2020 a year of turmoil SOLUTIONS Annual Review Opinions Focus Threat Intelligence Risk Evaluation 2

About this Review About Pool Re SOLUTIONS Intelligence cut-off date Disclaimer The Pool Re SOLUTIONS Annual to provide a statistical underpinning Pool Re SOLUTIONS was launched The analysis in this report was current This report has been prepared by Review provides an overview of to other studies. Where the Global in November 2019 and combines as of 1 Sep 2020 and has not been Pool Reinsurance Company Limited significant developments in the field Database was not used, decades of knowledge and expertise updated to reflect recent developments, (Pool Re). While this information of terrorism risk, bringing together we used publicly available data drawn with data and analytics drawn from a such as the change of the UK’s threat has been prepared in good faith, no experts from a range of disciplines from a variety of sources, the references wide range of notable partnerships. level to SEVERE, or the imposition representation or warranty, expressed including (re)insurance, policy, to which can be found at the end of of a second ‘lockdown’ in England or implied, is or will be made and no academia, security, and risk each article. By investing heavily in the best and Wales. responsibility or liability is or will be management. As well as addressing people and resources to support our accepted by Pool Re, or by any of its key issues in counter-terrorism and We hope that our analysis of the terror objectives, we are able to provide respective directors, officers, employees protective security, the Review threat will be helpful for our Members our clients with a blend of services, or agents in relation to the accuracy includes leading research and and other stakeholders as they seek information, and tools to evaluate, price, or completeness of this document, commentary on significant events and a greater awareness of the frequency and manage terrorism risk. and any such liability is expressly trends in disaster risk financing and and severity of terrorist events and disclaimed. In particular, but without how the evolving threat impacts It is comprised of three pillars: Risk related public policy. Contributors to Awareness, Risk Modelling and Risk limitation, no representation or warranty the report include both SOLUTIONS on their particular area of activity. is given as to the reasonableness of Furthermore, we aim to promote a Management, with all three teams in-house team of analysts, actuaries, contributing to this report. future suggestions contained in this and risk managers, and individuals from better understanding of the challenges document. Pool Re is a company Pool Re’s wider network of thought and opportunities faced not only in the limited by guarantee and registered in leaders and subject matter experts. field of terrorism risk, but by the wider England and Wales under company no. (re)insurance sector. 02798901, having its registered office at When examining the terrorism threat, In this edition, we consider a range Hanover House, our methodology is based on analysis 7 Savoy Court, WC2R 0EX of the wide range of publicly available of trends and events which are open source material and collaboration reconfiguring the threat landscape, with subject-matter experts. We also as well as looking more widely at used the Global Terrorism Database, developments in the re(insurance) compiled by the University of Maryland, sector and related legislative and policy issues.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 3

facing. Stephen Catlin (Chairman and CEO, Convex) and Dr I am pleased to introduce this year’s Adrian Leonard (University of Cambridge) address the difficulties Annual Review. Twelve months ago, of anticipating complex risks, and pose a series of challenges we launched SOLUTIONS, an in-house we must collectively overcome if we are adequately to prepare for these. In response, Professor Paula Jarzabkowski (City centre of excellence to work alongside University) considers how the increasing prevalence of systemic Pool Re and drive its expertise in risk threatens traditional models of risk transfer, and whether a new approach to managing these is now required. understanding and mitigating terrorism Alongside this, the Review contains comprehensive analysis of risk and financing terrorism risk solutions. the current terrorist threat to the , drawing on in- This publication marks SOLUTIONS first anniversary and comes house expertise from the SOLUTIONS team as well as its wider towards the end of a year which continues to present acutely network of excellence, including contributions from subject- This timely challenging conditions for virtually every business and nation matter experts in academia, policy and risk management. publication comes across the world. I am very grateful to all of the Review’s contributors, and to the towards the end of a Despite these challenges, and as this report demonstrates, ongoing work of our network of partners in the UK and around year which continues SOLUTIONS has already made significant steps in progressing the world with whom we share a common purpose. Mutual the UK market’s understanding of contemporary terrorism risk. interests have long been a key ingredient of cooperation and to present acutely As an industry, we cannot effectively mitigate or finance terrorism progress, and COVID-19 is just the latest reminder that no nation challenging conditions risk solutions without a deep knowledge of its drivers, of how it is immune to the vulnerabilities of our interconnected world. As for virtually every manifests now and may manifest in the future. SOLUTIONS is several of the articles in this Review discuss, terrorism is likely committed to furthering this understanding in the years ahead, to shape a number of the threats on the daunting spectrum of business and nation and to investing in the research and development our industry catastrophic risk we all face in the years ahead. across the world needs to take a greater and more confident stake in insuring and The insurability of extreme risk is going to be one of the defining mitigating terrorism risk in the years ahead. issues of the next decade, not just for our sector, but for the The contributors to this edition underscore our commitment societies we serve. Our ambition is for Pool Re SOLUTIONS to to bringing together talent from a broad range of disciplines provide a template for how mutual interests and cross-sectoral to develop the best possible understanding of terrorism and partnerships can improve our collective understanding of catastrophic risks, and how we might strengthen our national emerging risks. Only with this understanding can our society resilience to such risks at the beginning of a decade which has be more resilient through better preparedness, innovative already brought profound uncertainty and difficulty. mitigation techniques, and creative forms of risk sharing and financing solutions. We are fortunate to be able to draw on the expertise of former leaders like the Rt Hon (former ) In that spirit, I hope you enjoy this year’s Review. and Paddy McGuinness (former Deputy National Security Director). Both have shared their views on the security challenges facing the nation, and how greater public–private collaboration can improve the UK’s resilience to extreme risk. Julian Enoizi The Review also includes contributions from leading voices CEO, PoolRe within the insurance industry on the challenges it is currently

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 4

Pool Re SOLUTIONS Annual Summary 2020

Opinions Focus Threat Intelligence Risk Evaluation Headline: Terrorism and risk management in a Guns ‘n’ Bombs: “They haven’t gone away The UK protect duty (Martyn’s Law) A conversation with the Rt Hon Amber Rudd post-COVID world you know...” A closer look at the consultation on new Pool Re’s Chief Resilience Officer talks to the Current threat landscape and the changing Terrorist intent, capability, and the threat of firearms protective security legislation and how it former Home Secretary about politics, security risk management environment and explosives attacks might support the insurance industry and national resilience Horizon scanning the terrorism threat The growing violence of the far right NDBI in Europe: observations and Rethinking resilience in the 2020s Understanding the drivers of terrorism and anticipating Assessing the scale of the threat posed by implications for the UK Integrating reinsurance into the national resilience new threats right-wing terrorism Pool Re’s Chief Actuary reflects on recent and disaster risk financing architecture non-damage terrorist events in Europe and How will Brexit impact on the UK’s ability to Terrorist recidivism what these mean for the UK From risk transfer to risk sharing counter terrorism? How much of a problem is reoffending by How systemic risks are changing the relationship Pan-European security initiatives and the outlook convicted terrorists? Business Interruption between risk, responsibility, and reward and the for security cooperation post-Brexit Lessons from COVID-19 and beyond need for greater risk sharing E-: a credible new threat? Insure to be resilient: how to strengthen national Al-Qaeda’s new cyber strategy and the outlook for Can you really manage terrorism risk? Our word is our bond security in a post-COVID world ‘cyber terrorism’ Pool Re Head of Risk Management, The importance and challenges of linguistic clarity The Integrated Review and how the insurance industry Chris Medhurst-Cocksworth, talks to in cyber (re)insurance can contribute to national resilience Global insecurity and the terrorist threat to the UK Steve Coates, discussing the challenge Examining the relationship between insecurity overseas terrorism risk poses to businesses, and Imagination at the tail end Hardly anyone saw it coming and the UK’s terrorism threat landscape what they can do about it Anticipating tail risk events and developing Insuring against pandemic risk – how the industry is effective responses to their occurrence responding, and what more can be done Conspiracy theories and terrorism The growing role of online conspiracy theories as a Cyber in the new normal driver of political violence How COVID-19 is shaping the cyber threat landscape

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 5

Opinions

Headline: Rethinking resilience in the 2020s From risk transfer to risk sharing Our word is our bond Imagination at the tail end A conversation with the Rt Hon Integrating reinsurance into the How systemic risks are changing the The importance and challenges Anticipating tail risk events and Amber Rudd national resilience and disaster risk relationship between risk, responsibility of linguistic clarity in developing effective responses Pool Re’s Chief Resilience Officer talks financing architecture and reward, and the need for greater cyber (re)insurance to their occurrence to the former Home Secretary about risk sharing politics, security and national resilience

Author Author Author Author Author Ed Butler CBE DSO Chris Yeates Professor Paula Jarzabkowski Christian Wells Dr Adrian Leonard Chief Resilience Officer Associate, CEO’s Office Professor of Strategic Management, Special Counsel Associate Director, Centre for Pool Re Pool Re City University of London and Pool Re Financial History, University of Queensland University of Cambridge Ed Butler is Pool Re’s Chief Resilience Chris joined Pool Re at the beginning Paula Jarzabkowski is Professor of Strategic Christian Wells qualified as a solicitor in Dr Adrian Leonard is a writer, historian, and Officer and leads its Risk Awareness of 2018, having completed an MA in Management at Cass Business School, 1980. From 1982 until joining Pool Re in insurance specialist with one foot in the Team. He is responsible for developing Contemporary Literature at UCL. City University of London and University of 2012 he was a member of the Insurance University of Cambridge and the other in the company’s capacity and capability Queensland Business School. Professor and Reinsurance team at Lovells, from 1986 the City of London. His career combines in understanding the terrorism threat His role at Pool Re is to support the Jarzabkowski is an expert in insurance a partner specialising in the operation of journalism, academia, and commercial writing landscape and how to mitigate against Chief Executive across all areas of his role and reinsurance markets, having studied insurance businesses, including mutuals, for the insurance sector. Most of his 30 years these perils. Ed has over 35 years of to implement the strategic visions and different aspects of the global industry, MGAs and Lloyd’s syndicates, and related of writing have been focused on insurance. experience in counter-terrorism, security objectives of the company. and released a range of industry reports, disputes. Christian joined Pool Re as General He has advised companies from Amlin to and risk management, including 24 Chris is a published author, having written masterclasses, academic papers, and a Counsel and Company Secretary, in which Zurich Re. He was News Editor of Insurance years in the and eight years nine educational titles published by Gresham widely acclaimed book, Making a Market capacity he provided critical support for the Day and Press Officer at the International business consulting. He was privileged books for Key Stage 2 and 3 students across for Acts of God with Oxford University expansion of the company in the areas of Underwriting Association. Meanwhile he is to command 22 SAS and retired as a the UK. Press. Her current research examines how governance, regulation, risk and compliance. Associate Director of the Centre for Financial Brigadier in 2008. governments and markets around the world Since 2019 he has been the Company’s History, University of Cambridge. His book can better work together to address the Special Counsel, assisting the Chief London Marine Insurance 1438–1824: Risk, growing threat of disaster, and to increase Executive with project-based assignments. Trade and the Early Modern State is due for the links between insurance and resilience. publication in early 2021.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 6

Amber Rudd, Pool Re Advisory Council Member and former Home Secretary, chats with Pool Re A conversation Chief Resilience Officer Ed Butler. Ed Butler: When did you first become interested with the Rt Hon in politics? Amber Rudd: Politics had not occurred to me until I hit my 40s. I was yacking on about politics to some friends, Amber Rudd and one of them – she’s married to an MP – said: “Why don’t you stop talking about it, and just do it yourself?” Pool Re’s Chief Resilience Officer talks I suddenly thought: this is what I am going to do. I threw myself into it, trying to position myself as a good to the former Home Secretary about candidate. To my amazement, I pulled it off and became politics, security and national resilience an MP in 2010. I didn’t have departmental or ministerial leadership ambitions at that point. My initial priority was Hastings and Rye, which I represented for nearly 10 years. But as I moved up the ladder, I became more aware of the opportunities to influence legislation and be part of a team that gets things done. Looking back, it is a bit of a theme for women in recent parliaments. The Conservative Party had not been a welcoming place for female candidates, but changed that. He made an explicit call to professional women who shared his values, and I responded.

Ed Butler CBE DSO, Chief Resilience Officer, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 7

EB: You were Home Secretary for me, and possibly for the country, in a two years, including 2017, when the long while. UK suffered five terrorist attacks and fourteen failed plots. Was this your most EB: You now have a number of private- challenging time as Home Secretary? sector roles, including membership of the Pool Re Advisory Council. Do you believe AR: Of all my time in politics, that was the collaboration between the public and most extraordinary year because of the private sectors should be greater? scale of terrorism. The threat was Severe, and for a time Critical, meaning a further AR: Public–private partnerships are attack was imminent. 2017 felt as though typically more successful than when we, as a country, were under attack; it government goes it alone, or when the was as if there was an infection among private sector tries to second-guess a small minority of the people in the UK governments’ actions. The greater the who wished us harm. We tried publicly number of public–private partnerships, to exude calm, but inside the machine the better the chances of success in it was different. There was real concern many areas, including security. about the scale and intensity of the threat. They can be approached in different It escalated very quickly. At times we ways. For example, I recently joined were on the edge of our seats trying to Equinor, the Norwegian state-owned oil ensure we were prepared, even while company, as an advisor. It is 68% owned we were tracking down the perpetrators by the state, but has significant private- involved in previous attacks. One of my sector ownership too. That partnership fellow Pool Re senior advisors, Mark between public and private actors works Rowley, was the National Lead for well, aligning interests but also testing Counter-Terrorism in charge at the time. each other. He and his team came down very quickly Success requires a special mindset and on terrorist activity in the cities, where we leadership from both sides to uncover were most vulnerable, and we managed opportunities and set clear strategic to move away from the high danger zone. goals. It is also about trust: the private In May 2017, at about the same time as ...it was if there was an infection sector must feel it is getting what it the Arena bombing, we also among a small minority of the expects from government, and vice had the WannaCry cyber attack on the versa. Relationships are important. NHS. It was the first major hostile cyber people in the UK who wished Having been on both sides, I encourage incident we had experienced and the first us harm... more such partnerships. time the National Cyber Security Centre EB: We are in the throes of a global was called into action. So 2017 really was Home Secretary Amber Rudd joins a police patrol with Commissioner Sir Bernard pandemic which demonstrates that the the most interesting of times, but also Hogan-Howe (second R) in on her first day as one of Prime Minister ’s cabinet on government is the insurer of last resort the most worrying and testing year for July 14, 2016. (Photo by Lauren Hurley - WPA Pool/Getty Images)

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 8

when extreme risks impact on our We’re also looking at short term AR: The line between state and non-state terrorism, and our enemies operate in society and economy. Should insurance solutions for SMEs which could is sometimes blurred. In the first instance, very different ways. On the other hand, government have a more joined- be implemented quickly. That would give an attack may appear non-state, but a creating a set definition is incredibly up approach to understanding and the government a reason to get involved, state actor may very quickly be revealed difficult, because everybody wants to managing extreme risks? because the provision of cover would as the antagonist. We need a system, contribute. That can lead to a watered- give small businesses the confidence probably run through the National Cyber down result. If industry and government AR: It is the nature of government to to reopen. They would not have to look Security Centre and the Foreign Office, can manage with the existing definition, think largely in the short term, because over their shoulders continually to spot an which would make the distinction. I would hesitate to reopen the question, of the structure of our democracy. approaching, possible second wave. since achieving consensus among all governments should think strategically for As Home Secretary I established stakeholders would be very difficult. the long term, but they are unreasonably In the end, though, it will be up to the weekly meetings between preoccupied with the short term, insurance industry to find a solution. the National Cyber Security EB: Post-Brexit, will the UK be excluded because they are judged on their short They are the risk experts, and this is Centre and the Cabinet from European security initiatives, term performance every few years. an extreme risk situation. I would be Secretary, which reflected particularly shared databases, or can Long term thinking is therefore quite surprised if insurers cannot develop the government’s increasing we have effective bilateral relations? difficult to impose, despite its necessity. a workable product, even if it is less awareness of the cyber It sometimes happens, though. David than perfect. threat. I assume those AR: I’m worried about our post-Brexit Cameron and George Osborne set up meetings still take place. security relationship with the EU. I’ve the National Cyber Security Centre, I believe the attribution seen no evidence that government for example. It has absolutely been a problem will ultimately be understands how serious and success, but they received no electoral resolved, especially given essential it is to retain access to those credit or benefit for this initiative. this collaboration, but the shared databases, that they have governments should attribution challenge is likely saved lives, or that they were often Extreme risk is an area where public– think strategically for to perpetuate. originally established by the UK. private partnerships can add real value. The insurance industry is trying to find an the long term, but EB: In recent years I am also concerned we will lose insurance mechanism to protect against they are unreasonably Pool Re has assessed access to the European Arrest pandemic risks, and I have been helping whether the definition of Warrant. I have heard the Home by chairing one of the working groups preoccupied with the terrorism provided by the Secretary talk about falling back (as a volunteer, like everyone else in the short term, because they Reinsurance Act 1993 on Council of Europe terms, which group). We’re looking at Pool Re, and are judged on their short remains appropriate. are very poor compared to the considering an equivalent. But pandemic Should the Act be updated European Arrest Warrant. It is an risk is different, of course. Terrorism term performance to reflect the current threat efficient tool to get hold of and losses are isolated, short and sharp, while EB: As Home Secretary you were very environment? deport people who’ve committed pandemic losses potentially hit the whole concerned about the threat to the British crimes in the UK, but there country at the same time, and for a long economy and to critical infrastructure AR: The very fact that seems to have been no effort time, as we are learning now. Because of posed by cyber attacks. Were your terrorism was defined by to renew it in some form when that difference, we’re struggling slightly to concerns related to non-state actors, or the Act in 1993 means it we leave the EU. The same find a way to spread the risk. state and state-sponsored activity? probably should. We now goes for other databases such know very much more about as SIS II [which allows information

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 9

exchanges between national border of “no deal” and “walking away” isn’t a control, customs, and police authorities], reasonable approach. So I agree with Amber Rudd Biography Prüm [which facilitates exchange of you: security should be placed outside After a career in business, Amber Rudd fingerprints, DNA profiles, and vehicle the Brexit debate. became the Member of Parliament for registration numbers], and ECRIS [the Hastings and Rye from 2010 to 2019. European Criminal Records Information EB: On a lighter note, I’m sure you had Amber was appointed Secretary of State System]. You won’t find a single active plenty of sleepless nights when you were for Energy and Climate Change in 2015 law enforcement officer saying we could Home Secretary. Now that you are in the and led the UK team to the successful completion of the Paris Climate Change do without them, since they help keep all private sector, what keeps you awake at night? Agreement. This UN-sponsored of us safe. Conference of the Parties (COP 21) achieved the first ever legally binding When Theresa May was in government, AR: I have taken a couple of roles which contribute to the effort to address climate global commitment to reduce she was famous for her tough approach national carbon emissions. to security. It was absolutely her priority change. It is an urgent problem, and to make sure that we had the equivalent must be addressed immediately. But From July 2016 to April 2018, Amber served as Home Secretary. During 2017, deal on that front, either with the EU or realistically, the inclination of politicians is to look to the short term, as I said Amber responded to the succession of with individual European states. As Home terrorist attacks, calling for an international earlier. To combat this, we all need to Secretary I worked with her to see how response to take radicalising material off we could set up a treaty that would do understand that addressing climate the internet. She called for an industry exactly that. I hope government activity is change has become a short term issue, response led by the major Internet Service going on in this area, even if we cannot and act accordingly to ensure our Providers and travelled to Silicon Valley politicians realise this too. to make the case for a more responsible see it. If not, it will make our country less role by internet companies. The formation safe. of the Global Internet Forum for Counter Terrorism (www.gifct.org) in 2017 EB: On Brexit, I believe that security addressed this call and has successfully should be placed over and above politics reduced the amount of material online and economics. Hopefully we can I remember saying to my and set up a scheme to ensure smaller divorce it from all the other negotiations. companies are also able to remove German counterpart, “We radicalising material. AR: That was our plan when I was can argue over cod, but From November 2018 to September 2019, Home Secretary and Theresa May we can’t argue over lives Amber served as Secretary of State for was Prime Minister. It was basically to Work and Pensions. She has also served appeal to the moral high ground on this The evidence is all around us, all the time. as Minister for Women and Equalities. issue. I remember saying to my German We see it in changing weather patterns Since leaving government she has counterpart, “We can argue over cod, around the world, for example. They become a Trustee for The Climate Group but we can’t argue over lives. We all have trickle into everything else: immigration, (www.theclimategroup.com), working with businesses and government to promote the same interest: You care about the refugees, famines in Africa, and many climate action. She is an advisor for Teneo Germans in London, and I care about the other areas – including terrorism. We (www.teneo.com), Darktrace Brits in Dusseldorf.” That position relies need urgently to adopt a concerted, (www.darktrace.com) and Pool Re on strong relationships, which we had at Amber Rudd attends The Royal Academy Schools annual dinner and auction at Royal Academy of global effort to address climate change. (www.poolre.co.uk). the time. My concern is that all the talk Arts on March 4, 2020 in London, England. (Photo by David M. Benett/Dave Benett/Getty Images) That’s what keeps me awake at night.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 10

COVID-19 has brutally exposed the UK’s fragile resilience to systemic risks. The government has faced heavy criticism for its lack of preparation and mishandling of the crisis. Criticism Rethinking has also been directed at the insurance industry over business interruption claims. More generally, the industry’s ability to adapt to meet the demands of a new decade of risk is in resilience doubt as the indemnified proportion of the real economy continues to shrink. There is a mutual dependency between insurers and policymakers in rethinking their approach to resilience. Both need to act boldly and quickly to integrate (re)insurance functions and expertise into the national resilience and disaster risk-financing architecture. Doing so in the 2020s would build on the example set by Pool Re in the effective public–private management of societally catastrophic risks, aligning social and Integrating reinsurance into the free-market objectives in pursuit of a common goal. national resilience and disaster risk financing architecture

Chris Yeates, Associate, CEO’s Office, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 11

In a state of disrepair of the challenges that we’ve had Reputation and trust are driven by “When the pandemic hit, Britain was are not about policy advice or the perception, and the general perception not the strong, successful, resilient science advice; they are questions is a potent mix of a) the “callous denial country it imagined, but a poorly of resilience,” commented Walport. of claims [by insurers]” (in the words of Developing on a theme, Boyd stated one national broadsheet), and b) that governed and fragile one. The truth that “the reality is, there has been a the industry is “increasingly unable to is, Britain was sick before it caught major systemic failure… The really serve the needs of the real economy the coronavirus.” In August this year, important question is whether the with good-quality insurance” (in the The Atlantic published a high-profile, state, in its current form, is structurally words of another). comprehensive indictment of Britain’s capable of delivering on the big- response to COVID-19 based on picture items that are coming, whether The first of the two perceptions may a series of interviews with some of pandemic or climate change or be repairable over time through the country’s most senior politicians, anything else.” greater contractual transparency, civil servants, and scientific advisors. and a more authentic alignment of The report begins, for example, expectations between businesses, by noting the disproportionately brokers, and insurers. The latter is far punishing cost of the pandemic on more dangerous, and has become British society from both a human a well-vocalised concern even within and an economic perspective when Whether or not insurers the sector. John Ludlow, CEO of compared internationally. At the deserve the national Airmic, recently reflected on insurers’ time of its publication, Britain had backlash they are currently deteriorating value proposition to the worst overall COVID-19 death corporate clients, and warned that the toll in Europe, and the continent’s receiving is immaterial. insurance industry was at a “critical second worst ‘excess death’ tally per Reputation and trust are juncture”. capita. Meanwhile, confirmation of driven by perception It is a sign of these extraordinary the virus’s crippling financial impact times that these perceptions, soon followed from the government’s “Critical juncture” understandable in many ways, can own Office for Budget Responsibility COVID-19, however, has shown that co-exist with COVID-19 being one (OBR), which has reported that the Boyd’s comment is just as applicable of the costliest catastrophes in the UK is on track for the largest annual to a sector closer to home as it is insurance industry’s history in terms of decline in GDP for 300 years, and to the British state. The controversy claims payments. Extraordinary times, unprecedented peacetime rises in over business interruption claims however, are probably here to stay. In borrowing and debt. and resultant High Court test case fact, if we accept that the catastrophic “raises the risk insurers could emerge norms of the future can be seen in the Unsurprisingly, most of The Atlantic’s from the COVID-19 crisis among eminent interviewees chose to tail risks of , they are only likely its greatest villains”, according to to become more extraordinary. As remain anonymous. Mark Walport Insurance Day. and Ian Boyd, who both sit on the such, the primary ‘need of the real government’s Scientific Advisory Whether or not insurers deserve the economy’ over the next decade is to Group for Emergencies (SAGE), national backlash they are currently be resilient to a sobering spectrum of were not amongst them. “Many receiving is largely immaterial. ‘big-picture items’.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 12

Some of these items will manifest, increased investment, higher output systemic risk events. though the degree may be uncertain (potentially up to 2% of GDP), and (increasingly extreme weather events greater financial, physical and cultural Pool Re’s public-sector classification resulting from climate change); others resilience.1 Narrowing protection gaps by the ONS earlier this year will require may manifest (further destructive will not be a silver bullet for national a period of transition and integration, viruses of an epidemiological or digital resilience; doing so is, however, an and presents a timely opportunity nature); others are as yet unimagined indispensable ingredient. for the government to respond to (black swan events as traditionally the industry’s ambitious proposals. defined). Terrorist capabilities and In a recent policy document, HM networks of all stripes are likely to Treasury has already committed to shape or even drive such phenomena ‘consider its stock of contingent over at least the next ten years. liabilities and investigate where it good-quality insurance; for may be appropriate to expand the Resilience Re? these correlative, complex scope of current pooling schemes’. What is certain is that ‘good-quality risks is not viable under the Pool Re would seem a logical place insurance’ for these correlative, to start. An industry-wide mutual traditional insurance model already guaranteed by a Treasury complex risks is not viable under the …[and] meaningful protection traditional insurance model (where loan facility, it is a ready-made, the losses of the few are paid for by for businesses will require a trusted conduit between government the premiums of the many), and that public–private approach and industry, with proven success meaningful protection for businesses in building commercial capacity will require a public–private approach. Through Stephen Catlin’s Steering around a commercially unattractive Elsewhere in this Review, Professor Group, the insurance industry has risk, embedding risk mitigation, and Paula Jarzabkowski shows how mobilised more quickly than the state responding to a dynamic peril as characteristics unique to systemic to propose pathways to transition to it evolves. a risk-sharing model for pandemic risks disrupt the traditional insurance The time for rethinking resilience is model and processes of risk transfer, risk premised on state involvement. Other coalitions have gone further and running out; through their successful and consequently argues that a partnership for managing the risk of Lloyd’s estimates that transition to ‘risk sharing’ is the only promoted the idea of evolving Pool Re into an ‘umbrella’ facility, perhaps catastrophic terrorist attacks, insurers a 1% rise in insurance feasible way to build resilience to and government already have the threats of this nature. a ‘Resilience Re’, by not only uniting penetration can translate existing state-supported pools, but starting gun for turning Britain from to a 13% reduction in As an indicator of the prize for such creating further pools to facilitate (re) a ‘poorly governed and fragile’ state uninsured losses, and a transition, Lloyd’s estimates that insurers’ participation in ‘big-picture into the ‘strong, successful, resilient’ a 1% rise in insurance penetration items’ for which there is currently country it imagined it was before the over 20% reduction in can translate to a 13% reduction little or no commercial market. This start of the decade. disaster recovery burden in uninsured losses, and to over concept has also been mooted as part on taxpayers 20% reduction in disaster recovery of Lloyd’s’ ‘Black Swan Re’ framework Note burden on taxpayers. Substantial to address the short-, medium- and 1. https://www.jbs.cam.ac.uk/wp-content/up- loads/2020/08/crslloydscityriskindex-execsum- macroeconomic benefits include long term risks associated with future mary.pdf

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 13

From risk transfer to risk sharing How systemic risks are changing the relationship between risk, responsibility and reward, and the need for greater risk sharing

In this feature I argue that, because climate change and other systemic risks, such as pandemic, are changing the relationship between risk, responsibility and reward on which the risk transfer process is based, we need to shift the paradigm to one of risk sharing.

Professor Paula Jarzabkowski, Professor of Strategic Management, City University of London and University of Queensland

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 14

Insurance is essentially a process populations encroach upon the habitats of risk transfer. Policyholders of animals, there is also increased transfer a proportion of the risk on frequency in outbreaks of new their property or their business to a pathogens, leading to epidemics and primary insurer, who then transfers a even pandemics. Taken together, these proportion of that risk to a reinsurer. climatic and demographic changes Each stage of this process is governed constitute a systemic risk for society. by principles of transferring the risk of damage or loss for which one party By systemic, I mean that risks is responsible (e.g. the business or are correlated, either because of homeowner) to another party, who potentially hidden causal relationships receives a reward (premium) for between risks, or because of their accepting that risk, and, in return, also co-occurrence. For example, while assumes responsibility for paying for the warming in the Arctic tundra, bushfire damages or losses. The underpinning in Australia, drought in Southern Africa, assumption of this process is a) that the and increased intensity of hurricanes party doing the transfer can rationally in the Caribbean may be considered evaluate the amount of risk to which ‘uncorrelated’, climate change may they are exposed, decide how much of present a ‘hidden’ causality or at least that they are willing to be responsible mean that all can occur at the same for paying themselves, and what reward time. While the extent to which climate they would pay to transfer the balance change is a systemic risk remains to another party; and b) that the party is debatable in some quarters, few would actually capable of being responsible for argue that the current pandemic is the damage and losses incurred. That systemic; it is global, affects multiple is, having done (a) – evaluate the risk – insurable risks, and is concurrent. they can do (b) – behave ‘responsibly’ Systemic risk disrupts the risk– to mitigate the chances of a loss. responsibility–reward transfer process in two ways. First, it disrupts the ability to Systemic risk do (a) – evaluate the risk. Because we However, under climate change, and evaluate risks largely in isolation – their systemic disasters such as pandemic, probability within a particular location for these principles of transferring risk break a particular peril, building largely from down. Specifically, weather-induced historic data – we struggle to evaluate disasters, such as flood, hurricane, the extent to which systemic impact drought, and bushfire, are increasing Climatic and demographic changes on a particular risk, such as flooding in frequency and severity, exacerbated or wildfire for a particular property or by both climate change and increasing constitute a systemic risk for society business, might escalate the frequency population density in areas of high and severity of loss, and, therefore, to exposure. At the same time, as human

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 15

The River Ouse overflows following a period of heavy rain and floods the streets of central York in the United Kingdom. (Photo Getty Images). decide what level of reward (premium) levels and excess rainfall? The home needed to assume the responsibility to organisation, industry, or, as pandemic is appropriate to transfer that loss to that was not on a floodplain when pay for the losses of systemic risk. shows us, country. My vision for risk another party. And indeed, if we could purchased 25 years ago now floods sharing involves establishing the needs appropriately evaluate the systemic three years in a row. Systemic risk The need for risk sharing of the businesses and home owners impact on that risk, the increase in negates the responsible transfer of risks, Given growing threats from systemic risk, who actually hold or are most exposed probable loss would likely mean the which assumes that the party doing the we need to shift the paradigm from risk to systemic risks and considering them reward for transfer would be too high to transfer can actually affect mitigation of Systemic risk transfer to risk sharing. We already have as partners in the solutions to risk. We be sustainable for most policyholders. possible losses. negates the models for sharing risk that is difficult need to combine this with the best that to transfer, either because of problems we know from cross-sector partnerships Second, it disrupts point (b) – Similarly, responsibility to pay for losses responsible transfer in market supply, such as Pool Re and – not merely public–private – in order to responsibility for mitigating loss. In the means that the counterparty, the insurer other terrorism pools, or problems in share systemic risk across businesses, case of pandemic, which business could or reinsurer, must charge a premium of risks, which affordability, often exacerbated by climate home owners, markets, government realistically have mitigated for the loss appropriate to the level of risk they take, assumes that the change, such as with Flood Re. These departments, and civic and societal of, for example, travel, tourism, and which must equate to the probability provide useful lessons, but my vision organisations. Systemic risk affects us entertainment? In the case of flooding, that they will have to pay any particular party doing the is bigger and more holistic than these all and cannot simply be transferred which business or householder can claim at any particular time period. transfer can actually discrete approaches to sharing risk from away. Rather, we need to work actively be responsible for the legacy assets But if these risks are systemic, as with a definable event or peril. Systemic risk, at shifting the paradigm, and hence the they own, which are impacted on by pandemic, all claims will need to be paid affect mitigation of by definition, is one of the grand societal solutions, to one of risk sharing that will prior planning and building codes that simultaneously, meaning that there is no challenges that extends beyond a single better protect us all. are inadequate in the face of rising sea means to model or reserve the capital possible losses

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 16

In July 2020, The Geneva Association and Our word is our bond IFTRIP published a new report proposing a The importance and challenges of linguistic clarity common language for insurers to approach in cyber (re)insurance Cyber War and Cyber Terrorism. ‘Hostile Cyber Activity’ introduces a new terminology, designed to promote transparency and, ultimately, insurability.

Christian Wells, Special Counsel, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 17

Partnership with the Geneva the group began discussions. It soon Association became clear that, as with the IFTRIP group, what was of real interest to the The origins of the term “Hostile Cyber insurance market, despite the group’s Activity” lie in a working group established initial brief, was state-backed activity by IFTRIP early in 2019, to investigate which was not terrorism but fell short of potential common definitions of Cyber warfare. Furthermore, the market lacked Terrorism and Cyber Warfare. It soon any vocabulary to deal with it, mainly became clear that, although both because the phenomenon was recent phenomena lacked a common definition, and the terminology applied to both there was a greater preliminary hurdle. terrorism and warfare would not be of What most people talked about as assistance. What was needed, it was Cyber Terrorism or Cyber Warfare was initially thought, was a suite of words and in fact something other than terrorism or phrases. Equally, it was important not to warfare carried on by cyber means: state- develop parallel and potentially confusing backed cyber activity short of war aimed language if existing terminology could at damaging covertly the economies be used. or infrastructure of other states, often through attacking corporations. It also Establishing a new became clear that Pool Re was the only terminology IFTRIP member to define Cyber as well It was not lost on the Pool Re delegation as Terrorism, being the only one needing in the IFTRIP team that the state-backed to do so for the structure of its cover. In activity under discussion had been, 2018 Pool Re had reintroduced limited along with the extension of Pool Re’s cyber cover by using positive language government backing to cover Non- to reduce the scope of an otherwise Damage Business Interruption, the blanket exclusion. Other IFTRIP pools subject of the UK Counter-Terrorism and covered cyber terrorism automatically if Security Act 2019. Although the definition the underlying insurance did, and thus in that Act of state-backed activity was needed no definition. obviously aimed at establishing criminal Following discussions with the Geneva offences, the concept and scope of the Association (GA), to which the subject conduct covered were clearly relevant was also of interest, a joint working Hostile cyber activity (HCA) and widely applicable to the working group was established and met in refers... to covert attacks group’s discussions. It was not, therefore, London in December 2019. Reinforced too great a step to adopt the legislation’s by eminent practitioners from the GA’s aimed at economic targets term “Hostile Act” and christen the global membership and catalysed by a or at undermining or phenomenon ‘Hostile Cyber Activity” in presentation on the cyber activity itself the insurance context. That label found from Pool Re SOLUTIONS Ed Butler, destabilising public life almost immediate acceptance and

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 18

appeared to have the great advantage • Property damage and losses • Established the beginnings of a Together with its successors, this paper amendment of Terrorism Acts applicable that, as discussions continued, it did not • Direct and indirect business interruption common language to be used in the should encourage and help the insurance to criminal conduct, it is unsurprising that prove to need a suite of secondary terms (BI)/disruption market segment; and industry to develop a widely and badly Pool Re is considering how best that to support it. Existing insurance terms • Economic/financial loss and damage • Aimed to facilitate discussions needed new product to protect major definition might be updated while being could be used. economies against an increasing peril. kept relevant to an insurance context. • Environmental damage between the insurance industry and governments about insurability, and The Pool Re delegation in the IFTRIP team Hostile Cyber Activity (e.g. pollution) is proud to have played a significant With an increasing level of state-backed the likely necessity of more ambitious cyber activity, and resulting losses which Hostile Cyber Activity (HCA) refers • Undermined or diminished public trust public–private partnerships to address part in its production. generally, but not invariably, to covert • Civil unrest are likely to exceed the capacity of existing and emerging risks which commercial insurance markets before attacks aimed at economic targets or • Political strife neither can sustainably address alone. Maintaining momentum at undermining or destabilising public Being able to play a leading role in long, private–public partnerships are • Loss/damage to relationships or These components are all basic steps life (including democratic processes) or developing a term such as Hostile one of the most obvious ways of dealing reputation (or plain embarrassment) towards the world’s insurance markets public trust, using cyber means or triggers Cyber Activity reflects the growing work with the problem as well as being the being able to offer cover for Hostile Cyber perpetrated generally by, on behalf of, or performed by Pool Re on the definitions of most likely to do so successfully. Pool The report also: Activity in sufficient amounts and scope with the practical support and/or moral words and phrases relevant to its mission. Re SOLUTIONS is in the early stages • Analysed the spectrum of cyber to provide the amount likely to be needed encouragement of nation states with the As its own definition of “acts of terrorism” of considering how best a suitable risks between the simply criminal and by corporations targeted or just caught aim or consequence of causing one of was drafted in 1993 in the specific framework might be developed in the UK. outright war, in particular the space up in state-backed cyber activity aimed more of the following: context of IRA truck bombs in the City between cyber terrorism and cyber primarily at damaging other states. • Disruption to any level of government warfare; of London and has not been changed • Death or injury (physical or mental) since, notwithstanding the passage and

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 19

ImaginationAnticipating tail risk events and developing at effective the responses tail to their end occurrence

Effective risk handling demands imagination. It’s easy to foresee a vehicle smash or a workplace injury, and relatively straightforward to emplace risk mitigation and management procedures to minimise such accidents. They still occur, of course. From the insurance perspective, these losses are attritional. They have been imagined, predicted, and priced.

Dr Adrian Leonard, Associate Director, Centre for Financial History, University of Cambridge

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 20

The ultimate cost of some catastrophic TREs would be so great that to insure them conventionally would simply be uneconomic

Risks which have not penetrated possible loss resulting from a tail event) is Extreme Value Theory woefully inadequate tool to determine to bear. This has led to the formation the minds of risk managers and large, they constitute catastrophes. Extreme Value Theory (EVT) can help to future UK extremes. Instead, EVT yields worldwide of many, typically state-backed underwriters lie at the other end of determine if and when tail events are likely ranges for conservative estimation of facilities to provide affordable coverage. the spectrum. It was once widely TREs such as a hurricane landfalling risks at the tail of the distribution, and can These range from India’s national crop in Miami may be widely foreseen, and to occur, and how severe they may be. believed, for example, that no more Natural and man-made disasters may therefore assist in the pricing of high-level insurance programme to the Florida than 20 floors of the World Trade the potential loss calculated with some reinsurance protections. Hurricane Catastrophe Fund, and confidence. When imagination has appear fortuitous, but “they are actually Center could be destroyed by even happening according to well defined indeed Pool Re. Discussions about the worst loss event affecting the Twin failed, though, they might not have been This is not the place to explain how EVT the creation of various public–private considered at all, and therefore not priced rules of science known as extreme value calculates those ranges. You will have to Towers. Fire prevention measures would theory”, according to the architects of pandemic re/insurance facilities are well limit the damage, restricting the Probable by underwriters. Everyone understood the trust me that it overturns old approaches underway. Ideas about government- possibility of a pandemic illness, especially a 1993 conference struck to discuss to PML calculations by abandoning Maximum Loss. Despite an earlier bomb the theory and its possible applications. guaranteed systems to insure a cyber attack on the iconic building, no one had after SARS. Remarkably, though, no one, the usual curves, and shows that a e-pandemic that affects networks it seems, imagined the lockdown. At the heart of EVT is the principle that counter-intuitively large number of tail considered the possibility that an entire loss distribution curves are insufficient to worldwide are maturing. tower would fall – let alone both – in a events is possible. The theory is now well Such unlikely, costly loss events keep predict and describe tail events. Data are established in actuarial pricing circles. In Such unconventional arrangements terrorist attack from the air. Imagination insurers, and especially their reinsurers, the weak link, since rare events obviously had failed. some cases, no doubt, reinsurance rates are becoming increasingly common as awake at night. They understandably yield very few data cases, and because are loaded to take account of imagined the enormous cost both of imagined devote much attention to imagining Tail risk events records set by extreme events are TREs which the number-crunchers have and especially of experienced TREs TREs before they occur, but with often broken, denying an ergodic future The loss is an example of a tail risk assessed through EVT. hits home. Yet even the powerful mixed success, as the 2020 pandemic which unfolds much like the past – an event (TRE), one which has a very small mathematics behind EVT will not calculate illustrates so starkly. But simply perceiving assumption at the core of risk modelling. possibility of manifesting. The name refers Imaginative solutions loss ranges for tail risk events which lie a TRE is not enough. When one has Here again, though, reality is often to the very skinny end of the distribution Consider extreme temperature. Four beyond our collective imagination. As been imagined and acknowledged different from theory. Unfortunately the curve. Many tail events are unnoteworthy, of the hottest-ever days in the UK that black-sky thinking expands, and as feasible, the difficult next step is to ultimate cost of some catastrophic such as the risk that no car crashes occur occurred in 2019, including winter and fears of enormous, crippling, systemic calculate not only its likelihood, but also TREs would be so great that to insure on a given day (a risk to panel-beaters). summer record-breakers. That makes TREs extend, more such highly focused the potential severity, which requires still them conventionally would simply be Others are extremely severe. When the a distribution curve plotting average facilities to limit their impact are bound further imagination. Even more difficult is uneconomic. Policies would be too “tail value at risk” (TVaR, a measure of the temperatures over the past century a to emerge. to create a structure to insure against it. expensive for many insurance buyers

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 21

Focus

Terrorism and risk management Horizon scanning the How will Brexit impact Insure to be resilient: how to Hardly anyone saw it coming Cyber in the new normal in a post-COVID world terrorism threat on the UK’s ability to strengthen national security in Insuring against pandemic risk – How COVID-19 is shaping the Current threat landscape Understanding the drivers counter terrorism? a post-COVID world how the industry is responding, cyber threat landscape and the changing risk of terrorism and anticipating Pan-European security initiatives The Integrated Review and how the and what more can be done management environment new threats and the outlook for security insurance industry can contribute cooperation post-Brexit to national resilience

Author Author Author Author Author Author Ed Butler CBE DSO Professor Andrew Silke Emily Winterbotham Paddy McGuiness CMG OBE Stephen Catlin Conrad Prince CB Chief Resilience Officer Professor of Terrorism, Risk Director, Terrorism and Conflict group Former UK Deputy National Chairman and CEO, Convex Senior Cyber Terrorism Advisor Pool Re and Resilience Senior Research Fellow Security Advisor to Pool Re Cranfield University RUSI

Ed Butler is Pool Re’s Chief Andrew Silke is Professor of Emily Winterbotham is Director of Paddy McGuinness was the United Stephen Catlin began his insurance Conrad Prince served as the Resilience Officer and leads its Terrorism, Risk and Resilience the Terrorism and Conflict group Kingdom’s Deputy National Security career in 1973. He founded Catlin Director General for Operations Risk Awareness Team. He is at Cranfield University. He is and Senior Research Fellow at Advisor from 2014 to 2018. He led Underwriting Agencies in 1984, and Deputy Director of GCHQ from responsible for developing the internationally recognised as RUSI, focusing on extremism and on the implementation of policies which later became part of Catlin 2008 to 2015. In those roles he company’s capacity and capability a leading expert on terrorism radicalisation, countering violent and programmes designed to build Group Limited. Stephen served led GCHQ’s intelligence operations in understanding the terrorism and counter-terrorism and extremism and peacebuilding. the UK’s domestic resilience to as Catlin Group’s Chief Executive and oversaw the development of threat landscape and how to has published widely on these all hazards and threats, throughout its history and also the UK’s national offensive cyber mitigate against these perils. Ed subjects. He is a member of including terrorism. served as the active underwriter capability. From 2015 to 2018 he has over 35 years of experience the UK government’s Cabinet of Lloyd’s Syndicate 1003 and was the UK’s first Cyber Security in counter-terrorism, security and Office National Risk Assessment later Syndicate 2003 until May Ambassador, leading cyber security risk management, including 24 Behavioural Science Expert Group. 2003. He assumed the position of capacity building work with a years in the British Army and eight Executive Deputy Chairman of XL number of key UK allies. He retired years business consulting. He was Group Ltd from May 2015 (upon after 28 years of government privileged to command 22 SAS and the completion of XL’s acquisition service in January 2018, and now retired as a Brigadier in 2008. of Catlin Group Limited) until May holds a range of advisory roles in 2017. From May to December 2017 cyber and security. he acted as special advisor to XL’s Chief Executive Officer, Mike McGavick. In April 2019, Stephen and Paul Brand founded international specialty insurer and reinsurer, Convex Group Limited.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 22

Terrorism and risk management in a post-COVID world

The current threat landscape and changing risk management environment

Ed Butler CBE DSO, Chief Resilience Officer, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 23

We are currently living in possibility of attacks, despite lockdown Terrorist attacks and foiled plots in Great Britain by threat actor type 2017-2020 has been a noticeable increase of online and CT police protective security Source: Pool Re internal database radicalisation by right-wing extremists. very curious times indeed measures, as witnessed in Reading on Worryingly, many terrorist causes are 22 11 as the global pandemic 20 June 2020.1 Of note, the national Plots Attacks being fuelled by a general feeling of anger 20 threat level remains at SUBSTANTIAL,2 and frustration caused by the fallout enters its ninth month and 18 we still don’t know what which means that an attack is likely. from COVID-19, including government 16 lockdown measures, lack of resources, the new norm is going to 14 and growing levels of unemployment, look like. This is equally 12 to name a few. Far right extremists are

11 stirring hatred both online and offline, as true in the terrorism and 10 counter-terrorism arena. The 7 well as exploiting tensions relating to the 8 Black Lives Matter movement. Of note 7 catastrophic economic and 6 The threat from was the designation of the Feuerkrieg social impact of COVID-19 4 Division (FKD) on 17 July, which became international terrorism the third neo-Nazi organisation in just six is likely to provide a catalyst 2 2 1 1 months to be proscribed as a terrorist for further attacks across 0 is very much alive Islamist terrorist Right-wing terrorist Violent Dissident Republican Unknown group by the UK government.4 the threat spectrum and we Islamist extremism remains the primary terrorist threat actor in Great Britain. However, right-wing This could lead to an ‘action–reaction’ may see the emergence of Internationally, Islamist extremist media terrorism takes up an increasing proportion of counter-terrorism resources. cycle of attacks between far right and have called for increased activity while Islamist extremists. new terrorist groups and governments remain preoccupied with methodologies. This is a dealing with the pandemic. The new Deaths and injuries by terrorist attack in Great Britain 2017-2020 Multifarious domestic threats complex and changing Daesh spokesman, Abu Hamza al- Source: Pool Re internal database What does the current and future terrorism landscape that Qureshi, released an audio message, threat landscape look like for the UK? which included the following message: 800 Injured Killed will continue to have a long Injured The current threat picture remains very different from when I started my counter- term impact on our security ‘What you are witnessing these 100 days are only signs of big changes terrorism career in the early 1980s, and resilience. when the threat to the UK stemmed in the region that’ll offer greater 80 overwhelmingly from violent dissident opportunities than we had previously A complex threat Republicans. environment in the past decade.’

60 London Bridge The threat from international Islamist Full lockdown measures assumedly put We now have, and will continue to have, terrorism is very much alive, and the the brakes on planning and preparation a threat landscape which is very complex, major actors of Daesh, al-Qaeda (AQ), for many plots in Europe and Advanced 40 fast moving, with multiple actors from , al-Shabaab and Hezbollah Markets, and, as the restrictions eased, Parsons Green extreme right, left and Islamist groups. are still active in the planning, preparation The time between individuals deciding those plots and new ones have started 20 and execution of terrorist atrocities across up again.3 Islamists, right-wing extremists Finsbury Park to undertake attacks and executing Reading Arndale Centre Fishmongers’ Hall Whitemoor Streatham the globe, particularly in failed and failing Manchester Victoria them continues to be compressed, as and separatists will all have been Stanwell states. Closer to home, the threat has not affected, and we can expect plots across 0 witnessed by the attacks in Streatham The remains by far the most lethal attack in Great Britain since the and Reading this year, while the process gone away, and there remains a realistic the threat spectrum. Furthermore, there July 2005 London bombings.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 24

of radicalisation can also now occur with assessed to be low, meaning bioterrorism unprecedented speed. will likely remain a low probability if high impact risk. However, we should not COVID-19 and terrorism forget our hard-won experiences from Terrorists continue to embrace more counter-terrorism campaigns at home rudimentary methodologies, as, with the and abroad and recognise that terrorists reduction in size and number of crowded will continue to move up the technology places as a result of the coronavirus curve (sometimes referred to as the pandemic, terrorist targeting has had to “counter-terrorism/terrorist technological change, although attack methodologies arms race”), exploiting ungoverned are likely to remain the same as those spaces both on the internet/dark web seen pre COVID-19: low sophistication, and in failed and failing states. off-the-shelf attacks (bladed weapons, vehicles as weapons, IEDs) carried out by lone actors or small groups of individuals. New crowded places and spaces are emerging, such as queues outside shops We still cannot discount the or eateries on pavements that will require new and innovative protective security threat posed by Dissident plans. New legislation, resulting from Republicanism or new Martyn’s Law and the new Protect Duty, single-issue groups will require organisations to consider The effects of the pandemic on the these emerging vulnerabilities. global economy will almost certainly Some commentators, cited the foiled result in an increase in instability in the extreme-right-wing attack in Kansas developing world. While the relationship City in March 2020, believe we could between economic hardship and violent see attacks on health care and hospital extremism is not direct, increased facilities, but this is assessed as less likely. economic marginalisation and attendant However, there could be a renewed focus political disaffection will likely lead to on symbolic sites, including government greater radicalisation of vulnerable buildings or police and military targets. groups, potentially exacerbating or precipitating violent struggles. There is Another consequence of the global also the realistic possibility that political pandemic could be the rekindling of strife in neighbouring regions to Europe, terrorist interest in bioterror weapons, as particularly the Middle East and North witnessed in in the 1990s Africa, will lead to an increase in terrorism and early 2000s. While this would directed at the UK and its allies. Iraqi security forces are seen as they conduct an operation be a troubling development, terrorist against Daesh in rural areas of Kirkuk, Saladdin and Diyala capabilities in this field are currently on 24 September 2020 in Kirkuk, . (Photo by Ali Makram Furthermore, as a result of the pandemic, Ghareeb/Anadolu Agency via Getty Images) law enforcement and other agencies

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 25

Terrorism trends in Advanced Markets vs Rest of the Wold 1990-2018 Source: Pool Re analysis of Global Terrorism Database, START, University of Maryland

17000 With the reduction Rest of the World Advanced Markets in size and number of crowded places 12750 as a result of the coronavirus pandemic, 8500 terrorist targeting has

had to change 4250

0 19 19 19 19 19 19 19 19 19 19 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 90 91 92 93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17

from home. Of concern is that some the use of novel technologies, such as potentially a shift towards businesses will continue to invest in risk mitigation people are becoming more reclusive and, Chemical, Biological & Radiological (CBR) being targeted. measures to achieve this. Increasing our owing to pre-existing mental and other material or a destructive cyber event, knowledge and awareness of the terrorist issues, are therefore more vulnerable to inflict mass casualties and resultant There can be no quick fixes to this more and extremist threat is now even more Terrorists will continue to extremist propaganda. However, economic damage. diffuse and complex form of terrorism important as we enter what is likely to be a to use tactics, techniques complex, multi-stage cyber attacks largely and associated insecurity. Some areas prolonged economic downturn which will and procedures that exploit remain the preserve of nation states and Looking forward: what’s will need more focused attention to be exploited by those people and entities cyber-crime syndicates. As a reminder, all different now in the COVID-19 improve our social, economic and who want to do us harm. gaps and weaknesses in community resilience. our state and corporate the attacks in the UK in 2017 had a digital pandemic world we live in? component and we are likely to see even The trouble is that terrorists will continue What is clear is that there has been security architectures Notes greater use of the internet, dark web and to use tactics, techniques and procedures a paradigm shift in risk management may be forced to allocate resources encryption, by “Digital Terrorists” in future that exploit gaps and weaknesses in our as a result of COVID-19. As a result, 1. https://www.standard.co.uk/news/crime/ plots and attacks. terrorist-attack-london-likely-lockdown-scot- away from counter-terrorism operations state and corporate security architectures, companies will have to recognise, if land-yard-a4517156.html to public order and other responsibilities. as well as divisions in our communities. Ever adapting terror networks they have not already, that they need 2. The UK’s threat level was increased to SEVERE Additionally, there could be fewer So, we are likely to see more copy-cat to adapt as they look at implementing on 04 Nov, after the intelligence cut-off date of resources available to counter-terrorism It is very easy overly to focus on the killings and terrorists gravitating towards this Review. here and now of terrorist attacks and new strategies and plans to protect their bodies owing to economic difficulties and more sinister, as well as digital, forms of people, assets, reputation and share 3. https://www.dw.com/en/uk-fears-of-resur- attendant budgetary restrictions. we cannot ignore the threat of another attack as traditional targets and sites are gent-terrorism-as-COVID-19-lockdown- value, in particular against extreme risks. ends/a-54124486 ‘spectacular’. The threat of catastrophic “hardened”. We could well see ‘new’ We have already seen a huge uptick in 4. https://www.gov.uk/government/news/govern- 9/11-style attacks remains a tangible risk, crowded places further targeted and Increasing resilience against terrorist attacks cyber attacks targeting people working ment-takes-action-to-proscribe-right-wing-ter- be it an attack on the aviation sector or remains Pool Re’s core objective and we rorist-groups

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 26

HorizonUnderstanding the driversscanning of terrorism and the anticipating terroism new threats threat

Understanding the causes of terrorism represents an important step in anticipating the emergence of new terrorist campaigns and offers real potential to assist with the mitigation of the impact of terrorist conflicts. Macro-level causes will be the main factors responsible for future terrorism.

Professor Andrew Silke, Professor of Terrorism, Risk and Resilience, Cranfield University

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 27

Example causes could include civil such as Boko Haram and Islamic war or deep-rooted conflicts, invasion State. For example, between 2005 and occupation by foreign military and 2010, Syria experienced the forces, bad governance and corruption, worst drought in its recorded history, rapid modernisation or technological leading to a mass migration of the rural The significance of developments (like the rise of the population to urban areas in search climate change on internet and social media), and actions of new livelihoods. At the same time, terrorism in the coming by hostile states. Emerging macro-level Syria experienced an influx of refugees decades looks only set causes which appear to be of growing from Iraq as a result of ongoing conflict. to increase seriousness and significance include The urban infrastructure of the country population growth, social polarisation, could not cope with the surge in youth bulges are associated with social climate change and migration patterns. population and collapsed. Within a unrest and civil strife, and are already The COVID-19 pandemic is another year, there was a widespread uprising emerging in regions such as Saudi example of a macro-level event with the against this Assad government and Arabia and Yemen. potential to have serious impacts on years of civil war followed. The role that Syrian (kurdish) people in refugee camp in Suruc. Another important future trend is terrorism trends. (Photo Getty Images). climate change played in igniting the conflict has generally been overlooked. increased global migration. This raises It can be difficult to design counter- The significance of climate change a variety of challenges, one of which is terrorism policy around major global Figure 1: Refugees, internally displaced people, and asylum-seekers on terrorism in the coming decades how to integrate migrant communities trends, as they require a much more vs terrorist trends 1994-2016 looks only set to increase, but our within host countries to avoid a rise holistic approach to tackle them Source: Author’s analysis of Global Terrorism Database, START, University of Maryland, and UNHCR Refugee Statistics understanding of the processes and in ethnic tensions and extremism. effectively. They are also longer-term dynamics involved is in its infancy. Given anticipated increases in global threats, and there can be reluctance 80,000,000 Refugees displaced Global Terrorist attacks 20,000 population over the next 50 years – to think beyond what is immediately Research suggests that population which will disproportionally affect Asia around the corner. The international 70,000,000 size alone is currently the best single and Africa – combined with deepening response to COVID-19, for example, predictor of future terrorism. The effects climate change impacts, fresh patterns exposed a wide range of serious flaws 60,000,000 15,000 of all other predictors are massively of migration are anticipated, with the and failures in terms of long term increased if they occur in a country developed world remaining the most 50,000,000 preparation and mitigation. Similar with a big population. As the world’s popular target for many migrant groups. challenges await in terms of other long population increases further, the risks Figure 1 highlights the remarkably strong 40,000,000 10,000 term drivers of terrorism. overall are going up. The current world overlap between patterns of terrorism population is estimated at over 7.5 and the global numbers of refugees. Climate change is a useful starting 30,000,000 billion, and a recent study in the Lancet The significant role that conflict plays factor to consider. It is already estimated it would peak at 9.73 billion in driving the numbers of refugees increasingly recognised as a strategic 20,000,000 5,000 in 2064. Further, many societies are helps explain the close similarity shown security concern for most states. Even 10,000,000 forecast to experience youth bulges – between the two trends. The results now it is impacting on low-intensity and as their population increases they are suggest that some migration trends are terrorist conflicts in Africa, the Middle 0 0 also going to see a particularly huge potentially useful in terms of a proxy for East and Asia, where it has contributed 19 19 19 19 19 19 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 increase in the young population falling identifying conflict hotspots which are to the emergence of terrorist groups between the ages of 15 and 30. Such likely also to feed into terrorism trends.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 28

Thinking about mitigation be until the problem “unambiguously one of many challenges each already and adaptation bites” that attention will be paid to it, represents. Nevertheless, some and at the moment there is relatively little encouragement can be taken from how To what extent is the reinsurance engagement or awareness of the long- the insurance and reinsurance sector sector thinking about the major drivers term role of large-scale macro factors. has already engaged with some of these and causes of terrorism and is this macro drivers outside of a terrorism feeding into expectations around the A lack of data is one of the key current framework. In particular, there has been potential frequency and severity of obstacles. Without good data, there growing awareness and activity with terrorism? Critically, is such analysis is reduced awareness of the potential regard to climate change impacts. As currently feeding into thinking around problems and a lack of debate about early as the 1970s, leading international potential policy mitigations and security long-term mitigation across the sector. reinsurers had already started to assess Improved data in comparison would how climate change could lead to a allow for more serious engagement with potential rise in natural disaster losses. the issues, enable better modelling of As the growing scale of the climate crisis the potential impacts, and significantly has become steadily more apparent, the facilitate the sector’s ability to inform and sector has devoted increasing attention Without good data, engage with potential policy responses. there is reduced to the issues raised. In a UK context, awareness of the potential Given the scale of the issues involved, for example, this has been most it is critical to think in terms of mitigation clearly seen with regard to policy problems and a lack of and adaptation. Mitigation aims to planning around coastal erosion, flood debate about long term reduce or prevent problems; adaptation defences, land management and water mitigation across the focuses on adjusting to actual or infrastructure planning. [insurance] sector anticipated changes and reducing Significantly, there has also been vulnerability. This distinction is worth increasing engagement between the measures? Interviews with several noting. Some of the trends involved insurance/reinsurance sectors and stakeholders in the terrorism re- have now built up formidable long- academia to conduct research in order insurance sector paint a bleak picture on term momentum. In the context of to strengthen the evidence base around this front. The core messages highlight climate change, for example, current the potential threats and appropriate that thinking in this area is still in its early assessments are that, even with mitigation and adaptation responses. stages, with little systematic analysis immediate radical measures, climate Linked to this, insurers and reinsurers to date in terms of how either major change can still be expected to continue have also engaged in awareness-raising macro drivers such as climate change for the coming decades. Without radical campaigns focused on clients and or population trends can or will impact immediate measures, the momentum the wider public, and some have also on terrorism frequency. Furthermore, can be expected to deepen. engaged with government to help inform there has been no serious consideration Climate change, population increase, policy at national and international levels. of potential mitigation approaches. The and migration are all major global issues This presents a useful model to follow focus instead across the sector remains in and of themselves. Their potential primarily short term and national. In Demonstrator confronts policemen in relation to future terrorism risk. There impact with regard to terrorism is just at an rally. the words of one stakeholder, it will not (Photo Getty Images) can be no doubt that a crucial next

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 29

step is to improve our knowledge and Concluding thoughts understanding in this area. In particular, We are seeing a gradual awakening to there is a need for more sophisticated some of the problems that lie ahead. modelling better to understand Going forward, there are a variety how trends in these macro factors of ways in which the reinsurance can interact with terrorism trends. and insurance sectors can support For example, we need to improve governments and the private sector in our understanding of how trends in addressing some of the macro causes developing nations impact on terrorism and consequences of future terrorism. trends in Advanced Markets. As figure 2 Much of this approach can effectively illustrates, terrorism trends in Advanced model how the sectors have already Insurance countries do not necessarily engaged with the challenges posed map closely with the trends seen in by climate change more generally. the rest of the world. In the past thirty The sectors unquestionably have an years, the most intense period of terrorist important role to play in increasing attacks for Advanced Markets was wider awareness on how emerging witnessed in the 1990s, whereas for macro drivers can impact on terrorism the rest of the world it has been the era risk. Further research and data will be since 2012. We currently lack a good an essential foundation to support the understanding of how terrorism trends sector’s approach to these issues. in the rest of the world affect trends in Protesters arriving at an EDL rally. (Photo Getty Images) Advanced Markets (and vice versa). Overall, the sectors have a major potential to generate and provide Figure 2: Terrorism trends in Advanced Markets vs Rest of the World 1990-2018 government, clients and the general 17,000 No. of terrorist attacks public with easy-to-access information Rest of the World Advanced Markets on these issues. Crucially, they can do a great deal to improve risk awareness

12,750 with regard to the terrorism impacts of these macro drivers and provide expert Terrorism trends in advice on mitigation and adaptation within a terrorism context. Advanced Market 8,500 countries do not necessarily map closely with the 4,250

trends seen in the Source: Author’s analysis of Global Terrorism 0 Database, START, University of Maryland 19 19 19 19 19 19 19 19 19 19 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 rest of the world 90 91 92 93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 30

How will Brexit impact on the UK’s ability to counter terrorism? Pan-European security initiatives and the outlook for security cooperation post-Brexit

One of the few things that the UK and the EU can agree on is that counter-terrorism (CT) cooperation must continue beyond Brexit. This includes protecting CT capabilities, such as mechanisms for rapid and secure data exchange; practical measures to support cross-border operational cooperation; and UK cooperation with EU law enforcement, intelligence and criminal justice agencies.

Emily Winterbotham, Director, Terrorism and Conflict group, Senior Research Fellow, RUSI

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 31

How will Brexit impact all information systems and databases extra-European connections will remain on the UK’s ability to established on the basis of EU law is unaltered by Brexit. more likely.3 Even if the UK manages to counter terrorism? negotiate a deal, this will likely be more This does not fully protect the UK against One of the things that the UK and the EU In any case, the UK’s restrictive than that awarded to Schengen the loss of access to law enforcement can agree on is that counter-terrorism Area associated states, representing and criminal justice tools resulting from a (CT) cooperation must continue beyond 5 most significant and a major loss of capability. The UK will no-deal Brexit. In this scenario, the UK the Brexit transition period. This includes attempt, and may to some extent would see its access to EU capabilities protecting CT capabilities, such as successful international succeed, in building parallel structures fall below that of other third countries mechanisms for rapid and secure data collaboration is the Five and workarounds. However, the end- such as the US, Canada and Australia. exchange; practical measures to support result is likely to involve more friction This potentially exposes the UK to risks in cross-border operational cooperation; Eyes community and reduced levels of cooperation. The three key areas: 1) identifying terrorists; 2) and UK cooperation with EU law impact on the UK’s terrorist threat picture tracking their travel; and 3) extradition of enforcement, intelligence and criminal is, however, likely to be minimal. terrorists to the UK. justice agencies. 1. Identifying terrorists Worst-case scenario: Yet, time is running out, and the UK is Even in the event of a deal, the UK now unlikely to secure a bespoke Internal “No deal” Brexit will lose membership of Europol – the Law enforcement and intelligence Security Treaty, providing permanent EU’s law enforcement agency.6 A hard agencies in Europe see terrorism primarily access to most (if not all) EU information Brexit would mean losing access to 1 through a national lens. Even in the worst- systems. This was always ambitious, the Europol Information System (EIS),7 2 case scenario, relationships between the given the lack of legal basis or precedent a database containing information on UK’s security and intelligence services and the UK’s refusal to adhere to the more than 86,000 suspected criminals and their counterparts in EU countries will Court of Justice of the and terrorists. UK investigators would continue to operate on the basis of direct (CJEU). no longer be able directly to check contact between national agencies. The whether information on a potential Instead, the scenario that the UK will UK will also continue to be a member terrorist suspect existed in any other crash out of the EU, losing access to of the Counter Terrorism Group (CTG), member states’ systems. The UK would which facilitates CT cooperation across also be unable to exchange sensitive 30 European Intelligence and Security and restricted data through the Europol services. The CTG has the capability Secure Information Exchange Network to undertake CT operations globally Application (SIENA).8 and provides valuable proactive and sometimes pre-emptive threat intelligence This would be compounded by the Even if the UK manages that would otherwise be unavailable.4 loss of access to the European Criminal to negotiate a deal, Records Information System (ECRIS), In any case, the UK’s most significant and which enables rapid exchange of this will likely be more successful international CT collaboration information on criminal records and restrictive than that is the Five Eyes community, principally the convictions, including terrorist information, , but also Australia, Canada awarded to Schengen across EU member states.9 This could Ara associated states and New Zealand. Those and other

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 32

cause delays in the retrieval of time- Rachid Ramda from Britain to France sensitive intelligence that is paramount in over his role in the 1995 Paris metro the wake of a terrorist attack. bombing.13 In 2005 it took just 56 days to bring the failed 21/7 London tube 2. Tracking terrorists’ travel A hard Brexit would also bomber Hussain Osman back from Italy A no-deal scenario would mean the to London using an arrest warrant.14 UK would be denied participation in the mean that the UK would Schengen Information System II (SIS II), A limited deal is reached losing real-time information on persons of lose access to the Euopean Whilst the UK appears to have accepted interest, objects and vehicles travelling to that it will lose unrestricted access to the the UK. The UK would also lose access Arrest Warrant regime EU’s capabilities outlined above,15 it is to the EU Passenger Name Record still in the interest of both sides to reach (PNR) airline programme and would a deal. The level of access would vary be unable to identify terrorist suspects by tool, and currently only Schengen in advance of travel, including those Area associated states (Norway and travelling under aliases.10 Switzerland) are granted full access to any EU data system. In preparation, the UK is imposing stronger border controls, including £20 UK aspirations to maintain the core million of additional funding for the Home features of its current membership with Office. This aims to help improve the Europol are unlikely.16 The UK could intelligence picture about threats moving establish an operational agreement in and out of the UK, strengthening the similar to the US, Switzerland and multi-agency response to people and Australia, which would allow it to station goods entering the UK and support liaison officers at Europol headquarters, investment in new capabilities for Border and access Europol’s messaging facility 17 Force and Counter Terrorism Policing and other services. This would not (e.g. improved detection equipment).11 extend to the EIS. UK investigators seeking information on a potential terrorist 3. Extraditing and prosecuting suspect would have to make separate terrorists requests to member states to check A hard Brexit would also mean that the whether they held relevant information.18 UK would lose access to the European The process of determining whether EU Arrest Warrant (EAW) regime, with no nationals visiting the UK have terrorist equivalent alternative arrangement convictions in their home countries in place.12 EU member states could could also take up to ten times longer in therefore refuse to extradite their own the likely event that the UK is unable to 19 nationals to the UK. To illustrate the access ECRIS. EAW’s value to the UK: before the EAW It is also not evident that the UK will existed, it took 10 years to extradite Military presence at France–UK border at Calais ferry. (Photo Getty Images) benefit from real-time alert mechanisms

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 33

A Europol police agent looks at the onscreen logo of a new website launched by Europol at the Europol headquarters in The Hague. (Photo JAN HENNOP/AFP via Getty Images)

Notes 1. Alexander Babuta, No Deal, No Data? The Future of 9. House of Commons, Home Affairs Committee Oral UK–EU Law Enforcement Information Sharing, RUSI, evidence: The work of the Home Secretary, HC UK aspirations to maintain the core features of its current membership with 2019, https://rusi.org/sites/default/files/20190226_bp_ 434, 27 November 2018, http://data.parliament. Europol are unlikely no_deal_no_data_web.pdf uk/writtenevidence/committeeevidence.svc/ 2. European Parliament, the EU-UK relationship beyond evidencedocument/home-affairs-committee/the-work- Brexit: options for Police Cooperation and Judicial Co- of-the-home-secretary/oral/92960.pdf of terrorists travelling into the UK, at least predict. If Brexit is perceived as a partial operation in Criminal Matters, European Union, 2018 10. Babuta, No Deal, No Data? What is the overall impact on https://www.europarl.europa.eu/RegData/etudes/ 11. https://www.gov.uk/government/news/705-million-in- in the short term, given that the EU is terrorism in the UK? victory over ‘liberal internationalism’, this STUD/2018/604975/IPOL_STU(2018)604975_EN.pdf vestment-for-gb-eu-border unlikely to offer more than basic access could inspire violent attacks to hasten 3. Statement by Michel Barnier following Round 4 of 12. HMG, The Future Relationship with the EU. The UK will be unable to replicate its negotiations for a new partnership between the to SIS II. There is also no legal basis for its demise. European Union and the United Kingdom, 5 June 13. https://www.economist.com/britain/2005/10/20/the- existing relationship in any scenario. The 2020, https://ec.europa.eu/commission/presscorner/ non-trial the UK’s hope for reciprocal transfers of detail/en/speech_20_1017 14. https://www.theguardian.com/uk-news/2020/feb/27/ 20 main impact will likely be felt in terms of More importantly, the existing capacity PNR flight data. Any access is likely to uk-to-withdraw-from-european-arrest-warrant time and efficiency. Even in the event 4. HM government, No-Deal Readiness Report, October come at a cost. The UK would be paying of the UK to counteract any form of 2019, https://assets.publishing.service.gov.uk/gov- 15. HMG, The Future Relationship with the EU. of a hard Brexit, after a period of initial terrorist violence is unlikely to be greatly ernment/uploads/system/uploads/attachment_data/ 16. House of Lords, Brexit: future UK-EU security and to use the very same system that it was file/837632/No_deal_readiness_paper.PDF disruption, most challenges would likely damaged. The reality is that neither the police cooperation; HMG, The Future Relationship with instrumental in developing. 5. Operation Yellowhammer, HMG Reasonable Worst the EU. be mitigated by strengthening existing UK nor European governments want Case Planning Assumptions, as of 2 August 2019, 17. https://www.europol.europa.eu/partners-agreements/ bilateral relations with member states and https://assets.publishing.service.gov.uk/govern- operational-agreements The UK has already announced that a terrorist attack that can be pinned, in ment/uploads/system/uploads/attachment_data/ it is not seeking to participate in the other rapid adjustments. part, on Brexit having caused a lack of file/831199/20190802_Latest_Yellowhammer_Plan- 18. Evidence on future UK-EU security cooperation provid- ning_assumptions_CDL.pdf ed by Robert Wainwright, former Director of Europol, EAW but aims to establish a fast-track preventive transnational coordination. https://publications.parliament.uk/pa/cm201719/cm- Anti-Western jihadists have shown 6. HM government, The Future Relationship with the select/cmhaff/635/635.pdf extradition arrangement, based on the Counter-terrorism security is one of the EU: The UK’s Approach to Negotiations, February relatively little interest in Brexit. The 19. Nigel Inkster, Survival: Global Politics and EU’s surrender agreement with Norway few areas in which Brexit will ultimately 2020, https://assets.publishing.service.gov.uk/gov- UK leaving the EU is unlikely to have ernment/uploads/system/uploads/attachment_data/ Strategy December 2018-January 2019, Brexit and Iceland.21 This treaty took 13 years make comparatively little difference. file/868874/The_Future_Relationship_with_the_EU.pdf and Security, https://www.iiss.org/publications/ any impact in terms of judging which to enforce after it was signed in 2006, 7. https://www.europol.europa.eu/activities-services/ survival/2018/survival-global-politics-and-strat- countries should be targeted in future services-support/information-exchange/europol-infor- egy-december2018january2019/606-04-ink- though it is likely that both sides will ster-cm Islamist attacks. The effect of Brexit mation-system want a post-Brexit agreement in place 8. Babuta, No Deal, No Data? 20. HMG, The Future Relationship with the EU. upon far right terrorism is more difficult to much faster. 21. HMG, The Future Relationship with the EU.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 34

Insure to be resilient: how to strengthen national security in a post-COVID world The Integrated Review and how the insurance industry can contribute to national resilience

Paddy McGuinness CMG OBE, Former UK Deputy National Security Advisor

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 35

Rather, there was a list of things the effective crisis response rely upon. As 2020 draws on, and Administration, and especially chief Prime Illustration of the high consequence risks facing the UK Crisis has become business as usual. we endure the largest Ministerial advisor Dominic Cummings, This is unhappy news for some in the *The use of some chemical, biological, radiological and natural hazard event of cared about - procurement structures, nuclear (CBRN) materials has the potential to have very Administration who dislike the existing role of the Armed Forces, technology and serious and widespread consequences. An example crisis response structures centerd our generation, we should would be the use of a nuclear device. There is no historical data. There was a heavy emphasis on precedent for this type of terrorist attack, which is excluded around the Cabinet Office. The departure ask whether and how the constructive challenges. from the non-conventional grouping on the diagram. Pandemic of Cabinet Secretary and National British government plans to influenza Security Advisor Sir Mark Sedwill, may The two previous Strategic Defence well be followed by a reworking of these partner with the insurance and Security Reviews, both conducted Coastal flooding structures with a greater emphasis on industry to improve national during the Cameron ministries, had Major individual government departments pulled resilience to the fore as a national industrial resilience? accidents Inland Attacks taking the lead. One of the strengths of security issue and had placed hazard Major Attacks flooding on crowded the UK’s counter-terrorism and, indeed, on critical places The answer, I fear, is that events – Public Health and Major Transport cyber crisis response has been the Accidents infrastructure Natural Hazards – in the first tier of Non- Attacks the industry is not in their conventional ability to act across a complex system

risks alongside terrorism, international Relative impact on transport minds, or at least not in attacks* quickly and to significant effect. This military conflict, instability overseas and maintains public confidence through a positive way. It is worth cyber. Up to February 2020, domestic incidents and creates a drive towards thinking how we change resilience lacked profile for Johnson’s Severe recovery (the partner of response in the team. Since then, natural hazard has weather resilience process), which can keep that for all our benefit. asserted itself in the form of the global Animal disease Electronic business interruption and thus claims to a The Integrated Review COVID-19 pandemic. It is not just that attacks minimum. From personal experience, ’s majority-backed a low-probability, high-impact event has it is bad enough trying to support administration came into office on 13 occurred but also that, like a fever which ministers handling some type of crisis makes one feel every past injury and December 2019 with a definite plan to Relative likelihood for the first time through established rethink and reorganise the UK’s approach weakness, the virus has opened us up decision-making processes. Managing to national security. This was in part a to state and criminal cyber activity, and real events for the first time through newly function of “Global Britain” and the idea to opportunistic manoeuvres by state designed arrangements has the potential may be at a lower point of the oscillating that the UK has a standing and a role adversaries (such as the imposition of the for dysfunction. in the world beyond its membership controversial Hong Kong security law), threat from terror than we were when of the EU. It manifested itself in a and made the fabric of our economy Daesh or al-Qaeda controlled territory, the The interruption of normal business planned “Integrated Review” (IR) of the more susceptible to damage. problem has not gone away. Terrorists by COVID-19 has taken its toll on the UK’s Foreign, Defence, Security and The Treasury’s exceptional are persistent. Integrated Review. The teams working Terrorism has also made a showing – it, civil service and political advisers, Development Policies said to be the though not as the strategic challenge to spending of tens of billions largest since the end of the . The impact of COVID-19 have been diverted to pandemic the economy which Pool Re was set up It is worth reflecting how these On 26 February 2020, when the IR of pounds in response response and so have lost both time to counter or which 9/11 or the various developments feel within the was announced, there was almost no to COVID-19 means that and momentum. Insiders tell me that attempts to disrupt the international Administration. The COVID-19 crisis public comment about the seemingly insurance claims were not there are strong drafts circulating on the aviation system represent. The stabbing has stressed all of the structures and low profile of terrorism or indeed wider UK’s place in the world suggesting that in Reading was a reminder that, while we a critical factor in the processes that good government and natural hazards in the press release. national response the interplay between two gifted men –

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 36

Professor John Bew, the Prime Minister’s Domestic resilience and the insured individuals and enterprises. The Diplomatic Advisor, and diplomat Alex insurance industry sector has very wide reach in society Ellis – is working well on traditional which complements that of government So it does not seem likely that the IR will subject areas. There isn’t the same grip bodies and adds capacity. This is about innovate in response to the challenge of on domestic resilience but it is hard to preparedness and response but also domestic resilience. Nor will it, as things think that such a review coming during recovery. Every household or business stand, look to the insurance industry this pandemic can avoid a substantive that stands back up after an event for solutions. More’s the pity as the approach to hazards. supported by insurers is one less that will industry has a wider range of tools and ultimately fall on government’s books. greater reach than many in government Fifth, the concentration of the insurance understand. Six aspects stand out. industry in the City of London is a source First, and perhaps above all at a time of comparative advantage to the UK. n when government is struggling to shape general, successive governments have public behaviour to the better following sought to protect that market while A great challenge lockdown, the industry promotes the maintaining drivers for innovation. Here in domestic resilience understanding of risk (and where it there is an opportunity for more active lies amongst those insured). A great is that government stimulation of innovation in an area which challenge in domestic resilience is that several Countries are considering. has limited control government has limited control over over the critical the critical assets and systems that Finally, there is the question of how this we all depend upon. Acceptance and government thinks of its role as insurer assets and systems management of risks by the private of last resort. Some in past governments that we all sector to optimise resilience is at the core have sought to deny this role but major depend upon of this challenge. Second, the insurance events such as this pandemic or a industry can influence practical mitigation tragedy such as Grenfell Tower, see The output of such reviews is generally of those risks as a policy condition or the state paying out. For terrorism, a strategy which lays out what the as a recommended step. I have been government chose to create a buffer government hopes to achieve including struck by how many of my clients have and protection for the market through a through legislation. We should have in turned to their insurers to test the validity pooling mechanism. mind whether there is space for new of their arrangements for return to work initiatives. There is a backlog of national post-lockdown. Third, it promotes the An ambitious IR would stand back and security related legislation to be cleared service industries that deliver those apply the pooling model to a wider range – on Internet Harms, National Security mitigations. It requires standards and of difficult to insure risks from the National and Investment, a Counter-Terrorism provision of service at scale. For instance, Risk Assessment than just terrorism and Sentencing Bill, perhaps an Espionage in the cyber context, the adequately flood: a Catastrophe Reinsurance Pool. Act and the Third Direction. Absent insured consistently respond and recover For now, this is not on the agenda. It dramatic events which force a change quicker from events than those with should be. of agenda, there will be little parliamentary Prime Minister Boris Johnson gives a press conference on the ongoing situation with limited or no cover. Fourth, there is a the coronavirus pandemic in Downing Street after he had taken part in the government’s network effect for government: through time for new measures for at least COBRA meeting on 16 March, 2020 in London, England. (Photo by Richard Pohle - two years. WPA Pool/Getty Images) the insurance industry’s interaction with

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 37

Hardly anyone saw it coming Insuring against pandemic risk – how the industry is responding, and what more can be done

Stephen Catlin, Chairman and CEO, Convex

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 38

Universal pandemic. Towards a Pandemic Re Entire countries in I realised – and the COVID-19 epidemic proved – that, like terrorism risk, the lockdown for months. threat of potential loss arising from Economies battered. contagious disease is too great for 25 million infections. our sector to manage on its own, at least at present. I discussed this with 850,000 dead. Hardly numerous colleagues and friends from anyone saw it coming. across relevant organisations to create a solution. The Pandemic Re Steering The COVID-19 crisis brought insurance Group coalesced as a result of these losses too great for our sector’s existing conversations. It unites leaders from the structures to handle. Like everyone else, industry, policy, science, and academia, we were caught on the hop, and flat- all working pro bono, to develop a footed. As the dust settled, it became cohesive and comprehensive response clear that something had to be done for government to consider. to ensure we are prepared for similar, future pandemic events. The insurance sector, with its huge depth of knowledge about risk and its extensive infrastructure to manage indemnity, is the obvious contender Like terrorism risk, the to develop solutions. But the industry, threat of potential loss already reeling from a sustained arising from contagious soft market and successive years characterised by multiple large-loss disease is too great for events, suffered serious reputational our sector to manage on damage as insured businesses around its own the world believed, in a great many We first met, virtually, in April 2020. We cases, that their coverage did not decided quickly to work closely with extend to pandemic-related losses. Pool Re, and alongside the industry to Someone in the insurance industry support customers and communities. needed to get on the front foot to I assumed the Chairmanship of the counter the growing anti-insurance informal group, with members Maurice sentiment, and to get the nation ready Tulloch and Stephen Hester, the CEOs for the inevitable next disease crisis, respectively of the UK insurance giants whenever it arrives. I put my head Aviva and RSA; Julian Enoizi, who People queuing for entry to Waitrose during COVID-19 leads Pool Re; and three very senior above the parapet. lockdown measures. (Photo by Getty Images)

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 39

reinsurance brokers: Nick Frankland, considerable progress by mapping and academia have been allocated to of British Industry; academic bodies the UK CEO of Aon’s Reinsurance Solutions out what needs to be done, identifying work streams, and another 65 have Cambridge Centre for Risk Studies and division; James Nash, International CEO working groups and business leaders volunteered their or their organisation’s Imperial College London; data providers of Guy Carpenter; and James , to direct them, as well as helping to help. Dunn & Bradstreet, Mastercard, Willis Re’s CEO. determine the detailed activities of each Metabiota, and Verisk; legal firms Arnold work stream. The Corporation of Lloyd’s has agreed & Porter, Clifford Chance, and Herbert We agreed a primary objective: to to provide resources for two of the Smith; and, on the medical side, the propose, to both the government The Customer Engagement and work streams. Its CEO, John Neal, sees National Health Service. Many more and the country, a viable, sustainable Distribution working group is led by Julie government backing for the project as reinsurers are now involved as well. industry response that will be sufficiently Page, CEO of Aon UK, with Chris Lay, essential. “In this type of crisis only the robust to cover UK businesses in CEO of Marsh UK & Ireland as deputy government has the wherewithal to Challenges ahead the case of future pandemics. We chair. The Technical Insurance working address the economic consequences, We have a significant task ahead, concluded too that our industry is best group is directed by Pool Re chief no single industry can do that, but there including challenges such as the placed to support the government, underwriting officer Steven Coates. is a hell of a lot that we [as insurers] can development of a legally sustainable individuals, and businesses through Paul Jardine, chairman of the Lloyd’s do,” he told the Insurance Insider. definition of pandemic, and the creation our sophisticated claims-paying firms Asta and Chaucer (and an actuary of a robust event definition which the infrastructure and our extensive and architect of Lloyd’s enormous R&R industry is willing and able to embrace. distribution channels. project), heads the Modelling and Data The enormous levels of support group. The Scheme Structure and we have received will make all that An existing disaster Operating Models stream is headed by possible. It will also make the fact that risk-financing model Michael Dawson of Nuclear Insurance; the UK insurance sector is speaking Pool Re, a world-class example of Pandemic Preparedness and Mitigation government must with a single, united voice irrefutable a disaster risk-financing mechanism by senior insurance lawyer William to government. Government must formed as a public–private partnership, Marcoux; and the Legal, Regulatory and be involved in the be involved in the insurance against will provide invaluable structural government Affairs working group by insurance against pandemic risk, since our sector’s recommendations based on its long former Home Secretary Amber Rudd. collective balance sheet – large as it is – term experience and success managing pandemic risk cannot bear this risk alone. extreme event risks, its global leadership A Project Committee led by Michael in public–private insurance partnerships, Dawson includes these individuals Meanwhile Jon Dye, Chairman of the Insurance is a collaborative industry by and its enormous connections. plus Martin Hattrell, another very Association of British Insurers and nature, and with this highly experienced Moreover, the industry would, through experienced legal expert. The working CEO of Allianz Insurance, agreed group of leaders, supporters, and our links with academia, provide groups are now being populated to join the Steering Group. Other advisors we intend to deliver a robust expertise on how to mitigate risk. by a balanced and diverse group of organisations involved in the project structure. The need is too great, industry experts. Each has a significant include the brokers Hyperion and and our position as the appropriate After many more conversations during work stream to undertake, with pre- Gallagher, the consultancies Deloitte, organisations and individuals to meet it which the steering committee discussed determined areas of responsibility. KPMG, Oliver Wyman, and PwC; so clear, that we cannot stand by and the challenges and potential solutions, More than 50 representatives from associations including the British wait for someone else to act. we recruited dozens more high-profile leading insurance brokers, insurers and Insurers Brokers Association, the experts to get involved on a pro bono reinsurers, management consultants, Lloyd’s Market Association, the London basis. Since then, we have made data modellers, the medical profession, Market Group, and the Confederation

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 40

Cyber in the new normal How COVID-19 is shaping the cyber threat landscape

Conrad Prince CB, Senior Cyber Terrorism Advisor to Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 41

The full implications of the last three months of 2019. Cyber company VMWARE CARBON BLACK the COVID-19 pandemic reported that cyber attacks on financial for cyber security will not institutions increased by a factor of nine from February to April. And there is no be known for some time. question that the crisis has seen cyber What is clear though is criminals pivot to COVID as a theme that cyber criminals have for phishing attacks, although there are signs now of a shift to new themes, taken full advantage of such as Black Lives Matter. Cyber the crisis and nation criminals are nothing if not agile. states have used cyber With that in mind, it is worth looking at espionage to give them three key areas for businesses to focus an edge in the race to on: the technology of remote working, the people risk, and the challenges of find a vaccine. supply chains. Meanwhile, there have been some profound changes in our ways of The technology of remote working that increase the cyber risk, working from both a technical and a human The pandemic has seen some point of view. fundamental shifts in ways of working that have major implications for cyber security. Our dependency on digital has become more profound than ever. The widespread shift to remote working opened up a number of new The widespread shift to opportunities for cyber attackers. remote working opened According to cyber security firm Kaspersky, the number of brute force up a number of new attacks on Remote Desktop Protocol opportunities for (the key technical standard for using a cyber attackers desktop remotely) was up by a factor of 6-7 in March–April this year. Various sources have reported an upsurge in cyber attacks during the It seems likely that, in establishing pandemic. Cyber insurance specialist remote working at scale and pace, Beazley reported a 25% increase in more than a few security corners will ransomware attacks worldwide in have been cut. While this may well the first quarter of 2020 compared to have been done for sound practical

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 42

businesses are still ultimately responsible So businesses need to be particularly and others who used the company to for their data, how they are accessed, alert at this time. An integrated response manage their data. and by whom. is key. Good line management alert for possible danger signs is more That risk is greater than ever, yet the All too often the signs of an The people risk important than ever, as is the effective evidence is that, despite all the talk, The most useful thing a insider risk may be there, The risks from remote working are not bringing together of data from technical many businesses are still not taking business can do right but the dots have not been simply about technology. The insider monitoring with HR and security it seriously. The UK government’s now is take a fundamental joined up threat – the risk that an individual information. All too often the signs of an annual Cyber Security Breaches look at its cyber risk within an organisation acts in a hostile Survey revealed this year that just 34% reasons, balancing business need with insider risk may be there but the dots profile and its strategy way against it – is a significant issue of financial services and insurance risk, it will be essential for businesses have not been joined up. for mitigating that in a cyber context. A rogue member companies surveyed had reviewed to understand the implications of the of staff, especially one with access to The challenges of supply the cyber risk associated with their may even become part of a permanent decisions they have made and develop key systems, can bypass many of the immediate suppliers, and only 18% had set of new ways of working. In many a sound understanding of the additional chains security controls that protect against Even before the pandemic there was reviewed the risk in their wider supply respects this is simply an acceleration risk they are carrying. external cyber threats. The risk of that a big focus on the supply chain as chain. This is concerning. It’s essential of an existing digital-driven agenda. Measures such as VPNs, two-factor will have increased as pressures on staff a source of cyber risk. There have to review the cyber security standards And the fundamentals of cyber authentication and strong passwords mount during the pandemic, making been growing examples of companies applied in the supply chain and to security remain the same. From that are important for the security of remote them more vulnerable. They are isolated being damaged as a result not of a build specific cyber requirements into perspective, perhaps the most useful working. And it will be worth many from their workplace and colleagues, direct cyber attack but because of the contractual agreements with third thing a business can do right now is businesses considering adopting and it is simply less easy to keep track an attack on one of their third-party parties. Otherwise, businesses really are take a fundamental look at its cyber risk longer-term strategic solutions to secure of what they are doing. Moreover, many suppliers. In just one recent example, leaving open a soft underbelly for attack. profile and its strategy for mitigating that. working at scale, with automated monitoring systems designed to look for the ransomware compromise of cloud It seems likely that many of the Only 35% of businesses polled in the security management built in. Cloud unusual behaviours potentially indicating computing provider Blackbaud, the fundamental changes in business government’s survey have conducted a services offer many advantages in this an insider threat (such as accessing the industry-leading provider of software practice prompted by the pandemic will cyber risk assessment. Now feels like a respect. But it is critical to remember office at odd times) are not designed for for the non-profit sector, has impacted be with us for some time to come, and good time to take a strategic look at the that in adopting a cloud solution the new normal. on dozens of universities, charities cyber risks in the new normal.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 43

Threat Intelligence

Guns ‘n’ Bombs: “They haven’t gone away you know...” The growing violence of the far right Global insecurity and the terrorist threat to the UK Terrorist intent, capability, and the threat of firearms and Assessing the scale of the threat posed by right-wing terrorism Examining the relationship between insecurity overseas explosives attacks and the UK’s terrorism threat landscape Terrorist recidivism How much of a problem is reoffending by convicted terrorists? Conspiracy theories and terrorism The growing role of online conspiracy theories as a E-Jihad: a credible new threat? driver of political violence Al-Qaeda’s new cyber strategy and the outlook for ‘cyber terrorism’

Author Author Author Jerry Smith OBE Eden Stewart Callum Yourston Senior Partner Senior Analyst Analyst CHC Global Pool Re Pool Re Jerry Smith OBE is a senior partner at CHC Global, an independent Eden Stewart joined Pool Re as an analyst on the Risk Awareness Callum Yourston joined the Pool Re Risk Awareness team in London-based special risks intermediary and advisory company. team in October 2017. Prior to joining Pool Re, Eden worked as an September 2019. Before joining Pool Re, Callum worked as a political He has over 25 years’ experience of security risks and crisis intelligence analyst specialising in cyber crime. Eden holds a Master’s risk analyst covering the Middle East and North Africa. He holds an response, specialising in the management of CBRN perils. Degree in Security and Intelligence Studies from Brunel University, MA in Terrorism, Security and Society from King’s College London and He is a former bomb disposal officer and UN weapons inspector. and a BA in History from the University of Leeds. an undergraduate degree in International Relations from the University of St Andrews. He is proficient in Arabic and French.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 44

Guns ‘n’ Bombs: “They haven’t gone away you know...” * Terrorist intent, capability, and the threat of firearms and explosives attacks

*Gerry Adams, former President of Sinn Féin, responding to a Republican heckler demanding he bring back the IRA.

Jerry Smith OBE, Senior Partner, CHC Global

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 45

Terrorist attacks in the European Union by threat actor type 2017–2019 Source: Terrorism Situation and Trend report 2020 Europol 100 2017 2018 2019

88 80

60 56 56 49 40

33 27 20 24 24 26 21 19 1 1 1 3 1 0 5 5 0 6 6 Islamist Left wing Right wing Northern Irish Dissident Other Nationalist/Separatist Single issue Unspecified

Background casualty attacks in the region in 2019 measure of the means available – from groups, with many more linked to other Capability which involved the use of firearms. access to weapons, to the technical national/separatist movements on the The University of Maryland’s Global The two key elements of capability – know-how of building a weapon and continent. Despite this, Europol found Terrorism Database (GTD)1 shows that the ability to acquire the peril (firearms/ The increasing frequency of rudimentary using it in an attack. For the vast that all casualties from extremist attacks the majority of mass casualty attacks methodologies reflects changes in the explosives) and the skills to employ in Western Europe now employ low- majority of potential terrorists in the UK, were caused by either Islamist or far character and intent of the main terrorist capability, in regards to access and right actors, with the former accounting effectively – are exemplified in the 2019 complexity methodologies involving the threat actors in recent years, as well as 5 Halle synagogue attack in . use of vehicles or knives as weapons. ability to use firearms and explosives, is for the vast majority. improved counter-terrorism and general far outweighed by intent. The attacker had improvised firearms; Nonetheless, there were still two mass law enforcement efforts in the control This reflects the fact that the intent to but the unreliability of his weapons and of firearms and explosive materials. The lowering of the UK threat level to carry out mass casualty attacks is far ammunition, and his limited tactical However, these methodologies continue SUBSTANTIAL2 in November 2019 more prevalent amongst Islamist (and, handling experience, along with effective to represent the most effective means of was encouraging; but the Head of more recently, extreme right-wing) security, meant that larger numbers of carrying out mass casualty attacks. Counter Terrorism Policing emphasised terrorists than amongst long-standing casualties were thankfully avoided.6 that “an attack is (still) likely”.3 national/separatist or leftist groups. The intent to carry out Threat The employment of low-complexity Analysis of criminal networks suggests mass casualty attacks Terrorism threat is commonly measured Intent methodologies by these threat actors that large volumes of firearms continue to is far more prevalent in terms of ‘intent’ and ‘capability’. Europol’s 2020 Terrorism Situation and in Europe is a consequence of limits to reach Western Europe across its porous amongst Islamist (and, The former element consists of the Trend (TE-SAT) report4 recorded 119 their capability — their inability to source borders with the Balkans and Ukraine, psychological and organisational factors completed, failed, or foiled terrorist more lethal weaponry — rather than to with some of these ending up in the more recently, extreme such as objectives, risk tolerance and attacks in 2019. Almost half were their intent. hands of terrorists.7 The repurposing of right-wing) terrorists appetite for violence. Capability is a attributed to Northern Irish dissident blank firing and deactivated firearms,

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 46

along with the increasing prevalence of Significant progress has been made 3D printed weapons (as seen in Halle), in reducing the ability of terrorists to remains another means to develop a acquire the precursors to manufacture viable, if unreliable, weapon. improvised explosives. Stringent controls on the composition and management of In the UK, the National Crime Agency’s agricultural fertiliser has reduced the ease (NCA) Operation Venetic,8 a countrywide with which an ammonia-nitrate-based operation in 2020 targeting serious bomb could now be built. However, in organised crime, resulted in a large 2019, a British newspaper reported11 number of arrests and the recovery of that three tons of such material had 77 firearms – including an assault rifle, been found by UK police in 2015. The sub-machine guns, four grenades and sources were unnamed, but it was thousands of rounds of ammunition. claimed that the Lebanese terrorist Whilst the majority of such weapons tend organisation Hezbollah had stockpiled to be used by criminals against rivals, the fertiliser in north west London – the NCA noted that the small number of close to a large Jewish community. This seizures of fully automatic weapons were discovery suggests that there remains “gradually increasing”.9 the possibility that sufficient quantities of controlled material can still be acquired While some terrorists have exploited to build what could have been the their criminal connections to acquire largest improvised bomb in the UK. firearms, the crime–terror nexus is However, it is also reasonable to assess often downplayed, with commentators that such a well-connected and funded assuming that organised criminals organisation, actively supported by Iran, are averse to supplying terrorists with has capabilities well in excess of other weapons for fear of attracting unwanted non-state actor groups. attention from police. While this is Acetone-peroxide-based improvised sometimes the case, most criminal explosives are more challenging to arms dealers are usually either unaware legislate against. These can be made of or disinterested in the intentions of 10 from common household products such those buying their wares. Therefore, as drain cleaner and paint thinners, with a sustained increase in the supply of many ‘how to’ recipes on the darker illegal weapons in Britain makes their corners of the internet. But access to this procurement by terrorists more likely. capability can come at a price – these Furthermore, while most terrorists explosives can be extremely sensitive in Britain will lack formal training or to shock. In 2017, immediately prior to weapons-handling experience, these the Barcelona vehicular impact and knife need not be major obstacles, as attacks, two members of the terror group demonstrated by the Bomb disposal unit is investigating a were killed when the peroxide-based suspicious baby stroller and a bag. MP in 2015. (Photo by Getty Images) explosive they were making detonated prematurely.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 47

Notes 1. https://www.start.umd.edu/pubs/START_GTD_ GlobalTerrorismOverview2019_July2020.pdf 2. The UK’s threat level was increased to SEVERE on 04 Nov, after the intelligence cut-off date of this Review. 3. https://www.gov.uk/government/news/terror- ism-threat-level-lowered-to-substantial 4. https://www.europol.europa.eu/sites/default/files/ documents/european_union_terrorism_situation_ and_trend_report_te-sat_2020_0.pdf 5. https://www.europol.europa.eu/sites/default/files/ documents/european_union_terrorism_situa- tion_4. 6. https://www.theguardian.com/world/2019/ oct/10/halle-attack-homemade-guns-jammed-re- peatedly-video-shows 7. https://www.theguardian.com/world/2018/ apr/18/arms-race-criminal-gangs-helping-terror- ists-get-weapons-report-warns

A view of the pistols recovered by Delhi Police Special 8. https://nationalcrimeagency.gov.uk/news/opera- Cell officials, at Police Headquarters, on 14 February tion-venetic 2019, in New Delhi, India. (Photo by Amal KS/ Hindustan Times via Getty Images) 9. https://www.newsshopper.co.uk/ news/14331619.video-weapons-gang-reported- ly-run-by-22-year-old-swanley-mastermind-un- load-deadly-cargo/ Conclusions explosives and had conducted a ‘hostile malfunctions, injury, or arrest – or to 10. https://www.europol.europa.eu/sites/default/files/ reconnaissance’ of her target.14 conduct less sophisticated attacks. documents/european_union_terrorism_situation_ The collective data suggest that, whilst and_trend_report_te-sat_2020_0.pdf mass casualty attacks are down in The ability to match ‘capability’ to this It cannot be concluded that the risk 11. https://www.telegraph.co.uk/news/2019/06/09/ Europe, the intent to cause fatalities ‘intent’ continues to be a challenge of a firearms or explosive attack in the iran-linked-terrorists-caught-stockpiling-explo- sives-north-west/ remains. It was recently reported12 for terrorists in the UK. The potential UK has increased significantly. But that UK authorities had interdicted 25 12. https://news.sky.com/story/25-terror-plots-have- Analysis of criminal for trained and experienced returning the number of criminally connected been-foiled-since-2017-westminster-attack-min- terrorist plots since the Westminster Islamist fighters from Iraq and Syria individuals, Islamist, far right, or ister-reveals-12012317 networks suggests Bridge attack in March 2017 – a rate of remains viable. Such technical skills may otherwise, who can acquire, and have 13. https://www.bbc.co.uk/news/uk-51405537 around one plot every two months, with also be available to right-wing groups, the experience to use, firearms and 14. https://www.independent.co.uk/news/uk/ that large volumes roughly 800 live investigations ongoing. with a small number having connections explosives has the potential to increase. crime/safiyya-shaikh-isis-trial-st-pauls-cathe- dral-london-terror-attack-bomb-prison-sen- of firearms 2020 has already seen two convictions to, or being former members of, the Whilst there is little evidence of a tence-a9599791.html against individuals who separately military. But unless they can acquire systematic nexus between organised continue to reach planned to bomb St Paul’s Cathedral firearms from underworld connections, crime and terrorism, petty criminal and attack a London Pride march.13 The or steal from a legitimate source, linkages may provide the opportunistic Western Europe bomber had got to the stage of sourcing they will have either to manufacture acquisition pathway that cannot a manufacturer for the improvised their firearms and explosive – risking be ignored.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 48

The growing violence of the far right Assessing the scale of the threat posed by right-wing terrorism

Eden Stewart, Senior Analyst, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 49

Number of fatalities caused by right-wing terrorist attacks worldwide 2000-2019 Number of fatalities caused by right-wing terrorists worldwide 2000-2019 Source: Pool Re analysis of Global Terrorism Database, START, University of Maryland Source: Pool Re analysis of Global Terrorism Database, START, University of Maryland

100 100 No. of mass casualties No. of lethal attacks No. of attacks attacks (3+ deaths)

80 80

60 60

40 40

20 20

0 0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 On 30 June, Feuerkrieg Division became the third far right group to be proscribed by the UK’s Home Secretary, making it a criminal offence to be a member of, or invite support for, the organisation. This followed the proscription of Sonnenkrieg Division, another neo-Nazi group, in February 2020. In September last year, the National Lead for Counter-Terrorism Policing, Assistant Commissioner Neil Basu, described the far right as the “fastest growing” terror threat in Britain. Shortly after, Home Office statistics for PREVENT, the government’s counter-radicalisation programme, made headlines after revealing near parity between the number of individuals referred for concerns relating to right-wing extremism and those Globally, it appears referred for Islamist extremism. that violence Perceptions of an emboldened and in 2011. However, the statistical evidence report on RWT in the United States by group them for statistical purposes will perpetrated by increasingly prolific movement of right- for an upsurge in RWT is thinner than the Center for Strategic and International probably remain a challenge for the wing terrorism (RWT) were reinforced such headline-grabbing occurrences studies included attacks by so-called foreseeable future. the far right has by a series of deadly shootings by far suggest.1 ‘incels’ (involuntary celibates) and anti- increased in right extremists across the West in abortion activists as forms of RWT.2 No less of a problem is the perennial 2019/–20, most notably the March 2019 What is right-wing terrorism? Such categorisations are not without issue of what constitutes terrorism. recent years Christchurch mosque shootings – the Among the reasons for the lack of controversy.3 Indeed, the ideological Violence by neo-Nazi skinheads, often deadliest attack by a right-wing actor reliable data on RWT is the absence of and organisational diversity of far right directed against ethnic minorities, since the murder of 77 people in Norway universally accepted criteria for what collectives is such that attempting to has been prevalent across Europe for constitutes far right terrorism. A recent decades. Yet, historically, such attacks

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 50

have largely (but not exclusively) been more frequent. Since the March 2019 far right extremists, with a further seven treated as hate crimes rather than Christchurch shootings, there have plots foiled (roughly a third of the total). terrorism. While national laws are been seven mass casualty attacks by These figures represent an enormous sometimes inconsistently applied, there RWT, compared to three such attacks increase over the three years preceding is even less uniformity across different in the preceding decade.6 While this 2017 and represent a historic high.8 jurisdictions, meaning compilations of may transpire to be a temporary spike, it national records of far right violence are potentially portends a new dynamic, to The drivers of right-wing viewed by some as less than reliable.4 be explored later. terrorism Accounting for the increase in RWT Frequency and severity Across the Atlantic, a consensus is observed in the UK, US and elsewhere of attacks emerging that far right terrorists are the is far from straightforward. The drivers Nonetheless, it is possible to draw most prolific threat actor in the United of radicalisation are complex, and it is broad conclusions from the available States. The hypothesis is well supported. normally a combination of personal, data. Globally, it appears that violence While the data are open to contestation, social, and political factors which perpetrated by far right extremists has gunmen holding far right views appear to precipitate attack planning by radicalised increased in recent years. Analysis of account for the majority of deaths from individuals. However, several factors are several databases indicates that the terrorism and, excluding the 9/11 attacks, likely to have contributed to the growing 7 frequency of violent incidents attributed have done for some time. reach of RWT ideology. ‘Macro’ drivers, to right-wing actors has increased In Europe, the picture is less clear-cut. It such as increasing political polarisation, significantly (albeit remaining below is almost certain that support for far right diminishing social cohesion and the historic highs in the 1990s), in both ideologies has increased in recent years growing traction of ‘meta-narratives’ Europe and the United States since since the 2015 migrant crisis. However, in around migration and identity, probably all 5 around 2015. Annual totals vary most Western European countries, RWT play a role, but one of the most significant considerably, but the trend has remains mercifully rare, and continues catalysts appears to be other terrorist been upwards. to be overshadowed by the threat of attacks – those committed both by RWE Islamist extremism. Germany, which has and Islamist extremists. experienced several high-profile attacks The 2017 Finsbury Park attack against by right-wing extremists in the past year a Muslim centre was ostensibly carried and a half, is something of an outlier in out ‘in revenge’ for the London Bridge Those plots most likely to this regard. In June, the German interior attacks by Islamist extremists days earlier, succeed are opportunistic minister described Right Wing Extremism while the now-banned neo-Nazi group (RWE) as the “greatest threat to security National Action was formed in response and unsophisticated in Germany”. to the in 2013. Perhaps more concerningly, the lethality Assessing the situation in Britain, Conversely, the perpetrator of the 2019 of attacks by right-wing extremists has Assistant Commissioner Basu’s assertion attack in Stanwell was reportedly inspired also increased significantly. This largely that RWT represented the fastest growing by the Christchurch shooting the previous reflects the increasing prevalence of mass terror threat in the country is entirely day. The attacks in New Zealand would casualty attacks. Such attacks, formerly Chain of special forces of the Austrian police also subsequently be cited as inspiration against demonstrators of the identitarian movement supportable. Since 2017, there have quite rare, have become alarmingly at a demonstration in Vienna. (Getty Images) been three confirmed terrorist attacks by by several far right terrorists who carried

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 51

out mass casualty attacks in the US and and arson attacks on property, to the 2019 Christchurch or 2011 Norway Europe in the months following. marauding mass casualty attacks. attacks unlikely, the use of equally lethal The increasing prevalence of the latter alternative methodologies by a capable Another major driver appears to be the is driven by a combination of factors. and disciplined far right actor in Great emergence of online communities which One of these is the reciprocal dynamic Britain cannot be discounted. play a key role as sources of ideological between Islamist extremism and the and tactical inspiration, but also constitute new far right. More extreme violence Notes a primary audience for acts of terror has effectively been ‘legitimised’ by the committed by participants. This dynamic 1. https://www.washingtonpost.com/poli- indiscriminate attacks conducted by tics/2019/04/02/is-right-wing-terrorism-violence- was seen at play in the Christchurch Islamist terrorists, while their tactics, from rise/ attack, in which the attacker livestreamed vehicular impact attacks to marauding 2. https://www.csis.org/analysis/escalating-terror- ism-problem-united-states the atrocity, while his weapons were shootings, are eagerly emulated by more inscribed with references to assorted far 3. https://foreignpolicy.com/2020/06/01/canada- zealous adherents of far right ideologies. may-host-the-worlds-first-incel-show-trial/ right shibboleths. It was also seen in the There is also a new ‘competitive’ element 4. http://www.terrorismanalysts.com/pt/index.php/ October 2019 Halle synagogue shooting, driven by the gamification of real-world where the attacker addressed his pot/article/view/508 violence, and a desire to exceed levels of 5. https://www.sv.uio.no/c-rex/english/topics/on- livestreaming audience, not in his native 11 violence exhibited in previous attacks. line-resources/rtv-dataset/limited-version.html German, but in English – the lingua franca https://csis-website-prod.s3.amazonaws.com/ of the increasingly internationalised online Conclusions s3fs-public/publication/Jones_EuropeTerror- 9 far right movement. Sadly, these factors are unlikely to abate ism_WEB%20FINAL.pdf?QujAgipQZ97O7HifLb- NHKTSWAWHUBJY8 in the near term, and may very well Recurrent themes within these online 6. Author’s analysis of GTD. intensify. A continued upward trend in far right milieus are hostility to migrants, 7. https://www.csis.org/analysis/escalating-terror- religious and ethnic minorities, and the the number of RWT plots in the UK is ism-problem-united-states therefore probable. Only a minority of perceived impotence or ambivalence 8. It is worth noting that prior to the 2015 mur- of the political establishment to these will ever reach fruition. The police der of Jo Cox MP, the police and intelligence and intelligence services are alert to the services dedicated few resources to identifying transgressions allegedly committed by RWT plots; however, very few materialised in the these groups.10 To a large extent, these threat and have proved adept at both preceding decade. dismantling RWT organisations and narratives drive the target selection of 9. https://www.un.org/sc/ctc/wp-content/up- right-wing extremists. Crowded places detecting and disrupting plots by lone loads/2020/04/CTED_Trends_Alert_Extreme_ and symbolic sites associated with these actors. However, even without existing Right-Wing_Terrorism.pdf groups are frequently targeted by far resource constraints, it is implausible that 10. https://csis-website-prod.s3.amazonaws.com/ every plot will be foiled. s3fs-public/publication/Jones_EuropeTerror- right terrorists. However, the political left ism_WEB%20FINAL.pdf?QujAgipQZ97O7HifLb- is also seen as a target, whether it be While recent experience suggests NHKTSWAWHUBJY8 individual politicians (as seen in Britain, 11. https://www.bellingcat.com/news/ameri- those plots most likely to succeed are cas/2019/08/04/the-el-paso-shooting-and-the- Germany and Poland), or gatherings and opportunistic and unsophisticated, gamification-of-terror/ institutions (as seen in America). RWT across the globe have proven The tactics employed by right-wing capable of executing mass casualty attacks without warning. While the UK’s Female protestor holding up a banner extremists vary considerably, from less at the English Defence League rally in lethal unarmed assaults on individuals strict firearms laws make a repeat of the centre of Bradford. (Getty Images)

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 52

Terrorist recidivism How much of a problem is reoffending by convicted terrorists?

Eden Stewart, Senior Analyst, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 53

On 29 November 2019, stabbed five people, two fatally, at There is considerable an offender rehabilitation debate over the actual conference adjacent to level of threat posed by London Bridge. He had terrorist offenders on been released from prison their release 11 months earlier, having the government introduced a series of served half of his six-year measures to keep convicted terrorists in prison for longer and improve monitoring sentence for planning and management of them after their attacks in London. release. Three months later, Sudesh Aman The government’s response occurred stabbed two people on Streatham High against the backdrop of wider concern Street before being killed by armed among European policymakers over police. Amman had been released from levels of recidivism and reengagement prison the previous month, after spending amongst terrorists released from prison.1 around 18 months behind bars for Such concerns are understandable: possessing terrorist literature. These two across Europe, there are currently more attacks on the public were punctuated by than 2,000 individuals convicted of terror a third on prison staff at HMP Whitemoor offences who are due to be released in in January, when two inmates, one of coming years (not to mention those who whom was convicted for terror offences, have been radicalised in prison having wounded several guards. This incident been jailed for non-terror offences).2 also raises questions about the security protocols in place for terrorist offenders A justifiable concern? in prison. Given the attacks in the winter of 2019– 2020 in the UK, such concerns appear These attacks generated considerable to be well founded. However, there is media scrutiny of sentencing and parole considerable debate over the actual level practices relating to terrorist prisoners of threat posed by terrorist offenders on in the UK. It also raised questions their release.3 The research on levels of about how to manage the risk posed terrorist recidivism is far from conclusive, by terrorists who have completed their Boats from the Metropolitan Police Marine Policing Unit patrol near and reliable data on the subject are sentence but not disengaged from the scene after a number of people are believed to have been injured scarce and complicated by a range of after a stabbing at London Bridge, on 29 November 2019 in London, 4 extremism. In response to the attacks, England. (Photo by Peter Summers/Getty Images) methodological issues.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 54

Comparison of studies on terrorist recidivism rates in Western countries Source: Re-offending by Released Terrorist Prisoners: Separating Hype from Reality, Andrew Silke and John Morrison, International Centre for Counter-terrorism 650 Recidivism study data 600 number of recidivists (% of sample) sample size England & Wales: individuals convicted of 550 9.2% terrorist offence 500 Northern Ireland: paramilitary prisoners 450 2.4% 400 : Individuals supervised by Terrorism, Extremism and Radicalisation Team 350 2.2% 300 Belgium: Jihadi-related prisoners 250 United States: Guantanamo detainees 200 (New America Foundation) 150 100 3.1% 4.2% 50 0 England & Wales Northern Ireland Netherlands Belgium United States However, recent analyses of the problem of non-terror offenders on any charge Reengagement need not take the form in two rehabilitation schemes whilst in in Europe point towards a relatively low will lead to their inclusion in general of attack planning (released offenders prison and on parole, and was viewed rate of recidivism amongst released recidivism statistics, terrorist offenders may apply themselves to recruitment or as sufficiently benign as to be granted terror offenders. A 2016 study of a Dutch must commit further terror offences fundraising activities, for example) and a day-pass to travel to London (travel rehabilitation programmme established to be included in terrorist recidivism would therefore contribute indirectly restrictions were a condition of his a recidivism rate of roughly 4%.5 A more figures. Recent analyses of to the level of threat. Nonetheless, the parole).9 In contrast, police harboured recent Belgian study assessed that, the problem in Europe current volume of terrorist offenders major concerns about Sudesh Amman among 577 offenders, there were only Recidivism vs reengagement imprisoned across Europe means that, on his release, and he was therefore 13 cases of recidivism, a lower rate of Furthermore, low rates of recidivism point towards a even if only a small minority of those placed under close armed surveillance, around 2.3%. do not necessarily reflect low rates relatively low rate released in coming years reengaged, which ultimately limited the lethality of his of ‘reengagement’ in extremist it would still constitute a significant attack. These figures are broadly consistent with activity. Reengagement refers to a of recidivism additional operational burden for police Home Office statistics for England and return to terrorist activity having been amongst released and intelligence services. A bigger An intractable problem Wales, which showed, between 2013 ‘disengaged’, either by choice, or through challenge is extremists who did not While recently introduced measures and 2019, only six terrorist offenders of terror offenders incarceration. Despite reengaging and issues as research relating to recidivism, travel to the Middle East to engage and are intended to improve assessment a total of 196 were convicted for terror reoffending, neither Usman Khan nor therefore have not been prosecuted. of the threat posed by released terror 6 including small sample sizes, varying offences a second time. Such figures Sudesh Amman would be counted in offenders,10 it is improbable that these will are contrasted favourably with recidivism methodological approaches, and often Furthermore, attempting to discern recidivism statistics, as both were killed incomplete cross-national data. be entirely foolproof. It is therefore likely rates for non-terrorist offenders, because of their actions, which prevented whether terrorist offenders actually have that the police and intelligence services estimated to be around 45-55% in them from being prosecuted.8 However, it seems likely that disengaged from extremism remains will continue to allocate considerable 7 most Western countries. However, a reengagement rates are at least a challenge, particularly given the resources to monitoring even those Attempts to measure reengagement direct comparison of the two rates is somewhat higher than recidivism rates, weakness of monitoring and control in released terror offenders not deemed to rates are plagued by many of the same disingenuous; while the reconviction not least for the reason given above. this space. Usman Khan had participated represent an immediate threat.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 55

Given this, the government’s desire, minority will reengage with terrorism. Notes reflected in the new tougher sentencing The threat they pose will depend on the 1. https://ctc.usma.edu/overblown-exploring-the- gap-between-the-fear-of-terrorist-recidivism-and- and release measures, to keep nature of their reengagement, and the the-evidence/ terrorist offenders in prison is entirely response of the police and intelligence 2. https://ctc.usma.edu/overblown-exploring-the- understandable. However, while longer services. While some may eschew gap-between-the-fear-of-terrorist-recidivism-and- sentences (and greater scrutiny of attack planning and engage in facilitating the-evidence/ early releases) may keep potential activities, with a lower probability of 3. https://www.projectproton.eu/wp-content/ recidivists away from the public for a detection, others may follow the example uploads/2019/09/Crime_and_Terror_Examining_ Criminal_Risk_Factors_for_Terrorist_Recidivism. time, most of the UK’s terror offenders of the London Bridge and Streatham pdf are serving sentences of less than 20 High Street attackers. 4. https://www.projectproton.eu/wp-content/ years, with many jailed for under four uploads/2019/09/Crime_and_Terror_Examining_ years.11 Therefore, significant numbers In this scenario, it is likely that these Criminal_Risk_Factors_for_Terrorist_Recidivism. pdf of terror offenders will be released in the individuals would employ the same low- near term despite government action. complexity tactics in order to minimise 5. https://www.projectproton.eu/wp-content/ the chances of their intentions being uploads/2019/09/Crime_and_Terror_Examining_ Moreover, without greater success in Criminal_Risk_Factors_for_Terrorist_Recidivism. rehabilitating convicted terrorists, such detected and their plans thwarted. Such pdf measures are unlikely to be that effective attacks require very little preparation and 6. “Terrorism: Prisoners’ release: written question few resources; indeed, Sudesh Amman – HL782, Answer by Lord Keen of Elie”, U.K. at reducing the threat of terrorism in House of Lords, 11 February 2020. the long term. The risk of recidivism or procured his weapon, a kitchen knife, by stealing it from a homeware store 7. https://ctc.usma.edu/examination-jihadi-recidi- reengagement by those released will vary vism-rates-united-states/ immediately before launching his attack. significantly depending on a range of 8. https://ctc.usma.edu/overblown-exploring-the- factors, including age, sentence length, Such low-sophistication attacks are gap-between-the-fear-of-terrorist-recidivism-and- the-evidence/ virtually impossible to stop, while 9. https://www.bbc.co.uk/news/uk-50618324 resource-intensive close surveillance 10. https://www.gov.uk/government/news/tough- operations will be restricted to only the er-sentencing-and-monitoring-in-govern- highest risk cases. This means outcomes ment-overhaul-of-terrorism-response Attempting to discern similar to that of the Streatham attack 11. https://www.bbc.co.uk/news/uk-50823532 are far from certain. Without rapid police 12. https://www.projectproton.eu/wp-content/ whether terrorist offenders intervention, even rudimentary tactics uploads/2019/09/Crime_and_Terror_Examining_ actually have disengaged can inflict significant loss of life, with Criminal_Risk_Factors_for_Terrorist_Recidivism. pdf from extremism remains resulting man hunts and subsequent a challenge investigations causing widespread disruption. Organisations should therefore affiliation with terrorist groups, family plan and prepare for such eventuality life, engagement in deradicalisation even if, owing to the work of the police, programmes, and the stringency of intelligence, probationary and other 12 monitoring and control measures. government services, they will fortunately remain an infrequent occurrence. However, even the most optimistic Prisoners at HMP (Her Majesty’s Prison) Pentonville walk studies of recidivism suggest that a small through an atrium. (Photo by Ian Waldie/Getty Images)

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 56

E-Jihad:a credible new threat? Al-Qaeda’s new cyber strategy and the outlook for ‘cyber terrorism’

Eden Stewart, Senior Analyst, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 57

In June 2020, al-Qaeda (AQ) released the second issue sophisticated approach to the cyber domain on the part of AQ remains to be of its new English-language magazine One Ummah. The seen. However, the magazine seems to publication’s diverse contents included a lengthy article have been published with the blessing on the United States economy, specifically how it might of the group’s leadership, and therefore probably carries more weight than be harmed in furtherance of the group’s global agenda. the hyperbole periodically issued by Amongst the usual menacing assertions was a call for the technically minded sympathisers. AQ faithful to engage in ‘e-jihad’, to conduct cyber attacks The limited capabilities against a range of US critical national and commercial of terrorists infrastructure.1 Despite this, the evidence for AQ or other Islamist extremist groups possessing Renewed calls for Rather than positing cyber attacks as the capability to mount more than cyber terrorism a simple or cost-effective alternative rudimentary network operations is non- While AQ has called for cyber attacks on to conventional attacks, the article existent. More sophisticated actors, the West for roughly a decade,2 the One acknowledges that successfully carrying such as Hamas and Hezbollah, have Ummah article was notable for several out such operations requires considerable employed malware for intelligence reasons. In contrast to the typically “time, resources and manpower”. gathering alongside more quotidian bombastic tone of AQ publications, Beyond proffering suggestions on how disinformation and propaganda activities. the author gave a relatively mature the group might develop the necessary However, there is nothing to suggest that appreciation of the complexities of capabilities (recruiting software engineers, even those groups are remotely close to network operations, recognising “such training young recruits in IT), it also having any kind of capability to disrupt activities require significant technical advises cooperation, where possible, with the operation of Western critical national capabilities and teams of professional unaligned malicious actors (presumably infrastructure (CNI), let alone deliver hackers, along with the necessary cyber criminals of one variety or another). destructive effects digitally. Indeed, such infrastructure”. Finally, the author appears to be familiar capabilities are believed to remain the with the literature on ‘cyber war’. As preserve of a handful of nation states. well as invoking the prospect of a ‘cyber Disruptive cyber attacks 9/11’, the article recounts statements made by senior Western policymakers on the increase Nonetheless, disruptive* attacks on CNI The evidence for AQ or on the potential vulnerability of critical and industrial targets are increasing in infrastructure, urging followers to exploit other Islamist extremist frequency.3 While these incidents might this. groups possessing the not have the psychological impact of capability to mount more In all, the piece was more sober and conventional attacks, they can cause than rudimentary network pragmatic than earlier Islamist extremist significant financial losses to those operations is non-existent material on the subject. The extent to which this reflects a new, more * Disruptive attacks are those that disrupt physical systems, but do not cause material damage.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 58

directly affected, as well as significant groups. But while such attacks are an extreme scenario, threat to life. The Notes inconvenience to consumers. unlikely to garner significant attention attack was claimed by the ‘Jerusalem 1. https://www.hstoday.us/subject-matter-areas/ outside the InfoSec and national security Electronic Army’ but was widely believed infrastructure-security/pushing-for-a-cyber-9- In February, a US gas compression 11-al-qaeda-recruits-for-e-jihad-to-ruthlessly-ex- community, they do accord with AQ’s to have been orchestrated by Iran.7 ploit-vulnerabilities/ facility was shut down after ransomware recently restated attritional strategy of 2. https://www.criticalthreats.org/wp-content/up- was deployed against the operator’s economic warfare, even when conducted While groups such as AQ are unlikely loads/2016/07/Al_Qaeda_Electronic-1.pdf information and operational technology readily to find nation-state backers, More alarming is for financial gain. 3. https://www.govtech.com/security/Are-Hack- networks. While no programmable the normalisation of offensive cyber ers-Targeting-Critical-Infrastructure-More-Often. the potential for logic controllers (PLCs) (responsible for Perhaps more alarming is the potential operations increases the probability of html directly controlling physical processes) for nation states to use non-state actors such capabilities proliferating. However, 4. https://www.forbes.com/sites/kateofla- nation states to use hertyuk/2020/02/19/us-government-issues- were affected, the entire pipeline had to conduct deniable network operations in the near term, it is more likely that powerful-cyberattack-warning-as-gas-pipeline- non-state actors to to be shut down for 48 hours owing against adversaries. In April, several AQ and its peers will attempt to acquire forced-into-two-day-shut-down/#757dd3e65a95 to transmission dependencies.4 Less Israeli water facilities were targeted in a more modest capabilities that allow 5. https://theenergyst.com/elexon-hit-by-cyber-at- conduct deniable impactful ransomware attacks have coordinated attack. In this case PLCs it to conduct ‘disruptive’ rather than tack/ also been reported in Europe, including were compromised in an attempt to ‘destructive’ cyber attacks. While 6. https://www.securityweek.com/hack- network operations 6 ers-knew-how-target-plcs-israel-water-facility-at- against Elexon, the company responsible alter chlorine levels in the water. The a disquieting prospect, this will not tacks-sources against adversaries for the balancing and settlement of the attack was detected, and no damage materially change the threat landscape, 7. https://www.jns.org/iran-opened-a-pandoras- UK’s power system, in May.5 was caused. However, the incident as a range of threat actors, from cyber box-in-cyber-attack-on-israeli-water-system/ demonstrated the potential to cause criminals to hacktivists, are already at it. There is nothing to suggest that any significant physical disruption and, in of these attacks have links to terrorist

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 59

Global insecurity and the terrorist threat to the UK Examining the relationship between insecurity overseas and the UK’s terrorism threat landscape

Callum Yourston, Analyst, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 60

The frequency of international terrorist events occurring Against the backdrop of the Irish The global security situation in the UK increased significantly after the 9/11 attacks. republican and unionist paramilitary is deteriorating. Increasing aia evoltio Po terrorism, these incidents were litic political polarisation, climate al 19 19 eve somewhat incongruous. They were 20 nt change, and unprecedented 20 1 79 0 19 s primarily related to international eatio itod aet de o ilie ee Ri 1 disputes between third-party countries, challenges to the post-war 12 U 19 20 Rall lot K T err 2 and their occurrence on British soil ori international order are all 11 st ev 19 was largely tangential. Nonetheless, en contributing factors. On top 20 ts at idlad aiot lot they demonstrated the potential for 10odo tok hae lot of this, the world is now laeda oea lot 19 international insecurity to impact directly facing the worst public health 20 4 on the domestic security of the UK. 09ahete iadill iide lot

crisis in over a century, the aia a eie 19 A new era geopolitical and economic 20 0 ete oi The signalled a ramifications of which will be new era of terrorism both in the UK and ad ahete 19 oi felt for years to come. While o ia worldwide – the rise of globalist Islamist 20 odo a o lot 07 de o voe lethe lao aiot attak iot oi eatho extremism with a focus on waging better placed than some, the iiha eheadi lot ‘jihad’ in the West, with al-Qaeda (AQ) 19 UK will not be insulated from 7 being the primary threat actor. AQ 20 0 aatlati aiat lot these changes. However, Timeline of had been active since the late 1980s,

their impact on domestic international terrorist although it was primarily concerned with attacks and plots in 19

security is unclear, as is the attak okeie oi combatting the presence of Western 0 extent to which international 20 l lot the UK 1979-2013 countries in Muslim-majority countries,

developments materially affect

04 20 19 the threat of terrorism in 9 Great Britain. 20 0 ood ee ii lot The threat landscape of terrorism in the 19 aeli a oi 90 l a UK has shifted dramatically over the l a 20 The September 11 last 60 years. From the 1960s until the 02 19 late 1990s, the threat overwhelmingly 91 attacks signalled a stemmed from domestic actors 20 – the Irish Republican Army (IRA) 01 19 new era of terrorism laeda iiha o lot 92 and associated groups. However, 20 both in the UK international terrorism did affect the 00 19 UK sporadically – the 1980 Iranian attak 19 9 and worldwide etee 19 Embassy siege and the 1988 Lockerbie ade oe 99 19 19 94 although some precursor groups that bombing being perhaps the most 9 19 19 9 joined with AQ, such as Egyptian Islamic salient examples. Source: Pool Re internal database 97 9 Jihad, were focused more on the ‘near

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 61

enemy’ and ‘apostate’ regimes in the places, culminating in the 7/7 bombings as well as anti-Shia. This sentiment propaganda capabilities were severely Middle East and North Africa. British- in London in 2005. This led to the was amplified by Western bombing diminished following the fall of Raqqa born travelled overseas to formation of the Joint Terrorism Analysis campaigns against the group from as well as a lack of manpower participate in jihad in regions such as Centre (JTAC) and the implementation the early , but ultimately Daesh following sustained kinetic operations Kashmir and Bosnia, gaining combat of a terrorism threat level that continued the AQ strategy of targeting by the global coalition arrayed against experience and, in some cases, terrorist delineated the threat from terrorism into the ‘far’ enemy – namely attacks against the group. tradecraft. However, throughout the ‘international’ (a euphemism for Islamist civilians in the West. 1990s, despite the growing number of extremism) and ‘domestic’ (a catch-all However, the group could resurge, ‘mujahids’ residing in Britain, there was term for non-Islamist terrorism). International and domestic particularly against the backdrop of no evidence of intent on their part to terrorism blur coronavirus. Since March 2020, Daesh mount attacks in Britain. Some of the offenders involved in Further complex, coordinated plots and its affiliates have claimed attacks these early plots and attacks had like 7/7 have largely been prevented at an increased tempo in both Iraq This was largely the result of the UK been involved in the conflicts in Bosnia owing to the vast resources dedicated and Syria. This is possibly due to an government offering asylum to a range and Central Asia. As a result of British by the UK and its allies to identifying overburdening of local security forces of political exiles, including Islamists, foreign policy towards the Middle East, and disrupting transnational terrorist as both countries attempt to curb the with a mutual understanding that exile the country went from a neutral party networks. However, Daesh could still groups would not sanction attacks in to a hostile one almost overnight, exploit vulnerable members of British the UK. The head of al-Muhajiroun, leading to an increase in terrorism. Muslim diasporas in the UK to conduct , called This shows that a state’s response so-called ‘inspired’ attacks through this a “covenant of security”. Thus, to insecurity overseas can materially spreading its ideology online, though of British authorities made no attempt to affect the terrorism threat landscape course ideology plays just one part in Further complex, prevent individuals from travelling to domestically. the radicalisation process alongside a coordinated plots like wage Jihad overseas or to prosecute number of other structural and personal 7/7 have largely been returning fighters, and in return Islamist That is not to say that interventions by the British government always contributors. Additionally, Daesh has prevented owing to the vast groups treated the UK effectively as played a more prominent part in the resources dedicated by ‘neutral territory’, although UK-based have this effect. British interventions in Sierra Leone, the former Yugoslavia actual coordination of many of these the UK and its allies individuals or groups did play a hand in ‘inspired’, low-complexity attacks by the organisation of attacks elsewhere in and elsewhere did not elicit the same spread of the virus. Additionally, foreign response. The key dynamic here actually directing UK-based ideologues. Europe, such as the Groupe islamique The Security Service acknowledged militaries present in both countries were armé (GIA), which mounted several appears to be the interplay between either pulled from service or stood down foreign policy decisions, significant this dynamic when, in July 2019, attacks in France. it updated the threat level system at the beginning of the local lockdowns diasporas within the UK with overseas earlier this year. A resurgence of Daesh links, and an international ideology to reflect that terrorism with an Afghanistan, Iraq ‘international’ ideology may be in the Middle East is of particular However, the invasions and subsequent capable of exploiting tensions over perpetrated by wholly domestic actors. concern to the UK and Europe as a wars in Iraq and Afghanistan ended this government policy to radicalise and whole given the proximity of the region covenant. Following Britain’s significant mobilise sympathetic individuals. Following the loss of its claimed to Europe and the group’s record of involvement in these conflicts, Islamist This internationalist ideology has territories in Iraq and Syria in 2017 and successfully directing and inciting Police FIT forward intelligent team officer videoing plots and attacks began to increase persevered into the present day with the 2019, Daesh has largely been unable attacks in Western Europe. This threat is student protest against education cuts, Aberystwyth on British soil, primarily focused on to inspire or direct attacks in Western Wales UK. (Photo by: Photofusion/keith morris/ rise of Daesh. The group, born of AQ compounded by the possibly thousands Universal Images Group via Getty Images) aviation targets, but also other crowded in Iraq, was congenitally anti-Western Europe. This is in part because its of foreign terrorist fighters of European

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 62

origins currently interred in refugee . While this dynamic necessarily mean that the severity camps or jails across the region who could manifest in relation to other of attacks will materially increase. It may return to their countries of origin or extremist ideologies, there are no remains challenging for terrorist actors attempt to reestablish a in other candidates with such to acquire sophisticated weapons the Levant. established narratives or widespread in Great Britain, particularly military- agitative networks. grade firearms and explosives. Most Islamist insurgencies in places such attacks will therefore probably employ as sub-Saharan Africa or Southeast low-complexity methodologies such Asia, while a threat to international as bladed weapons and vehicular security and British interests overseas, impact attacks. A resurgence of state- are less likely to affect the domestic sponsored terrorism by rogue states, threat landscape for a variety of as witnessed in Britain in the 1980s, reasons. The physical distance of these would have the potential drastically to regions from Europe is a major one, Most attacks alter this situation. However, while such but less tangible factors also play a will therefore a scenario cannot be discounted, it part. Islamist groups operating in these fortunately remains unlikely in the near regions may be formally aligned with probably employ term. Ultimately, there are no certain AQ and Daesh and pay lip service to rules governing the relationship between the principle of international Jihad but low-complexity security developments overseas and the are essentially parochial and locally or methodologies such domestic terror threat. The UK’s benign regionally focused, lacking the intent geographical position means it is, to or capability to mount out-of-area as bladed weapons some degree, isolated from the effects operations in most cases. Some locally of deteriorating security environments engaged groups, such as al-Qaeda in and vehicular further afield. However, the UK is also the Arabian Peninsula (AQAP), showed impact attacks highly globalised and continues to play some determination in engaging an active role in international security, internationally, including claiming Given this, it seems likely that Islamist meaning it will remain an attractive responsibility for the 2009 ‘Underwear terrorists will remain the key threat and accessible (if hardened) target for Bomber’ plot and publishing English- group that will capitalise on the international terrorist groups. language propaganda. Furthermore, growing insecurity overseas to expand the conflicts in these regions lack their capabilities in the UK and wider the emotional resonance of those in Western world. That being said, as their the Middle East, at least to Western presence overseas peaks and troughs, audiences, and are therefore less likely so too will their ability to direct attacks to galvanise violence by those in Britain and inspire plots in the UK. sympathetic to Islamist ideologies. Forecast This interplay between diaspora, Police and emergency vehicles gather near London Bridge in London, on 29 Although attacks in the UK may November 2019 after reports of shots being fired on London Bridge. A man wearing a ideology and foreign policy response increase in frequency as a result of suspected hoax explosive device was shot dead by armed officers on London Bridge on Friday after a stabbing spree, in what police said was a terrorist incident. (Photo by is almost exclusively related to global insecurity overseas, this does not DANIEL SORABJI / AFP) (Photo by DANIEL SORABJI/AFP via Getty Images)

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 63

Conspiracy theories The growing role of online conspiracy and terrorism theories as a driver of political violence

Callum Yourston, Analyst, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 64

The Great Replacement theory four attackers worldwide since 2019 have Conspiracy theories cited the Great Replacement Theory in Within traditional ideological drivers of 4 originating from obscure terrorism, there is often a conspiratorial their manifestoes. online forums are element. For instance, many Such conspiracy theories are an effective contemporary far right ideologies recruitment tool when compared to becoming increasingly Conspiracy theories are incorporate the so-called ‘Great more traditional far right ideologies (such an effective recruitment Replacement Theory’, which is part as neo-Nazism, , or commonplace in of the broader ‘white genocide’ Christian fundamentalism), as a wider mainstream political tool when compared to conspiracy. Such theories purport that cross-section of society is able better to white Europeans are being replaced, identify and understand such narratives. narratives. In some more traditional far right coordinated by a liberal, globalist elite. instances, these ideologies Most narratives usually point to France Online conspiracy theories as an example of this, but the UK and By contrast, some of the more recent conspiracy theories other European and Western countries conspiracy theories that have emerged have been targeted by proponents of the on online forums have dispensed entirely have led to violence Great Replacement Theory, including in with pseudo-intellectual properties. Whilst offline. This raises a Germany, New Zealand, the US these theories have zero basis when and Norway. compared to more ‘traditional’ theories number of questions used in terrorist ideologies, they also Conspiracy theories propagated by play on the anxieties of the population for both security traditional terrorist actors often have a by offering ‘explanations’ for real-world kernel of truth and are often rooted in practitioners and the events and are able to draw adherents pseudo-academic literature, such as because of this. insurance industry. It is the aforementioned Great Replacement not immediately clear Theory.1 For example, while ethnic And, despite the unbelievable, outlandish demographics have shifted in certain elements of these newer theories, whether acts of violence European countries, through migration some adherents of the theories have and falling birth rates, there is not a cabal mounted attacks in response to them. related to conspiracy 2, 3 of globalist elites orchestrating this. Most recently in the UK since April 2020, unidentified assailants have partially theories would be Nevertheless, there has been a sizeable damaged or completely destroyed over change in demographics over the past investigated as an 70 telecommunications towers across fifty years in the UK and other Western the United Kingdom. Police linked act of terrorism, nor European countries. By linking this these attacks to an online conspiracy to a faceless, left-wing elite, far right whether they would be theory propagated online that links the extremist groups are able to play on the spread of the COVID-19 virus to 5G covered under the anxieties of certain groups within society signals.5 At least 40 telecommunications and use conspiracy theories like the Pool Re scheme. engineers have also been threatened or A conspiracy theory slogan about 5G telecommunications Great Replacement within recruitment networks, written on an equipment box in . even attacked, with one hospitalised (Photo Getty Images). propaganda, with some success. At least

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 65

in a stabbing incident.6 It is worth Similarly, conspiracy-theory-inspired Notes considering that attacks against attackers do not seem to have a 1. https://www.isdglobal.org/wp-content/up- loads/2019/07/The-Great-Replacement-The-Vi- telecommunications systems might preference towards one particular olent-Consequences-of-Mainstreamed-Extrem- constitute a terrorist attack under methodology, with bladed weapons, ism-by-ISD.pdf Section 1 (2)(e) of the 2000 Terrorism firearms, incendiary devices, explosives 2. https://www.newstatesman.com/ Act, which makes serious disruption or and arson attacks being used by such world/2019/08/deadly-myth-great-replacement interference with an electronic system offenders worldwide.9 3. https://www.brookings.edu/testimonies/un- a terrorist act if done to intimidate the rest-in-france-november-2005-immigration-is- lam-and-the-challenge-of-integration/ public and in order to influence the There is no discernible trend in whether government. Arguably, these actions such attackers have a preference 4. https://www.splcenter.org/hate- for targeting people over property. watch/2019/03/15/new-zealand-terrorist-mani- are very close to that definition and have festo-influenced-far right-online-ecosystem-hate- possibly crossed the line. Targeting against individuals, business watch-finds interests, or critical national infrastructure 5. https://www.cnet.com/health/5g-coronavi. More violently, in 2016, a gunman seems to be dependent on the theory rus-conspiracy-theory-sees-77-mobile-towers- opened fire in a pizza restaurant in propagated.10 Mass casualty attacks are burned-report-says/ Washington DC, ascribing his motives a possibility, but it is assessed that such 6. https://www.mylondon.news/news/west-london- news/kilburn-stabbing-victim-openreach-engi- to the debunked ‘Pizzagate’ conspiracy offenders would be more likely to target neer-18065323 theory. This theory falsely claimed that individuals or specific business interests. 7. https://www.washingtonpost.com/news/local/ the restaurant was harbouring a child wp/2016/12/04/d-c-police-respond-to-report- sex abuse ring led by Hillary Clinton.7 of-a-man-with-a-gun-at-comet-ping-pong-res- taurant/ An Illinois woman was arrested in April 8. https://www.insider.com/biden-qanon-sup- 2020, after travelling to New York City porter-arrested-attemp-live-streaming-trip-to- with dozens of hunting knives and take-2020-5 threatening to kill Joe Biden on live Conspiracy-theory- 9. Pool Re’s internal database. stream, owing to Biden’s supposed inspired attackers do 10. Pool Re’s internal database. involvement in the aforementioned not seem to have a trafficking ring.8 preference towards one While these conspiracies advocated attacking a broad range of targets, this is particular methodology arguably no different from conventional Given the relatively recent emergence terrorist attackers who seek to mount of violence related to these theories, it an indiscriminate, mass casualty event. remains to be seen how the industry What makes this unique is that, with will respond. Under current terrorism each new theory, a potential new target insurance policies, it is unlikely that such may emerge, increasing the threat of claims would be covered under the attack to that particular target category. Pool Re scheme. However, it is possible But the threat of attack may increase that claims would be paid under more or decrease depending on the online conventional property and criminal popularity and spread of the theory. damage policies.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 66

Risk Building Awareness resilience Risk against Modelling Risk terrorism Management risk

SOLUTIONS: Providing first-class terrorism risk analysis and data. Our new in-house speciality division works alongside Members and policyholders on risk evaluation and mitigation, providing a series of tools and training for a wide range of industry professionals.

For more information contact us at: [email protected]

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 67

Risk Evaluation

The UK Protect Duty (Martyn’s Law) NDBI in Europe: observations and implications for the UK Business interruption A closer look at the consultation on new protective security legislation Pool Re’s Chief Actuary reflects on recent non-damage terrorist Lessons from COVID-19 and beyond and how it might support the insurance industry events in Europe and what these mean for the UK Can you really manage terrorism risk? Pool Re Head of Risk Management, Chris Medhurst-Cocksworth, talks to Steve Coates, discussing the challenge terrorism risk poses to businesses, and what they can do about it

Author Author Author Nick Aldworth Steve Burr, BSc(Hons) FIA MCSI Steve Coates Director Chief Actuary Chief Underwriting Officer Risk to Resolution Limited Pool Re Pool Re Until mid-2019, Nick was the UK’s CT National Co-ordinator for Protective As Chief Actuary, Steve heads Pool Re’s actuarial team, which focuses Steve is Chief Underwriting Officer and a member of the Executive Security and Preparedness. Across a 36-year career in policing, and prior on understanding members’ terrorism exposure and model development. Management Team at Pool Re. Steve has responsibility for all aspects of to this the UK military, Nick has held multiple roles in counter-terrorism. He Steve played a key role in the pricing and risk analysis of Baltic Re – the ILS underwriting and claims, including exposure management and modelling. was the Protect and Prepare lead for London throughout the 2017 attacks issued in 2019 by Pool Re – the world’s first pure terror cat bond. Steve Prior to this, Steve spent 12 years at Allianz UK, latterly as Head of UK and led his teams in the rapid development of new risk mitigation tactics. is a Fellow of the Institute and Faculty of Actuaries and has worked in the Property and Casualty. He also spent a year with Allianz Australia in 2005-6. London market since 1994 in a variety of roles. Prior to joining Pool Re, Before that he worked for Independent Insurance for 10 years, ending up as Since retiring, Nick has worked closely with victims of terrorism to Steve worked for Renaissance Re Syndicate 1458 for six years supporting UK property underwriting manager. Steve started his career with Eagle Star campaign for a new law that will require publicly accessible locations to the pricing of Insurance and Reinsurance products. Before Renaissance where he worked in a variety of commercial underwriting roles. Steve is an undertake simple, low-cost, protective security measures. Re, Steve held a number of positions within various teams at Willis Re over associate of the Chartered Insurance Institute and is also an expert witness in a period of nearly eight years (Capital Markets, Reinsurance Optimisation insurance matters. within the Analytics team, and other Structured solutions). Steve came to London following a move from a direct insurer to take up a position in Swiss Re UK’s non-life team. Steve remained with Swiss Re for more than seven years predominantly as a Reserving and Reporting Analyst (and later as a qualified Actuary) as well as structuring Alternative Risk Transfer Solutions. Steve holds a degree in Actuarial Mathematics and Statistics from Heriot- Watt University and is a Member of the Chartered Institute for Securities and Investment.

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 68

A closer look at the consultation on new The UK Protect Duty protective security legislation and how it (Martyn’s Law) might support the insurance industry.

Nick Aldworth, Director, Risk to Resolution Limited

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 69

On 24 February 2020, the UK Home Office announced an intention to launch a public The number of consultation on the need potential targets for a protective security is in the hundreds law that would require of thousands operators of public spaces attacks in Streatham High Street and and places to protect their Forbury Gardens in Reading highlight customers and users. the extent of vulnerable locations across the UK. The genesis of that announcement There is a, conservative, estimate of can be tracked back to 2014, when 650,000 readily identifiable locations the Islamic terrorist movement known in the UK that might be considered as Daesh encouraged its followers ‘crowded’. to attack targets in the West using anything as a weapon. This led to Following inquests into the deaths a wave of attacks across Europe on Westminster and London Bridges culminating in four Islamist and one as well as Borough Market, coroners right-wing attack in the UK in 2017 and directed that responsibility for protecting the deaths of 36 people. vulnerable locations should be better apportioned and the ‘crowded places’ ‘Unrestricted terrorism’ model reconsidered. Ultimately, this and crowded places led to the government considering the Historically, the state has absorbed the ‘Protect Duty’. duty to provide proactive support to the 8,000 or so locations in the UK that Martyn’s Law - proposals were deemed to be most vulnerable, Known colloquially as Martyn’s Law through the Office for Security and after Martyn Hett, who was murdered Counter Terrorism’s (OSCT’s) ‘Crowded at Manchester Arena, this legal duty Places’ model. However, the Daesh would mirror other existing regulations ideology of ‘anybody being a terrorist, such as the Health and Safety at using anything as a weapon, against Work Act (HASAW) and Fire Safety any target’ meant that the number regulations. While it is still at the proposal

of potential targets in the UK is in the Security at the Olympic torch relay in Trafalgar stage, campaigners have been calling for hundreds of thousands. The terrorist Square (Photo by Getty Images) Martyn’s Law to have five requirements:

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 70

• Employees to engage with counter- The law has the potential to help the terrorism training and awareness insurance industry focus its insureds products on better risk mitigation standards. • Owners and operators to undertake Importantly, the law is likely to generate vulnerability assessments As well as saving three important outcomes, all of which • Owners and operators to mitigate are likely to yield loss mitigation benefits: vulnerabilities as far as is reasonably lives, Martyn’s • Reducing risk to people practicable Law could result in • Reducing risk to property • Premises to have a CT security plan better commercial • Reducing risk to business interruption. • Local government authorities to have a resilience How CT insurers might respond to new CT response and recovery plan legislation is yet to be seen, but there caught up in an attack, or within the are obvious implications for setting The government has not yet committed immediacy of one, can suffer significant premiums and incentivising customers to how much of the proposal it will financial loss owing to loss of facility better to protect themselves and reduce enact, but each element is intended or loss of custom. Marauding terrorist the potential for loss. to ensure that individual places and attacks, such as that in Borough Market spaces will have a greater awareness and earlier in Paris, mean that police In a post-COVID-19 world, the of their vulnerabilities and therefore response and investigative cordons government is keen that none of its how to keep people safe. The proposal can be extensive and highly restrictive policies place unnecessary burdens was developed from feedback given for businesses caught within them. on business. It has been clear from its by victims and survivors of terrorist Problems arose at Borough Market earliest discussions with campaigners attacks, who universally, stated that from businesses not being able to that the law should be no or low cost their experience would have been less access stock in storage or working in its ability to be implemented. There is traumatic if the places they had been at space. Larger companies that had fall- no reason why this can’t be achieved. had had a plan and knew what to do in back sites or IT back-up fared much There is already a plethora of advice the event of an attack. In some cases, better, with one national newspaper still available on the National Counter simple protective measures might have being published despite losing access Terrorism Security Office (NaCTSO) prevented or diverted the attack. to its main editorial office. It was, in website (www.gov.uk/government/ Implications for business part, owing to the learning from this organisations/national-counter- attack that Pool Re Members were ), as well As well as saving lives, Martyn’s Law terrorism-security-office subsequently allowed to create Non- as more technical information from could result in better commercial Damage Business Interruption products the Centre for Protection of National resilience. for their customers. Infrastructure (CPNI) website (www. Many larger businesses have a strong . While Martyn’s Law is not likely to cpni.gov.uk) focus on business continuity planning, require business continuity planning, At its most basic, the government but few SMEs have the skills or time the strengthening of CT knowledge and continues to promote Run–Hide– to consider the threat of terrorism. planning is likely to have that residual Tell (RHT) as the response to being However, attacks in the UK, and Football supporters outside , London (Photo by Getty Images) effect. caught up in a terrorist attack. What elsewhere, have shown that companies

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 71

Martyn’s Law will do is help businesses recently revised advice for preparing for responsibility. The insurance industry recently confirmed his commitment to implement this advice for their staff and a marauding terrorist attack. Much of can play an important role in supporting the government’s manifesto promise customers, with their potential response the information from NaCTSO is to be its customers by guiding them towards of strengthening the UK against being Guide–Shelter–Communicate if it drawn into a new Information Sharing credible information sources, including terrorism. Legislation typically takes 12 is not possible to RHT. But any response Platform (ISP), funded by Pool Re, and Pool Re’s own reports. to 18 months to develop and progress needs to be thought through, and this is aimed at creating a one-stop shop for The law has the through parliamentary processes, so It is currently undecided how the law why Martyn’s Law is so important. It will CT protective security information. potential to help the there is time for UK businesses to would be enforced, but, like the HASAW, require people to have a plan, and most get ready for that. However, recent While the law is unlikely to create it is likely that default will be identified insurance industry focus people who have been involved in crisis events have shown that terrorist threats statutory roles, such as it does within at the point of failure, or through public management will tell you that having a its insureds on better continue to be nascent, and responsible the HASAW, many business are likely reporting. There may be an inspection plan significantly reduces the stress on businesses will already be doing the to want to appoint someone to hold the role, and there is potential for the risk mitigation standards individuals caught up in an incident and best they can to protect their customers responsibility for overseeing regulatory insurance industry to shape this through reduces your overall exposure to risk. While the consultation for Martyn’s Law and staff. compliance. For those who already the consultation process. It is possible has been delayed owing to COVID-19, In the last two years, NaCTSO has employ security practitioners, this is Martyn’s Law may be connected to it is still expected to be undertaken in also made a CT e-learning package unlikely to present a problem, but others other regulatory structures such as local 2020. The security minister, the Right available to the general public and more may be daunted by such a perceived licensing committees. Honourable James Brokenshire MP,

Free Sources of Training and Information (click for more) Preparing to respond to an attack will require time and may require investment but could Run–Hide–Tell make the difference between life and death. continues to be the • Appoint and empower an individual to direct your • Know what RUN–HIDE–TELL means in the government’s core preparations with accountability at the highest context of your organisation advice for those level of your organisation • Provide signage and accessible hiding places • Plan across internal business areas and ideally and optimise technical capabilities caught up in a with emergency services terrorist incident • Test, refine and rehearse your response • Work with landlords and neighbours to • Make provisions for recovery coordinate your response; share preparation effort and receive warning of an attack before it • Using announcements makes a difference. reaches you Decide how to use them to alert personnel and public • Develop response plans that define clear roles and responsibilities • Train staff and personnel to perform key tasks under pressure Click an image for more information

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 72

NDBI in Europe: observations and implications for the UK

Pool Re’s Chief Actuary reflects on recent non-damage terrorist events in Europe and what these mean for the UK

Steve Burr BSc(Hons) FIA MCSI, Chief Actuary, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 73

in prediction…with one caveat – are perhaps some proxy for “daytime From March 2019, such additional data still relevant to the population” could be used to help following a change to situation we are trying to draw inference define this attractiveness? to? And if not, why not? the Act of Parliament If we refine our thinking, we may be which mandated The answers to such questions can able more easily to produce a ‘relativity often be hinted at through dialogue with of attack index’ to apply to different Pool Re’s creation, counter-terrorism specialists and Pool areas. Such analysis may also have Pool Re was able to Re’s Risk Awareness team for example, implications for policing and in particular as well as those academics who have in- identification of sites such as critical provide cover to Class depth knowledge of the drivers of certain national infrastructure. B Members that offer extremist groups. Imagine if such data existed … by Non-Damage Business Low-level terror attacks location, for every hour of every day. Interruption (NDBI) cover NDBI events are generally those that What would be the best grouping of to their insureds. target the general population. These such data to determine the relativities? attacks frequently utilise knives and The entire 24-hour period? Intuitively Pool Re’s NDBI model is available to all vehicles; they typically don’t cause perhaps times when people are ‘on the Members to help price NDBI risk, or to property damage but can lead to street’ - commuting [7-9am; 5-7pm], seek an alternative view from their own. business interruption losses. socialising (think Borough Market) [7- We are happy to provide Member output 11pm], or unrelated (think Fishmongers’ and sensitivity analysis following individual Such attacks are rare; their primary Hall) [11am-12pm]? Member discussion. objective is to harm or fatally wound people; and to instill fear and create Furthermore, does this change over The model contains a number of disruption. time – seasons (e.g. Christmas assumptions, informed by counter- shopping; summer tourists)? Could we terrorism specialists and data analysis. But just how rare are such attacks? even see differences within the days of Unfortunately, we would not be the week? These assumptions include potential particularly surprised to see at least a targets and the relativity of one target to couple of such attacks each year on The development of such questioning another. The first version of the model average within the UK, based on paved the way to some early analysis of assumed all 1,200+ targets were equally recent experience. the Global Terrorism Database (GTD). A likely; this, however, is unlikely to be the number of observations can be made; case. Consequently, the question we Data sets whilst these are unlikely to feed directly have recently posed is whether data exist Pool Re are currently looking at a into the model, they may help answer which can help identify such relativities in number of data sets which could the question of suitability and indirectly the “attractiveness” of different targets? be used as a proxy to help steer the steer the quest for “daytime population” analysis of relative attractiveness of data. Actuaries and statisticians look to draw targets. This work will inform the next Using enriched data from the Global comparisons from enlarged data sets, version of the NDBI model. If such Terrorism Database for 01/01/2014 to reduce the element of uncertainty attacks are directed towards people,

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 74

to 31/12/2019 [data provided as at Note there is huge subjectivity in NDBI attacks in W. Europe 2014-2019 – distribution by month set (Europe excluding France) with the Q2 2020], there have been at least 92 whether an event would have led to desire to be more focused, accepting a 15% attacks within Europe which would have it being regarded as a NDBI event, smaller data set will exhibit more volatile been classed as NDBI attacks in the UK were it to take place in the UK. Only 12% results. – that is, a cordon would have been put where there is a closure of business, for 11% 9% 9% 9% In fact France had a comparatively large in place and businesses prevented from instance, through being caught within a 8% trading. cordon, could there be a BI loss. 7% 7% 7% 7% number of attacks in January, March, June and August. Even after removing The summary by country shows that Additionally the purpose of the data 2% France from the data, August (with 40% of these low-level terror attacks analysis should be considered. If the Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec October close behind) has definitely have actually taken place in France, concern is for personal safety, then seen the most attacks. nearly three times the number that have perhaps ‘targeted’ attacks (e.g. against NDBI attacks in W. Europe 2014-2019 – distribution by month (excluding France) taken place in the UK. military or police) should be ignored, It is interesting that attacks within the unless civilian intervention took place. 16% UK in August, in contrast to attacks Events by country 2014-2019 15% in all other European countries, are France 37 40% What else do the statistics 11% 9% 9% United Kingdom 12 13% tell us? 7% 7% 7% 7% 7& Germany 12 13% Risky months 4% 0% Belgium 5 5% Basic analysis indicates that the highest Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Italy 5 5% number of attacks are in August – perhaps there are more people on NDBI attacks in Great Britain 2014-2019 – distribution by month 4 4% the streets enjoying warm weather? there is huge 25% Netherlands 3 3% Perhaps July and September are low by 25% subjectivity in whether Sweden 3 3% comparison, as attacks are specifically Greece 3 3% planned for August rather than months 17% 17% an event would have Denmark 2 2% either side? led to it being regarded Norway 2 2% It must be asked - is any particular 8% 8% as a NDBI event country skewing these results? Is the Finland 2 2% 0% 0% 0% 0% 0% 0% comparatively lower than other months country with the largest number of Jan Feb Apr May Jun Jul Sep Nov Dec 1 1% Mar Aug Oct (caution – this is based on only 12 data attacks different from the UK and/or the Ireland 1 1% points). rest of Europe, and if so why? NDBI attacks in France 2014-2019 – distribution by month Total 92 France by comparison shows a Perhaps it would be more useful to 14% 14% 14% worrying trend of at least one attack per exclude France in attempting to draw 11% month. Is this due to reporting of even conclusions for the UK? We trade the minor incidents? increased credibility of a greater data 8% 8%

5% 5% 5% 5% 5% 5% Data source: ‘Pool Re analysis of Global Terrorism Database, START, University of Maryland Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 75

Day of the week analysis Does ideology of perpetrator Of these 51 attacks, we can test NDBI attacks in W. Europe 2014-2019 – distribution by threat actor type Whilst we can say that June, August matter? the hypotheses that we may expect and October appear to have more If most events (whole of Europe) more or expect fewer attacks during Anarchists 1 attacks than other months (considering occur on Friday, does this change by Ramadan. Anti-Muslim extremists 3 all of Europe), do we see any discernible perpetrator? Interestingly, of those Perhaps more attacks could be difference by day of the week? attacks inspired by or attributed to expected, owing to heightened Anti-immigrant extremists 6 Given sufficient data, we could look at Daesh, al Qaeda or other Islamist religiosity and fervour; or fewer because Anti-Semitic extremists 6 whether this changes by month, but extremists, the “most popular” choice of observation of the religious holiday. for now we will consider all months of day for attack is Friday. Greek Nationalists 1 aggregated together. Is this indicative of the terrorists’ Daesh 6 extremist nature – perhaps not attending the Islamic day of worship Islamist extremists 45 but carrying out an attack on that day Of the 92 attacks which instead; or attacking because of it? could be classified as Neo-Nazi extremists 3 NDBI, 51 were carried out Organisation for 1 Of those attacks There is, by contrast, no discernible by Islamist extremists revolutionary self-defense trend of non-Islamist extremist, other Violent Dissident 1 inspired by or than perhaps Saturday being more Interestingly, only three of these 51 Republicans attacks took place within the Ramadan attributed to Daesh, popular – perhaps when more people Unknown 18 are on the streets. periods – this is not far from the White supremacists/ al Qaeda, or other approximate proportion that would nationalists 1 Islamist extremists, Of the 92 attacks which could be be expected (i.e. 1/12th of the total) classified as NDBI, 51 were carried out and proves inconclusive either way, the “most popular” by Islamist extremists, including those suggesting that there is no significant 0 5 10 15 20 25 30 35 40 45 choice of day for influenced by Daesh and al Qaeda. difference within this religious period. attack is Friday Friday and Saturday would appear to NDBI attacks in W. Europe 2014-2019 – NDBI attacks in Great Britain 2014- NDBI attacks in W. Europe by NDBI attacks in W. Europe by have the most events. Is Wednesday distribution by day 2019 – distribution by day Daesh and other Islamist extremists non-Islamist extremist terrorists 2014-19 – distribution by day 2014-19 – distribution by day low because if you get to mid-week you 9.78 % may as well wait until the end of the week 17.39 to carry out an attack? France actually % 25.00 25.00 drives this trend and mirrors this chart, 21.74 % % 6.52 6.52 6.52 6.52 % % % % albeit with Friday being slightly higher. % 19.57 % 16.67 16.67 9.78 15.22 % % 8.70 % 4.35 4.35 The picture is slightly different for the UK 13.05 % 7.61 % % % 11.96 % 6.52 on its own, though Saturday remains in 8.70 % % 9.78 % % 8.33 8.33 top spot (it shares its place with Monday). % % % 2.17 3.26 0% % % Note caution reflecting data paucity. Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat

Data source: ‘Pool Re analysis of Global Terrorism Database, START, University of Maryland

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 76

Daytime population Targeted attacks NDBI attacks in W. Europe 2014-2019 – distribution by time banding If we are to create an updated index to Excluding attacks targeted towards 11% estimate target relativities according to government, military, police, religious 10% 10% daytime population, what periods would figures/institutions, and educational 9% make the best indicators? The chart establishments, then we are left with an opposite shows peaks at 10-11am, event set which is most likely to have 7% 12-1pm, 4-5pm and 8-9pm (local times involved the general public. We are 6% 6% 6% assumed). Does this make sense? Is left with less than half the original – 44 the picture too granular to be helpful events. This suggests more than half of 4% 4% 4% 4% considering the size of the data set? attacks are specifically targeted towards 3% these groups. The graph, opposite, of casualties looks 2% 2% 2% 2% 2% quite different and indicates that the most 1% 1% 0% 0% 0% 1% Final remarks 00-01 01-02 02-03 03-04 04-05 05-06 06-07 07-08 08-09 09-10 10-11 11-12 12-13 13-14 14-15 15-16 16-17 17-18 18-19 19-20 20-21 21-22 22-23 23-24 impactful attacks would happen around Work is ongoing in this area, and the 5-6pm or 9-11pm – most probably when analysis above should be treated as there are larger numbers of people on the cursory yet potentially interesting. streets either commuting or leaving bars All observations here should be and restaurants. treated with some caution – they are based on a very small data set. Casualties caused by NDBI attacks in W. Europe 2014-2019 – distribution by time banding Pool Re SOLUTIONS is available 150 to discuss the NDBI model, its construction, and assumptions. 125 118 The picture of deaths Final caveats GTD data are subject to revisions, and injuries indicates additions and questions – this may even that the most affect historic data. 63 impactful attacks Whether an event would have 40 43 constituted a NDBI event in the UK is 37 36 would happen around subject to much subjectivity; indeed this 28 6 4 16 19 18 5-6pm or 9-11pm rationale may change over time. 1 12 0 2 0 1 4 0 3 2 It may be possible in the future to look 00-01 01-02 02-03 03-04 04-05 05-06 06-07 07-08 08-09 09-10 10-11 11-12 12-13 13-14 14-15 15-16 16-17 17-18 18-19 19-20 20-21 21-22 22-23 23-24 at numbers killed and injured separately – whether those include the terrorist, the specific target, or innocent bystanders. Data source: ‘Pool Re analysis of Global Terrorism Database, START, University of Maryland

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 77

Business Interruption Lessons from COVID-19 and beyond

Steve Coates, Chief Underwriting Officer, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 78

It would be fair to say COVID concerning pandemic and insurance would probably have been that the past six months in the context of mortality and life has seen business insurance. Whilst nearly 1m have died so far from COVID-19, this is nothing interruption (BI) policies like the 50m who died from Spanish Flu mentioned in the press in 1918-19. There are many reasons more than the preceding for the difference, but one is clearly the response of governments globally who decade. Although the FCA elected to shut down large parts of their litigation dominated the economy in order to suppress the virus. headlines with regard to BI, much of the discussion around the continued fitness and relevance of BI has focused on the extent to which a One of the key issues solution developed for the has been the lack of industrial revolution can anticipation that a serve the needs of a digital pandemic would have globally interconnected such a catastrophic economy 250 years later. effect on both business and society The ways in which a modern business might be ‘interrupted’, as well as This public-safety-led approach clearly the causes of such interruption, are limits virus infections, but businesses completely different in 2020, as indeed that are not directly affected by the virus is the socio-economic landscape any are collateral damage when they are business must exist within. Although forced to close or curtail their activities. the COVID-19 pandemic event has Moreover, there are many other highlighted a number of factors that businesses that are indirectly affected illustrate this, one of the key issues by the pandemic and/or the resultant has been the lack of anticipation closures or restrictions, as, whilst their that a pandemic would have such a business would not be affected directly, catastrophic effect on both business Traditional British Pub on a Summer’s Day overcoming the Coronavirus COVID-19 pandemic restrictions by offering counter its customers, suppliers, or indeed and society. Any discussion prior to takeaway service for beer and cocktails (Photo by Getty Images) employees are affected. If everyone

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 79

B and Q home improvement store opens following coronavirus lockdown restrictions ease (Photo by Getty Images) works from home, then a city sandwich the profits such assets generated, insurance solutions to policyholders. reasons for this, there seems little doubt shop that relies on office workers will whereas many businesses today rely BI insurance has already changed that the detailed and protracted claims have few customers and a significant on intangible assets such as their enormously since it was developed in process embedded within BI policies reduction in turnover. So what is the website and brand to deliver revenues. the late 18th century, with peril-based was a problem when the objective is proximate cause of the loss to such So not only is the traditional property triggers transitioning to ‘All-Risks’, to deliver fast cash to the policyholder. The pandemic has businesses: is it the pandemic, the insurance trigger of a peril affecting a payroll covers and special forms for Furthermore, another common feature been the latest in a response of government in dealing physical asset less relevant than before, fee-based businesses as examples. The of these initiatives is that many see a series of wake-up calls with the pandemic, or both? This is but the resultant BI claim is driven cyber market has recognised this and parametric trigger as a better basis for one of the key debates in shaping the by completely different factors from tried to develop BI covers that respond coverage. Given that the FCA judgment for the global BI scope and nature of future BI cover and what was historically the case. Many to policyholder needs, but remains came to different conclusions on the insurance industry concerns the extent to which BI can businesses have very little that could be impaired by the common reliance on two main clauses under consideration, The pandemic has been the latest in a respond to the contemporary causes of damaged by a fire, but an internet or both the internet and network service access and disease covers, this is series of wake-up calls for the global BI business disruption. website outage for 24 hours could have providers, which in turn drives the need important, although we should be insurance industry. BI insurance remains a significant effect. to limit exposure. mindful that much of the case was about essential to many businesses, but too The businesses of yesterday were wording ambiguity. So a parametric- many policies and products are stuck disrupted by fire, weather, human One of the key questions we must ask To return to COVID-19, it is interesting based pandemic product would merely in a time warp and may not deliver the activity, and machinery breakdown. is, how can we change the way we think to note that many of the government require a trigger(s) to be hit and the protection the modern policyholder Tomorrow’s business could be about business interruption insurance? or public–private initiatives set up to policy would pay. Not all policies would requires. It is vital therefore that we use interrupted by internet outage, cyber Unless we question the fundamental examine how pandemic BI insurance function this way, and a parametric this global event as a trigger for a real crime, supply chain failure, space principles of BI policies and try to coverage might be provided in the approach might be most suitable for debate around BI covers and the way weather and climate change. Moreover, view them through the prism of how future came to the conclusion that a BI SME policyholders, with larger policies they might be adapted to reflect the 50 years ago businesses needed businesses are interrupted in 2020, we policy might not be the best place to looking more like a BI policy. needs of 21st-century businesses. to insure their physical assets and will struggle to deliver customer-centric start. Although there could be different

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 80

Can you really manage terrorism risk? Pool Re Head of Risk Management, Chris Medhurst-Cocksworth, talks to Steve Coates, discussing the challenge terrorism risk poses to businesses, and what they can do about it

Steve Coates, Chief Underwriting Officer, Pool Re

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 81

Can you explain what Pool Re The attack on London Bridge and Chris leads Pool Re SOLUTIONS Risk Management Borough Market in 2017 is a poignant SOLUTIONS Risk Team does? example where, sadly, eight people Management Team, We support our Members and their were murdered and 48 people injured, policyholders to understand the terrorism but the amount of physical damage supporting Members threat facing them and the impact was limited. However, the complexity and businesses to that could occur. We are then able to and extent of the subsequent police advise, based on their current state of investigation meant that the cordon understand the threat preparedness, to mitigate that threat. remained up for a considerable facing them and how To do this we work with our colleagues amount of time, creating a significant in Pool Re SOLUTIONS Risk Awareness business interruption to the traders and to manage that threat. and Risk Modelling teams to deliver businesses inside the market. I often With over 20 years’ detailed analysis – the aim being to ask business leaders how they would enable business leaders to make be able to operate if they had no access experience in the British informed decisions on how best to to their premises, IT, phones, or other Army, much of that time manage the threat, based on their risk critical elements. appetite and the resources available And then there is the impact of social focused on counter- to them. media. In November 2017 a non- terrorism in both the UK What do you mean by terrorist incident at the Oxford Circus terrorism risk? tube station led to an outbreak of and abroad, Chris has mass panic as people fled the vicinity The UK faces a serious and challenging and social media incorrectly claimed a deep and thorough threat from international terrorism as it was a terrorist attack. Stores along well as our own domestic terrorist understanding of the Oxford Street were severely impacted groups, whether they are aligned to ISIL in the subsequent chaos, which led to real impact terrorism or to far-right extremists. They can be significant damage and nine injuries, groups or, as we have seen recently, can have. some of them life-changing. individuals who have been radicalised In recent years, he has worked but all of whom are easily capable Manchester Arena, that does not mean indirectly affected by being in the What type of preparations can with many FTSE 250 and global of delivering low-sophistication but that terrorists no longer wish to deliver vicinity of an attack and its aftermath businesses undertake? a “spectacular” attack to an iconic site or their supply chain is disrupted by an companies, advising them on key high-impact attacks. The fact that the There is a plethora of advice provided in the UK or to inflict mass casualties. attack. The interruption to businesses risk mitigation strategies. Now at police and security services have been by the police and the other security They do and will continue to do so. can be considerable, through loss Pool Re, Chris works with a team successful in disrupting many attacks agencies. At the very lowest level, of physical assets and employees to only serves to underline the fact that the employers should review the information of terrorism risk experts, all of Surely most businesses would not loss of clients as they choose to stay threat remains and these individuals will given in the ACT Awareness e-learning whom have held senior positions be considered terrorist targets? away from a particular location or are continue to seek to identify and exploit package, which is specifically designed in the military, police or other Terrorism is a major threat for prevented from access because of vulnerabilities. Whilst recent attacks for businesses and is now available government agencies. businesses, whether they are the police cordons and the subsequent have not been on the same scale as for the general public ( intended target, such as a stadium investigation. https://act. the attacks on London Transport or ). Our own website or other crowded place, or they are campaign.gov.uk/

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 82

collates a number of the various sources How can businesses understand if to improve. We are able to offer a one- and do not consist primarily of domestic terrorist event. Many business leaders on our resources page (https://www. they are doing the right thing? hour virtual workshop with our security properties. However, any businesses, are now seeking assurance that they poolre.co.uk/security-advice-and- In addition to the advice on our consultants to go through the report and even if they do not reach this size or are have identified and are able to manage information/). In addition, we have webpages, Pool Re offers a free-to- identify any areas for improvement and not yet policyholders, can undertake the significant events to demonstrate developed a number of guides for SME use service, the Vulnerability Self- how they might go about it. assessment to review their current state good corporate governance. This (https://www.poolre.co.uk/solutions/ TM of security risk management. level of insight, combining our security Assessment Tool (VSAT ), which The key aspect is that those who are report/sme-guide-to-terrorism/) and experts, academia and world-leading enables businesses to review their eligible, and who achieve the required In addition, we regularly work with large businesses (https://www.poolre. modelling, enables business leaders in-house security and risk management standards, are able to claim a 7.5% Loss our Members and their policyholders co.uk/solutions/report/best-practice- to make strategic insurance and risk procedures and policies against UK best Mitigation Credit against their insurance. on bespoke projects to help them guide-to-counter-terrorism-security-for- management decisions based on practice and standards as advised by This is aimed at those businesses with identify specific threat scenarios business-premises/) to use, as well as a the police and security services. At the informed assumptions and data. guide for brokers, in concert with BIBA policyholders whose portfolios aggregate applicable to their business as well end of the assessment, businesses will to a Material/Property Damage declared as reviewing the likely impact of, and (https://www.poolre.co.uk/solutions/ receive a report on their risk levels and value sum insured of £50m or above, their preparedness to manage, a report/biba-terrorism-insurance-guide/) vulnerabilities as well as advice on how

Risk Assessment targets six fundamental security-related categories

Physical security Personnel security Information and cyber Corporate profile and Site maintenance and Emergency procedures security specialised business servicing process

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 83

Personnel security

Physical security VSAT™ – reducing risk, rewarding ™ resilience The chance to qualify for a Loss Mitigation Credit (LMC) equating to a 7.5% discount on Terrorism Insurance Premiums - applicable for 3 years. This is VSAT Information the key selling point. Helping your clients save 7.5% on and cyber An Executive Summary and comprehensive Risk Report listing practical recommendations on security measures to reduce risks and vulnerabilities identified their Annual Terrorism Premium in the assessment. Post-assessment support with one of our expert security professionals via a free one-hour telephone ™ or virtual workshop. Specially designed for clients with medium and large A digital dashboard and RAG report simplifying the ™ prioritisation of risk improvement strategies. businesses, VSAT is a powerful free-to-use-tool to Improved resilience to disruption caused by an unexpected event like a terrorist attack, and protection help identify, assess, mitigate and prevent a range of VSAT against other crimes such as theft or cyber extortion. risks in line with UK government best-practice advice. Emergency Take the next step Powered by the latest analytical software, VSAT™ is a newly streamlined risk procedures Corporate profile and specialised If you’d like to know more about assessment platform, created to help your clients assess security vulnerabilities how VSAT™ can benefit your within six key areas of their business and operations: business process clients, contact us at [email protected] today. Site maintenance and servicing

Pool Re SOLUTIONS Annual Review 2020 Opinions Focus Threat Intelligence Risk Evaluation 84

SOLUTIONS: Our strength lies in our partnerships government advice expert advice in one place

Cranfield Home Cabinet University Office Office

CASS Business National Cyber School Security Centre

University Metropolitan of Maryland Police

University of Joint Security Cambridge and Resilience Centre

Wharton Centre for the University of Protection Pennsylvania of National Infrastructure

International Forum Royal United of Terrorism Risk Services (Re)Insurance Pool Institute

HM Treasury

Click on an icon for more information

Pool Re SOLUTIONS Annual Review 2020 We believe all organisations and businesses can benefit from a better understanding of the terrorism risk solutions available. To find out more about Pool Re SOLUTIONS and how your organisation can take advantage of this service, please contact us at: [email protected]

Pool Reinsurance Company Limited Equitable House 47 King William Street London EC4R 9AF poolre.co.uk

© Pool Reinsurance Company Limited