundolf Köhler (and possibly others).xvi Another well-known terrorist attack was the “Munich massacre” during the 1972 Summer Olympics in Munich when members of the Israeli delegation were killed by the Islamic group “Black September”.xvii Numerous acts of terrorism were committed by the left-radical terrorist group “Rote Armee Fraktion” (Red Army Faction, RAF), especially during the so-called “German Autumn” (Deutscher Herbst) of 1977.xviii These include among others the kidnapping of Hanns-Martin Schleyer (1977), the murder of Jürgen Ponto (1977), Alfred Herrhausen (1989) and Detlev Rohwedder (1991) and the bombing of Weiterstadt penitentiary (1993).xix A significant part of terrorism in Germany was directed against US-soldiers (e.g. “La Belle” discotheque bombing of 1986; Hepp-Kexel-group; bombing of US Air Base Rhein-Main 1977; shelling of the US-embassy in Bonn 1991)xx, another against asylum-seekers and persons who are perceived as foreigners, especially in the form of arson, which peaked in the years after the German reunification (e.g. Hoyerswerda excesses 1991, riot of Rostock-Lichtenhagen 1992, murder of Mölln 1992, Solingen arson attack 1993).xxi Extremists of both sides of the political spectrum often had close ties to Palestinian terror groups (e.g. RAF, Hepp-Kexel-group).xxii

A significant number of events that did in fact involve public transport were aircraft hijackings. From 1969 until the end of 1999 24 passenger aircrafts were directed to Germany from abroad by hijackers. Until the German reunification in 1990 most hijacked planes came from the Eastern bloc.xxiii While most of the hijackers were politically motivated, there were also a significant number of mentally ill hijackers.xxiv The vast majority of these hijackings ended without bloodshed after the hijackers were overpowered or simply gave up.

The following list is limited to high-profile events that occurred from 1991 until today in the context of public transport and that involve terrorism, illegal migration and crime (cyber, organized and white-collar). Since the number of such events in Germany is rather small, the definitions of the abovementioned categories are construed extensively where appropriate. For the same reason, the list is followed by a section that includes selected high-profile events preceding the specified time frame of twenty years.

20

Past Event G1 Name Hijacking of KLM flight KL 100 Category of Terrorism security event Type of event Hijacking Date 15 / 16 August 1993 Where – Field / Flight KL 100 (a Boeing 737-400) of Dutch airline KLM travelling from Tunis to Area Amsterdam is hijacked in the skies over Germany and taken to Düsseldorf airport. Who An Egyptian constructor (age 55) Event Description The hijacker passed a note for the pilot written in English to a crew member. In the note he claimed to have a bomb strapped to his body and said that he wanted to be taken to New York. He also demanded the release of Sheik Omar Abdel- Rahman, an Egyptian cleric and the alleged wire-puller behind the World Trade Center bombing of 26 February 1993, held in New York and that the United Nations enforce sanctions against Serbia more strictly. After he was told that the aircraft was incapable of reaching New York, the hijacker was persuaded by the pilot to permit landing at the nearest airport (Düsseldorf). The pilot’s behaviour in this situation was standard procedure at the time and still is today. At Düsseldorf Rhein-Ruhr Airport (today: Düsseldorf International Airport), the aircraft was directed to a remote area of the airport and parked there while the hijacker negotiated with the police by radio. Shortly after the landing the hijacker was successfully persuaded to release all passengers and four crew members, leaving only himself, the pilot, the co-pilot and a steward on board. Later, the female co-pilot was also released. When it became clear, that he himself could not reach New York to pick up Rahman, the hijacker instead demanded Rahman to be flown to Egypt. After a standoff of eleven hours, at 2 am, the two remaining hostages managed to escape through a cockpit window. Members of the special forces unit GSG9 of the German Federal police simultaneously stormed the aircraft and overpowered the hijacker who was at that time using the aircraft toilets. It was then discovered that he did not carry any explosives or weapons whatsoever. Effects and The aircraft had 131 passengers and 7 crew members on board. There was impacts however no real danger to them, since the hijacker did not carry any dangerous weapons or materials. SMT / CIT - involved Other issues A passenger later stated that he had noticed the hijacker at the check-in in Tunis involved and that he had seemed to be very nervous to him. Other passengers however described the hijacker as calm and friendly. Security - challenges Sources http://www.spiegel.de/panorama/a-48287.html; http://archiv.rhein-zeitung.de/on/01/03/16/topnews/tupochro.html; http://www.independent.co.uk/news/world/hijacker-seeks-sheikhs-release- 1461406.html; http://articles.latimes.com/1993-08-16/news/mn-24360_1_muslim-cleric.

21

Past Event G2 Name Hijacking of an Austrian commercial aircraft Category of Illegal immigration / terrorism security event Type of event Hijacking Date 7 January 1997 Where – Field / Flight AuA 104 (a McDonnell-Douglas 87) travelling from Berlin to Vienna is hijacked Area in the skies over Germany. Who Salko Loncaric (age 39, from Bosnia, asylum seeker) is supposed to be deported on 15 January 1997. He had been living in Rostock since 1994 and was suffering from a psychosis. Event Salko Loncaric, armed with a kitchen knife (10cm blade) and two 45cm long wooden Description clubs, intoxicated, managed to hijack an Austrian Airlines commercial aircraft travelling from Berlin to Vienna shortly before landing. He entered the cockpit and forced the pilot to turn around and go back to Berlin-Tegel airport. He threatened the pilot and co-pilot by hammering his club against the seats and the cockpit door case and by pointing his knife at them. He first demanded to be taken to the USA, but the aircraft did not have enough fuel. He then demanded to talk to German foreign minister Klaus Kinkel and ordered the pilot to return to Berlin. After the landing in Berlin, the aircraft was directed to a remote part of the airport and surrounded by special forces. However, two ordinary policemen had already managed to enter the aircraft unnoticed and overpowered the hijacker. Effects and The hijacker was sentenced to seven years of confinement in the psychiatric ward of impacts Tegel penitentiary. On 29 December 1997 he hung himself in his cell using a girdle and the window cross. During his trial, Loncaric stated that he did not expect to be able to pass airport security controls with his knife and clubs. SMT / CIT The security controls at the airport were conducted by private company Securitas. involved The personnel had only had one week of training before starting work at the checkpoint. Fellow travellers in the aircraft stated that the hijacker had attracted their attention because of his shabby clothing and the smell of alcohol he emitted. After the incident Securitas was heavily criticised. Loncaric’s lawyer, Jutta Lüdicke, said that it was made very easy for him to carry out his plan (“Man hat es meinem Mandanten leicht gemacht.”). The hijacker was also carrying 45 cigarette lighters when he entered the security checkpoint. Unlike the knife and club which he carried on his body and another club in his luggage, they were discovered and confiscated. Other issues Loncaric’s lawyer claimed during the trial that a falsely completed form led to the involved deportation. Security Insufficient passenger screening challenges Sources http://www.berlinonline.de/berliner- zeitung/archiv/.bin/dump.fcgi/1997/0704/lokales/0039/index.html; http://www.berlinonline.de/berliner- zeitung/archiv/.bin/dump.fcgi/1997/0705/lokales/0081/index.html; http://www.spiegel.de/spiegel/print/d-20289300.html.

22

Past Event G3 Name Bomb discovery at Dresden central station Category of (Terrorism), blackmail security event Type of event Bombing Date 6 June 2003 Where – Field / Dresden central station; the bomb was found between two food vending Area machines. Who A 62 year-old highly indebted financial broker from Falkenstein im Vogtland (a small town in Saxony) built and planted the bomb. Event The perpetrator wanted to blackmail the Deutsche Bank into giving him 120m Description Euros. To do this he placed a bomb hidden inside a suitcase at Dresden central station and simultaneously sent a blackmail letter to the Deutsche Bank headquarters in Frankfurt am Main. In that letter he threatened to plant a second bomb in Frankfurt, unless his instructions were followed. However, the bomb in Dresden was found after security personnel discovered the unattended piece of luggage and disarmed by police special forces using a water gun. Since the bomb timer was destroyed during the disarming, it is unknown when the bomb would have exploded. After his arrest, the bomb planter denied that the bomb was armed, but police believe this to be a defensive lie. Police were able to find him through DNA on the suitcase and the fact that the letter had been posted in Dresden. After his arrest, police found enough explosives in his flat to build a second bomb. Effects and A functional, professionally constructed bomb containing 1.6 kilogram of TNT and impacts 6 kg crushed stone in a pressure cooker hidden inside a wheeled suitcase was used. The explosion would have been strong enough to go through steel plates. SMT / CIT DNA testing, CCTV cameras did not record involved Other issues After the bomb was found, police received a false claim of responsibility from the involved “Caucasian Liberation Front Abu Achikoba”, a rebel group from Chechnya. Security At the time the bomb was found, police believed that the bomb was part of a challenges terrorist plot since only a few months earlier four Algerians had been convicted of planning a bombing in Strasbourg, France also using a pressure cooker. Therefore the media treated the event like a terrorist attack and speculated on a possible Islamist or right/left extremist background. Another important issue in this case was an apparent lack of security at railway stations: CCTV cameras installed at Dresden central station might have helped to identify the bomb planter, but they were not set to record anything. Federal minister of the interior Otto Schily pressed for more and better video surveillance at railway stations after the event. Sources http://www.spiegel.de/panorama/0,1518,252643,00.html; http://www.sueddeutsche.de/politik/polizei-festnahme-im-fall-dresdner- kofferbombe-1.896761; http://www.handelsblatt.com/bekennerschreiben-zu-dresdner- kofferbombe/2253566.html.

23 Past Event G 4 Name “Geiseldrama von Ennepetal” 2005, Ennepetal hostage crisis Category of security Terrorism / illegal migration event Type of event Kidnapping Date 12 April 2005 Where – Field / Urban bus in Ennepetal (city in North Rhine-Westphalia) Area Who Man, no name given (age 50), mentally ill; from Iran, but living in Ennepetal since 1997 as an asylum-seeker; his request for asylum had been denied conclusively and he was supposed to be returned to his country of origin in May 2005 Event Description The man entered an urban bus with 10 students on their way home from a local school. He threatened the driver with two butcher knives and started tying up the children using washing lines. Then he forced the children to leave the bus. Outside, six of the hostages managed to flee. The kidnapper left a note in Arabic in the bus. When he noticed a woman nearby trying to open the door to her home, he overpowered the owner, entered the house and barricaded himself in the cellar with the remaining four hostages, three thirteen year-old girls and another sixteen year-old girl. After five hours a special unit of the German police stormed the cellar. During the rescue operation the hostage-taker managed to injure one of the girls. The kidnapper later claimed that it had never been his intention to harm the girls. He had however planned the kidnapping for a long time. After the trial, the man was taken to a mental institution. He had been in psychiatric therapy before. Effects and impacts 10 students were threatened with two butcher knives. SMT / CIT involved Police special forces Other issues The kidnapping was a last resort after several failed legal actions, over 60 involved letters to the authorities, two hunger strikes and two suicide attempts to make the immigration office recognise him and his family, which was still in Iran, as victims of political repression and therefore allow him to stay and his family to be brought to Germany. With the kidnapping he had hoped to draw the federal government’s attention to his situation. Security challenges - Sources http://www.spiegel.de/panorama/0,1518,350967,00.html; http://www.sueddeutsche.de/panorama/ennepetal-geiselnahme-endet- glimpflich-1.922114; http://www.stern.de/politik/deutschland/ennepetal-geiseln-sind-frei- 538980.html; http://www.stern.de/politik/deutschland/ennepetal-geiselnehmer-war- in-psychatrischer-behandlung-539023.html.

Past Event G 5 Name German train bombing plot, “Kofferbomber von Köln” (Cologne

24 suitcase bombers) Category of security Terrorism event Type of event Bombing Date 31 July 2006 Where – Field / Regional trains departing Köln Central Station (Regionalexpress 10121 Area from Aachen to Hamm and Regionalbahn 12519 from Mönchengladbach to Koblenz), bombs were timed to explode near Hamm and Koblenz Who Jihad Hamad (age 20) and Youssef Mohamad El Hajdib (age 21, lived in Germany since 2004 as a student of mechatronics in Kiel); called “Kofferbomber von Köln” (Cologne suitcase bombers) by the media; others that are suspected to have helped to plan the attack are Ayman Hawa, Khaled Khair-Eddin el Hajdib, Khalil al-Boubou and Saddam el-Hajdib; all from Lebanon; arrests took place in Germany (Youssef Mohamad El Hajdib) and Lebanon (rest); all were sympathizers of Al Qaeda and presumably linked to the Lebanese terrorist group Fatah al-Islam Event Description The two abovementioned suspects placed two wheelie bag suitcases containing bombs on regional trains departing Köln Central Station. They took their respective trains until the first stop (Troisdorf/Köln- Deutz) and then left the train, acting as if they had simply forgotten their luggage. The bombs were constructed using propane canisters with timed detonators attached. The detonators went off at 2:30 PM, but they did not ignite the gas due to faulty construction (lack of oxygen in the canisters). At 2:40 pm the first suitcase was discovered by a conductor and taken to the lost property office of Dortmund Central Station where upon opening the suitcase the bomb was discovered. The federal police was called and the bomb was disposed by explosives experts. The second suitcase was also discovered by a conductor and taken to an office at Koblenz Central Station, but the bomb was not discovered until the next day, when the suitcase was opened. On the day of the attempted attack, both suspects left Germany via Köln-Bonn airport. They first travelled to Istanbul and then from there to Lebanon. Youssef Mohamad al-Hajdib returned to Germany on 8 August 2006 via Frankfurt am Main Airport. Jihad Hamad and Youssef Mohamad El Hajdib were identified using footage from security cameras installed at Köln Central Station, which allowed a manhunt using pictures and video footage. A 50,000 € reward was announced for leads to their whereabouts. Effects and impacts The attacks had the potential to kill hundreds of people; the force of the explosions would have been similar to those of the terrorist attacks on 7 July 2005 in London. During the trial against Youssef Mohamad El Hajdib at the Higher Regional Court of Düsseldorf chief judge Ottmar Breidling said that

25 Germany had escaped from a catastrophe only because of the technical inadequateness of the accused (“Deutschland ist nur aufgrund der technischen Unzulänglichkeit des Angeklagten einer Katastrophe entgangen.”). The incident sparked a public discussion on the safety of Germany’s infrastructure and its vulnerability to terrorist attacks from Islamic terror cells. SMT / CIT involved Advertency of conductors towards unattended luggage, CCTV Other issues The plans for the bombs were supposedly downloaded from the involved internet, but the suspects diverged from the plans and made technical mistakes that caused the bomb’s malfunction. The suspects also considered attacks on a football stadium during the 2006 FIFA World Cup in Germany and on the Hohenzollern Bridge in Köln, but they were unable to get a sufficient amount of explosive materials. The suspects were inspired to act by the prophet caricatures published in the Danish newspaper “Jyllands Posten” on 30 September 2005 and the killing of Iraqi Al Qaeda leader Abu Musab al-Zarqawi on 7 June 2006 by the US military. Security challenges - Sources OLG Düsseldorf, 9.12.2008 – 2 StE 7/07-3; BGH, 24.11.2009 – 3 StR 327/09; Latsch, G., et al., Alptraum der Fahnder, Der Spiegel 35/2006, 20 f.; Meyer, C. / Ulrich, A. / Widmann, M., Der dritte Mann, Der Spiegel 36/2006, 42; Brandt, A. / Kaiser, S. / Meyer, C. / Ulrich, A., Drohung aus dem Libanon?, Der Spiegel 34/2006, 36 f. http://en.wikipedia.org/wiki/2006_German_train_bombing_plot; http://de.wikipedia.org/wiki/Versuchte_Bombenanschläge_vom_31. _Juli_2006; http://www.n-tv.de/politik/Angriff-auf-WM-Stadion-geplant- article286537.html; http://www.faz.net/-00ndnl; http://www.aina.org/news/20060823102444.htm http://www.spiegel.de/thema/kofferbomber/.

26 Past Event G 6 Name German bomb plot of 2007, “Sauerland-Gruppe” (Sauerland group) Category of Terrorism security event Type of event Bombing Date 4 September 2007 (date of arrest) Where – Field / A holiday home in Oberschlemdorn, Sauerland (the Sauerland is a rural area in Area the south-east of North Rhine-Westphalia) Who Fritz Gelowicz (age 28, from Munich, group leader), Daniel Schneider (age 21, from Saarbrücken), both converted to Islam as teenagers; Adem Yilmaz (age 28, from Turkey, came to Germany in 1993); they met at a training camp of the Islamic Jihad Union (IJU) in Pakistan and had links to Al Qaeda; seven other suspects (presumably from Turkey) are still searched for, but not all are known by name; the radicalisation of the group was started by the Egyptian physician Yehia Yousif in Neu-Ulm. Event Description The suspects were under observation by the police since 2006 after Fritz Gelowicz had been seen staking out the US Air Force facility near Hanau. At a holiday home in Oberschlemdorn, where they were arrested on 4 September 2007, the group had amassed 700kg of hydrogen peroxide which had been purchased legally and 26 military grade detonators (not all of them working). Police were monitoring the group members’ phone calls and the group was aware that they were under observation by the police. In July 2007 the hydrogen peroxide was secretly replaced with a harmless liquid. The observation (codename “Operation Alberich”) involved 400 officers of the German police, the German Secret Service (BND) and the German Military Counterintelligence Service (MAD) that worked together in the Joint Terrorism Defence Centre (GTAZ) founded on 14 December 2004. The GTAZ worked closely together with the CIA on this case. A police officer was shot in the hand when the suspects tried to resist arrest. Effects and The group considered attacks on a discotheque in Gießen frequented by US impacts soldiers, the US Air Base at Ramstein and Frankfurt airport using self-made car bombs. New anti-terrorism legislation was proposed by minister of justice Brigitte Zypries that would make it an offence to visit terrorist training camps (“Terrorcamps”) and to obtain plans or substances for the construction of bombs. This new law came into effect on 4 August 2009 as the “Gesetz zur Verfolgung der Vorbereitung von schweren staatsgefährdenden Gewaltstraftaten” (BGBl. I S. 2437 Nr. 49) / “Act for the persecution of the preparation of severe seditious criminal actions involving force”. SMT / CIT Covert listening devices, observation involved Other issues The fact that two of the members of the Sauerland group were converts with involved German roots sparked a debate on the existence of home-grown terrorists (scope, potential for violence) and the consequences for German homeland security in the future. Security - challenges

27 Sources Ramelsberger, A. / Richter, N., Die Banalität des Hasses, Süddeutsche Zeitung, Bayern, München, Die Seite Drei, 4.9.2008 http://en.wikipedia.org/wiki/2007_bomb_plot_in_Germany; http://de.wikipedia.org/wiki/Sauerland-Gruppe; http://www.spiegel.de/thema/sauerland_gruppe/; http://www.sueddeutsche.de/thema/Sauerland-Gruppe; http://www.focus.de/schlagwoerter/themen/s/sauerland-gruppe/.

Past Event G 7 Name “Operation Athena” Category of security White-collar crime / terrorism event Type of event Tax evasion, funding of terrorist activities Date 10 – 17 September 2008 Where – Field / German-Swiss border, German-Liechtenstein border, 17 German Area airports, trains travelling to Switzerland Who People trying to get money out of the country without registration Event Description From 10 - 17 September 13,000 persons and 22,000 pieces of luggage were searched for hard cash. Customs officers searched passengers on trains travelling to Switzerland, cars in the area near the border to Switzerland and Liechtenstein and airline passengers on 17 airports throughout the country. This was part of “Operation Athena” of the European Union which all member states and Tunisia, Morocco, Norway and Croatia participated in. The goal of the operation was to strike a blow to tax evasion and money laundering (e.g. profits from smuggling drugs, cigarettes and weapons), but also to trail money flows to terrorist organisations. 800 customs officers registered 5.5m € over 181 cases (European total: 11m € in 400 cases). It was the biggest hard cash investigation ever conducted in the Federal Republic of Germany. Effects and impacts - SMT / CIT involved Sniffer dogs, road blocks, luggage inspections Other issues - involved Security challenges - Sources http://www.focus.de/politik/deutschland/schmuggel-operation- athena_aid_334680.html; http://www.zoll.de/f0_veroeffentlichungen/e0_sonstiges/w0_2008/z 28_bargeldkontrolle/index.html.

28 Past Event G 8 Name “Saar-Terrorist” Category of security Terrorism event Type of event Threats against the Federal Republic of Germany; attempts to recruit Germans citizens for terrorist organisations and Islamist groups fighting in Afghanistan Date 2008 – 2010 Where – Field / Neunkirchen, Saarbrücken, Afghanistan Area Who Eric Breininger († at age 22), called “Saar-Terrorist” by the media after his Saarland origin (the Saarland is a German state in the south- west of the country) Event Description Breininger was an average German teenager, living with his older sister and mother after his parents’ divorce. In early 2007, while working for a transport company one of his colleagues introduced him to Islam. A few moths later, Breininger converted and came into contact with the “Sauerland group” (see above). In November of 2007 Breininger left Germany, travelling to Afghanistan via Iran and Pakistan. There he graduated from a terrorist training camp run by the Islamic Jihad Union. From 2008 until 2010, Breininger recorded a number of video messages in German. In these messages, he tried to inspire Germans to come to Afghanistan and fight with the Taliban. He also implied threats to the Federal Republic of Germany, stating that Germany should withdraw its military presence from Afghanistan. His work as a propagandist was considered very important by his sponsors, since he gave them the means to address the German public directly in German through the video messages. On 30 April 2010 Breininger died during a fire-fight with Pakistani soldiers. Effects and impacts Although Breininger stated in a video message that he himself was not planning terrorist attacks in Germany, there were numerous reports in the media over the years claiming he had returned to Germany to perform terrorist attacks or at least that he was orchestrating attacks from his hideout in Afghanistan. The fact that he was of German descent played a big role in the debates that followed his messages. Called “Saar-Terrorist” by the media, his continuing presence as a propaganda mascot for the Taliban, was a constant reminder of the fact that Germany was in fact in the cross hairs of Islamist terrorist groups and that this threat was not only a “foreign” one through persons with a migration background, but that there was also a “home-grown“ threat through converts. Breininger’s messages resulted in a heightened state of alert, especially at German airports and railway stations. SMT / CIT involved -

29 Other issues - involved Security challenges - Sources http://www.bild.de/news/vermischtes/pakistan/terrorist-breininger- in-deutschland-5935656.bild.html; http://de.wikipedia.org/wiki/Eric_Breininger; http://www.bild.de/news/vermischtes/deutschland/plante-zweites- 9-11-5664606.bild.html; http://www.welt.de/politik/deutschland/article7484468/Das-kurze- Leben-des-Islamisten-Eric-Breininger.html; http://www.spiegel.de/thema/eric_breininger/.

Past Event G 9 Name Cargo planes bomb plot of 2010 Category of security Terrorism event Type of event Bombing Date 29 October 2010 Where – Field / Yemen, Dubai, Köln/Bonn airport, East Midlands airport, Chicago; Area several aircrafts, among them commercial passenger jets Who Terrorist group “Al Qaeda in the Arabian Peninsula” (AQAP) claimed to be responsible Event Description Two packages were sent from Yemen to outdated addresses of Jewish synagogues in Chicago containing odourless plastic explosives hidden inside the printer cartridges of two printers. The Saudi Arabian secret service had gained knowledge of the bomb plot and relayed that knowledge to the German authorities among others. The first package was processed in Dubai and at Köln/Bonn airport without the bomb being detected and flown to East Midlands airport near Nottingham/Leicester. From there it was supposed to travel to Chicago via Philadelphia. The bomb was only detected and (inadvertently) disarmed after US authorities provided Scotland Yard with the tracking number of the package and even then only after the US authorities put pressure on British officials to inspect the package a second time. The second package was discovered on a cargo plane at Dubai airport. Effects and impacts The bombs would have destroyed two airplanes in mid-air, presumably shortly before landing in the USA. The bombs would probably have been transported by passenger planes during their transatlantic voyage. Restrictions for the import of cargo from Yemen were put in place. For two weeks passenger flights from Yemen to Germany were suspended. The Federal government recognised the need for a more thorough inspection of transit and transfer cargo after being criticised for the fact that the bomb reloaded at Köln/Bonn airport was not

30 discovered by security. SMT / CIT involved Cargo screening; Qatar Airways and German Federal Criminal Police officials stated that the bombs could not have been detected by sniffer dogs, explosives detection equipment or X-ray screening due to their sophisticated nature (plastic explosives hidden inside printer cartridges). In fact the first package cleared inspections in Dubai, Germany and the United Kingdom. Only the intelligence gained through a defector from the AQAP by the Saudi Arabian secret service made it possible to prevent the attacks. The terrorists had previously sent three dummy packages as a test drive for their attacks. Other issues The incident shows, that it is possible to outsmart current detection involved mechanisms using sophisticated bomb designs. Security challenges Cargo screening needs to be improved. Sources http://www.spiegel.de/politik/ausland/0,1518,726310,00.html; http://www.telegraph.co.uk/news/uknews/terrorism-in-the- uk/8124226/Cargo-plane-bomb-plot-ink-cartridge-bomb-timed-to- blow-up-over-US.html; http://en.wikipedia.org/wiki/Cargo_planes_bomb_plot; http://www.n-tv.de/politik/Bomben-Paket-fliegt-ueber-Koeln- article1825561.html; http://www.welt.de/print/die_welt/politik/article10680637/Paketbo mbe-war-drei-Stunden-in-Deutschland.html.

Past Event G 10 Name Discovery of a dummy bomb in Windhoek Category of security Terrorism event Type of event Bombing Date 17 November 2010 Where – Field / Hosea Kutako International Airport in Windhoek, Namibia Area Who The local airport security chief was arrested on 20 November 2010 and confessed that he had placed the dummy. Event Description During the loading of Air Berlin flight AB 7377 (an Airbus A330) destined for Munich, a suitcase attracted attention. It had a sticker saying “Test” on it, but otherwise no markings. Using an X-ray machine, security noticed batteries connected to a detonator and a running clock. Hours later, experts of the Federal Criminal Police arrived in Windhoek and discovered that the suitcase was a dummy bomb used to test airport security and did not contain any explosives (bomb simulator made by US company Larry Copello Inc., “Realtest- Koffer”). 27 hours after the dummy was found, German minister of the interior, Thomas de Maizière, told the press that the suitcase did not contain a real bomb.

31 However, it remained unclear who had placed the dummy. Local authorities denied any involvement. Soon speculations ran wild. German authorities speculated that a foreign secret service might be responsible, but failed to inform Namibian and German authorities about the test. Others conjectured that a German agency was responsible, but was now too embarrassed to admit its involvement. It was finally discovered that the airport security chief at Windhoek airport was the responsible party. Effects and impacts A few hours before the dummy was found, minister de Maizière had issued an unusually explicit terror warning about an attack planned for the end of November 2010 without giving any further details. Together with the news of the bomb in Namibia, this attracted significant media attention. Even after the alleged bomb was revealed to be a dummy, Matthias Seeger, head of the Federal Police, said in an interview with tabloid newspaper BILD that the threat of a terrorist attack in Germany was higher than ever: “On a scale from one – no threat – to ten – immediate threat – we are at 9.0” (“Auf einer Skala von eins - keine Gefahr - bis zehn – akute Anschlagsgefahr - liegen wir im Moment bei 9,0”). The heightened state of alert in Germany which was instructed even before the events in Windhoek was sustained until the end of 2010. SMT / CIT involved After the dummy was found, the Air Berlin aircraft was unloaded, the passengers questioned and the crew replaced. After a delay of six hours, the plane finally departed. Passengers and luggage were again screened upon arrival at Munich’s Franz-Josef-Strauß-Airport. X-ray, vigilance of local security personnel, sniffer dogs. Other issues - involved Security challenges - Sources http://www.spiegel.de/politik/ausland/0,1518,730543,00.html#ref=rs s; http://www.spiegel.de/politik/deutschland/0,1518,729836,00.html; http://www.stern.de/politik/deutschland/terrorverdacht-in-namibia- kofferbombe-war-wohl-eine-attrappe-1625480.html; http://www.reisenews-online.de/2010/11/18/namibia-kofferbombe- fuer-deutschen-flug-entdeckt/.

Past Event G 11 Name Frankfurt airport shooting Category of security Terrorism event Type of event Shooting Date 2 March 2011 Where – Field / Frankfurt am Main airport, a US military bus in front of terminal 2 Area

32 Who Arid Uka (age 21), born in Kosovo, but raised in Germany, employed as a substitute at the International post office near terminal 2 of Frankfurt airport; radical Islamist with ties to radical groups, but presumably not connected to any terrorist groups Event Description The shooter approached the bus which had about a dozen soldiers aboard and which was waiting at a bus stop in front of the terminal building. He then shot a soldier standing in front of the bus. After that he shot the bus driver who was sitting behind the wheel and went inside the bus where he fired at two other soldiers. After having fired a total of nine shots, a stoppage of gun prevented him from firing more shots and he tried to flee the scene of the crime, but was overwhelmed and arrested almost immediately by German police officers. The American military busses at Frankfurt airport are used to transport returning soldiers back to their bases. Effects and impacts 2 American Air Force soldiers died, 2 were severely injured. Police increased their presence at the airport; officers who patrol the area now wear bullet proof vests and carry machine guns; use of more undercover agents at the airport. This event is the first Islamist terrorist attack on German soil that could not be prevented and that resulted in casualties. It is therefore of great significance. SMT / CIT involved - Other issues The shooter stated that the motivation behind his actions was his hatred involved towards US soldiers which he developed after seeing a video on the internet allegedly showing US soldiers plundering a house in Afghanistan and raping a girl. He also stated that he overheard US soldiers at the airport making derogatory remarks about the people of Afghanistan. This triggered an urge to kill US soldiers, especially those travelling to Afghanistan. Security challenges - Sources Obert, M., Der Rätselhafte, Frankfurter Rundschau, Panorama, 9.3.2011 http://en.wikipedia.org/wiki/2011_Frankfurt_Airport_shooting; http://www.spiegel.de/thema/anschlag_frankfurter_flughafen_2011/; http://www.sueddeutsche.de/politik/attentat-auf-frankfurter-flughafen- allahu-akhbar-und-neun-schuesse-1.1067703; http://www.focus.de/politik/weitere-meldungen/frankfurter-flughafen- attentaeter-ist-erster-home-grown-terrorist- deutschlands_aid_605302.html.

Past Event G 12 Name “Düsseldorf cell” (Düsseldorfer Zelle) Category of security Terrorism event Type of event Bombing Date 29 April 2011 (date of arrest) Where – Field / Düsseldorf Area

33 Who Abdeladim el-K. (age 29, contacts to high-ranking al Qaeda members, group leader), Jamil S. (age 31) and Amit C. (age 19, student, about to get his A-levels); all members of al Qaeda; two originally from Morocco, one from Iran, but they had lived in Germany for some time; Abdeladim K.’s residence permit had expired in November 2010; el-K. was trained at a terror camp. Event Description Police arrested the group members after overhearing through listening devices that their search for bomb components and building instructions was getting more and more concrete. This was the moment, when evidence became sufficient to start a preliminary investigation by public prosecution. The arrests took place in Düsseldorf and Bochum. Before that they had bought chemicals that can be used to construct bombs and were on the verge of building and testing a bomb. Effects and impacts Three al Qaeda members were planning an attack on the public transport system of a major German city, but had not yet decided on a specific target. They discussed attacks on a bus stop or a bus shortly before police intervened. They were seeking a high number of fatalities. During a press conference, Jörg Ziercke, head of the Federal Criminal Police said: “We cannot give the all-clear!” (“Wir können keine Entwarnung geben!”). Hans-Peter Friedrich, minister of the interior, stated that Germany „is still in the cross hairs of international terrorists“. SMT / CIT involved A special task force of the Federal Criminal Police (“Komet”) had been tailing the members of the group for six months before the arrest took place. CIA and Moroccan secret service were also involved. Online searching of computers / spyware, acoustic surveillance. For the first time, the German Federal Police used the full force of all available methods of investigation. Other issues The scope of the case was smaller than that of the “Sauerland group” involved case (see above), but there were many similarities (e.g. the use of certain chemicals). Interior minister Hans-Peter Friedrich stated that flight passenger data that was transmitted from the U.S. was instrumental in this case. U.S. authorities had alerted German police to suspicious travel patterns of members of the Düsseldorf cell. German magazine “Der Spiegel” claims that an average of five Islamists leaves Germany every month to be trained at a terrorist training camp. At least 220 persons from Germany were trained at a terror camp in the last decade; half of them returned to Germany afterwards. Security challenges - Sources http://www.spiegel.de/politik/deutschland/0,1518,759842,00.html; http://www.tagesschau.de/inland/alkaidafestnahme102.html; http://www.swr.de/blog/terrorismus/2011/04/30/ziercke-wir-

34 konnen-keine-entwarnung-geben/; http://www.spiegel.de/politik/deutschland/0,1518,759741,00.html, http://www.spiegel.de/politik/deutschland/0,1518,760983,00.html. Rosenbach, M., Stark, H., Eine Bombe für Deutschland, Der Spiegel 19/2011, 7.5.2011., p. 28-33.

Past Event G13 Name Arson attack on a cable bridge in Berlin Category of security Terrorism event Type of event Date 23 May 2011 Where – Field / A cable bridge leading hundreds of cables over Markgrafendamm Area street at Berlin-Ostkreuz railway station. Ostkreuz station is a major junction for railway traffic. Who Unknown, but police assumes that there is a left-wing autonomous background. Event Description A cable bridge was set on fire on Monday morning using flammable liquids. The fire destroyed most cables until it was finally extinguished at 4:30am. An anonymous claim of responsibility was distributed over the internet, quoting “anti-nuclear”, “anti-militarism” and “anti-racism” to justify the deed. Effects and impacts The attack shut down a significant part of railway traffic in Berlin for hours and had a severe impact especially on commuter traffic. The arson attack brought several railway control centres offline and severed railway communication lines. Tens of thousands of railway passengers and both intercity travel and mass transit were affected by cancellations and severe delays that lasted until late Tuesday. Additionally, the fire resulted in a massive disruption of the Vodafone telephone network which affected tens of thousands of Vodafone customers in Berlin and Brandenburg. The economic damage due to the impact on commuter traffic is unknown. SMT / CIT involved - Other issues Over the years, the Deutsche Bahn (German railway company) has involved been the target of a large number of attacks against railway overhead contact lines and locomotives that occurred all over Germany. A similar, but less severe arson attack (also attributed to far-left radicals) occurred in Berlin on 1 November 2010. Security challenges Protection of peripheral infrastructure Sources http://www.spiegel.de/politik/deutschland/0,1518,764475,00.html; http://www.rbb-

35 online.de/nachrichten/vermischtes/2011_05/bahnverkehr_nach_kab elbrand.html; http://www.morgenpost.de/berlin- aktuell/article1648708/Zugverkehr-in-Berlin-bricht-nach-Brand- zusammen.html.

Past Event G 14 Name Hijacking of Lufthansa Flight 649 in 1972 Category of security Terrorism event Type of event Hijacking Date 22 / 23 February 1972 Where – Field / Lufthansa Boeing 747 “Baden-Württemberg” (flight LH 649) travelling Area from Tokyo to Frankfurt am Main via Delhi-Palam Airport is hijacked in the skies over India and brought to Aden (South Yemen) Who 5 Palestinian hijackers of the “Popular Front for the Liberation of Palestine” (PFLP), the same organisation as behind the “Landshut” hijacking in 1977 and the hijacking of an Air France plane in 1976, led by Wadi Haddad aka Abu Hani Event Description On 22 February 1972, the hijackers seized control over the airplane shortly after takeoff from Delhi-Palam airport (today: Indira Ghandi International Airport) using firearms. An unknown PFLP member had already sent a ransom note written in English demanding an unknown sum of money and the release of three Jordanians under arrest in West Germany. It arrived a few hours after the hijacking at the Lufthansa offices in Köln bearing a Köln postmark. The deadline given was 9 am of the following day (23 February). In Yemen, the hijackers threatened to blow up the aircraft, killing all hostages. The German authorities decided to comply with the demands and to follow the terrorists’ demands to the letter in order to save the lives of the hostages. After successful negotiations with Nasser Muhammad, prime minister of South Yemen, whose government was amongst the supporters of terrorist groups, a Lufthansa security officer took $5m in cash to Beirut in Lebanon. There he picked up a car whose keys had been sent together with the ransom note. He was wearing identifiable clothes and carried a copy of Newsweek magazine as instructed by the kidnappers. In the car, PFLP members had left a note with further instructions. The Lufthansa officer was told to drive a predetermined route around Beirut until the car was finally stopped by PFLP members. He handed over the money and was in turn given a code word which was forwarded to the hijackers in Aden. This signalled the delivery of the ransom money and that the hijacking had been a success.

36 In return, the hostages were released: first women and children, then the other passengers, finally the crew and the aircraft itself. Explosives experts disarmed the bombs that had been planted on the aircraft. The South Yemen government is said to have received $ 1m of the $ 5m ransom as “landing fees” from the hijackers. Effects and impacts The hijackers took 186 hostages (172 passengers + 14 crew). The fact that the German government was giving in to the demands of the hijackers may have encouraged future hijackings. SMT / CIT involved Lack of proper passenger / luggage screening, no protection of the cockpit from intrusion Other issues At that time, $ 5m was the biggest sum ever paid as ransom for an involved aircraft. Originally, the hijackers had intended to take the aircraft to Amman in Jordan, but abandoned that plan after the pilot told them that the plane was too big to land there. Among the passengers was 19 year-old Joseph Patrick Kennedy II., son of Robert Francis Kennedy. Lufthansa paid the $ 5m ransom and was later compensated by the German government. Georg Leber, German minister of transportation, told the press that the whole operation was so elaborate and well planned that the hijackers themselves were most likely only subordinates in a large terrorist network, taking orders from unknown wire pullers. Security challenges Sources http://news.bbc.co.uk/onthisday/hi/dates/stories/february/23/newsi d_2518000/2518731.stm; http://www.guardian.co.uk/theguardian/2011/feb/26/bonn-paid- 5million-ransom.

Past Event G 15 Name Hijacking of a Slovair twin-engined aircraft Category of Illegal immigration / terrorism security event Type of event Hijacking Date 8 June 1972 Where – Field / Slovair flight (a Let L-410A with 17 passenger seats) travelling from Area Mariánské Lázně, Czechoslovakia (German: Marienbad) to Prague is hijacked and taken to Weiden in der Oberpfalz, a town in Bavaria near the German-Czechoslovakian border. Who A group of ten Czechoslovakians (7 men and 3 women, one with an infant): Lubomir Adamica (age 22, leader of the group), Milan Trcka (age 21), Jiri Vochomurka (age 21) and others between age 18 and 23; all seeking refuge in West Germany Event Description The hijackers entered the aircraft with the regular passengers. Two of the women carried handguns in their underpants while the men carried

37 cola bottles. Shortly after takeoff Adamica signalled the others to begin the attack by taking off his jacket. Two of the passengers were struck down with the cola bottles. The other passengers were threatened with one of the guns that had been snuck aboard. Then Vochomurka and Adamica went to the cockpit to force the two pilots to change course. The pilots resisted and in the following brawl Adamica shot pilot Ján Micica in the throat. Co-pilot Dominik Chrobák then ceased his resistance and flew the aircraft to Latsch airport near Weiden in der Oberpfalz, his dying colleague in his lap. The hijackers were taken into police custody without resistance as soon as the plane landed. Effects and 4 passengers and 2 crew members were taken hostage; the pilot was impacts shot in a scuffle and died. The large number of skyjackings in the early 1970s led to a change in the treatment of air pirates that tried to escape the Eastern bloc. While in the beginning, many received a hero’s welcome upon arrival on the West, the criminal energy and brutality behind some of the following skyjackings in conjunction with attempts to improve political relationships with the Communist bloc changed that. § 316c was installed into the German Criminal Code which made skyjacking a distinguishable crime and the perpetrators were denied political asylum (before that skyjackers were usually charged with illegal restraint and duress, but granted asylum). SMT / CIT - involved Other issues Adamica, the shooter, hanged himself in January 1973 while he was in involved pre-trial custody. Trcka also attempted to commit suicide, but failed. Security challenges - Sources http://www.spiegel.de/spiegel/print/d-42602458.html; http://www.spiegel.de/spiegel/print/d-41911334.html; http://sk.wikipedia.org/wiki/Únos_lietadla_do_NSR_dňa_8._júna_1972.

Past Event G 16 Name Hijacking of Lufthansa Flight 615, “Kiel Entführung” (Kiel hijacking, after the name of the aircraft) Category of security Terrorism event Type of event Hijacking Date 29 October 1972 Where – Field / Flight Lufthansa LH 615 (a Boeing 727) travelling from Beirut via Area Ankara to Frankfurt am Main is hijacked north of Cyprus and taken to Zagreb airport; after their demands are met, the hijackers take the aircraft to Tripoli. Who 2 unknown members (one called himself “Abu Ali”) of the terrorist group “Black September”, the same group responsible for the “Munich massacre” a month earlier

38 Event Description The two hijackers entered the aircraft in Beirut as passengers. North of Cyprus they entered the cockpit, produced handguns and forced the pilot, Walter Claussen, to take the plane to Zagreb after refuelling in Cyprus. The hijackers demanded the release of the three terrorists who had survived the “Munich massacre” and who were at that time incarcerated in Bavarian prisons (Sammar Abdullah, Abdul Kader Dannawi and Ibrahim Badran) and safe passage to a friendly Arab country. In Zagreb, the aircraft was again refuelled and brought to Riem Airport München where the three prisoners were to be exchanged with the hostages. But the hijackers chose not to touch down on the airport, which was surrounded by police. Instead they circled over Nürnberg for a while until negotiations with the German authorities ultimately failed and then ordered Claussen to take them back to Zagreb where they again circled the airport without touching down. The prisoners had in fact been released under unknown circumstances and were taken to München, from where (after the exchange had failed) they took off in a private aircraft led by Lufthansa CEO Herbert Culmann. The plane was ordered not to leave German airspace until an agreement had been reached with the hijackers. When he heard that the “Kiel” circling Zagreb airport was almost out of fuel and the hijackers were threatening to blow up the aircraft, Culmann decided to take the prisoners to Zagreb without consulting the crisis team in Bonn and to make an exchange on the hijackers’ terms. Upon their last minute arrival in Zagreb (the “Kiel” had only one minute of fuel remaining when Culmann’s plane touched down and the hijackers gave the order to land), the prisoners joined with the hijackers aboard the “Kiel”, but without fuel the aircraft was unable to leave the airport. In response, the hijackers threatened to detonate their explosives once again, thus killing everybody aboard the plane, unless they were provided with fuel. They had hidden explosives everywhere on the aircraft. Kurt Laqueur, local German consul general, gave in to their demands (despite being under orders not to do so) and the aircraft went to Tripoli where all hostages and the aircraft were released. Effects and impacts Laqueur’s lone decision to fuel the aircraft against his orders is still controversial. Lufthansa CEO Herbert Culmann called him a hero who saved the lives of the hostages, while Bavarian minister of the interior Bruno Merk stated that Laqueur gave way for the victory of brutal extortion. During the re-election campaign of chancellor Willy Brandt, the opposition called the events a “humiliation” for West Germany. Ulrich Wegener, then aide of minister of the interior Hans-Dietrich Genscher, later said in an interview: “At this time the German government thought they could negotiate with terrorists … to get rid of them”. Some sources claim that the hijacking was staged as a cover story to

39 make it possible to release the three terrorists who survived the “Munich massacre” only a few weeks earlier and who were at that time jailed in Germany. Those three terrorists were in fact released when the German government complied with the demands of the hijackers (see above). It is alleged that German officials agreed to the hijacking as a cover to get rid of the jailed terrorist because of their fear of “real” retaliatory measures to free them. Chancellor Willy Brandt denied that a secret deal was made with the terrorists. SMT / CIT involved Lack of proper screening at Beirut airport, no protection of the cockpit from intrusion Other issues The events put considerable pressure on the relationship between involved West Germany and Israel. Security challenges - Sources http://www.time.com/time/magazine/article/0,9171,910445,00.html ; http://de.wikipedia.org/wiki/Kurt_Laqueur; http://www.spiegel.de/spiegel/print/d-41443421.html; http://www.guardian.co.uk/world/2000/mar/26/jasonburke.theobse rver1.

Past Event G 17 Name Hijacking of Lufthansa Flight 181, “Landshut Entführung” (Landshut hijacking, after the name of the aircraft) Category of security Terrorim event Type of event Hijacking Date 13 – 18 October 1977 Where – Field / Flight Lufthansa LH 181 (a Boeing 737) travelling from Palma de Area Mallorca to Frankfurt am Main is hijacked as it passes over Marseille, then taken to Mogadishu with stops in Rome, Cyprus, Bahrain, Dubai and Aden. Who 4 members (two men, two women) of a terror commando called “Martyr Halimeh” of the “Popular Front for the Liberation of Palestine” with close ties to the German terrorist group “Rote Armee Fraktion (RAF)”: Zohair Youssif Akache (age 23), Suheila Sayeh (age 24),Wabil Harb (age 23) and Hind Alameh (age 22) Event Description The four terrorists managed to smuggle aboard two pistols, four hand grenades and 500g of plastic explosives hidden in vanity cases and a radio. The aircraft was hijacked in French airspace over the Mediterranean Sea. It was then that Akache burst into the cockpit with a handgun. The aircraft was first lead to Rome, where it was refuelled. In Rome the terrorists articulated their demands which were identical to those of the kidnappers of Hanns Martin Schleyer (see below, “Other issues”): the release of eleven RAF-terrorists incarcerated in Germany. Additionally they demanded $ 15m and the release of two

40 persons from a Turkish prison. During a stop in Aden pilot Jürgen Schumann was shot by the terrorists after they had allowed him to leave the aircraft to inspect the tires after the rough landing in Aden; the aircraft was then piloted by co-pilot Jürgen Vietor. The plane arrived in Mogadishu on 17 October at 4:34 am after several countries had refused to open their airports to the terrorists. Here the kidnappers issued an ultimatum to release the RAF-terrorists from prison and are duped into believing that their demands were being followed to gain time. The kidnappers poured alcohol over the passengers and readied their explosives. The government of Somalia which was friendly towards the Palestinians was told that the kidnappers were Germans (a lie) and promised weapons to help Somalia in its war with Ethiopia. In turn the government of Somalia agreed to a rescue operation. Fake update reports on the pretended release of the RAF-prisoners were fed to the hijackers. On 18 October at 0:05 am CET a team of the GSG-9 (an elite counter- terrorism and special operations unit of the German Federal Police established after the Munich massacre), which had been following the Landshut on her journey, stormed the aircraft (“Operation Feuerzauber” / operation fire magic). After seven minutes three of the four hijackers were dead and the fourth apprehended without casualties among the passengers and the crew. A GSG-9 officer, a stewardess and three passengers were slightly injured, however. Effects and impacts The aircraft had 82 passengers and 5 crew members on board (not including the hijackers); one hostage (the pilot) was shot by the hijackers. The GSG-9 achieved prominence after the successful rescue operation. The German government stated that it would continue its policy not to negotiate with terrorists. Chancellor Helmut Schmidt, who later stated that he would have resigned if there had been casualties among the hostages during the rescue operation, was praised for his management of the crisis. SMT / CIT involved Lack of proper screening of luggage at Palma de Mallorca airport, no protection of the cockpit from intrusion, counter-terrorism police unit Other issues This terrorist attack was part of the so-called “Deutscher Herbst” involved (German autumn) during which a series of terrorist activities struck Germany. This in turn was part of the “Offensive 77” of the left- radical terrorist group “Rote Armee Fraktion” (Red Army Faction, RAF) in which the so-called “Second Generation” of the group tried to force the release of the imprisoned members of the “First Generation”. The Landshut hijacking was closely tied to the kidnapping of Hanns Martin Schleyer, industrialist and president of the Confederation of German Employers’ Association (BDA) and of the Federation of German Industries (BDI), on 5 September 1977. Schleyer was killed by his captors on 18 October 1977, after the

41 Landshut hijacking had come to an end. In the night before, the leaders of the “First Generation” (Baader, Ensslin, Raspe) had committed suicide in the maximum security prison of Stuttgart- Stammheim penitentiary which prompted the murder of Schleyer. Security challenges Sources http://en.wikipedia.org/wiki/Lufthansa_Flight_181; http://de.wikipedia.org/wiki/Entführung_des_Flugzeugs_Landshut http://nachrichten.t-online.de/zeitgeschichte-die-landshut- entfuehrung-108-stunden-in-der-hoelle/id_12999754/index; http://www.welt.de/politik/article1259970/Der_Albtraum_der_Lands hut_Entfuehrung.html; http://einestages.spiegel.de/static/topicalbumbackground/2845/_wo _sind_die_schweine.html.

.

42 Israel

Sixteen different recent security events related to the mass transportation infrastructures found in Israel. All events are linked to one of the two largest and most important public transportation systems in Israel: Ben-Gurion International Airport (BGIA) and the Israeli Railway. The events are categorized as either related to terrorists' activities, Cyber events (e.g. radio / GPS interference), criminal activity or illegal immigration.

Information about the events was obtained from interviews conducted with security personnel in both BGIA and the Railway. Additional information was found in the printed and online media.

Past Event IL1 1 Name The Pretty Woman Category of 2 Terrorism security event* 3 Type of event* Suicide bombing 4 Date January 1984 Where - Field / Ben Gurion International Airport (BGIA) and Athens international 5 Area airports 6 Who 15 May terrorist organization Operated by the 15 May terrorist organization, a female British citizen messenger was sent to Israel with a sealed suitcase filled with explosives, which was set to explode on air or in the airport. The messenger wasn't aware of the explosive device and did not even carry the key to the locked suitcase. Her good look and sense of fashion combined with her ability to develop small talk with the controllers probably helped her skip comprehensive checks and she boarded the plane unchecked. She flew with El-Al from Athens to Tel-Aviv (BGIA)

Fortunately for her and for her fellow passengers, there was a failure with the explosion mechanism and the suitcase did not explode. The messenger, unaware of her good luck, stayed in a hotel in Israel with the suitcase for a few days. After a while she went back abroad with the suitcase, this time as an outgoing passenger from Ben-Gurion to 7 Event Description Athens. Still the booby trapped suitcase was not identified and fortunately – did not explode as well.

The incident was only recognized three months after the actual boarding, when some of the perpetrators involved were caught in the UK for other reasons. They weren't aware of the failure of the explosive device, so the law keepers who searched the messenger’s apartment in Athens were surprised to find the sealed suitcase inside, still filled with the explosives. The suitcase was given to the woman by a Jordanian named Fouad Abdallah. He was arrested in April 1984 by British and American agents in a raid in his apartment in Athens. The Greek authorities released him and provided him safe passage to Algeria. He was finally arrested in 1990 and taken to Israel, where he was sentenced to 25-years in prison.

43 .

Practically there was no impact on the public which was not aware to the event. The security forces in BGIA, however, changed the checking process so that each passenger was questioned by two security men not at the same time, The controllers met together immediately 8 Effects and impacts afterwards to confirm they both received the same information. Since the time of the incident, it was concluded that locked suitcases without keys are a suspicious sign which should cause a special treatment of the passenger. Profiling method: relying on suspicious signals to determine which level 9 SMT / CIT involved of potential security threat should be assigned to the passenger. Other issues 10 - involved The questioning method proved inadequate in filtering potential 11 Security Challenges security threats. It was since combined with a luggage check for every passenger. http://www.crowell.com/PDF/UTA-Flight-772/20_Caprioli_Report.pdf (p23) Sources http://fresnozionism.org/2010/01/the-greeks-had-a-word-for-it- hypocrisy/ http://meria.idc.ac.il/journal/1999/issue2/jv3n2a4.html Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents * / agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL2

1 Name Explosives on the Railways – 1 Category of 2 security event* Terrorism 3 Type of event* Failed attempt to blow up a train 4 Date 17/5/2001 Near Binyamina – a small town in Israel. Despite its small size the station in 5 Where - Field / Binyamina serves practically all the trains between the northern and central Area areas of Israel. 6 Who Unknown A small explosive device was placed on the railway between Binyamina and Zikhron-Ya’akov. The explosive was activated by contact with the train not using remote-control elements. Traces of batteries and wires were found in the area. Event 7 Description The explosion occurred exactly when a train carrying passengers went down the railway, but caused no damage to the tracks, other than creating a shallow hole between the tracks and causing very light damage to the headlights of the locomotive.

44 Investigation of the scene revealed that the device was placed in a hurry between the tracks and no attempt was made to destroy the tracks themselves by planting the explosives under them.

Further investigation revieled that the perpetrators apparently reached and left the place using a quad (all-terrain vehicle). Infrastructur Light, almost insignificant damage to the railway and the e locomotive. The railway traffic, however, was cut off for most of the day. Economy This was the first terrorist attack against the train, and caused much anxiety to people. Although exact financial Effects and 8 damages cannot be easily estimated, it is likely that many impacts potential passengers were discouraged from using the train again Political The event was one of many terrorist attacks between the years 2000 and 2003, most often initiated and perpetrated by Palestinian organizations with a political agenda. The free-range railways in Israel are generally protected at best with a fence SMT / CIT 9 and at worst are exposed to the road. Therefore, no SMT was used to involved prevent the incident. The director of the train company mentioned that a much larger and Other issues 10 heavier explosive device is needed to blow up a train. This results in future involved assessments of such events. Security Developing ways to prevent explosive devices from being placed on the 11 Challenges railway. http://www.ynet.co.il/articles/0,7340,L-742790,00.html sources http://news.walla.co.il/?w=/21/62586 http://www.haaretz.co.il/hasite/pages/ShArt.jhtml?itemNo=35628&contrassID=0 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL3

1 Name Piracy on the Air - 1 Category of 2 Radio and GPS Interference / Terrorism security event* Radio communication at frequencies used by BGIA caused a disturbance in 3 Type of event* the proper order of work 4 Date 18/6/2001 5 Where-Field/Area BGIA 6 Who Palestinian pirate radio stations An IsraAir's airplane was forced to make an emergency landing in BGIA at night due to unspecified circumstances. The communication between the pilots and the control tower was heavily disrupted by radio transmissions from a pirate radio station located in a village near Tul Karem, which is in 7 Event Description the territory of the Palestinian Authority. Luckily, the airplane still managed to make the emergency landing safely. Although BGIA's authorities informed the Ministry of Communication of the incident, the disruptions in radio communication only worsened the next

45 morning and caused delays in leaving and incoming flights. The flight controllers were forced to constantly switch radio frequencies to bypass the interferences. A day later, the Palestinian Authority yielded to the demands of the Prime Minister Office and shut down the station. Ironically, the station itself, Kol Hashalom (Voice of Peace) belonged to a radical-left movement in Israel, and most of its broadcasts consisted of peace songs. People Luckily, the airplane managed to land safely, with all 34 passengers unharmed. Values The incident served to bring to light the danger posed by pirate radio stations both in Israel and in the Palestinian Authority. It changed the attitude of the public towards Effects and the pirate stations. 8 impacts Political The incident resulted in a political pressure on the Palestinian Authority to shut down pirate stations. Economy There were claims that IsraAir, whose plane made the emergency landing, tried to divert the attention from the original failure of the airplane to the pirate radio broadcasts, to minimize damages to its reputation. 9 SMT/CIT involved The main issues here were solved outside the airport, by political pressure. The media assisted in bringing the incident to the public attention, hence encouraging the government to take care of it. Other issues 10 involved The same technology that was used by peace activists for peaceful purposes could also be used more effectively by terrorists to prevent landing and uptake of airplanes. Security Developing measures to withstand serious interferences in the radio 11 Challenges communication between the control tower and airplanes. http://news.walla.co.il/?w=/9/75800 sources http://news.walla.co.il/?w=/21/76161 http://www.thevoiceofpeace.co.il/ Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL4

1 Name Suicide Bombing in Train Station – 1 Category of 2 security event* Terrorism 3 Type of event* Failed attempt to perform a suicide bombing attack in a train station 4 Date 16/7/2001 Where- 5 Field/Area Outside the train station in the city of Binyamina 6 Who Hamas and the Islamic JAyad terrorist organizations. According to police reports, the terrorist arrived at Binyamina train station Event 7 at 19:35. Another driver brought him to the station, but left the perimeter Description immediately. It is unknown whether or not the driver realized what his

46 passenger had in mind. He was a youngster at his early twenties, well-shaved and well-dressed, and carrying an explosive device that contained nails and metal strips designed to be ripped to shrapnel by the blast. His plan was apparently to conduct the attack at the station platform, or go into one of the trains and explode inside. Since the station had additional security forces at that time, he did not go into the station but waited at the nearby bus station from across the road. He waited for train passengers to leave the train and reach the bus station before activating the explosive device. The police confirmed that there were warnings concerning a specific terrorist attack in the train station in Binyamina, which is the reason the security forces in the station were bolstered, including placing detectives posing as civilians. People Two passengers were killed, and eleven injured were evacuated to the hospital, three of them in a severe state. Economy As in any terrorist attack, this one heightened the state of fright which caused people to avoid the train. Political The event was one of many terrorist attacks between the years 2000 and 2003, most often initiated and Effects and 8 perpetrated by Palestinian organizations with a impacts political agenda. According to the Israeli cabinet’s policy at the time, Israel decided to retaliate against every terrorist attack. The Palestinian Authority denunciated the attack. Infrastructure The explosion demolished the bus station, as well as two cars that stopped by to pick-up passengers. SMT / CIT It is clear that the human-based measures at the entry point to the station 9 involved deterred the terrorist from making an attempt at the train station itself. Other issues It is believed that the terrorist received aid by another person who drove 10 involved him to the spot, but did not necessarily know his intentions. Security Possibly protecting both the train station area, and the area immediately 11 Challenges surrounding it. sources http://www.haaretz.co.il/hasite/pages/ShArt.jhtml?itemNo=52747&contrassID=0 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL5

1 Name Suicide Bombing in Train Station – 2 Category of 2 security event* Terrorism Type of 3 event* Failed attempt to perform a suicide bombing attack in a train station 4 Date 18/9/2001

47 Where - Field 5 / Area Near the train station in the city of Nahariya. 6 Who Hamas and the Islamic JAyad terrorist organizations. A few days before the attack, the terrorist left his village of Abu-Snan, where he was the head of the Islamic Movement and was a past-candidate to the position of mayor. He spent a few days in the territory of the Palestinian Authority, and infiltrated his way back into Israel a short time before the incident. The ISA (Israel Security Agency, "Shabak") notified the Palestinian Event Authority that the man made contact with the Hamas in the Strip, but the 7 Description Authority claimed that the terrorist was not in their territory at the time. The attack happened twenty meters away from the train station in the center of Nahariya. A policeman noticed the terrorist waiting for passenger coming down from the train, and tried to apprehend the man. The terrorist fled and eventually blew himself up, with an explosion so massive it was heard throughout large parts of the city. People The hospital in Nahariya received seventy injured people, eight of them carrying severe burns. The attack eventually cost the lives of three people. Economy As in any terrorist attack, this one heightened the state of fright which caused people to avoid the train. Political The event was one of many terrorist attacks between the Effects and years 2000 and 2003, most often initiated and perpetrated 8 impacts by Palestinian organizations with a political agenda. The event triggered a clash between the citizens of Abu- Snan, of which half are Muslims, a third Druze and the rest are Christians. The Druze residents threatened to take revenge on the Muslim residents after the incident. Infrastructure The train infrastructure was not harmed. The train line to Nahariya, however, was cut off for a few hours. It would appear that the security forces at the entrance to the train station deterred the terrorist from attempting to enter the station. SMT / CIT Although the deterrence can be counted as a success, this terrorist attack 9 involved caused a radical change in the profiling system, since the terrorist did not fit the usual profiles of terrorists. He was 48 years old, a well-known and respected religious person, and married with children. His son, a devout Muslim and 20 years old, was arrested later by the police. It Other issues 10 was suspected that he assisted his father in the attack. involved

While demonstrating the incapability of the profiling system to detect all threats, the fact that the terrorist could not (or would not) enter the station proved the importance of the security forces at the entrance to the station. Security 11 Seeing as the policeman identified the terrorist, but could not stop him and Challenges avoid the explosion, it is obvious that an SMT that will allow the security guards to stop the terrorists at a distance from the station's entrance would be very useful. This is one of the top priority security challenges today. http://www.ynet.co.il/articles/0,7340,L-1098668,00.html sources http://www.ynet.co.il/articles/1,7340,L-1099128,00.html http://news.walla.co.il/?w=/9/113492

48 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents * / agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL6

1 Name Explosives on the Railways – 2 Category of 2 security event* Terrorism 3 Type of event* Failed attempt to blow up a train 4 Date 30/6/2002 Where - Field / 5 Area On the railway near the city of Lod. 6 Who Unknown, but estimated to be a Palestinian terrorist organization. An explosive device weighing 5 kgs was placed on the railway near the small city of Lod. The device contained steel shrapnel as well as explosive material. Event The device exploded at 7:20 in the morning when the train passed over it, two 7 Description kilometres from the nearby train station. One of the indirect effects of the event was that during follow-up investigation of the area, illegal immigrants were located nearby. Infrastructur The explosion caused a hole in the ground, but the railway e itself was not damaged. The bottom of the first passenger cabin was only slightly damaged. Economy As in any terrorist attack, this one heightened the state of fright which caused people to avoid the train. The travelling fees of the train were raised by 7% the following day, partly because of the need to fund extra- security. Political The event was one of many terrorist attacks between the years 2000 and 2003, most often initiated and perpetrated by Palestinian organizations with a political agenda. Effects and 8 Thirty Palestinians illegal immigrants, who were found in the impacts neighbourhoods near the train station, were taken into arrest and questioned. Infrastructur The explosion caused a hole in the ground, but the railway e itself was not damaged. Following the incident, the fire fighting services decided to form a special committee that would look into methods to rescue passengers trapped in a burning train that was involved in a terrorist attack. As a result of this event and the previous attempts at sabotaging the railways, an option to separate the railways from the roads by bridges was taken into consideration. The free-range railways in Israel are generally protected at best with a fence, SMT / CIT and at worst are exposed to the road. No other SMT was used to prevent the 9 involved incident, beside patrols along the rails. Closed spaces (e.g. tunnels) are also protected by cameras. Other issues The railway traffic between Tel-Aviv and Lod was stopped for four hours 10 involved following the event.

49 Security Developing ways to prevent explosive devices from being places on the 11 Challenges railway. http://www.ynet.co.il/articles/1,7340,L-1971034,00.html sources http://www.globes.co.il/news/article.aspx?did=598087 http://news.walla.co.il/?w=/9/247232 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL7

1 Name Explosives on the Railways – 3 Category of 2 security event* Terrorism 3 Type of event* Failed attempt to blow up a train 4 Date 22/7/2002 5 Where-Field/Area Near the city of Rehovot. Unknown. Possibly the same perpetrators of the previous terrorist attack 6 (Explosives on the Railways – 2), since the device was determined to be Who identical to the one in the other attack. An explosive device was activated, apparently by remote control, at 7:45 in the morning, near a barrier separating the railway from the road. According to police reports, the device weighed 5-6 kg. The targeted train had two decks, and did not slip off the railway because of the explosion. 7 Event Description According to the Train’s director, no one saw the device before it exploded, even though other trains passed on the same railway earlier. He also claimed that the railways in the area are protected by a fence. It should be mentioned, however, that the fence does not cover the intersection of the road with the railways, and is thus useless at these locations. People Three passengers suffered from panic attack, and one passenger was injured by the shockwave created by the explosion. Economy As in any terrorist attack, this one heightened the state of fright which caused people to avoid the train. A week before the incident, the Minister of Transportation ordered a special budget of 11 million NIS for the train, which Effects and would be dedicated to the purchase and deployment of SMTs 8 impacts around the railways. Political The event was one of many terrorist attacks between the years 2000 and 2003, most often initiated and perpetrated by Palestinian organizations with a political agenda.

People The driver of the locomotive was injured in the explosion and was moved to a nearby hospital. Another passenger suffered from shock. The passengers were evacuated from the train.

SMT / CIT The free-range railways in Israel are generally protected at best with a fence, 9 involved and at worst are exposed to the road. Even when protected with a fence, this

50 incident demonstrated that the fence cannot stretch across some points in the railway, which therefore serve as the weak spots of the entire railway security system. 1 Other issues It is estimated that the terrorist/s waited in the vicinity for a certain train 0 involved before choosing to explode the device with a remote control. 1 Security Developing ways to prevent explosive devices from being places on the 1 Challenges railway, and to be able to detect them on time. http://www.inn.co.il/News/Flash.aspx/30497 sources http://news.nana10.co.il/Article/?ArticleID=36305 http://news.walla.co.il/?w=/9/256753 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL8

1 Name Suicide Bombing in Train Station – 3 Category of 2 security event* Terrorism 3 Type of event* Failed attempt to perform a suicide bombing attack in a train station 4 Date 24/4/2003 5 Where-Field / Area The train station in the city of Kfar-Saba 6 Who Al-Aqsa Martyrs’ Brigades, the operational arm of the Fatah The terrorist, an 18 years old youth from the refugee camp near Nablus, reached the train station at 7:20 in the morning. He was stopped at the entrance and was requested to present his identification card (ID) and to be checked with a metal detector. Their suspicion was apparently raised 7 Event Description by the black sports jacket the terrorist was wearing, even though the day was extremely hot. The terrorist pretended to look for his ID, patting his jacket, and eventually activated the explosive belt that was hidden underneath the jacket. People Sixteen people were injured in the attack, and the security man who stopped the terrorist died from his wounds. Economy As in any terrorist attack, this one heightened the state of fright which caused people to avoid the train. The station was also new, and only opened three weeks before the incident, in a new building resembling a shopping mall. Some economical damage was therefore probably caused to the station and for the commercial activity at the shopping center as well. 8 Effects and impacts Political The event was one of many terrorist attacks between the years 2000 and 2003, most often initiated and perpetrated by Palestinian organizations with a political agenda. Following the attack, Fatah and Al-Aqsa Martyrs’ Brigades published a joint message accepting responsibility for the attack. Later that day, another division in the Brigades published a different message which denied any involvement of the organization in the attack. The two different messages served to highlight the division in the

51 Brigades, especially in regards to their policy on terrorist attacks.

Infrastructure Some damage was caused to the entrance to the station. As in previous cases of suicide attacks in the train station, the security measures at the entrance prevented the terrorist from going inside. 9 SMT / CIT involved The metal detector might have alerted the terrorist to the fact that he is about to be exposed, and caused him to explode prematurely. While the attack cost the life of the security man, this is largely Other issues 10 considered a collateral damage and an unavoidable loss of life which involved prevented a much larger disaster. There is a need to protect security forces as much as possible while still 11 Security Challenges maintaining their efficiency and the normal services of the train station. http://www.ynet.co.il/articles/0,7340,L-2583374,00.html sources http://www.ynet.co.il/articles/1,7340,L-2583734,00.html Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL9

1 Name Pirates on the Air - 2 Category of 2 Radio and GPS Interference security event* Radio communication at frequencies used by BGIA caused a disturbance in 3 Type of event* the proper order of work 4 Date 13/5/2004 Where - Field / 5 BGIA Area 6 Who Pirate radio stations from Israel The communication between the control tower and airplanes in the air around BGIA was increasingly disrupted by transmissions from pirate radio stations. The control tower switched to alternative frequencies at first, which allowed some of the planes to land. When the disruptions continued and 7 Event Description increased, however, the decision was made to completely stop the landings and take-offs. The airplanes received instructions to wait in the air, and the take-offs were stopped completely. As soon as the disruptions lessened, the take-offs were renewed, albeit at a slower pace than usual. The landings continued as usual. People No person was injured, although there was a potential risk, if the disruptions were to continue for a longer time. Passengers were generally annoyed by the delay in both landings and take-offs. Effects and Values The incident served to bring to light the danger posed by pirate 8 impacts radio stations both in Israel and in the Palestinian Authority. Political It is also known that the Israeli government acts with a light hand towards some of the pirate radio stations. Incidents like this serve to deepen the mistrust between the people and the government.

52 Economy There were no long-term damages to the economy. Were the disruptions to take longer, however, they would probably have led to loss of working hours, fuel and other factors. Means for detection of the pirate transmissions were used in order to identify ASAP the source of the broadcasts. Once the sources were detected SMT / CIT 9 and identified, rapid legal and practical steps were taken in order to locate involved and confiscate the radio equipment (although it has been proven that the equipment can be replaced with new devices quite rapidly). The same technology that was used for peaceful purposes, could also Other issues 10 be used more decidedly and deviously by terrorists to prevent the involved landing and leaving of airplanes. Security Developing measures to withstand serious interferences in the radio 11 Challenges communication between the control tower and airplanes. sources http://www.ynet.co.il/articles/0,7340,L-2916212,00.html Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

53 Past Event IL10

1 Name Spy on the Train Category of 2 Terrorism security event* Failed attempt to spy for the Hezbollah on sensitive infrastructures while riding 3 Type of event* the train 4 Date 6/1/2005 5 Where-Field/Area The train from Nahariya to Tel-Aviv 6 Who Hezbollah On December the 29th, 2004, a 38 years old Danish citizen of a Lebanese descent called Ayad Al-Ashuah, entered Israel in a Turkish Airlines flight, by using a brand new Danish passport. In the following days he has located two Israeli citizens of an Arab descent, whom he planned to recruit to Hezbollah. On the 6th of January, 2005, Al-Ashuah travelled on the train with one of his Israeli- Arab friends. During the ride he was filming through the window with a video camera. His behaviour caused suspicion on the part of the train's security officer. Event 7 When the train reached Tel-Aviv, the officer upheld Al-Ashuah until the police Description arrived and took custody of him. Al-Ashuah was taken to questioning at the police station, and it was revealed that while his Israeli-Arab friend was innocent, Al- Ashuah himself tied himself to the Hezbollah and admitted that he was sent to spy on military sites in Israel for 2000 dollars. Capturing the spy was largely because of the alertness of the security officer, who was utilizing human-based measures of profiling and paying close attention to suspicious behaviour on the part of the passengers. Infrastructur The spy was taking pictures of military structures and sites along the e railway. It is likely that such images would have been used later to bring harm to these sites. Political Israel received criticism from Denmark since no Danish representatives were allowed to meet with the spy for two weeks from the moment of his capture. Details of the affair were publicized in Danish newspapers and other media. Experts on international law Effects and claimed that Israel was breaking the international law, as well as the 8 impacts Vienna Treaty. While Danish representatives made clear that "the friendship relations with Israel are very good", it seems that the affair has left a smear on the relationship between the two states. People The other Israeli-Arab passenger was freed almost immediately, when it was clear he was innocent. Two other Israeli-Arabs, relatives of al-Ashuah were also taken into custody under suspicion that he contacted them in order to recruit them to Hezbollah, but they were released soon after due to lack of evidence. The only SMT in use here was the security man himself, being alert and 9 SMT / CIT involved adhering to the guidelines according which he was taught to recognize suspicious behaviour. 10 Other issues involved - The train should probably have some means for an arrest of suspicious 11 Security Challenges individuals, and for isolating and taking care of terrorists and other criminals during the ride itself and until arriving at the station. http://www.ynet.co.il/articles/0,7340,L-2583374,00.html sources http://www.ynet.co.il/articles/1,7340,L-2583734,00.html

54 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

Past Event IL11

1 Name Pirates on the Air – 3 Category of 2 Radio and GPS Interference security event* Radio communication at frequencies used by BGIA caused a disturbance in the 3 Type of event* proper order of work 4 Date 6/6/2007 5 here- Field/Area BGIA 6 Who A Israeli ultra-orthodox religious pirate radio station Disruptions in communication between the control tower and the airplanes caused a cessation of take-offs from BGIA for a short period of time in the middle of the day, and at 23:00 in the night. As a result, seven take-offs were postponed, and only resumed later at a slower pace of take-offs than usual.

The BGIA workers union declared its intention to strike and paralyze the airport. 7 Event Description Due to the rapid response of the Minister of Transportation and Minister of Communication, who promised to come to the airport themselves to take care of the problem, the union decided not to strike.

It is believed that the cause of disruptions was found in an apartment in the city of Bnei-Brak, whose owner was using radio equipment to establish a pirate radio station. The person was taken for questioning, and later released. People No person was injured, although there was a potential risk, if the disruptions were to continue for a longer time.

Passengers were generally annoyed by the delay in both landings and take-offs. Values The incident served to bring to light the danger posed by pirate radio stations in Israel.

The fight against pirate radio stations became more pronounced three days later, when the Israeli court made a decision to keep the manager of a pirate radio station Kol Effects and 8 Haemet (Voice of Truth) in custody. The manager has instructed impacts his workers to buy a new transmitter for every one that was confiscated by the police, and so there was a very real concern that the radio station broadcasts would go on the air again. Political The Ministers of Transportation and Communication received requests to take care of the situation. A request was also presented by parliament member Nissan Slomiansky to initiate an urgent discussion in the economy committee of the parliament regarding the pirate broadcasting. Economy There were no long-term damages to the economy.

Were the disruptions to take longer, however, they would

55 probably have led to loss of working hours, fuel and other factors.

Foreign aircraft companies were furious over the delays in take- offs and landings. The director of Swiss company in Israel announced that the state must take care of the existing infrastructures, and handle the pirate radio stations decisively. Means for detection of the pirate transmissions were used in order to identify ASAP the source of the broadcasts. Once the sources were detected and SMT / CIT 9 identified, rapid legal and practical steps were taken in order to locate and involved confiscate the radio equipment (although it has been proven that the equipment can be replaced with new devices quite rapidly). The same technology that was used by ordinary citizens, could also be used more Other issues 10 decidedly and deviously by terrorists to prevent the landing and leaving of involved airplanes. Security Developing measures to withstand serious interferences in the radio 11 Challenges communication between the control tower and airplanes. http://www.themarker.com/hitech/1.446282 sources http://www.news1.co.il/Archive/001-D-132931-00.html http://www.nrg.co.il/online/1/ART1/634/304.html Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

56 Past Event IL12

1 Name Gas near the Airport Category of 2 White collar crime security event* 3 Type of event* A large and illegal stock of cooking gas was caught near BGIA 4 Date 17/10/2007 Where - Field / 5 In the city of Or Yehuda, near the runways of BGIA Area 6 Who A white collar criminal, selling and distributing gas without a permit A large stock of cooking gas, which was stored and distributed without a permit, was located in a warehouse extremely close to BGIA's runways, at a distance of less than one kilometer away.

7 Event Description The warehouse contained twenty tones of illegal gas, contained in hundreds of tanks. According to the Minister of Infrastructures, Binyamin Ben-Eliezer, the presence of such large quantities of cooking gas in a proximity to BGIA is a deadly hazard. People The criminal was apprehended for questioning, received fines and will have a criminal record. Effects and Infrastructure No damage was caused during the arrest. If the 8 impacts warehouse had caught fire, however, the resulting explosion and fires could easily have threatened the adjacent airport. SMT / CIT The police took care of the activity, following weeks of tracking the criminal 9 involved activities. Despite the potential threat to BGIA's security, it is not clear whether the Other issues 10 police forces involved took care to alert BGIA's authorities regarding the involved cooking gas warehouse 'under their noses'. Monitoring the outer perimeter of BGIA, including neighbouring streets. Security 11 Challenges Achieving clear and efficient communication between the police forces and BGIA authorities. sources http://www.news1.co.il/Archive/001-D-143132-00.html Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

57 Past Event IL13

1 Name Sick Oligarch Category of 2 White collar crime security event* Smuggling of a large amount of money through the airport, on the body of 3 Type of event* a Russian businessman 4 Date 21/10/2010 5 Where-Field/Area BGIA 6 Who Suliman Kraminov, a Russian oligarch Suliman Kraminov, a Russian oligarch whose name can be found in the list of 25 richest people in the world, landed in BGIA without notice, with his assistants and security men. The customs people decided to check Kraminov and his entourage, and uncovered a suitcase that one of his personal security men carried, and in it a large number of bills amounting to 100,000 Euro. The oligarch and his entourage did not declare the large sum of money, and the Israeli law requires the declaration of any tourist or passenger 7 Event Description who wants to transport into Israel more than 80,000 NIS (or the equivalent sum in foreign coin) in cash. When held for questioning by the customs people, the oligarch claimed that he brought the money to donate to the court of Rabbi Ifragen, a well- known mystic in Israel, whose fame has apparently travelled throughout the world. In return for the money, the oligarch wanted to consult with the rabbi regarding his unstable health. The customs people decided to confiscate the suitcase with the cash in it, and to determine its fate in later days. Economy While the smuggled amount of money is relatively small, it is extremely important to enforce the laws in Effects and 8 all cases, even in the case of a philanthropic oligarch. impacts Political No damage was done to the relations between Russia and Israel. SMT / CIT Human-based measures, as well as a manual check of the suitcase in 9 involved question, and an investigation of the person's economical background. Other issues - 10 involved Security Identifying the possibility of smuggling even when the party in question 11 Challenges does not fit the usual criteria of smugglers. http://www.nrg.co.il/online/1/ART2/169/280.html?ap=1&from_art=1595 sources 416&to_art=2169280 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

58 Past Event IL14

1 Name The Peruan Priest Category of security 2 event* Organized Crime 3 Type of event* Drugs Smuggling 4 Date 23/1/2011 5 Where - Field / Area BGIA 6 Who Drug currier from Peru, working for a network of drug dealers A drug currier, working for an organized network of drug dealers and smugglers (about which no information was uncovered), reached BGIA via an identified "safe" route that began in Peru, through Amsterdam, and ended with flying with KLM to Tel-Aviv. It is unknown how he bypassed the security checks in Peru and Amsterdam. When he reached BGIA, however, he was identified by the front controller as soon as he went off the plane. He was described as being frightened and having an odd behaviour. The 7 Event Description passenger was taken to a personal check, in which a heavy priest mantle was found in his bag while checking it with an X-ray machine. The imaging turned up that the bag had an internal lining with unidentified organic chunk inside. The possibility that the material was an explosive was discounted using sniffers. Once it was clear that this was no terrorist attack, the Israeli police became involved and identified the material as drugs. The currier was transferred to a holding facility, where he excreted from his body additional drug containers which he swallowed before the flight. Obviously, if the drug load were not caught, it would have caused 8 Effects and impacts trouble for society. Besides that, however, this incident did not seem to have much of an impact.

A wide variety of SMTs was involved in this incident. Human controllers noticed the currier’s anxiety and apprehended him for questioning, where they noticed his strange luggage and opted to 9 SMT / CIT involved check it using an X-ray machine. Sniffers were used to discount the presence of explosives, police methods were utilized to identify the drug load, and the confinement made sure that the rest of the drug load left the body of the currier. It is disturbing to realize that the drug currier managed to pass 10 Other issues involved through two other airports – in Peru and in Amsterdam – without raising the alarm. 11 Security Challenges Sophisticated smuggling methods and means. Source Interview with one of the persons in charge of security in BGIA. Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

59

Past Event IL15

1 Name The Oily Fuel Category of security 2 event* Suspected Terrorism 3 Type of event* Contamination of airplane fuel supply 4 Date April 2011 5 Where - Field / Area BGIA / Fuel supply facility 6 Who Unknown Suspicious oily material was found in the fuel filters in the reservoirs of the airport. The fuel supply was stopped, and there was not enough safe clean fuel available to let the airplanes take off. As a result outgoing flights suffered very long delays (or were cancelled). All incoming flights were 7 Event Description instructed to carry with them a portion of fuel sufficient to enable them to fly back to a nearby airport (Cyprus, Jordan) to refuel. Samples of the suspicious material were taken to local laboratories, as well laboratories abroad in order to try to identify this unknown material and it's source. So far no clear conclusion has been reached and published. Infrastructure Re-evaluation of the fuel supply chain was needed. Economy The entire air service to and from Israel was stopped with heavy economic impacts. Political According to the Minister of Transportation, this Effects and 8 incident gave the ‘green light’ to promote and impacts advance the planning of a new airport in Timna, which could be used as an alternative to BGIA should the need arise. Possible international assistance was needed to overcome fuel shortage Standard methods and protocols were used for checking and controlling the supplied fuel. Some time has passed between detection of the contamination the evaluation ad and making the decisions how to handle the situation. Initially, 9 SMT / CIT involved it was assumed that no danger was expected from it. When the unknown material was detected all over the supply chain and couldn’t be identified, however, a decision was made that this unknown chemical might cause aircraft malfunctions. All flights were put on hold and samples were sent to specialized laboratories abroad. The fuel is supplied by a private firm. A question of responsibility was raised. International support was required. Other issues Questions were raised regarding the local capability to identify the material 10 involved and locate its source. Another issue came up, as using wrong fuel might damage the airplane engines, and the engine manufacturers and the insurance companies were worried about that as well. 11 Security Challenges Securing the whole fuel supply chain. This is a fresh event from the last days, so all the data was taken from the publish media. Some internet sources include: Sources www.energianews.com/article.php?id=9425; www.news-israel.net/Article.asp?Code=26053; http://www.globes.co.il/news/article.aspx?did=1000644866;

60 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation systems,4)hacking of control systems = cyber crime

61 Past Event IL16

1 Name Human Flyover Category of security 2 Terrorism /order disturbance event* Protests by illegal tourists with the intention to disturb order in BGIA , that 3 Type of event* made it difficult to efficiently service passengers in the airport 4 Date 8.7.2011 5 Where - Field / Area Airport - incoming passengers' hall. 6 Who "so called" peace activists Demonstrators came to BGIA travelling in different air companies from different countries and airports. They had a planned schedule according to which they were trying to get into the country en-masse and later reach the Palestinian territories. Including the Gaza Strip, "to protest and act against the “blockade of Gaza” (quote). Some local citizens tried to join them in the reception hall to disrupt order and attract media attention.

Israel made an effort to prevent the activists from boarding the planes in the first place, by using diplomatic pressure and announcing that 7 Event Description participants in this venture will not be allowed to enter Israel. Known participants were declared as not eligible to enter ISRAEL The laws of the International Civil Aviation Organization state that in this case the air companies should vdeny flight permission from such passenger and thus would have to fly them back if they arrive in Israel The companies themselves decided to prevent the boarding of these individuals

In BIGA, police forces were deployed in order to identify the relevant individuals put them. in custody and send them back.. Some people however succeeded to enter Israel. People The flyover didn't bring in as many people as expected due to the successful measures applied. Some case of order disruption took place with disturbance of passengers' flux. Economy Although no economical impacts were discerned, it 8 Effects and impacts seems likely that some passengers decided to avoid BGIA at the day of the flyover. The security measures caused extra budget need Political The event caused a small uproar in Israel and Europe; The security measures applied were successful. Increasing police activity, special instructions on sensitive human treatment, 9 SMT / CIT involved arrangement of needed infrastructures (e.g. custody facility), enhanced control measures. Other issues Legal questions on who can be denied entrance into the country. 10 involved Dealing with massive demonstrations and order disruptions in BGIA in a 11 Security Challenges sensitive yet firm manner. Identification of potential order breakers. Possible international cooperation in early prevention All media cover – e.g.: http://www.ynet.co.il/articles/0,7340,L-4091551,00.html sources http://www.israelhayom.com/site/newsletter_article.php?id=296

62 Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents / * agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation We have systems,4)hacking of control systems = cyber crime presented a number of security events from the past thirty years. The events dealt mostly with the security of either BGIA or the Train and railways system in Israel. Several security needs were identified in this analysis:

- Protection of the railway system - The railways in Israel are mainly protected with a fence however, practically anyone can cut through it or make an attack on the tracks at places where the railway meets the road and the fence's continuity is cut off (see Error! Reference source not found., Error! Reference source not found., Error! Reference source not found.). In addition, no alarming system exists to signal possible threats. The only solutions currently available are manned reconnaissance.

- Airport communication - Another problem is the treatment of pirate radio stations who can interfere with the communications between the control tower and airplanes in the air and on the ground, leading to a complete halt in landings and take-offs (see Error! Reference source not found., Error! Reference source not found., Error! Reference source not found.). A real threat is identified with risk of air accidents.

Attention should be given to the most basic SMTs – the human-based measures. Well-trained - and reliable security men have proven again and again their capability at either deterring terrorists from making an actual attack on a train station (see Error! Reference source not found., - , Error! Reference source not found.), or identifying a drug carrier based on signs of nervousness alone (see Error! Reference source not found.).

63 Italy

Terrorism

Past Event IT1

1 Name Terrorist attack on Rome Airport 2 Type - Threat topic Terrorism 3 Threat Mass Murder / Harm 4 Date December 27th, 1985 5 Where - Field / Area Fiumicino Airport, Rome The attack was first blamed on Palestine Liberation Organization (PLO), but its leader, Yasser Arafat, denied the accusations and denounced the strikes. The PLO asserted that the attacks were intended to force Austria and Italy into severing ties with the Palestinians. Responsibility for the attack was later claimed by the Abu Nidal Organization (ANO) in retaliation for Operation Wooden Leg, the Israeli bombing of PLO headquarters in Tunis on October 1, 1985. Libya was accused of funding 6 Who the terrorists who carried out the attack; although they denied the charge, they did praise the assault. According to published reports, sources close to Abu Nidal said Libyan intelligence supplied the weapons and the ANO's head of the Intelligence Directorate's Committee for Special Missions, Dr. Ghassan al-Ali, organized the attacks. Libya denied these charges as well, notwithstanding that it claimed they were "heroic operations carried out by the sons of the martyrs of Sabra and Shatila."

At 08:15 GMT, four gunmen walked to the shared ticket counter for 7 Event Description Israel's El Al Airlines and Trans World Airlines at Fiumicino Airport outside Rome (Italy) firing assault rifles and threwing grenades.

The attackers killed 16 people and wounded 99 before three of them 8 Effects and impacts killed by police. The remaining one was wounded and captured by police. 9 SMT / CIT involved Explosive detectors, Metal detectors, Weapon detectors To increase the efficiency and the efficacy of explosive detection devices and security protocols for the prevention/mitigation of 10 Security Challenges terrorists’ attacks to airports. To install efficient behaviour recognition software in airports CCTV. Source(s) National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database (http://www.start.umd.edu/gtd/) http://en.wikipedia.org/wiki/Rome_and_Vienna_airport_attacks

64 Past Event IT2

1 Name Terrorist attack on Vienna Airport 2 Type - Threat topic Terrorism 3 Threat Mass Murder / Harm 4 Date December 27th, 1985 5 Where - Field / Area Schwechat Airport, Vienna 6 Who Abu Nidal Organization 7 Event Description The morning of 27th of December 1985 at the Schwechat Airport (Vienna International Airport, Austria), three terrorists carried out an attack. Hand grenades were thrown into crowds of passengers queuing to check-in for a flight to Tel Aviv. 8 Effects and impacts Two people killed and 39 people wounded. 9 SMT / CIT involved Explosive detectors, Metal detectors, Weapon detectors 10 Security Challenges To increase the efficiency and the efficacy of explosive detection devices and security protocols for the prevention/mitigation of terrorists’ attacks to airports. To install efficient behaviour recognition software in airports CCTV. Source(s) National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database (http://www.start.umd.edu/gtd/) http://en.wikipedia.org/wiki/Rome_and_Vienna_airport_attacks

Past Event IT3

1 Name Attack on Bologna Airport 2 Type - Threat topic Terrorism 3 Threat Murder 4 Date February, 11th , 2010 5 Where - Field / Area Bologna Airport 6 Who “Conspiracy of Fire Nuclei” organization 7 Event Description On 11th of February 2010 an improvised explosive device (IED), hidden inside a package on an airplane, was sent to Italian Prime Minister. The package was in route from Athens to Paris, meant to travel through Belgium and later to Rome, when it was discovered. The plane stopped and landed in Bologna, Italy where authorities checked the package. 8 Effects and impacts The IED caught fire while it was being checked. There were no casualties or damaged and the Conspiracy of Fire Nuclei claimed responsibility for the attempted bombing. Thirteen of the group's members were arrested in connection with the attacks. 9 SMT / CIT involved Explosive detectors, mail control procedures / systems 10 Security Challenges To increase the capability of early warning explosive hidden in mail packages. Source(s) National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database ( http://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=201011020012 )

65 Past Event IT4

1 Name Attack on Milan Metro 2 Type - Threat topic Terrorism 3 Threat Mass Murder / Harm 4 Date February 5th, 2002 5 Where - Field / Area Duomo Metro station, Milan 6 Who Unknown 7 Event Description 05/11/2002: Unknown perpetrators attempted to bomb the Duomo Metro station in Milan (Italy). The attackers set fire to a 66 pound gas canister and left a note written in both Italian and Arabic stating that they were fighting on behalf of Allah to convert all non-believers to Islam. No group claimed responsibility for the attack. 8 Effects and impacts Metro employees were able to put out the blaze before any damage occurred to the facility. 9 SMT / CIT involved CCTV, smoke detectors, gas detectors, behavior recognition software 10 Security Challenges To improve metro transportation control systems, in order to automatically recongnize suspect behavior and early detect gas and explosives. Source(s) National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database ( http://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=200205110003 )

Past Event IT5

1 Name Attack on Rome Metro 2 Type - Threat topic Terrorism 3 Threat Mass Murder / Harm 4 Date December 21st , 2010 5 Where - Field / Area An empty train coach in Rome subway 6 Who Unknown 7 Event Description Around 10.00 in the morning in Rome (Italy) an improvised explosive device (IED), hidden in a bag inside a black shoebox, was found under the seat in an empty train coach in the subway. The IED was made of gunpowder and metal tubes but it did not explode since it did not have a detonator. 8 Effects and impacts There were no casualties or damages and no group has claimed responsibility.

9 SMT / CIT involved CCTV, smoke detectors, gas detectors, behavior recognition software, biometrics 10 Security Challenges To improve metro transportation control systems, in order to automatically recongnize suspect behavior and early detect gas and explosives.

66 Source(s) National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database ( http://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=201012210002 )

Cyber crime

Past Event IT6

1 Name Hacker attacks on Pisa Airport, Italy 2 Type - Threat topic Cyber crime 3 Threat Reduction of airport systems functionality 4 Date December 19, 2010 5 Where - Field / Area Pisa Airport 6 Who Unknown 7 Event Description The morning of 20th of December a cyber attack to Pisa’s airport ICT infrastructure was registered. The airport servers were affected by “flooding” (contemporary access of a large quantity of fake users), and the consulting services of flights departures and arrives were interrupted for a short period of time. 8 Effects and impacts The attack didn’t reach flight control systems but relevant economic problems were caused to Airline Company due to the compromising of on-line flights booking services. Airport Security Authorities activated an external web link to provide flights information to passengers. 9 SMT / CIT involved ICT security protocols, internet firewalls 10 Security Challenges To increase ICT systems security and reliability of airport internet services, without excessively slow information computing processes. Source(s) Aeroporto di Pisa, sito web sotto attacco – Pubblicaamminstrazione.net 20.12.2010

Past Event IT7

1 Name Hacker attacks on Catania Airport, Italy 2 Type - Threat topic Cyber crime 3 Threat Cyber Attack at Catania’s airport 4 Date March 5, 2011 5 Where - Field / Area Computer network of Catania Airport 6 Who Two boys 7 Event Description In the evening of 5 March 2011, Catania airport website was affected by a cyber attack that interrupted secondary functionalities for some hours. The cause was a cyber attack brought by two 22 years old boys.

8 Effects and impacts The problem was solved in few hours and didn’t cause relevant problems to Airline Companies or airport operators.

9 SMT / CIT involved ICT security protocols, internet firewalls 10 Security Challenges To increase ICT systems security and reliability of airport internet services, without excessively slow information computing processes.

67 Source(s) Catania: attacco siti web aeroporto – corriereborsa.it 05.03.2011

Past Event IT8

1 Name “Defacement” of Italian Postal Service 2 Type - Threat topic Cyber Crime 3 Threat Compromising of mail services 4 Date October 10, 2009 5 Where - Field / Area Italian Postal Service official website 6 Who Two Hackers called “Mr.Hipo and StutM” 7 Event Description During the night of 10 October 2009 the security measures of Italian Postal Service official website were violated. Two hackers attacked the main server forcing the system to report the following message: “You are lucky, we aren’t dangerous people”. This event, even if it had no relevant consequences, allowed the hackers to access the information contained in Postal Service database (users list, account credential, passwords, etc.). 8 Effects and impacts This event caused a lot of concerns in public opinion. Italian Post's representative personnel said that the attack wasn’t dangerous for post users data, but the event was strongly discussed by mass- media, influencing citizens opinion on the reliability and security of postal services. 9 SMT / CIT involved The technical name of attack type is “SQL injection”. This attack affects web application based on SQL database, exploiting system vulnerabilities to gain access to restricted data.

10 Security Challenges To increase security measures (mainly ICT protocols and procedures) of web-based platforms. Source(s) Poste, un defacement annunciato - ZEUS news 15.10.2009

Past Event IT9

1 Name Cyber attacks on Italian Universities 2 Type - Threat topic Cyber crime 3 Threat Stealing and Counterfeiting of Universities data 4 Date July 7, 2011 5 Where - Field / Area Milano, Torino, Bologna, Cagliari, Bari, Foggia, Lecce, Messina, Modena, Napoli, Pavia, Roma, Salerno, Siena, e Urbino.

6 Who LuzlStorm, cellular of anonymous hacker group 7 Event Description A wide-range cyber attack was performed to a number Italian Universities: Bologna (Antoniano e Unibo), Cagliari, Milano (Politecnico, Bocconi e Bicocca), Bari, Foggia, Lecce, Messina,

68 Modena, Napoli, Pavia, Roma, Salerno, Siena, Torino e Urbino. A team of hacker called “LuzlStorm” gained access to users data contained in Universities’ archives (telephone numbers, passwords, generalities, etc.). 8 Effects and impacts Representatives of the Italian Universities officially communicated that the hackers stole only general data and not confidential information. The objective of hackers seemed to simply be a demonstration of the vulnerability of Universities’ ICT systems. 9 SMT / CIT involved ICT security protocols 10 Security Challenges To increase the protection of on-line databases from cyber attacks. Source(s) Le università svelate dagli hacker – LaStampa.it 07.07.2011 Gravissimo attacco hacker alle università – LaRepubblica.it 07.07.2011

Transnational organized crime

Past Event IT10

1 Name Honk Hong Drug Traffic 2 Type - Threat topic Transnational organized crime 3 Threat Drugs diffusion 4 Date December 29, 2010 5 Where - Field / Area Kwai Chung Container Terminal 6 Who Drug traffickers organizations 7 Event Description Hong Kong Customs detected a transnational cocaine trafficking case at Kwai Chung Container Terminal in 29 December 2010 and seized about 290 kilogrammes of high-grade cocaine, with an estimated value at about $260 million, in a container arriving from South America and destined for the Mainland. Customs officers intercepted two containers declared to contain "wood working products" from a container vessel arriving from Chile (South America) for examination. After an inspection using the X- ray system and drug detector dogs, officers found a batch of cocaine in one of the containers concealed inside 88 pieces of hollowed-out wood planks. 8 Effects and impacts To combat transnational cocaine trafficking activities, Hong Kong Customs, through risk assessment, stepped up inspections against suspicious consignments from South America for examination at Kwai Chung Container Terminal. The Head of Customs Drug Investigation Bureau, Mr John Lee, said today (January 19) at a press briefing, "Hong Kong Customs will continue to work closely with the Mainland and overseas drug enforcement agencies to combat transnational drug trafficking activities." 9 SMT / CIT involved X-ray system and drug detector dogs 10 Security Challenges To increase the reliability and the efficacy of drug detectors at Customs.

69 Source(s) Government of Honk Hong, Custom and Excise Department – Press Release http://www.customs.gov.hk/en/publication_press/press/index_id_787.html

70 Illegal immigration

Past Event IT11

1 Name Karaburun tragedy 2 Type - Threat topic Illegal Immigration 3 Threat Death of immigrants travelling in unsecured conditions 4 Date Jenuary 9th, 2004 5 Where - Field / Area Strait of Otranto towards Brindisi in the coasts of Puglia 6 Who Travel arrangers (2 drivers and 1 traffic leader) and 36 people from north Albania. 7 Event Description Karaburun tragedy, also known as 9 January tragedy in 2004 was the fatal trip of 36 people from north Albania, 2 drivers and 1 traffic leaders, who were trying to cross the Strait of Otranto towards Brindisi in the coasts of Puglia by means of an inflatable boat. Karaburun tragedy is the Albanians emigrants' marine tragedy with the 2nd highest mortality rate after the Otranto tragedy in March 1997, when the Albanian ship with clandestine was hit by the Italian combat ship Sibilla, causing the death of 84 people.

8 Effects and impacts 28 people died or were declared lost. On November 8, 2010, Council of the European Union approved visa-free travel to Schengen Area for Albanian citizens.

9 SMT / CIT involved Satellites, Radio Communications, Radar 10 Security Challenges To improve sea monitoring systems and to increase the rapidity/efficiency of emergency response procedures to coastal accidents. Source(s) "Visa liberalisation for Albania and Bosnia and Herzegovina". Council Of The European Union. 2010-11-08. http://www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/jha/117555.pdf. Albanian news: http://www.alsat.tv/eng/ALSAT_Lajme/Breaking_News/Otranto_Tragedy,_Session_in_the_Court_of_Lecce_P ostponed/

71 White collar crime Past Event IT12

1 Name Olive Oil Relabeling Fraud 2 Type - Threat topic White collar Crime 3 Threat Pathogens spreading from uncontrolled oil quality 4 Date March, 05th , 2008 5 Where - Field / Area Italy's thriving fake olive oil business involves importing oil from Tunisia, Greece and Spain. 6 Who Italian Oil producers. 7 Event Description 12:01AM GMT, 05 Mar 2008, more than 400 officers took part in Operation Golden Oil after an investigation discovered as many as 91 people may have been involved in passing off low quality oil, made with olives around the Mediterranean, for the finest Italian product. Italy's thriving fake olive oil business involves importing oil from Tunisia, Greece and Spain and re-labelling it as Italian oil. Other ploys include labelling inferior oil as extra-virgin olive oil and claiming EU subsidies for growing olives in Italy while actually importing them from elsewhere. Police found invoices to the EU for €6.5 million of subsidies during the raids, as well as receipts for €39 million of 'Italian' oil made with non- Italian olives. Coldiretti, the farmers' union, said the amount of foreign oil being imported and re-labelled as Italian "rose by a quarter in 2007". 8 Effects and impacts Police in Italy have arrested 23 people and confiscated 85 farms in an operation that has exposed the scale of the country's fraudulent olive oil trade. 9 SMT / CIT involved Security of Commercial Transactions (with focus on food importing/exporting), food quality control systems. 10 Security Challenges To increase the traceability of goods exported/imported in European Union Countries. Source http://www.telegraph.co.uk/news/worldnews/1580807/Italian-police-crack-down-on-olive-oil- fraud.html

72 UK

This chapter provides an overview of security and public safety incidents that have directly targeted or otherwise effects public transportation in London, particularly the Underground system, as required by WP6. This report is not an exhaustive compilation of such events but a selective presentation of the most significant mass emergencies or deliberate attacks that have occurred during and since WWII. The information that follows has been gathered from media sources and academic literature when available. The incidents outlined herein provide the backdrop for the development of future scenarios in the later stages of WP6.

Past Event UK1 1 Name Bethnal Station Disaster 2 Category of security event Mass public emergency Numerous bombings and related mass emergencies affecting 3 Type of event London’s civilian transportation system during WWII. 4 Date March 3rd 1943 5 Where - Field / Area Bethnal Underground Station 6 Who Outcome of bombings during German blitz of London The most intense period of the blitz was between the fall of 1940 and the spring of 1941 during which time London was bombed for 76 consecutive nights by German air raids. The raids directly and indirectly affected London’s transportation system. The Underground was also used as a wartime shelter for London residents. Though authorities were initially reluctant to allow citizens to use Underground stations as bomb shelters the regularity of night-time bombing raids during the height of the Blitz prompted officials to reverse their position. At one point during this time a full 4% of London’s population was estimated to be residing primarily in the Underground. The makeshift shelters were not entirely bombproof of course, and bombs damaged Underground stations on a number of occasions. Sheltering in the Underground also generated its 7 Event Description own problems such as malnutrition, and disease, and psychological maladaptation. Indeed, one of the reasons authorities were initially reluctant to allow sheltering in the system was that they would be left with a quasi-feral population of deep-level tube dwellers.

The deadliest event associated with the Underground during this time was not due to the bombs but a human crush. In evening of March 3rd 1943 the Bethnal station was opened for sheltering in anticipation of a night raid. The sounding of the air sirens combined with the firing of a nearby (and previously secret) anti-aircraft weapon caused panic amongst the crowd and a rush to descend the stairs to the shelter. An individual at the bottom of the stairs tripped, causing many others to fall and be crushed under the weight of those behind them.

73 173 people, the majority of which were women and children, were killed in the disaster. This was the UK’s largest single loss 8 Effects and impacts of civilian life during WWII and the single greatest loss of life in the history of the Underground. Authorities blamed the incident on the irrationality of the crowd (‘mob mentality’) but inadequate attention to access and egress 9 SMT / CIT involved in the station, as with most stations at the time, almost certainly played a part in fomenting the conditions that lead to the disaster. The government’s inclination towards secrecy during wartime prevented news of the incident from travelling widely; leading 10 Other issues involved some to accuse the government of censoring new of the disaster and preventing a full investigation of what occurred. The Bethnal disaster highlights the problem of crowd management that public safety authorities continue to deal with today. Though the direct legacy of the Bethnal incident appears to be minimal, the broader problem of crowd management – or more specifically, distinct failures of crowd management – has driven innovations in the ‘science’ of crowd 11 Security Challenges control. This includes modifications to the built environment (most evident in how sport stadium are construction, especially after Hillsborough), the development of militarized police crowd control tactics (most evident in the policing of mass protests at the summits of the global political and economic elite), and computer-based simulation of crowd dynamics.

Sources www.dailymail.co.uk/news/article-521490/The-Bethnal-Green-Tube-tragedy-saw-173- people-crushed-death--making-wars-worst-civilian-disaster-But-censored-history.html

http://www.bbc.co.uk/dna/h2g2/A17895702

http://www.bbc.co.uk/ww2peopleswar/stories/09/a795909.shtml

74

Past Event UK2 1 Name 1973 IRA bomb attempts 2 Category of security event Suspected terrorism 3 Type of event Attempted bombings (3) 4 Date 1973 Baker Street Underground station; Sloan Square 5 Where - Field / Area Underground Station Unknown. British authorities held the IRA responsible for 6 Who all three attempts. In August 1973 two bombs were discovered in the Baker Street tube station. Both bombs were defused. In 7 Event Description December 1973 a similar type of bomb was diffused in Sloan Square station. There were no direct material effects due to the fact that the bombs were discovered before they could be 8 Effects and impacts detonated. Nevertheless, they provided a reminder of the ongoing IRA threat and the vulnerability of London’s rail infrastructure. Employees who discovered the bombs alerted the police, 9 SMT / CIT involved who disarmed the unsophisticated devices. These attempted bombings roughly mark the beginning of a wave of attempted and successful bombings throughout 10 Other issues involved London and the UK that were part of the IRA’s ongoing efforts to create an independent and unified Ireland free of UK political control. Though unsuccessful, the attempts were reminders of the difficulties in securing open systems designed for efficient 11 Security Challenges movement and predicated on trust from unpredictable methods that exploit the vulnerabilities afforded by such systems.

http://www.bbc.co.uk/dna/h2g2/A17895702

75

Past Event UK3 1 Name Hammersmith & City bomb 2 Category of security event* Terrorism 3 Type of event Bomb 4 Date March 15th 1976 5 Where - Field / Area West Ham Underground Station Vincent Donnelly. The IRA did not claim responsibility for the bomb but Donnelly was a known member of the IRA. 6 British authorities presumed the bombing was politically Who motivated. At approximately 4:40pm a bomb detonated on an Underground rail car minutes after it departed from West Ham station. Donnelly may have boarded a train heading away from central London, returned to West Ham after realizing his mistake, and then boarded a train heading 7 Event Description for the City and King’s Cross. Still in possession of the bomb as it was about to detonate, Donnelly threw the bag containing the bomb down the length of the car before escaping through the driver’s cab window into the tunnel after the explosion. The bomb killed one person, destroyed the rail car, and caused substantial damage to the rail car and Metropolitan line tunnel. The train conductor and a 8 Effects and impacts passenger pursued Donnelly in the tunnel, both of whom he shot, killing the conductor. Donnelly tried to shoot himself once cornered by police but was unable to do so. He is currently serving five life sentences in prison. Security on the Underground consistently primarily of Metropolitan Police (if nearby) and local staff maintaining watch over the facility while performing other duties. As 9 SMT / CIT involved such, security was not particularly sophisticated, and Donnelly was evidently able to board more than one train while carrying a bomb unnoticed. The attempted bombings were part of the IRA’s ongoing 10 Other issues involved efforts to effect political change through force. As with the three unsuccessful bomb attempts in 1973, this event highlighted the difficulties of securing and open designed for efficient movement and predicated on trust from unpredictable methods that exploit the vulnerabilities afforded by such systems. It also drew 11 Security Challenges attention to the potential damage that could be caused if the plan fully ‘succeeded’ and the bomb detonated as it carried on through the populated City only minutes later. As of yet, however, such ‘success’ remained only a possibility. http://news.bbc.co.uk/onthisday/hi/dates/stories/march/15/newsid_2543000/254360 5

76 Past Event UK4

1 Name Wood Green bombing Category of security 2 event Suspected terrorism 3 Type of event Bombing 4 Date March 16th 1976 5 Where - Field / Area Wood Green Underground Station No suspected identified; authorities assumed it was 6 Who connected to the IRA The day after the bombing on the Hammersmith & City line (Event Summary 5) a bomb exploded on an empty train car 7 Event Description as it pulled out of a siding at Wood Green station in central London. The station and the rail car were both empty at the time, thus minimizing casualties. Flying glass injured one person 8 Effects and impacts standing on the train platform. However, had the bomb detonated 10 minutes later the train would have been full with football supporters leaving an afternoon match. As with the Hammersmith & City bombing, the 9 SMT / CIT involved perpetrators were successful in circumventing existing security measures in place at the time. The attempted bombings were part of the IRA’s ongoing 10 Other issues involved efforts to effect political change through force. As with the Hammersmith & City bombing, the human casualties of this event could have been much worst had the bomb detonated only minutes later, and both events 11 Security Challenges thus serve to underscore the vulnerability of public transportation systems. One direct effect of this event is that litter bins were removed from all Underground platforms.

http://everything2.com/title/London+Underground

http://www.bbc.co.uk/dna/h2g2/A17895702

77 Past Event UK5 1 Name King’s Cross fire 2 Category of security event Mass public emergency 3 Type of event Fire 4 Date Nov. 18th 1987 5 Where - Field / Area King’s Cross Underground Station 6 Who Accidental fire At approximately 7:30pm a small fire started underneath a wooden escalator exiting the rail-level platform of King’s Cross tube station. The initial response from authorities was that the fire was the result of an IRA bomb but this was quickly discounted when the fire was investigated. Judged at the outset to be small and not requiring an evaluation of the station, the fire smouldered for some time under the 7 Event Description escalator fed by grease and various bits of other material inside the machinery’s enclosure. The subsequent arrival of an incoming train forced a large amount of air through the exit tunnel (the ‘piston effect’), which intensified the fire in the tunnel, ignited gasses that had accumulated at the top end of the tunnel, and caused an explosion in the ticket- level platform of the station. It is believed that a discarded match used to light a cigarette caused the fire. Thirty-one people were killed and over 60 hospitalized from burns or smoke inhalation. The fire eventually destroyed both platforms of the Piccadilly line of King’s Cross station. Though a smoking ban in the Underground was already in place it was not strongly enforced until after this accident. The fire also revealed a previously unknown property of gas combustion in enclosed spaces now known as the “trench effect,” and the King’s Cross fire is often 8 Effects and impacts used an exemplary instance of this effect for fire prevention training purposes. The direct legacy of this event was the refinement of fire and building codes in the Underground. With one exception, all wood escalators in the system were replaced with metal escalators. Regulations were also placed in the type of paint that could be used in the Underground and requirements for fire suppression sprinklers and heat detectors. Fire fighters succeeded in fully extinguishing the fire by the 9 SMT / CIT involved following morning. 10 Other issues involved The incident was an early indication of the problems of 11 Security Challenges congestion and crowd control faced with the rise is passengers in the aging Underground system..

http://www.firetactics.com/KINGSCROSS.htm * http://www.firetactics.com/service.htm

Past Event UK6

78 1 Name Bishopsgate bombing 2 Category of security event Suspected terrorism 3 Type of event Bombing 4 Date April 24th 1993 5 Where - Field / Area Bishopsgate, City of London No individuals were apprehended for the bombing. The IRA 6 Who was widely blamed for the attack.

At 10:25am on April 24th a one-tonne fertilizer bomb was detonated in the Bishopsgate district of the City of London. The bomb was delivered in the bed of a dump truck that had been stolen the previous month in northern England. 7 Event Description The truck was driven into the City and abandoned at approximately 9:00am. Authorities received anonymous information that a bomb was in the area, and police who had already taken notice of the truck were in the process of evacuating the area when it exploded. One person was killed and 44 injured. The relatively low casualty rate is due to the fact that the bombing occurred on a Saturday morning when the district is only sparsely 8 Effects and impacts populated. Material damage was extensive. Near 1 billion GBP in damage was caused to buildings in the vicinity, including serious damage to the Liverpool Underground station. The low human impact of the Bishopsgate bombing belied the broader influence of the event on how terrorism in the City would be responded to. The City had been targeted by other bombs in the early 1990s, notably the St. Mary’s Axe bombing of 1991 (not included in this summary), but while response to the St. Mary’s Axe bombing was primarily reactive in nature and focused on developing emergency plans for managing the fallout of similar events in the future, reaction to the Bishopsgate bombing focused on preventing future incidents. The main thrust of this preventative orientation was to dislocate the City from the broader surroundings through physical and technological means. Some called for the City to be turned into a 9 SMT / CIT involved “medieval-style walled enclave to prevent further terrorist attacks.” While extreme, this statement nonetheless reflects the wider sentiment that the only manner to fully protect the city was to barricade it from its surroundings. This was realized (only in part, of course) by the rapid development of the City’s “ring of steel. Modelled on the counter-terrorism measures used to protect central Belfast from similar attacks, the ring of steel involved establishing a cordon around most of the City (it ‘faced’ mostly to the north and east) and implementing stringent access controls through checkpoints and other traffic management measures. In addition to a highly visible police presence the bombing also ushered in a rapid expansion of surveillance

79 cameras at checkpoints and throughout the City. This event marked the last major incident before a year- 10 Other issues involved long ceasefire with the IRA would take effect. Along with the 1991 St. Mary’s Axe bombing, the Bishopsgate bomb confirmed the “worst fears of the police” that determined perpetrators to deliver high- impact explosives into the heart of London. Nevertheless, 11 Security Challenges the human costs of both to these bombings remained relatively low, which is the result of decisions of the bombers (to warn authorities and choose to bomb on a weekend) rather than existing security measures.

Coaffee, J. 2003. Terrorism, Risk and the City. Aldershot: Ashgate.

80

Past Event UK7 1 Name Canary Wharf Bombing 2 Category of security event Suspected terrorism 3 Type of event Bombing 4 Date Feb. 9th 1996 Adjacent to the South Quay Station of the Docklands Light Railway in 5 Where - Field / Area London’s Canary Wharf district. The IRA claimed responsibility for the bombing. James McArdle 6 was arrested and imprisoned for 25 years. He was released in 2000 Who under the provisions of the 2000 Good Friday Agreement. At approximately 7:00pm a half-tonne ammonium fertilizer bomb was detonated in the Canary Wharf financial district. The bomb did 7 Event Description not directly target the DLR but it was close enough to cause substantial damage to South Quay station. Police were warned of the bomb approximately 30 minutes prior to the blast, and while they were able to evacuate most of the area two newsstand agents were killed and 39 hospitalized. Three nearby 8 Effects and impacts buildings were damaged beyond repair (two were subsequently reconstructed). The rail station closed for a period of time but reopened by the end of the month. 85 million GBP in direct damage costs were sustained. The “ring of steel” introduced after the St. Mary’s Axe and Bishopsgate bombings was relaxed during the ceasefire of 1994/1995. This bombing marked the end of that ceasefire and the return of the fortress mentality that characterized security in the City. Security cordons and checkpoints were immediately reactivated due to concerns that a bombing of the City would be targeted, and in the following days proposals were brought forth to expand the 9 SMT / CIT involved security zone westward, bringing over 75% of the City inside the security cordon. The number of security cameras at checkpoints and within the cordon increased as well, with every camera capable of reading licence plate and accessing a national database to check for suspect vehicles. The ring of steel remains the central element of security in the City today and is a key part of maintaining the City’s reputation as a safe and secure environment for global commerce. 10 Other issues involved There has never been another successful bombing in the City, which may speak to the effectiveness of the initiative for protecting London’s financial district. However, other bombings occurring 11 Security Challenges outside the security cordon demonstrates the problem of displacement wherein making a target highly security may make other targets vulnerable.

Coaffee, J. 2003. Terrorism, Risk and the City. Aldershot: Ashgate.

81 Past Event UK8 1 Name Aldwych Bus Bomb 2 Category of security event Suspected terrorism 3 Type of event Bombing 4 Date Feb 18th 1996 5 Where - Field / Area Aldwych near the Strand Edward O’Brian. The IRA did not claim responsibly for 6 Who the bomb but O’Brian was a known member of the IRA. At approximately 10:40pm a bomb explored on a London bus as it travelled west along the Strand towards Westminster. The detonation is believed to be 7 Event Description accidental and may have occurred as the bomber was transporting the bomb and bomb making material to another location. Six people sustained serious injury and three more were treated at the hospital. The bomber was killed in the explosion. Authorities were able to determine 8 Effects and impacts O’Brian’s identity and a search of his apartment found enough bombing making equipment for several more similarly sized bombs. The bomber was able to transport the bomb 9 SMT / CIT involved undetected until they detonated. Though the IRA did not claim responsibility for the bombing it occurred just over a week after the Canary 10 Other issues involved Wharf bombing and thus firmed up expectations that more bombings were to come. This event demonstrates that while the “ring of steel” security cordon may protect the City, it may serve at most to displace the threat to other areas of London. 11 Security Challenges Furthermore, this event and others like it demonstrate the difficulty of providing security for a system that by its nature is open and accessible.

http://www.independent.co.uk/news/dead-ira-man-had-hitlist-of-bomb-targets- 1305236.html

http://news.bbc.co.uk/onthisday/hi/dates/stories/february/18/newsid_4165000/4165 719.stm

82 Past Event UK9 1 Name 7/7 Bombings Category of security 2 event Terrorism 3 Type of event Bombing (4) 4 Date July 7th 2005 5 Where - Field / Area Multiple locations Hasib Hussain, Mohammad Sidique Khan, Germaine 6 Lindsay, Shehzad Tanweer. The perpetrators claimed to be Who inspired by al Qaeda. At approximately 8:50am three bombs were detonated inside three different trains in central London and a fourth explosion an hour later in an above ground bus. The first bomb exploded on a Circle line train as it approached Liverpool Street. The second also exploded on the Circle line as it travelled towards Paddington Station. The third 7 Event Description exploded on a Piccadilly train travelling to Russell Square. All trains had left from King’s Cross St. Pancras Station. The perpetrators were later tracked on surveillance camera as they passed through King’s Cross St. Pancras. The fourth bomb exploded an hour later on the top level of a bus on Tavistock Square after leaving King’s Cross. Fifty-six people were killed and over 700 injured in addition to the four bombers. Estimates of the economic impact of the bombing vary widely. The entire Underground system was shut down for days and reopened in stages in the days that followed.

The event(s) of July 7th 2005 had wide-ranging national and international impacts. The bombings have been referred to as a “game changer” in how terrorism is addressed in the country. Security at perceived targets such as political institutions, transportation hubs, and symbolic greatly increased in the capital and other major centres immediately after the bombing. London police use existing 8 Effects and impacts stop-and-search powers much more freely to frisk transit passengers and MI5 squads with shoot-to-kill orders covertly tracked suspects for fear of follow-up bombings (see Event Summary 11). A number of measures were brought forth in the wake of the bombings intended to enhance national counter-terrorism capabilities. The centrepiece of these efforts was The Terrorism Act of 2006, which extended the period that individuals could be detained (to 28 from 14) if suspected of terrorism and allowed Parliament to freeze the asset of suspected terrorists. Though some of these measures have expired, many remain in effect today. More broadly, it also brought the UK and USA together as allies in the US-led ‘war on terror.’ 9 SMT / CIT involved The timing and movements of the perpetrators from Luton

83 to King’s Cross were recreated using video surveillance footage. The bombers were otherwise able to circumvent existing security measures. The perpetrators were British-born “cleanskins,” meaning they were previously unknown to authorities. Of Pakistani and Jamaican descent, all perpetrators were British born and from well-to-do middle class families. The background 10 Other issues involved of the bombers thus challenged accepted conceptions of terrorism and cemented fears about ‘home-grown’ Muslim extremism. This had lead to widespread suspicion of Muslims and leading to strained relationships with the country’s large Muslim population. The event confirmed the vulnerability of London’s mass transit system as a target for unpredictable, asymmetrical 11 Security Challenges attacks due to the symbolic value of the system combined with its lack of individualized security measures.

http://www.guardian.co.uk/uk/2010/jul/07/london-bombings-anti-terrorism http://www.guardian.co.uk/politics/2009/may/13/terrorism-legislation-jack-straw

84 Past Event UK10 1 Name July 2005 attempted bombings 2 Category of security event Terrorism 3 Type of event Attempted bombing 4 Date July 21st 2005 5 Where - Field / Area Multiple locations Ibrahim Said, Yassin Hassan Omar, Hussain Osman, Ramzi Mohamed. These individuals are currently serving 40 year 6 prison terms. As with the 7/7 bombings, these individuals Who acted alone but claimed to be inspired by al Qaeda. Exactly two weeks after the bombings of 7/7 four persons again targeted London’s transportation system by attempting to detonate four bombs on four different vehicles. Shortly after noon an explosion occurred on the Hammersmith & 7 Event Description City line near Shepherd’s Bush Station. Minutes later another explosion occurred on the Northern line near Oval Station, followed shortly by an explosion on the Victoria Line near Warren Street Station. A fourth explosion followed on a Hackney Wick-bound bus in east London. None of the bombs were successful as only the detonator caps fired, not the main charges. There were no direct casualties as a direct result of the attempted bombs, but one person died as a result of an asthma attack at one of the locations. Initial reports of a strange smell coming from some of the stations raised concerns of a chemical attack but these 8 Effects and impacts concerns were quickly dismissed. Though the direct material impact of the attempted bombings was minimal, they reinforced the heightened state of alarm felt after the 7/7 by seemingly confirming fears that the 7/7 bombings might not have been a one-off attack but the first of a coordinated onslaught of similar attacks by al Qaeda-inspired and British- born attackers. Again, the perpetrators were successful in delivering the explosives to the intended targets. The only reasons greater 9 SMT / CIT involved casualties were not incurred is because the explosives were duds. The background of the attackers – all British-born Muslims – further entrenched fears of homegrown Islamic extremism, 10 Other issues involved thus reinforcing suspicion of Muslims and further straining already tense relationships. The event confirmed the vulnerability of London’s mass transit system as a target for unpredictable, asymmetrical 11 Security Challenges attacks due to the symbolic value of the system combined with its lack of individualized security measures.

http://news.bbc.co.uk/2/shared/spl/hi/uk/05/london_blasts/what_happened/html/21_07_0

5.stm# http://www.guardian.co.uk/uk/2010/jul/07/london-bombings-anti-terrorism

85

Past Event UK11 1 Name Shooting of Jean Charles de Menezes 2 Category of security event Murder 3 Type of event Wrongful shooting of suspect by police 4 Date July 22nd 2005 5 Where - Field / Area Stockton Station 6 Who Three Metropolitan Police officers The shooting of de Menezes occurred the day after the four attempted bombings of July 21st described in Event Summary 10. As the suspect had not died in the previous day’s attempts a full-scale hunt was launched for the suspects. de Menezes was mistakenly identified as one of these suspects and was being followed by a surveillance unit at his home. De Menezes left his apartment and was followed by at least three members of the surveillance unit. 7 Event Description Police followed de Menezes to the Stockwell Underground Station where he apparently acted ‘suspicious’ before boarding a train. A three-man firearms unit confronted de Menezes there, and while the details of what occurred in the following moments are disputed the encounter ended with de Menezes shot seven times in the head and once in the shoulder. Informed opinion suggests that the shooting bears the hallmarks of a military operation designed to ‘neutralize’ suicide bombers rather than typical police work. Police initially stated that the shooting was directly connected to the previous day’s bombings. De Menezes was said to have wore a heavy jacket unsuited for the weather, behaved erratically as he approached the tube station, jumped the turnstile at the ticket level, ran for the train as it as leaving the platform, and challenged officers when the confronted him on the train. Almost all of these details were disputed or contradicted by evidence collected after the fact. 8 Effects and impacts Police changed their position the following day by stating that de Menezes was not connected to the bombings in any way followd by an official apology. De Menezes family received 585,000 GBP in compensation. Subsequent investigation o the shooting raised raises questions of whether the police tried to hide procedural mistakes that occurred immediately prior to following de Menezes into the Underground. 9 SMT / CIT involved The shooting also brought widespread criticism of police ‘shoot to kill’ procedures for dealing with suicide bombers. The codename ‘Operation Kratos,’ which authorized police to shoot suspected 10 Other issues involved suicide bombers in the head without warning, is no longer used in official police vocabulary as a result of the de Menezes shooting though similar tactics may remain in force. The incident exemplifies the siege mentalities of authorities at the 11 Security Challenges time.

86 http://news.bbc.co.uk/2/hi/uk_news/7069796.stm

Past Event UK12 1 Name Haymarket attempted car bomb 2 Category of security event Suspected terrorism 3 Type of event Attempted car bomb (multiple) 4 Date June 29th 2007 5 Where - Field / Area Haymarket, London 6 Who Unknown perpetrators Suspects attempted to detonate two car bombs in central London on evening of July 27. The bombs were crude but 7 Event Description capable of inflicting heavy damage and loss of life. The bombs were discovered and disabled before they could be detonated. Though the bombs were not targeting the transportation system, at least one tube station was closed during the 8 Effects and impacts morning rush hour, leading to significant delays for trains passing through the area. The bombs were detected due to a combination of calls to 9 SMT / CIT involved the police from the public reporting the suspicious vehicles as well as attentive police officers in the area. The attempted bombing may have been planned and perpetrated by the same group as those responsible for driving a vehicle loaded with propane canisters into the arrivals level of Glasgow International Airport the previous 10 Other issues involved day. It was also suggested that the failed attempt may have been connected a planned Gay Pride parade to be held in the Haymarket district later in the week but that connection was not substantiated. The City’s “ring of steel” is intended to prevent attempts such as this by searching all vehicles entering the district at checkpoints. This event might be considered as indicative of how the ring of steel displaces the threat to other areas 11 Security Challenges of the city. The widespread disruption to the transportation system this event caused is also indicative of how relatively small disturbances can cascade throughout complex systems.

http://news.bbc.co.uk/2/hi/6252276.stm http://news.bbc.co.uk/2/hi/uk_news/6255960.stm

87 Past Event UK13 1 Name London Riot 2 Category of security event Large-scale riots 3 Type of event Public emergency 4 Date August 2011 Started in Tottenham and spread to other locations around 5 Where - Field / Area London 6 Who Large numbers of individuals In the early hours of August 7th 2011 a march protesting the police shooting of a 29 year old man in Tottenham, London turned violent. Mass looting and vandalism of the Tottenham retail district followed. Widespread violence 7 Event Description and looting in other areas of London occurred in the days following that, which was met by a deployment of over 16,000 police officers and militarized tactics of crowd control throughout London in the following nights. Over 700 individuals were arrested during the riots and 8 Effects and impacts damages of over 100 million GPB. The causes of the riots are source of widespread debate.

Though the Underground system does not appear to be targeted in any way, the closure of public transportation systems has become one element in a repertoire of tactics for dealing with mass unrest. Along with the use of less- than-lethal weapons such as water cannons or rubbers 9 SMT / CIT involved bullets, controlling the movement of protestors is a key tactic of crowd control, and closing down public transportation is one way of affecting this control. Numerous Underground stations in London were closed during the height of the August unrest to prevent the movement of crowds to other districts of the city. 10 Other issues involved Many in the media have questioned whether the London 11 Security Challenges riots are a preview of policing issues that may arise during the London 2012 Olympics.

http://www.globalsurance.com/blog/london-riots-cost-more-than-100m-404220.html

88 Past Event UK14 1 Name Crime and Disorder 2 Category of security event Illegal/undesirable behaviour 3 Type of event Illegal/undesirable behaviour 4 Date Ongoing 5 Where - Field / Area London Underground 6 Who Crime and antisocial behaviour in general are ongoing issues for Transport for London. These categories include distinct crimes such as pickpocketing, muggings, and assaults as well as public drunkenness, rowdiness, groups 7 Event Description of youths, and the verbal abuse of other passengers. While terrorism often garners the greatest share of attention on the topic of security, these issues occupy a far greater prominence for day-to-day management of the Underground. Though crime on the London transportation system is statistically rare, crime and antisocial behaviour is often 8 Effects and impacts framed as a ‘quality of life’ issue that affects all persons using the system. Everyday policing on London’s transportation system is guided by two principles: broken windows policing and reassurance policing. The broken windows thesis asserts that major crimes are precipitated by a proliferation of small offences, and that being aggressive with these small offences – graffiti, turnstile jumpers, panhandling, etc. – will by extension provide a check on major crime. 9 SMT / CIT involved Reassurance policing asserts that the perception of crime and disorder is a problem in itself and that changing those perceptions is also a policing objective. Both of these theories place a strong emphasis on police visibility in order to be deter and reassure. This is the current policy of Transport for London’s Public Safety and Security Directorate. 10 Other issues involved How can authorities not only reduce crime but reduce the 11 Security Challenges fear of crime?

89 Threat Scenarios The scenarios outlined in this report are deliberately speculative and seemingly far-fetched, but they are not removed from the realm of possibility. Each scenario reflects the incremental extension of events that have occurred elsewhere combined with the realization of past near misses that would have had far greater consequences if carried out to the full extent.

Terror Scenarios

1. Toxic gas attack on a subway train1

Potential offender Terrorists with political or religious motivation. They will most likely be part of a big terrorist network and have numerous abettors in order to successfully acquire the necessary chemical agents and process them. One person is sufficient to ultimately carry out the attack (or more if the attack is directed at several targets). Objective / intention Economic damage of offender Human lives Fear, demoralisation Tools Concealed pressurised canister containing a toxic chemical agent (pulmonary / nerve / blood agent), but a low-tech alternative is also thinkable (e.g. member of the Aum Shinrikyo used plastic bags wrapped in newspapers containing liquid sarin and then poked holes into the bags with umbrellas to release the toxin). The main obstacle in this scenario is obtaining or producing the necessary chemical agent(s). Use of tools Chemical toxins work best in enclosed environments. Most railway stations or airport terminals are vast halls, which reduces effectiveness significantly and makes the use of larger quantities of toxin necessary. A subway train however provides an ideal environment for a gas attack, since not even opening windows and doors will sufficiently reduce the gas concentration and casualties. A pressurised cylinder can be used to disperse the chemical agent automatically or manually. Automatic release will require a much more sophisticated container, but may also lead to the detection of the canister since the attacker will leave the concealed canister behind. Manual release minimises the chance of detection but will turn this scenario into a suicide attack since the attacker will most likely be the first victim of the toxin. This is due to the fact that the toxin needs to be dispersed ideally while the train is travelling. That way the toxin can disperse in the train and then, upon arrival at the next stop, spread out to the subway station. The attacker could use a gas mask (when using a toxin that needs to be inhaled), but putting on a gas mask before releasing the gas will most likely be noticed by the other passengers who might interfere and thus prevent the attack. Approach of offender The attacker enters the subway train with the regular passengers.

1 Inspired by: Shahar, Y., Non-Conventional Terrorism: Challenge & Response, in: von Knop, K./Neisser, H./van Creveld, M. (Ed.), Countering Modern Terrorism – Histroy, Current Issues and Future Threats (2nd International Security Conference), Bielefeld, 2005, 361, 375; and the Sarin gas attack by Aum Shinrikyo on the Tokyo subway, http://en.wikipedia.org/wiki/Sarin_gas_attack_on_the_Tokyo_subway.

90 / access point Insertion of tools The attacker will use a backpack or a bag to transport and to conceal the canister. Since there are usually no bag checks at subway stations, this will be no obstacle. Even if bags are checked (e.g. at major subway stations) the attacker can enter the subway train at a remote station where there are no bag checks. Target Passengers travelling on a subway train. If the train is not stopped before reaching a station (e.g. by engaging the emergency brakes) there will also be casualties at the station. The attack will most likely be carried out during rush hour for maximum effectiveness. Location of offender In case the attacker uses an automated dispersion device, he will leave the train after planting the device. If the toxin is dispersed manually (e.g. by manually opening a valve), the attacker will have to remain with the container and be killed by the toxin. The attacker could also initiate dispersion while the train is at a station and then quickly leave the train just before the doors close and the train departs. There is however some risk that the attacker will be contaminated despite these effort. Danger / threat The number of casualties depends highly on the chemical agents used in the attack. Extensive decontamination may be necessary after the attack, leading to a complete closure of the contaminated facility. SMTs (preventive) Access control; (random) luggage / bag inspections; CBRNE sensors and measurement systems. SMTs (emergency) Complete evacuation of the contaminated area (and possibly the surrounding area); halt traffic; EMTs / paramedics; fire brigade; protective suits and gear (NBC protection, respirators); movable decontamination facilities.

2. Sniper attack on the front court of a central railway station2

Potential offender A terrorist with political or religious motivation and the determination to die for his cause. The sniper will most likely have a military background or have received training at a terrorist boot camp. The shooter will fire shots until he is neutralised, making this a suicide attack. (A second or third shooter might increase the number of casualties and delay neutralisation by the police.) Objective / intention Human lives of offender Fear, demoralisation Tools Sniper rifle (for military/law enforcement use, shooting sport or hunting; some models available legally by gun licence holders, others through the

2 Inspired by the rampage of Charles Whitman, the “Austin Sniper”, on August 1, 1966. Whitman shot (among others) 10 students of the University of Texas from the 28th floor observation deck of the University’s administrative building. http://en.wikipedia.org/wiki/Austin_sniper; http://www.cbsnews.com/stories/2007/04/16/national/main2689785.shtml.

91 black market), ammunition, possibly lock picks, bag / suitcase etc. for concealed transportation. Purchasing the (preferably state-of-the-art) rifle or smuggling one into the country is the main obstacle to overcome in this scenario. Use of tools The sniper takes position on the roof or in one of the upper floors of a building that provides clear sight on the front court of a central railway station. He then shoots random people on the plaza and the adjacent streets, bus / taxi stations, etc. Approach of offender Most buildings surrounding the front court of a central railway station are / usually owned by companies who rent out individual floors to other access point companies, doctors, store owners, etc. (e.g. Mainz central station). Gaining access to the building itself will therefore not require any special measures by the shooter. The shooter will have staked out the area beforehand to determine the ideal position for his attack. Since the attack has to take place during office hours for maximum impact, using a window in an occupied office as firing position may require the murder of the people working there using a second, smaller gun. The sniper may use lunch time for his intrusion to find as little resistance as possible (and to ensure at the same time that the plaza is crowded). Getting through restricted areas may require the use of lock picks or force to open locked doors to gain access to certain floors or the roof. Another possibility to gain access to the firing position may be to seek employment in the building, ideally as a caretaker. Insertion of tools The shooter can use a dismantled sniper rifle and transport it using an unsuspicious bag, suitcase, backpack, etc. He then needs to assemble the pieces upon arrival at the chosen firing position. He may also carry a small handgun to deal with anyone who might pose an obstacle on his way to the firing position. Target Random people on the front court of a central railway station. Location of offender The roof or one of the upper floors of a building that provides clear sight on the front court of a central railway station. The shooter may barricade the door leading to the roof or the room he is in to delay police attempts to neutralise him. Danger / threat In 1966, Charles Whitman managed to kill ten people by shooting down from the top level of an administrative building in Austin, Texas. He was an ex-marine and hunted deer as a hobby. Since gun rampages were less common back then, many pedestrians misinterpreted the shots at first and went on with their business. This is when Whitman was able to kill most of his victims. 66 minutes passed from the first shot fired until Whitman was neutralised. It is possible that a sniper with proper training could kill a dozen people or more before being neutralised. Use of a state-of-the-art rifle and a silencer might help to significantly increase the number of victims. Potential problems for police forces dealing with this type of threat include the localisation of the shooter and gaining access to his position. SMTs (preventive) Access control for buildings surrounding critical infrastructure SMTs (emergency) Evacuation; halt traffic; public announcements (radio, public address systems) to instruct people to avoid the targeted area or to seek cover inside buildings and behind cars /

92 busses, etc.; police special forces, possibly police snipers.

3. Suitcase bombs on commuter trains3

Potential offender Terrorists with political or religious motivation (and possibly the determination to die for their cause). Some knowledge of chemistry is required to build a working bomb. Objective / intention Human lives of offender Fear, demoralisation (Economic damage) Tools Self-made explosives hidden inside suitcases, wheelie bags, backpacks, etc.; possibly using substances like hydrogen peroxide that can be acquired legally to build the bomb. Building the bombs and amassing the required amount of explosive materials without alerting the authorities will be the major objective in this scenario for the bombers. Use of tools The concealed bombs are placed on trains. They detonate ideally while the train is travelling at top speed to ensure derailing it which will increase casualties. To ensure that the bombs are not discovered and disarmed, it may be necessary for some of the bombers to stay with the bombs until the detonation is triggered (either manually or remotely to ensure that the suicide attacker does not get cold feet), making this scenario a suicide bombing. Multiple bombs can be placed on a single train for increased effect. Some can be timed to explode after the primary bomb(s) have detonated to hit rescue workers (EMTs, police officers, fire brigade) trying to recover injured or dead people from the wreckage of the primary explosion. Approach of offender The bombers could enter the trains at remote and small railway stations / access point which are usually not equipped with any type of security technology and have neither personnel from the railway company nor police stationed there. Then they could wait until the trains get more and more crowded as they approach metropolitan areas and detonate the bombs. Since there will be no surveillance footage from the railway station where the bombers entered the trains, it will be harder for police to resolve the crime afterwards. Insertion of tools The bombs will be concealed. Since bags are not checked before entering a train, getting the bombs into the trains will not be an obstacle. This might be different, if the bombers chose a central railway station as a point of entrance since police officers (e.g. of the German Federal Police) and security guards from the railway company are on patrol there. They might be alerted by suspicious behaviour, clothing or luggage.

3 Inspired by the train bombings in Madrid 2004 and the attempted bombings in Germany 2006. http://news.bbc.co.uk/2/hi/in_depth/europe/2004/madrid_train_attacks/; http://www.spiegel.de/thema/kofferbomber/.

93 Target The concealed bombs are placed on (multiple) commuter trains. This promises a higher number of casualties than express trains which usually have fewer passengers on board. The bombs would ideally have to be planted during rush-hour traffic. Another possible point of time for such an attack would be before or after a major sports event (e.g. premier league football) when a large number of fans travel to the venue using public transportation. Location of offender There are three options in this scenario. In case the bombers want to make certain that the concealed bombs are not discovered, at least one of them has to stay with every bomb and die in the explosion. Another option would be to stay with the bombs as long as possible, but to depart the train shortly before the explosion occurs. A third option would be to leave the trains as soon as the bombs have been planted. This third option may result in the discovery of the bombs by vigilant security personnel / conductors / passengers spotting the abandoned pieces of luggage. In the last two options, the explosion would have to be triggered either by a countdown clock or manually through an improvised remote (e.g. a cell phone). Danger / threat During the Madrid train bombings in 2004, 191 people were killed and about 2000 injured when ten bombs exploded inside four commuter trains. This gives an indication on the amount of casualties that can be expected from similar attacks. SMTs (preventive) Alertness of conductors towards unattended luggage; (random) luggage / bag inspections. SMTs (emergency) EMTs / paramedics; fire brigade; halt traffic; bomb squad / bomb disposal unit to defuse bombs that might not have exploded due to malfunction or have been left to hit rescue workers.

4. Gun rampage at an airport terminal building

Potential offender Terrorists (small group) with political or religious motivation and the determination to die for their cause. The shooters need to have some, but not extensive shooting skills, probably acquired during military service or training at a terrorist boot camp. Objective / intention Human lives of offender Fear, demoralisation Tools An array of firearms (e.g. shotguns, submachine guns, assault rifles; ideally (semi-)automatic weapons), large quantities of ammunition and a container for concealed transportation (e.g. bag, suitcase, backpack). Wearing bulletproof clothing (e.g. Kevlar vest) would be advantageous for the shooters to delay neutralisation by the police. Purchasing (preferably state-of-the-art) firearms or smuggling them into the country are the main obstacles to overcome in this scenario. Use of tools The shooters suddenly remove their firearms from their containers (e.g. suitcases, bags, or from under their coats) and start shooting at random people. People will most likely flee after the first shots have been fired, so the shooters will have to keep moving to find new targets. Ideally the first

94 targets would be police officers on patrol in the terminal building. The shooters may also use the firearms to take hostages after the initial killing spree. Approach of offender The shooters enter the main terminal building just like regular flight / passengers, wearing casual outfits (possibly dressing in layers with access point protective / bulletproof clothing underneath) and carrying bags or suitcases containing the guns. Since there are no security checks before check-in (at least in most countries, e.g. Germany4), gaining access will be no obstacle for the shooters. Insertion of tools The loaded firearms and ammunition are carried in unsuspicious containers like suitcases, bags or backpacks. Since luggage is only searched during / after check-in, like gaining access, this will be no obstacle (cf. footnote 5). Target The targets are people visiting the terminal building of a major airport (e.g. people waiting at the check-in counters). Daytime during holiday season (especially summer holidays) would be an ideal point in time for such an attack, since there is a significantly larger passenger volume. Location of offender The shooters will stand in a central spot in the main terminal building, ideally in a crowd of other people. Since there will be a panic after the first shots have been fired and people will flee from the source of danger, the shooters will then have to move around in the building to find new targets. After a significant amount of police officers and possibly special forces have arrived at the scene, the shooters will most likely seek cover behind check-in counters and seek a standoff with the police forces. It is also possible that the shooters will take a number of hostages to delay their neutralisation and to guarantee prolonged live media coverage of the event. Danger / threat If not stopped immediately, a small group of shooters could cause the death of dozens of people. It is therefore of key importance that the shooters are neutralised as soon as possible. Use of a state-of-the-art rifle and a silencer might help to increase the number of victims, since the shooters will be harder to locate by fleeing persons. One major problem for police forces dealing with this type of threat is the fact that the shooters are heavily armed and could easily kill a number of police officers before being neutralised (proper training and protection provided). Localising the shooters however will not be a problem (e.g. by using the CCTV cameras that are usually present at airports in large numbers). Another problem arises, if the shooters manage to take hostages after the initial killing spree and manage to barricade themselves with the hostages (e.g. behind check-in counters). SMTs (preventive) Access control for terminal buildings; preliminary security checkpoints before entering the compound (this is especially problematic for airports that are directly linked to train stations); armed police patrols wearing protective gear. SMTs (emergency) Evacuation; halt traffic (e.g. by blocking accommodation roads);

4 ICTAF states that there are security checks at Ben Gurion International Airport before entering the airport compound. This scenario hence will not apply to airports with similar security measures in place.

95 public announcements (radio, public address systems) to instruct people to avoid the targeted area, to flee or to seek cover; police special forces, possibly police snipers.

5. Dirty bomb in an airport terminal building

Potential offender Terrorists with political or religious motivation. They will most likely be part of a big terrorist network and have numerous abettors in order to successfully acquire the necessary materials and knowledge to build a dirty bomb. One person is sufficient to ultimately plant the bomb. This is a suicide mission for the bomb planter. Objective / intention Economic damage of offender Human lives Fear, demoralisation Contamination Tools Small “dirty bomb” / radiological dispersion device (RDD), which is a conventional explosive device that spreads radioactive materials (possibly using Americium 241, Californium 252, Caesium 137, Cobalt 60, Iridium 192, Plutonium 238, Radium 226 or Strontium 90)5 upon explosion. The RDD will be hidden inside a suitcase which is outfitted to prevent radiation from leaking and thus being detected (e.g. by using lead plating). The main obstacle in this scenario is obtaining the necessary radioactive material and smuggling it into the country. An advantage is however the fact, that only a relatively small amount of radioactive material is needed since the target is an enclosed space. Use of tools The bomb planter will open the suitcase at a prominent location in the foyer of the terminal building, revealing the bomb. He will then immediately activate the detonator and die in the following explosion. It is necessary that the bomb planter stays with the bomb until the explosion since the container (the suitcase) needs to be opened to ensure maximum dispersion of the radioactive material und thus maximum impact. This requires almost immediate detonation after opening the suitcase to avoid detection. Approach of offender The bomb planter enters the main terminal building just like a regular / access point flight passenger, wearing casual outfits and carrying a suitcase containing the RDD. Since there are no security checks before check-in, gaining access will not be an obstacle (cf. footnote 5). Insertion of tools The RDD is hidden inside an unsuspicious suitcase. Since luggage is only searched during / after check-in, this will be no obstacle (cf. footnote 5). Target The targets are the people visiting the central terminal building of a major airport, but also the building itself (see below under “Danger / threat”). Daytime during holiday season (especially summer holidays) would be an ideal point of time for such an attack, since there is a significantly larger passenger volume. Location of offender The bomb planter will manually detonate the RDD and die in the explosion. Danger / threat Initially, a small RDD has the same potential effect as a bomb upon explosion. Since most airport terminals are spacious halls, the number of

5 http://de.wikipedia.org/wiki/Schmutzige_Bombe; http://en.wikipedia.org/wiki/Radiological_weapon.

96 casualties from the explosion itself will be relatively small. However, the radioactive fallout will result in additional casualties. There will also be significant economic damage, since the building will be contaminated with radiation. This will make extensive decontamination necessary and it may take months until the area is safe again, meaning the complete closure of the facility. The layer of radioactive dust would have to be completely and thoroughly removed. The economic impact of closing a major airport (even just partially) is potentially very high. Even after the decontamination, passengers (and employees) may avoid the area in fear of residual radiation. This may make it necessary to tear down the contaminated building and rebuild it, thus deepening the economic damage. SMTs (preventive) Access control for terminal buildings; preliminary security checkpoints before entering the compound (this is especially problematic for airports that are directly linked to train stations); CBRNE sensors and measurement systems (e.g. Geiger counters). SMTs (emergency) Complete evacuation of the contaminated area (and possibly the surrounding area); halt traffic; EMTs / paramedics; fire brigade; protective suits and gear (NBC protection, respirators); movable decontamination facilities.

6. Missile attack on a starting / landing passenger aircraft

Potential offender Two terrorists with political or religious motivation (a driver and a shooter). The shooter will most likely have a military background or have received training at a terrorist boot camp. Objective / intention Human lives of offender Fear, demoralisation Tools Man-portable air-defence system (MPADS) which is a shoulder-launched surface-to-air missile launcher, preferably guided, ammunition. Purchasing the MPADS or smuggling one into the country is the main obstacle to overcome in this scenario. Use of tools The attacker simply aims and shoots. A guided system will lock on to the aircraft (e.g. using infrared) and direct the missile towards its target. Approach of offender The attacker will not have to enter the premises of the airport. Most / airports have motorways nearby (e.g. Frankfurt am Main airport) and access point starting or landing aircrafts fly over them at very low altitude during take- off or while landing. An attacker could simply stop a small van on the motorway’s emergency lane, jump out of the van as soon as an aircraft comes into range and fire, all within seconds. Insertion of tools The attacker will have the missile launcher with him in the back of the van, ready to fire. Target A passenger aircraft during take-off or landing. (Another possible target might be the air traffic control tower.) Location of offender The shooter will get out of the van in order to fire, then immediately get back into the vehicle and drive away.

97 Danger / threat The attacker can potentially destroy a larger passenger jet. There may be additional casualties on the ground when the plane crashes. SMTs (preventive) Flares or other countermeasure system will not be effective against such a short range attack. Also, most modern MPADS have the ability to recognise flares and reject them as targets. SMTs (emergency) EMTs / paramedics; fire brigade; halt traffic.

98 7. The Junky’s Mummy 1

Short A coffin is sent abroad, with a corpse filled with explosives description Potential A terrorist organization offender Objectives Taking down an airplane mid-flight causing a large number of casualties. A coffin is prepared with a real human corpse. The corpse is stuffed full with Tools used explosive materials and a detonator. A coffin is handmade, complete with a real human corpse and all the proper authorizations about the death of a real person whose family wishes to bury in another country. The body inside the coffin is filled with explosives, and the The scenario coffin itself contains a detonator with a timer, set to explode midair. The coffin is uploaded on an airplane and explodes midair, leading to a massive loss of human lives. No airplane is allowed to leave without having both the passenger and his or Location of her luggage on board. For that reason, one of the terrorists would probably offender choose to get on the plane and commit suicide. Any airplane crash, especially large airplanes, would carry People a horrendous price in human lives. Should the targeted airplane happen to crash in an urban Infrastructures area, the damage to infrastructures would be devastating. There would be the economic consequences of fear from Economy other following terrorist attacks on airplanes, leading to fewer passengers in the airport. Expected It is likely that some reduction in number of flights will impact be noticed. If the method for delivering explosives onto the airplane Values would be discovered, there would be a lessening of the sensitivity of security forces towards cultural and behavioral differences, including matters of privacy and religion. It is likely that the terrorist attack will be used for political Political leverage. Sniffers for explosive materials would probably be able to detect traces of the chemicals stuffing the body. The coffin could be carefully washed and cleansed from the outside so that no trace of the explosive chemicals would be left, however, and the security controllers are not likely to open the coffin and scan the body with the sniffers.

Preventive If the coffin can fit into a screening machine, it is possible that the unusual SMTs filling of the corpse would be identified, especially if the controller is suspecting foul play.

Another preventive SMT lies in the aforementioned fact that no airplane is allowed to take off with the luggage of a passenger, without having that passenger on board. Responsive Once the coffin has been loaded on the airplane, and the plane has taken off, SMTs there are no responsive SMTs that could prevent it from exploding. 99

100 8. The Deadly Porter

Short A porter in a hotel plants an explosive device in the suitcase of an innocent description resident who is about to leave to his flight Potential A terrorist organization, or an individual act offender Objectives Blowing up an airplane, leading to a massive loss of human lives. Tools used An explosive device to be planted in a suitcase A porter with terroristic aspirations would infiltrate the hotel room where suitcases are being stored before being sent to the airport with their owners. He would hide an explosive device deep inside one of the suitcases, without The scenario the owner being aware of it. The suitcase has a chance of escaping rigorous inspection (especially in less protected airports) before being loaded on the airplane. Once in the trunk of the airplane, it would explode at a pre-set time, taking down the airplane and all its passengers. Location of The offender would only have to be present at the hotel where he will plant offender the bomb in the suitcase. He would not come anywhere near the airport. Any airplane crash, especially large airplanes, would carry a People horrendous price in human lives. Should the targeted airplane happen to crash in an urban area, the damage to infrastructures would be devastating. The storage room in hotels would have to be securely Infrastructures redesigned so as to prevent infiltration by unauthorized persons. Security checks would have to be conducted among the porters and every other person allowed to handle the luggage. Expected It is unknown whether such an attack would even be impact interpreted as such and not as an aircraft malfunction, unless a terrorist organization will take the blame for it. Were it to be known, however, then there would be the Economy economic consequences of fear from other following terrorist attacks on airplanes, leading to fewer future passengers. Main result will be high investments in better airport protection means. It is likely that the terrorist attack will be used for political Political leverage. Preventive SMTs for this case consist primarily of sniffers and screening machines. One must also note that this is a case in which human-based measures are actually detrimental. Only technological measures are reliable here, and thus guidelines that state that the suitcase of every passenger must Preventive be screened (regardless of his or her seemingly innocent status) should be SMTs considered. The passengers must be informed of the possibility that a terrorist planted an explosive device in their belongings. Preventive SMTs might be considered for deployment in the hotel itself, or at the very least in its storage room. Responsive Once the suitcase has been loaded on the airplane, and the passenger boarded SMTs the aircraft, there is little to be done.

101 9. The Leaky Passenger

Short A terrorist pretending to be an innocent passenger would board a flight with a packet description of explosive material in his guts Potential A terrorist organization, or an individual act offender Objectives Blowing up an airplane, leading to a massive loss of human lives. Tools used A packet of explosive material wrapped and fit for swallowing. Also, a strong laxative. A suicide bomber would swallow, through either end of the digestive system, a tightly-wrapped packet containing explosive chemicals, possibly Semtex or another plastic explosive. In the case of T-4, C-4, or other explosives that can only be detonated using a special device, the terrorist might have to carry in his guts a small, altered detonator as well, or even take it on board in his handbag, disguising it as an electric transformer or a cellular phone recharger. The terrorist would have to go past the existing SMTs designed to detect traces of explosive material on the skin and clothes (sniffers). This could probably be arranged by washing and scrubbing the skin carefully with soap after ingesting the packet, and The ditching the clothes used when working with the material. While certain screening x- scenario ray machines might be powerful enough to image inner parts of the body, none of the above can be found in regular use on human beings in most airports due to health and privacy reasons. Therefore, as long as the terrorist does not pull attention to himself by acting suspiciously, he should be able to board the airplane without trouble. Once aboard the airplane, the terrorist would take a strong laxative. A few hours into the flight he will go to the toilet, dispose of the explosive packet, fit it into a proper shell and place the detonator inside. The contraption would be placed adjacent to the wall (possibly inside the wall) and detonated in an attempt to create a hole in the side of the plane which would lead to loss of pressure in the cabin and very possibly to a plane crash. Location of Owing to the unusual method of delivering the explosives onto the airplane, this offender would have to be a suicide bombing attempt. Any airplane crash, especially large airplanes, would carry a People horrendous price in human lives. Should the targeted airplane happen to crash in an urban area, the Infrastructures damage to infrastructures would be devastating. It is unknown whether the attack would even be interpreted as Expected such and not as an aircraft malfunction, unless a terrorist impact organization were to take the blame for it. Were it to be known, Economy however, then there would be the economic consequences of fear from other following terrorist attacks on airplanes, leading to fewer future passengers. It is likely that the terrorist attack will be used for political Political leverage. Sniffers might detect traces of explosive material on the skin and clothes of the terrorist. Powerful screening machines might be able to look into his bowels, but such are not ordinarily used in airports due to privacy and health reasons. Preventive Human-based measures, such as keeping on the alert for signs of nervousness or SMTs instability on the part of the terrorist, would probably work best in this scenario. The security forces might decide to delay the terrorist until the packet has left his digestion system in the ordinary way. The laxatives in his possession might give some

102 small indication towards his course of action. Some airplanes have security men on board, and they would have to keep a vigilant Responsive eye on the passengers. The stewardesses must also be on constant alert for any SMTs passenger that stays in the toilet for an overly long time.

10. Terror on the Railway Short An explosive device is placed on a railway description Potential A terrorist organization offender Objectives Derailing a train full of passengers Tools used An explosive device, either remote controlled or activated by pressure. The terrorists will probably refrain from using a timer, since a timer is unreliable if the trains do not run on time. The scenario A group of terrorists places an explosive device on a railway, with the intention of derailing a passenger train. The device will be activated by remote control, or by pressure sensors that cause it to explode at the moment the train passes over it. Location of The terrorists might wait nearby. This is especially true if the device is operated offender by remote control, they must stay near and give the cue. It is possible that they will leave the place in order not to be caught.

Expected People Should the terrorists succeed in derailing the train, one impact should expect hundreds of casualties. Infrastructures Effects on the train and the railway. In case the explosion is near a station we can expect damages to it too Economy Terrorist attacks like this one usually bring a halt to the trains traffic for a few hours, at least on the targeted railway. Political It is likely that the terrorist attack will be used for political leverage. Preventive Having a fence around the railway might deter some of the less-prepared SMTs terrorists, but has proven insufficient to keep terrorists out completely, especially in places where the fence has to end – such as in the intersections between a railway and a road. Cameras with movement detectors might prove more effective in alerting at intruders’ presence especially in sensitive points (e.g. tunnel entrance) Patrols moving along the railway might also identify the terrorists. Responsive As soon as the device explodes, police and train security forces would stop traffic SMTs along the targeted railway until it had been examined thoroughly to make sure no second device has been placed along it.

103 11. The Oily Fuel Short Terrorists inject contaminants into the fuel supply chain description Potential A terrorist organization offender Objectives Causing gradual degradation and malfunction of aircraft facilities, such as fuel filters and others Tools used A contaminant that will be injected into fuel supplies storage The scenario A terrorist organization uses a contaminant which can be injected into fuel supplies and remain mostly undetected. The contaminant causes degradation and malfunctioning of airplanes’ engine parts, such as fuel filters and others. If it is not discovered on time, it might bring about the failure of an engine midflight. If it is discovered, the airport’s fuel supply will have to be put on hiatus until the contaminant is either removed, or fresh fuel supply is provided.

Location of The terrorists only need to sabotage the fuel storage, which can be located inside offender the airport’s perimeter or outside. The tank farms containing the fuel might be outside the fence that surrounds the runways.

Expected People An engine failure could cause an airplane crash costing the impact lives of hundreds. Infrastructures Any airplane crash into an urban area would have a horrendous cost. Moreover, if the contaminated fuel leaves traces in the engine itself, there might be a need to replace the engines of many of the airplanes. Economy As soon as the contamination is detected, planes will not be allowed to refuel at the infected airport. This means less traffic, and consequently less passengers. The airline companies might also demand compensation from the government for their damages. Political It is likely that the terrorist attack will be used for political leverage. Preventive Having a fence surround the tank farms as well as the railways could lead to SMTs detection of the terrorists before they fulfill their purpose. Other SMTs for detection of the intruders will consist of CCTV with motion detection algorithms, radars and acoustic sensors. Patrols around the fence would serve as an extra precaution. Since the terrorists would probably need to buy a large amount of the contaminant, the police should keep an eye for such a purchase of suspicious materials. Responsive Scheduled checks of the fuel supply and of airplanes’ engines should be conducted SMTs to ensure that it had not been contaminated. If contamination had been discovered, the contaminant should be analyzed in laboratories to determine its nature. In the meantime, alternative fuel supply should be used. If no alternative fuel is found, airplanes should be instructed to refuel in other airports.

104 12. Armed cell trained commandos

Short description An armed cell of military-trained commandos seizes control of a main station. Potential offender A terrorist organization, trained native born Objectives Cease all military engagement in Muslim countries. Tools used Assault weapons and improvised explosives The scenario ‘Swarm’ attacks conducted by semi-militant groups targeting hospitality facilities and transportation hubs have been a concern since the storming of a hotel in Mumbai in 2008. In this scenario a dozen British-trained persons storm Main station in central London during the morning rush. Armed with assault rifles and a small to medium explosives, the group takes the station in a time and coordinated assault. Numerous people in the station are killed by gunfire. Being trained to a high level in British SAS tactics, the perpetrators succeed in countering attempts by authorities to retake the station by force and barricade themselves inside the station for the following three days. The perpetrators demand cease all military engagement in Muslim countries.

Location of offender Main train station

Expected impact People Dozens of persons killed in initial assault on station and more killed during following standoff Infrastructures Station damaged from gunfire and small explosions but most physical damage is superficial. Economy Majority of the Underground is closed for the duration of the standoff, bringing to a halt. The cost of the economic slow-down that results is estimated to be in the billions. Political 1. Authorities state publicly that they do not negotiate with terrorists but proceed with backchannel negotiations with the group, which highlights political divisions in Parliament. Fractious political infighting ensues, which further hinders response.

2. The military and secret services are deeply demoralized by their lack of success in retaking the station and because the perpetrators are of their own.

Preventive SMTs An attempt to realize a plot similar to this was foiled by advance intelligence that the attack was being planned followed by attempts to disrupt the group through freezing assets and killing the leaders. British Transport Police also has a unit of approximately 100 armed officers trained to deal with incidents such as this. Responsive SMTs As the Mumbai attack showed, a fast and coordinated response using force if necessary is needed to prevent an initial assault from turning into a drawn-out standoff.

105

Short Detonating a massive bomb on a train in capital city during a crowded description international even, e.g. in central London during the 2012 Olympics. Potential Terror organization offender Objectives Cease all military engagement in Muslim countries and releasing terror related prisoners. Tools used Ammonium nitrate fertilizer bomb The scenario A group of individuals succeed in loading a large ammonium nitrate fertilizer bomb on a train heading to the city. The bomb explodes as it prepares to arrive in to the central station during the important international event, killing hundreds and injuring thousands. Air and ground transportation across the capital is suspended, leaving thousands of visitors without transportation. Numerous smaller explosions occur in the following days. Government responds by declaring martial law and deploying military resources to protect the city from further bombings.

13. Fertilizer bomb

106 Location of At least one offender is killed on the train. Other suspects located in northern city offender where bomb is smuggled aboard train.

Expected People Hundreds killed and thousands injured. impact Infrastructures Train station and buildings in immediate vicinity completely destroyed. Economy Economic toll is in billions. Political - Preventive Screening measures for cargo on trains are in place but authorities have SMTs acknowledged that stopping such an attack from happening is virtually impossible if the perpetrator is determined enough to make it happen. Responsive Responding to mass emergencies such as this requires investment in training and SMTs resources for first responders.

107 Cyber Scenarios

14. Hacking an underground computer

Short Unknown individuals hack the Underground’s computer system description Potential A terrorist organization or a White Collar Criminal - A loose network of highly offender skilled individuals. Eight or 10 persons are thought to be behind the attack. Objectives Tools used Computers The scenario The 2007 the cyber attacks on Estonia are widely regarded as the first instance of contemporary ‘cyber warfare,’ and authorities in other countries are concerned that similar methods could be used to inflict major physical and economic damage to a country. In this scenario a coordinated network of hackers is able to defeat existing network safeguards and take control of a number of trains in a big city. The attacks are not malicious in nature but numerous accidents occur as trains crash into one another or are derailed. First response capabilities are unable to respond to all calls for service, leaving some accident sites unassisted for hours. Some trains are derailed in deep-level tunnels between stations, making medical treatment and evacuation extremely difficult. Dozens dies and hundreds require hospitalization.

Location of Location of offenders is unknown. They are likely to be physically dispersed around offender the globe and known to one another only through online aliases.

Expected People Expected impact impact Infrastructures Economy Political Preventive Greater investment in cyber security safeguards and compartmentalization of SMTs system so that control cannot be gained from single command centre. Responsive Responding to mass emergencies such as this requires investment in training and SMTs resources for first responders.

108

15. Total Shutdown of Airport Radio Communication by Terrorists

Short Terrorists armed with high-power radio transmitters cause a total shutdown of radio description communications in an airport Potential A terrorist organization, probably a highly sophisticated one offender Disruption of the airport operation trying to cause air accidents. All these in order to cause casualties and stop the air transportation to and from the airport. This could Objectives also result in a political crisis in regional or national level

High-power radio transmitters that can cover an area of a few dozen square Tools used kilometers. Alternatively, the terrorists could use high-power radio jammers which have a similar effect. Terrorists will place a few remote-control transmitters around an airport at covert locations. Due to the nature of the transmitters, they can be far enough from the airport so as not to be detected by security forces patrolling around. As a matter of fact, the transmitters could be hidden in urban areas near the airport and even in citizens’ apartments.

The scenario The transmitters can be scheduled to be activated in an irregular pattern, interfering with radio transmissions in the area.

The radio interference caused by the transmitters on multiple channels and frequencies would damage the ability of the control tower to communicate with airplanes in the sky and on the field, and put a stop to take-offs and landings. In extreme cases airplanes might collide into each other.

The terrorists would stay away from the transmitters, and possibly leave them Location of altogether. The devices will be discovered and eliminated eventually, but this could offender take a very long time especially if not all of them are activated at the same time. People Crash of airplanes can cause huge numbers of casualties Should airplanes crash into the airport, or into urban areas Infrastructures surrounding the airport, the infrastructural damage would be vast. Many flights will be postponed or possibly cancelled altogether. Should the incidents repeat themselves, some aircraft Expected Economy companies would decline landing their airplanes in the airport impact altogether, or raise their prices. In either scenario, citizens might come to regard the afflicted Values airport as unsafe, and it is likely that some reduction in flights will be noticed. It is likely that the terrorist attack will be used as a leverage to Political force certain political actions Preventive There are currently no effective SMTs that can identify such devices remotely hidden SMTs and prevent such an incident in advance. Responsive Special police units equipped with detection systems to find the transmission sources SMTs should be established.

109 16. Total Shutdown of Airport Radio Communication by Pirate Radio Stations Short A pirate radio station near the airport causes a total shutdown of radio description communications in the facility Potential A pirate radio station offender

The station's operators' objective is to remain on the air, possibly for monetary or Objectives ideological purposes.

High-power radio transmitters that can cover an area of a few dozen square Tools used kilometers.

A pirate radio station is being operated against the law without a license. Its broadcasts are interfering with the airport communication systems affecting the ability The scenario of the control tower to communicate with airplanes in the sky and on the field. Taking- offs and landings are completely stopped. In extreme cases accidents can happen.

Location of The radio station will probably be located in a nearby city or urban area. The operators offender will be in the station.

Passengers will suffer heavy delays. In extreme cases accidents People can result in casualties and human lives. Any Should airplanes crash into the airport, or into urban areas Infrastructures surrounding the airport, the infrastructural damage would be vast. Expected Many flights will be postponed or possibly cancelled altogether. impact Should the incidents repeat themselves, some aircraft companies Economy would stop using the airport. Heavy losses can be caused to the airport as well as related companies Values Airport will be considered by users as insafe. Political Public might lose confidence in the authorities Preventive There are currently not known SMTs that can prevent such an incident. SMTs Special police forces equipped with special systems (e.g. sensitive electromagnetic Responsive waves detectors). Could be established to cope with these risking stations SMTs To the best of our knowledge, there is currently no such police force in existence.

110 Organized Crime

17. The Junky’s Mummy 2

Short A coffin is sent abroad, containing a corpse filled with drugs description Potential Any organization dealing with drugs offender Objectives Transporting drugs between countries.

Tools used A coffin is prepared with a real human corpse. The corpse is stuffed with drugs

A coffin is handmade, complete with a real human corpse and all the proper authorizations about the death of a real person whose family wishes to bury in The scenario another country. The body inside the coffin is packed with expensive drugs. The customs services are incapable of detecting the drugs through the coffin, and are reluctant to open it. The drugs are successfully transferred across countries.

The currier in charge of the drug load will probably be a passenger on the Location of airplane carrying the coffin. He cans also wait in the final destination while the offender accompanying person is full innocent with no knowledge of the real mission.

A large and illegal drug load would be transported to Expected Economy another country, with all the obvious consequences for the impact people and the economy of that country.

If the coffin can fit into a screening machine, it is possible that the unusual filling Preventive of the corpse would be identified. SMTs Drug-sniffing dogs and sniffers might also be able to give alert, should they be applied in the airport. Responsive

SMTs

111 Disorders

18. The Human Flytilla

Short A pressure group arranges a combined effort of hundreds, possibly thousands of description people to come to a single airport and demonstrate, disrupting order in the facility Potential Pressure groups of all kinds. They could be peace activists, Muslim protestors, offender PETA and many others Objectives Drawing attention from the media and the crowd in the airport Tools used The tools in this case are the activists themselves, who will buy flight tickets and come to protest together The scenario A pressure group organizes a combined effort of hundreds, possibly thousands of people. They will all buy tickets to the same airport, arrive at the same day and peacefully exercise their right to demonstrate (which might not be applicable in the destination country).

Location of In the airport. offender

Expected People While the demonstrators intend to avoid violence and impact bloodshed, mass-demonstrations have a way of occasionally becoming bloody, at least for a few in the crowd. In addition, the ordinary passengers in the airport might become agitated by the demonstrators' activity, and brawls might arise. Infrastructures With the demonstrators clogging the airport, it is likely that there would be a disruption of the proper order of work. Economy The disruption in the order of work would encumber the airport and delay taking-offs of flights. Political The demonstrations could easily be used to convey political messages. Preventive Initial handling of the demonstrators could begin by obtaining their details ahead SMTs of time, and informing the airline companies that these people would not gain entry to the airport – which means the companies would have to take them back at their expense. This tactic worked very well for Israel during the Flytilla in 2011, and resulted in the airline companies themselves turning away most demonstrators and refusing them seats on the airplanes. Responsive Police and airport's security forces would have to step in and confine the SMTs demonstrators to the best of their abilities, possibly removing them entirely from the airport and/or taking them into custody.

112 Findings & Conclusions

In this report we present a summary of the efforts done in task 1 of WP6. In this task we had to describe past threat events which occurred in mass transportation systems such as air traffic systems and train platforms. We covered the five threat categories our research deals with – terror (T), illegal immigration (II), cyber (C), white collar (WC) and organized crime (OC). These listed events are followed by a related offered threat scenarios. We have covered some worldwide events, but focused on events collected by the partners, each partner in its country, and specifically related to each of the four case studies we base our research on: BGIA (Ben-Gurion International Airport), BER (the soon coming open new Berlin's Airport), London's Underground and Torino's Train System. The below table summarizes the main collected events:

Table No. 4: Past Events List

No. Partner Category Event 1 LSTS, Be T Suicide attack – World trade center / Pentagon 2 LSTS, Be T "SuperFerry 14" bombing using booby trapped TV, filled with TNT, in the lower decks

3 LSTS, Be T Madrid 4/11 – trapped backpack 4 LSTS, Be OC / T Operation "Ramp rats" (by an airplane employees) – smuggling drugs, weapons etc.

5 LSTS, Be II Operation "Maxim" – smuggling humans 6 LSTS, Be II Illegal immigration – Air china 7 LSTS, Be C / WC Sasser - computer worms attacked Delta air lines computer

8 LSTS, Be C / WC Juvenile hacker attacked Worcester airport 9 LSTS, Be WC / II Corruption in SA 10 SITI, Italy T Terrorist attack on Rome airport – rifles and grenades

11 SITI, Italy T Terrorists attack in Vienna airport - grenades 12 SITI, Italy T Attack on Bologna airport – IED (improvised explosive device)

13 SITI, Italy T Attack on Milan Metro – fire using 66 pound gas canister 14 SITI, Italy T Attack to Rome metro – IED, empty train 15 SITI, Italy C / T Hacker attack on Pisa airport 16 SITI, Italy C / WC Hacker attack on Catania airport 17 UK, Germany T Hijacking flights- KLM KL100/ Austrian commercial aircraft

18 UK, Germany T Bomb at Dresden central station 19 UK, Germany II / T Ennepetal hostage crisis

113 20 UK, Germany T Sauerland group – self made car bombs Frankfurt airport

21 UK, Germany WC / T Operation Athena - money smuggling in order to fund terror

activities The following table maps the 22 UK, Germany T Cargo planes - in the air bombing of packages sent by mail partners country's 23 UK, Germany Other – Dummy bomb I Namibia airport collected events criminal act divided by each of 24 UK, Germany T Frankfurt airport shooting at the threats categories - Past 25 UK, Germany T Trying to plan an attack on a public transport system events by 26 UK, Germany T Arson attack on a cable bridge (railway traffic) platform and category: 27 UK, Germany T Hijacking Lufthansa X 3 - flight 649, 615, 181

28 UK, Germany II / T Hijacking Slovair aircraft 29 ICTAF, Israel T Pretty woman 30 ICTAF, Israel T Explosive on the railways X3 31 ICTAF, Israel C / T Pirate on the air X 3 32 ICTAF, Israel T Suicide bombing in train station X 3 33 ICTAF, Israel T Spy on the train 34 ICTAF, Israel WC Gas container near the airport 35 ICTAF, Israel WC / OC Sick oligarch – smuggling money 36 ICTAF, Israel OC The Peruan priest - drugs currier 37 ICTAF, Israel T (?) The oily fuel

38 ICTAF, Israel T / Other Human flyover – order disturbance Table No. 1: Collected 39 NC, UK T Bomb on subway car Past Events 40 NC, UK T Bomb at empty train Categorization 41 NC, UK Can be T Fire in underground station 42 NC, UK T Fertilizer bomb at train station

43 NC, UK T Canary wharf bombing

The scenarios 44 NC, UK T Aldwych bus bomb developed and 45 NC, UK T 7/7 train bombing & July 25th attempt presented in this 46 NC, UK II / Crime and disorder in London's underground / above ground report are spin- ndesirable / DLR offs of the behaviour collected past events, and will serve the SIAM data base.

As can be seen in table 1 – most of the collected past events are related to Terrorism. Beside Cyber events, that are also part of terror acts, the rest of the threat challenges are less covered. This can be explained by the fact that while Terror and Cyber issues are direct threats on mass transportation systems, the other threats types might use transportation systems as platforms but not been considered as a threat for them.

114 The following event's categorization issues required special attention:

- Illegal immigration, specifically, suffered from an ambivalent attitude. A big question rose if immigration at all, even being illegal at the time it happened, should be seen as a threat. This question has been left open at this stage of the research.

While collecting the information required for this task, an interesting event of disorder happened at BGIA. In this event, a group of protestors (so called, but with suspected relation to terror groups) planed to gather inside the airport terminal, reaching it from abroad using a few close scheduled flights. Part of them even could not expect getting a visa to enter the country and would not get an entry approval. We couldn't categorize this situation as a terror attack or as any other type of crime, and therefore decided to add a new category. At this stage of the research, as it is not one of the original covered five categories, we have referred to it as "other". This event opened a discussion that will be covered later in task 3 (country workshops), trying to identify related scenarios, their expected impacts and suitable SMT's.

115 References

i Organised and White Collar Crime Discussion White Paper, Department of Justice and Law Reform of Dublin, 2010. ii http://en.wikipedia.org/wiki/Terrorism iii Bockstette, Carsten (2008). "Jihadist Terrorist Use of Strategic Communication Management Techniques" (PDF). George C. Marshall Center Occasional Paper Series (20). ISSN 1863-6039. http://www.marshallcenter.org/mcpublicweb/MCDocs/files/College/F_Publications/occPapers/occ-paper_20-en.pdf iv Bockstette, Carsten. "Jihadist Terrorist Use of Strategic Communication Management Techniques". George C. Marshall Center Occasional Paper Series . v Disorders and Terrorism, National Advisory Committee on Criminal Justice Standards and Goals (Washington D.C.). vi European Commission (2007). Communication from the Commission to the European Parliament, the Council and the Committee of the Regions of 22 May 2007 – Towards a general policy on the fight against cyber crime vii Identity theft occurs when someone appropriates another's personal information, such as name, PPS number or credit card number without their knowledge in order to commit fraud or other crimes. The crime takes many forms. Identity thieves may rent an apartment, obtain a credit card, or set up a telephone account in another person's name and the theft may take some time to come to light through, for example, a credit report, a credit card statement or contact by a debt collector. viii A form of online fraud where fake emails or websites, supposedly from a legitimate company, seek to obtain confidential account details with a view to conducting illegal transactions on the account. ix Unsolicited commercial e-mails. x A broad category of software threats to network and systems which can exploit vulnerabilities in computer systems. Any code which modifies or destroys data, steals data, allows unauthorized access, exploits or damages a system, and does something the user did not intend to do is called malicious code. There are various types, including viruses, Trojan horses and Worms. xi (The Parliamentary Office of Science and Technology (UK), 2006) xii TE-SAT 2009 EU TERRORISM SITUATION AND TREND REPORT. Europol. 2009. https://www.europol.europa.eu/sites/default/files/publications/tesat2009_0.pdf. xiii Walsh, Marion (2009) Human Trafficking, xiv Sections 1, 2, 3 & 4 of the Criminal Law (Human Trafficking Act) 2008 and Article 3, United Nations Protocol to Prevent, Suppress and Punish Trafficking in Persons, Especially Women and Children, Supplementing the United Nations Convention against Transnational Organized Crime. xv White-Collar Crime and Criminal Careers, by David Weisburd, Elin Waring, with Ellen F. Chayet. xvi http://www.focus.de/politik/deutschland/tid-19865/oktoberfest-attentat-als-der-terror-auf-die-wiesn-kam_aid_552841.html; http://de.wikipedia.org/wiki/Oktoberfestattentat. xvii http://www.spiegel.de/panorama/zeitgeschichte/0,1518,504008,00.html; http://en.wikipedia.org/wiki/Munich_massacre. xviii http://en.wikipedia.org/wiki/German_autumn; http://news.bbc.co.uk/2/hi/europe/2340095.stm; http://en.wikipedia.org/wiki/Red_Army_Faction. xix Kailitz, Politischer Extremismus in der Bundesrepublik Deutschland, 1st Ed. 2004, pp. 114-116. xx http://en.wikipedia.org/wiki/La_Belle_(discotheque); Kailitz, p. 97; http://de.wikipedia.org/wiki/Sprengstoffanschlag_auf_die_Rhein-Main_Air_Base. xxi Kailitz, pp. 104-105. xxii Kailitz, pp. 97, 114. xxiii http://www.spiegel.de/panorama/a-48287.html. xxiv http://archiv.rhein-zeitung.de/on/01/03/16/topnews/tupochro.html.

116