TERRORISM THREAT & MITIGATION REPORT 2019 2/ 53 TERRORISM THREAT & MITIGATION REPORT 2019 3/ 53 01/ TERRORISM THREAT & MITIGATION REPORT 2019 4/ 53

POOL RE’S RESPONSE TO THE EVOLVING THREATS OF TERRORISM I am pleased to present this year’s the tools and information it needs to Terrorism Threat & Mitigation Report, evaluate, price, manage and mitigate our fourth to date. Since 2016, and terrorism risk to a degree hitherto the creation of our Terrorism Research unseen in this country. We expect and Analysis Centre (TRAC), we have as a result to see further increases produced an annual report examining in the amount of risk Members are the terrorism risk landscape globally prepared to take, while simultaneously and in the UK. This 2019 edition, continuing to diversify the UK’s Julian Enoizi however, marks an exciting turning financial exposure through the growing Chief Executive Officer point not only for the company’s involvement of the global reinsurance / Pool Re flagship risk report, but also for TRAC and capital markets. We are also and Pool Re’s broader terrorism risk committed to continuing to unite analysis expertise. commercial, academic and political Julian Enoizi has been CEO of Pool engagement in understanding and Re for six years. Previously he was The publication accompanies the bridging protection and information CEO of ProSight at Lloyd’s. Julian launch of Pool Re Solutions, a new gaps, building on our success held senior executive roles with in-house centre of excellence within in relation to Non-Damage Business AIG Europe and Chubb Insurance Pool Re which will streamline and Interruption (NDBI) and cyber terrorism. Company of Europe based in amplify our emphasis over the past London, Paris and Brussels. Julian five years on risk awareness, risk As the analysis in this report is a graduate of the Universities modelling, and risk management. demonstrates, terrorist groups of Birmingham and Limoges, France. As the terrorism threat continues to have shown themselves to be He holds an LLB (Hons) degree in change and become more complex, highly adaptable and innovative. Law and French Law and a Diplôme there has emerged a corresponding The contemporary terrorist threat is D’Etudes Juridiques Françaises. He need for Pool Re to support its more diffuse and complicated than is a qualified lawyer and practised in Members with an equally dynamic ever before, and radically different London, Milan and Brussels before set of underwriting tools, technical from the IRA threat Pool Re was embarking on his insurance career. services, training, and insight, to created in response to. The threat support the traditional provision of of ‘spectacular’, 9/11-style attacks reinsurance cover. remains a tangible risk. However, contemporary Islamist and, Solutions represents a significant increasingly, right-wing extremists development in Pool Re’s offering to aim to cause mass casualties, the UK’s terrorism risk market, since attacking unprotected targets it has been designed to provide and rather than focusing on hardened stimulate the insurance industry with commercial or government targets. TERRORISM THREAT & MITIGATION REPORT 2019 5/ 53

THE THREE PILLARS OF POOL RE SOLUTIONS Horizon scanning and investing in the can do to protect themselves and techniques by building pathways We are very grateful for the research necessary to understand extended this year to agreeing to which link government agencies, contributions made by our guest the parameters of evolving or finance a unique information exchange academia, risk professionals and the writers, who bring a different emerging threats is a responsibility platform run by the Metropolitan insurance industry. Indeed, the latest perspective and experience to the we take seriously, as is increasing the Police, to allow the industry to CONTEST report recognises Pool Re challenges of delivering enduring commercial viability of risks which are benefit from the expertise of the and the insurance industry’s potential counter-terrorism strategies. I very difficult to insure, and future-proofing UK’s counter-terrorism agencies. to shape Insureds’ behaviour and much hope you enjoy the articles UK businesses with the protection improve safety, security and resilience. written by Conrad Prince (former they need. The Solutions platform is RISK MODELLING Director General of Operations at designed to enable Pool Re and its The Risk Modelling division will This recognition is at the heart of our GCHQ), Alexander Babuta (National Members to more effectively and continue to create and build terrorism flagship risk mitigation product, the Security Research Fellow at RUSI), holistically address some of the modelling tools and techniques that Vulnerability Self-Assessment Tool Andrew Silke (Professor of Terrorism market’s persistent challenges, can underpin better pricing and (VSAT). It allows businesses to at Cranfield University) and Jerry such as the problematic low greater deployment of capacity or conduct a detailed security audit to Smith (Senior Partner at CHC Global). take-up of cover by SMEs. capital into terrorism (re)insurance. The UK Government and internationally new paradigm these models represent recognised standards, and trigger It has never been so important for RISK AWARENESS was demonstrated in February this premium discounts, which from Pool Re and its public and private Pool Re’s Risk Awareness division will year, when they were a decisive factor the beginning of 2020 will be rising partners to understand terrorism; build on our current in-house expertise behind Pool Re’s placement of an to 7.5%. In addition, we are also now what drives it, how it manifests now and established reputation as a historic £75 million Insurance Linked delivering terrorism risk management and may manifest in the future; and thought leader in the field by providing Security. The models are being training courses for Member how we can together build lasting analysis, intelligence and expertise on developed in partnership with Company risk engineers. These resilience against a threat which all aspects of the terrorism threat to academia, insurance modelling courses, which are amongst the first above all seeks to destabilise and our private and public stakeholders. experts and government agencies, of their kind, are training risk engineers divide. In that spirit, I trust you will Our strong partnerships with and are a result of Pool Re’s ability to and claims handlers to improve find this report informative. academia, government agencies and bring together such diverse expertise. national terrorism risk literacy and specialist think tanks will inform our integrate terrorism within broader Julian Enoizi regular reporting and workshops, property risk management practice. Chief Executive Officer whilst also supporting our actuarial RISK MANAGEMENT These and other initiatives will Finally, the newly established Risk not only reduce the underlying and modelling capabilities. Our Management division will be working commitment to raising the level of terrorism risk the UK faces, but to become the key facilitator of mitigate and reduce effects of attacks awareness and understanding of terrorism risk management information terrorism risk and what businesses that do occur. TERRORISM THREAT & MITIGATION REPORT 2019 6/ 53 02/ TERRORISM THREAT & MITIGATION REPORT 2019 7/ 53

ENDURING AND THE THREAT LANDSCAPE MULTIFARIOUS IN THE UK REMAINS VERY THREATS COMPLEX AND INCREASINGLY Reflecting on the last 12 months, it attacks, targeting crowded places Daesh’s forces in Syria and Iraq may would superficially appear that the and iconic targets. Moreover, it is have been seriously degraded, and threat posed by Islamist extremism continually evolving and increasingly with it the group’s ability to directly UNPREDICTABLE peaked during 2017 and that the difficult to predict. These threat actors command and sponsor attacks in followers of Daesh have dispersed to – be they Islamist extremists, Right Western Europe, but its capabilities other ungoverned spaces and failed Wing terrorists (RWT), Left Wing and ability to inspire violence endure. states across the globe. While largely terrorists (LWT) or Violent Dissident The threat of Islamist extremists true that Daesh is adopting a Republicans (VDR) – employ a wide acting alone remains acute, as transnational, affiliated model, the threat array of methodologies, ranging from evidenced by the police and MI5 Ed Butler posed to the UK by Islamist extremism the unsophisticated (knives and undertaking 700 live investigations Chief Resilience Officer remains as high as ever. Of concern is vehicles as weapons) to more at any one time and the interdiction / Pool Re the threat posed by committed Daesh complex attacks involving Improvised of one major late-stage attack plot fighters who may return to the UK with Explosive Devices (IEDs) and firearms. on average every four weeks. Ed Butler, CBE DSO, is Pool Re’s battle honed-skills and the intent to use Increased VDR actions have the Chief Resilience Officer and leads them in attacks, as well as by unknown potential to provoke a response from The defeat of the so-called its Risk Awareness Team. He is lone actors acting independently of any Loyalist paramilitaries, who still exist Caliphate will not have changed the responsible for developing the direction from ‘Daesh central’. The but have almost exclusively been views of core Daesh followers, as company’s capacity and capability threat posed by Al Qaeda (AQ), in focused on criminal activities in the demonstrated by ongoing attacks in understanding the terrorism threat particular its affiliates in Syria, still last few years. This in turn may feed across the globe by its supporters. landscape and how to mitigate remains especially its aspiration to into a re-energised extremist British It appears the group has recognised against these perils. Ed has over commit another spectacular attack. Nationalist movement1. There remains the vulnerabilities attendant to holding 35 years of experience in counter- It is unsurprising then that the UK concern about the use of Chemical, territory in the face of action by terrorism, security and risk threat level remains at SEVERE Biological, Radiological or even Coalition forces. Rather, the group has management, including 24 years (meaning an attack is ‘highly likely’). Nuclear (CBRN) material forming gone to ground while it regroups in its in the British Army and eight years part of an IED, and more ‘novel’ heartland, carrying out attacks abroad business consulting. He was In order to better understand why the technologies to achieve a devasting to demonstrate its continued relevance privileged to command 22 SAS threat of terrorism has not gone away, event similar in scale to 9/11. and vitality. The Easter bombings in and retired as a Brigadier in 2008. and remains at an unprecedented Sri Lanka reflect this. Demonstrating high, it is necessary to unpack the The above view may not be sophisticated planning over a current range of threat actors and appreciated by much of the public; protracted period, the attackers were methodologies, and the associated risks there has not been an attack in able to acquire large quantities of to Pool Re, our Members and Insureds. Great Britain on a similar scale explosives and exploit Sri Lankan to Manchester or Borough Market intelligence failures. Elsewhere, the The threat landscape in the UK since 2017, and the so-called group continues to regularly claim remains very complex, fast-moving Caliphate was militarily defeated attacks, while reasserting itself in and occupied by a diverse group Syria and Iraq, its appeal much Iraq and Syria through a campaign of threat actors, a number of whom diminished from its height in 2016. of revenge and intimidation. want to conduct mass casualty TERRORISM THREAT & MITIGATION REPORT 2019 8/ 53

Where then does this leave the threat timescale4 and, secondly, the Driving the threat of RWT are several to the UK? Some might argue that opportunity for further radicalisation related ideologies, with cultural we have entered something of an and fraternisation with the criminal nationalism, white nationalism and equilibrium with Islamist extremism in community of convicted terrorists white supremacism the most prevalent. this country and question what more increases once incarcerated. While there are still significant variations can be done to suppress the threat of in the motivations of RWT in different lone actors. Certainly, attacks are being We are fortunate that we in the UK countries, there is evidence that planned at a faster rate than in 2014 have a very sophisticated counter- common themes like ‘the great and are quicker and cheaper to terrorism architecture and mature replacement’ theory and anti-Muslim execute. We are likely to see the security and intelligence capability, attitudes increasingly tie formerly continued use of low sophistication which continues to operate very disparate right-wing actors across the techniques – the use of vehicles and effectively against all forms globe. Rising political polarisation and knives as weapons – with an increasing of terrorism. Efforts are being made regional inequalities across Western appetite and capability for IEDs to inflict to improve the collaboration with IT countries are likely to continue to greater casualties and generate more and social media companies to take provide fertile ground for radicalisation. media attention. There is a real concern down online terrorist content, but about the high number of returning there is little evidence to date which While in Britain right-wing extremists fighters who could use their battlefield shows that this is effective against are increasingly organised, with experience in attacks in the UK. These those already radicalised who have some establishing links to extremist fighters are likely to try and plan more the intent to undertake attacks. groups overseas, most RWT attacks complex attacks, most likely involving worldwide continue to be carried a combination of techniques (blades, However, other threat actors are out by lone actors with no or only guns2, vehicles and IEDs) to maximise occupying an increasing share of peripheral connections to proscribed casualties3. Of more concern would be the UK’s counter-terrorism resources. organisations. The internet continues the teaming up of so-called frustrated Right Wing Terrorism (RWT) now to provide a space for right-wing travellers (those who could not get out accounts for a significant proportion of extremists to share ideas and incite to Syria) with returning fighters. the police and MI5’s workload and this attacks. Against the backdrop of threat has intensified over the last few online hatemongering, recent high A lower tolerance for the risk of years; seven of the 22 plots foiled since profile RWT attacks have spurred attacks such as those at Borough March 2017 have been RWT, and there copycats, with the Christchurch Market and Manchester requires our have been a further two successful attacks in March credited with THE POLICE AND MI5 ARE CT agencies to interdict these plots RWT attacks since the murder of inspiring a further four RWT attacks at a much earlier stage. These early Jo Cox MP in 2016. According to in the US, Britain and Norway. UNDERTAKING 700 LIVE stage interdictions have a number the latest Home Office statistical of unfortunate consequences. bulletin, extreme right-wing concerns Further such attacks are likely. INVESTIGATIONS AT ANY ONE TIME First, shorter sentences mean accounted for 18% of all referrals to The involvement of former military that convicted extremists are back PREVENT, and 44% of individuals personnel in extremist circles is a WITH THE INTERDICTION OF ONE out on the streets within a shorter receiving support from the programme. particular concern, with their potential MAJOR PLOT EVERY FOUR WEEKS TERRORISM THREAT & MITIGATION REPORT 2019 9/ 53

SIGNIFICANT ACTIVITY/ MANCHESTER VICTORIA STABBING ATTACK

Mahdi Mohamud, a Somali-born British resident, stabbed two civilians and a police officer at Victoria Station in Manchester while shouting Islamist slogans. Daesh routinely calls for its supporters to mount stabbing attacks against civilian targets in crowded areas, but Mohamud is not believed to have any ties to overseas extremists. The station was temporarily cordoned off but no property damage occurred during the attack. This incident highlights the possibility of terrorists successfully launching attacks outside of London.

DATE: 31 December 2018 LOCATION: Manchester, London OFFENDER: Mahdi Mohamud, unaffiliated Islamist extremist METHODOLOGY: Bladed weapons DEATHS: 0 INJURIES: 3 TERRORISM THREAT & MITIGATION REPORT 2019 10/ 53

UNCONVENTIONAL TERRORISM AND FUTURE THREATS to bring battlefield experience to the Terrorists are innovating as police and Instructions on making CBR devices planning and execution of attacks. MI5 get better at interdicting plots; as have featured in Islamist extremism While the targeting priorities differ illustrated by the sizeable growth in media over the last three to four years somewhat from Islamist extremists, the use of information technology and chemical (military grade) IEDs the recruiting tactics and attack and the use of data and encrypted were used regularly in Syria and Iraq methodologies they employ are communications, in attack planning (at their peak over a 100 per month much the same. over the last two to three years. We are were being deployed by both Islamic also seeing more technology transfer State fighters and the Assad regime9). The threat level from Northern Ireland from the battlefield to the streets, as The aspiration to use CBR material is Related Terrorism (NIRT) is SEVERE in well as between state and non-state nothing new; AQ published its Poison the Province. The frequency of terrorist actors. Collusion, especially in the Handbook in the early 1990s and it is attacks, mainly by the New IRA but cyber world, between the criminal known that AQ did possess a ‘poison also with some significant attacks from fraternity and terrorist groups remains gas dispenser’. Due to extensive the Continuity IRA, remains constant a constant concern. There is good controls on military and commercial with 15-40 incidents on average per evidence that Hamas is moving up the grade material, it is more likely that year; between March 2018 – March ‘value chain’ (as reported in Conrad terrorists would use hazardous 2019 there were 15 bombings and 37 Prince’s article in this report) and is chemical ingredients to construct an security related shootings, including now undertaking quite sophisticated IED. A device such as this is unlikely paramilitary ‘punishment’ attacks. The cyber espionage operations. As the to have any long-term persistency and killing of Lyra Mckee in March 2019, barrier to entry for malware and an area would be decontaminated and several under-vehicle explosive cyber tools lowers, along with the very quickly; property damage would devices and IEDs since are a reminder introduction of 5G6, so does our be restricted to the size of the blast of the intent and capability that Violent vulnerability to cyber-attack increase. and burns would be the most likely Dissident Republicans (VDRs) injuries sustained. However, possess. A ‘no deal’ Brexit could well The former Minister for Security, Ben the psychological impact would exacerbate these tensions, elicit a Wallace MP stated in January 2017 be considerable. “Chemical IED reaction from Loyalist paramilitaries it is a ‘question of when not if’ there exploding in London” would be an and lead to even more attacks in the is a CBRN attack in the UK7. There alarming newspaper headline and we latter part of the year. It is currently have been a number of plots could expect significant and extended assessed that these are unlikely to interdicted in the last two years, loss of attraction and consumer spill over onto the mainland, but including three plots in Europe confidence in the affected areas. this cannot be discounted – as involving the production of ricin.8 demonstrated by the sending of several incendiary devices through the post in March this year and the 2016 arrest of Ciaran Maxwell who had 18 viable pipe-bombs in his possession. TERRORISM THREAT & MITIGATION REPORT 2019 11/ 53

SIGNIFICANT ACTIVITY/ CHRISTCHURCH MOSQUE SHOOTINGS

Tarrant, an Australian white supremacist, consecutively attacked worshippers at two mosques with semi-automatic firearms before being arrested. IEDs found in his car were defused by police. The gunman livestreamed the attack on Facebook and published a manifesto online citing previous right-wing terrorists (RWTs) as inspiration. He was later linked to extremist networks in Europe, and his actions were seemingly intended to incite copycat attacks. The attack highlighted the vulnerability of places of worship, and the intent of RWTs to target crowded places associated with minorities.

DATE: 15 March 2019 LOCATION: Christchurch, New Zealand OFFENDER: Brenton Tarrant, unaffiliated right- wing extremist METHODOLOGY: Firearms / Improvised Explosive Devices DEATHS: 51 INJURIES: 49 TERRORISM THREAT & MITIGATION REPORT 2019 12/ 53

HOW CAN BUSINESSES IMPROVE THEIR FORECAST – WHAT RESILIENCE TO SEEN MIGHT EMERGE FROM AND UNSEEN THREATS? THE SHADOWS? The constantly evolving threat attack. In Britain, commercial We are likely to see more of the same of such an event remain Islamist landscape exposes new vulnerabilities organisations are able to purchase THE CONSTANTLY from Islamist extremists, RWT and extremists and the aviation sector for businesses, especially SMEs, terrorism insurance. Claims can be NIRT, with their focus remaining on remains one of the most likely during the so-called ‘new age’ of made for losses due to an act of EVOLVING the use of low complexity ways and targets for this type of scenario. terrorism which has emerged since terrorism even when a terrorist attack means to achieve their ends. The 2014. It is therefore essential to adopt has done no physical damage. THREAT methodologies will remain quite As with previous terrorist campaigns, a rigorous, analytical and realistic For example, owners and customers similar, with only a variance in target the unpredictability of what, when and approach to this peril, one that were denied access to businesses by LANDSCAPE selection. We cannot discount a where should be a given; we need to minimises the full spectrum of human the police cordon at Borough Market spectacular attack, be it a 9/11 or have maximum readiness not to be business and economic losses. for over a week following the London EXPOSES NEW an Anders Brevik type incident. surprised by the next type of attack Bridge attack. Many small traders VULNERABILITIES and have the full suite of mitigations in Organisations should develop a suffered considerable losses from Against the backdrop of political place, including terrorism insurance, to strategy to deal with the effects of a a drop-off in footfall and spoilage TO BUSINESSES polarisation, disenchantment of some ensure we are resilient to any event. terrorist attack. While they may not be of consumables. Since the event, people from the mainstream and directly targeted by a terrorist group Pool Re has created affordable declining social cohesion in many RISK MITIGATION or an individual attack, organisations ‘non-damage business interruption’ communities within the UK, we could can suffer the indirect consequences coverage for terrorism related losses. well see a cycle of violence and counter Several actions contribute to a of attacks (denial of access due to violence by terrorist and extremist comprehensive risk and resilience cordons and subsequent loss of The threat of terrorism is persistent, groups. A hard or no deal Brexit may strategy for dealing with terrorism attraction), or contagion risks and it isn’t just about London. Small lead to an increase in attacks by Violent risk, including: developing in-depth associated with terrorist activities and medium sized organisations Dissident Republicans in Northern risk awareness and knowledge; in another area. Therefore, all across the country are equally likely Ireland, with potential spillover effects. assessment of exposures; organisations should consider the to be affected, either directly or As previously mentioned, a counter appropriate mitigation and risk potential impacts of any terrorist attack indirectly. Taking a risk by not buying reaction by Loyalist extremists in management; and importantly, risk happening on their doorstep (or terrorism insurance, and instead Northern Ireland to rising VDR activities transfer through insurance. Less affecting their networks, given the adopting the belief ‘it will never could destabilise the Good Friday complex businesses with little spare growing threat of cyber terrorism), happen here’ is a high-risk strategy in Agreement and any Brexit negotiations. time or expertise to perform such and how best to minimise them. a world where terrorism is now, sadly, A reaction by extreme left-wing assessments should ensure that part of everyday life. Companies, movements (LWT) off the back of terrorism is considered within their Terrorism risk transfer is Pool Re’s large and small, can reduce the civil disorder over Brexit10 cannot be broader security considerations and business. We provide, indirectly impact of terrorism by having a ignored either. importantly, is not ignored from an through conventional insurance comprehensive risk strategy which insurance perspective. Advice and companies, the insurance backstop covers all aspects of this diverse It also cannot be discounted that any information is available from the which provides cash indemnity and and unpredictable peril. An terrorist group or individual will move police’s National Counter Terrorism supporting services designed to intelligence-led approach and plan further up the violence scale and Office, and through local Counter ensure that organisations will have will ensure effective and enduring deploy a weapon (or methodology) Terrorism Security Officers. the resources necessary to recover resilience. Transferring risk through of mass effect to inflict multiple as quickly as possible from a terrorist appropriate insurance is a must. casualties. The likely perpetrators TERRORISM THREAT & MITIGATION REPORT 2019 13/ 53

NUMBER OF ATTACK FATALITIES IN ADVANCED MARKETS BY OFFENDER TYPE / 1990-2018 (excl. 9/11)

220

200

180

160 1 https://www.bbc.co.uk/news/uk-northern- ireland-politics-47072147 140 2 https://www.theguardian.com/uk- news/2019/sep/08/police-raid-arms-terror- group 120 3 Although current statistics suggest that most foreign fighters will not get involved in an attack on return home. http://www. 100 washingtonpost.com/blogs/monkey-cage/ wp/2013/11/27/number-of-foreign-fighters- from-europe-in-syria-is-historically- unprecedented-who-should-be-worried/ 80 4 Current statistics suggest that re-offending by released terrorists is very low in the UK. https://repository.uel.ac.uk/download/ 60 d1d99fcc687fcbda9685336c5f6cdc63f 649049214a492ec6a23a467e461bdd2/37 8097/Risk%2520assessment.pdf 40 5 The attack on the 19th August near Wattlebridge in County Fermanagh was the fifth attempt by VDRs to kill police officers 20 this year and followed another attempt on officers at the end of July in Craigavon, County Armagh. 1990 1991 1992 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 6 https://www.telecomstechnews.com/ Anti-government Extremists Anarchists, Far Left, Environmental, Student Far Right Islamist Extremists Separatists news/2018/aug/14/uk-spy-agency-5g- cyber-terror-threat/ 7 https://www.independent.co.uk/news/uk/ BACK/ home-news/isis-terror-attacks-uk-plots- FAR RIGHT ISLAMIST EXTREMISTS THE DATA REINFORCES supporters-travel-syria-frustrated-basu- THE POINT THAT THE foreign-fighters-a8576431.html MAJORITY OF DEATHS 8 These are in addition to the RWT ricin plot that was foiled in Durham in 2009. ARE CAUSED BY SINGLE 9 Assad’s regime make indiscriminate use of EVENTS, AND NOT AN chemical munitions, including nerve agents. ACCUMULATION OF And IS have used mustard gas against % % % % Kurdish forces and are reported to have 25OF ALL DEATHS IN 71OF ALL DEATHS IN 62OF ALL DEATHS IN 29OF ALL DEATHS IN SMALLER EVENTS. THIS IS had chemical weapons production facilities. ADVANCED MARKETS ADVANCED MARKETS ADVANCED MARKETS ADVANCED MARKETS TRUE ACROSS ADVANCED 10 https://ukdefencejournal.org.uk/terrorist- radicalisation-in-the-uk-is-evolving-says- THIS DECADE LAST YEAR THIS DECADE LAST YEAR MARKET COUNTRIES. report/ TERRORISM THREAT & MITIGATION REPORT 2019 14/ 6353 03/ TERRORISM THREAT & MITIGATION REPORT 2019 15/ 53

ANALYSIS OF THE GLOBAL TERRORISM DATABASE Pool Re has analysed 30 years of Some attacks recorded in the GTD terrorist event data from the Global as separate events due to their Terrorism Database (GTD) published geographic or temporal discontinuity by the University of Maryland. The have been grouped together to GTD is the most comprehensive reflect Pool Re’s analytical practice. publicly available database of terrorist Others have been excluded from incidents and provides the ability to the analysed dataset entirely due assess trends in terrorist activity over to uncertainty over whether they the history of Pool Re. constituted acts of terrorism.

The GTD uses a very granular While terrorist activity across the globe schema for recording the attribution, is addressed, the analysis focuses on a methodology and targets of terrorist grouping of 29 countries which provide Eden Stewart Callum Yourston attacks. To enhance the utility of the substantial insurance protection (based Senior Analyst Analyst data to Pool Re and its Members, on insurance density and penetration / Pool Re / Pool Re these attack attributes have been as a percentage of gross national grouped into higher taxonomic ranks. product). This grouping is classified Eden Stewart joined Pool Re as an Callum Yourston joined the Pool Re The original data has also been as ‘Advanced Markets’. analyst on the Risk Awareness team in Risk Awareness team in September enriched to facilitate additional October 2017. Prior to joining Pool Re, 2019. Before joining Pool Re, Callum analysis of weapon complexity, Eden worked as an intelligence analyst worked as a political risk analyst damage potential and loss values. specialising in cybercrime. Eden holds covering the Middle East and North a Master’s Degree in Security and Africa. He holds an MA in Terrorism, Intelligence Studies from Brunel Security and Society from King’s University, and a BA in History from College London and an undergraduate the University of Leeds. degree in International Relations from the University of St Andrews. He is proficient in Arabic and French. TERRORISM THREAT & MITIGATION REPORT 2019 16/ 53

KEY FINDINGS DECREASE IN LETHALITY INCREASE TARGETING THE PUBLIC THE COMMERCIAL THREAT LANDSCAPE ATTACK FREQUENCY While the frequency of attacks in This is reflected in targeting trends INFRASTRUCTURE With man-made perils like terrorism, In recent years, the frequency of advanced markets remains below across advanced markets. Police, Attacks against commercial targets historical data is an unreliable that experienced in the 1990s, the military and government targets predictor of future risks. However, % attacks worldwide has declined have also fallen significantly, from 44Almost 44% of fatalities significantly. There was a large, lethality of attacks has increased accounted for the majority of attacks about 18% of all attacks in advanced for the near term at least, it is likely significantly. Excluding 9/11, almost worldwide over the 30-year period. that Islamist extremism will continue in advanced markets sustained increase in global events markets in the 1990s, to around 5% occurred in the last decade following the 9/11 attacks, through 44% of fatalities in advanced markets This was also true of advanced between 2015 and 2018. This mirrors to be the main driver of terrorism to 2015, during which the yearly occurred in the last decade, with markets for the 1990s. However, over the changes in the preponderant worldwide, even as attacks by its average number of attacks increased 2015, 2016, 2017 accounting for the last decade, attacks against the actor types and the methodologies proponents wane. In advanced eightfold. This was largely driven by the bulk of these. This primarily public and symbolic targets have they employ. Where commercial markets, the threat landscape is Islamist extremist violence, with global reflects the increased prevalence of far exceeded those against police, infrastructure was a preferred target increasingly complicated by what attacks reaching their peak while attacks by Islamist extremist actors military and government targets, of separatist groups, it has largely appears to be a more active and who, in contrast to separatist groups reflecting the greater prevalence of lethal far-right movement. Attacks % Daesh was at the height of its power. been eschewed by Islamist and right- 36of attacks in Advanced While the frequency of global attacks overrepresented in the 1990s, favour attacks by Islamist and right-wing wing terrorists, in favour of mass resulting in large-scale property mass casualty attacks, largely against extremists. damage or high numbers of Markets in 2018 attributed has decreased with Daesh’s territorial casualty attacks against crowded to right-wing terrorists defeats, it remains well above the unprotected targets. places and symbolic sites. In casualties will continue to be rare average for the 30-year period. LOW AND HIGH contrast, the proportion of attacks events, but attacks which aim to RIGHT WING against critical national infrastructure cause mass casualties will probably COMPLEXITY and aviation has remained fairly continue to grow as a proportion ADVANCED MARKETS TERRORISTS The decline in attacks targeting constant over the 30-year period, of the total. As seen with the recent While attacks in advanced markets Another contributing factor is the commercial infrastructure indicating consistent interest in such attacks across the West, these also spiked between 2014 and 2017 increasing lethality of attacks by right- corresponds with an increase in the targets across offender types. are more likely to cause business with the wave of attacks inspired wing terrorists (RWT). Although higher prevalence of low complexity and interruption losses than significant % 5the amount of attacks in or directed by Daesh, the annual in the 1990s, the number of attacks firearms attacks, again reflecting the material damage. frequency of attacks fell back below by RWT has increased considerably wider shift in intent from targeted to advanced markets in the 1990s, the 30-year average in 2018 (although over the past decade, following a dip mass casualty attacks in advances between 2015 and 2018 the number of fatalities remained well in the 2000s. Equally significantly, markets. Notwithstanding this, most above the historic average). Indeed, RWT have increasingly adopted casualties continue to arise from a the number of attacks in advanced methodologies employed by Islamist small number of high-impact events, markets in the 1990s was more than extremists, with the aim of causing with the majority of attacks causing double that in the subsequent two mass casualties by targeting crowded no fatalities. decades. This marked drop is largely places associated with minority attributable to the cessation of most groups, or other symbolic targets, terrorist activity by nationalist such as places of worship. separatist terrorists groups in Britain, Spain and France. TERRORISM THREAT & MITIGATION REPORT 2019 17/ 53

ATTACKS WORLDWIDE AND IN ADVANCED MARKETS OBSERVATIONS & CONTEXT / 1990-2018 The frequency of attacks in Advanced representative of attack frequency in Markets remains well below the Advanced Markets, both have seen highs seen in the mid-1990s, during substantial increases from 2012, which these countries collectively largely driven by the rise of Daesh. 18,000 experienced an average of 410 attacks per year. This figure dropped Since 2015, the frequency of global significantly in the 2000s, driven by a attacks has decreased significantly decline in attacks by separatist groups (corresponding with Daesh’s decline), like ETA and the IRA. In the 2010s, whereas attacks in Advanced Markets 16,000 the yearly average number of attacks continued to increase up to and in advanced markets was 192. including 2017. Despite a drop in 2018, attacks in Advanced Markets remain In contrast, the frequency of attacks above historic averages in the 2000s worldwide steadily climbed after 2001, and 2010s. This partly reflects 14,000 reflecting rising Islamist violence, increased activity by the right-wing particularly in the Middle East, Africa terrorists but may also point towards and South Asia. However, while the another decoupling of global activity global picture is not necessarily and advanced market attack frequency. 12,000

10,000 % 150attacks worldwide, since217 1990 4.6of global attacks since 1990 occurred in Advanced Markets Global attacks 8,000 Number of attacks % 6attacks, in851 Advanced Markets 2of attacks in 2018 occurred 6,000 since 1990s in Advanced Markets THE FREQUENCY OF THE FREQUENCY OF 4,000 ATTACKS WORLDWIDE ATTACKS IN ADVANCED HAS STEADILY MARKETS REMAINS CLIMBED SINCE 2001 WELL BELOW THE HIGHS SEEN IN THE 2,000 MID-1990S

Advanced Markets attacks 1990 1991 1992 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 TERRORISM THREAT & MITIGATION REPORT 2019 18/ 53

NUMBER OF ATTACK FATALITIES IN ADVANCED MARKETS BY MAJOR EVENT / 1990-2018

260 2,977 (Not scaled to axis) 240

220

200

180 Attack 1995 Oklahoma City Bombing 160 1995 Tokyo Subway 2001 9/11 140 2004 Madrid Bombing 2005 London 7/7 120 2009 Fort Hood Shooting 2011 Norway Attacks 100 2015 Paris

Number of attack fatalities 2016 Brussels 80 2016 Nice 2016 Orlando Nightclub Shooting 60 2017 Barcelona Attacks 2017 Las Vegas Shooting 2017 Manchester Arena Bombing 40 Other

20

1990 1991 1992 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

OBSERVATIONS & CONTEXT Most deaths due to terrorism in majority of all fatalities in Advanced deaths in the 1990s.This reflects shifts Advanced Markets since 1990 have Markets during the period. in the intent and methodologies of EXCLUDING 9/11, 2014- MORE PEOPLE WERE been caused by a small number of threat actors. Separatist groups 2018 REPRESENTED KILLED IN THE 9/11 particularly lethal terrorist attacks; Excluding 9/11, despite fewer most active in Advanced Markets THE DEADLIEST FIVE-YEAR ATTACKS THAN IN ALL more people were killed in the 9/11 attacks, 2015-2017 represented in the 1990s largely eschewed 26individual attacks 137people killed annually PERIOD IN ADVANCED OTHER ATTACKS IN attacks than in all other attacks in the deadliest three-year period in indiscriminate mass casualty attacks; accounted for 86% on average in Advanced Markets since 1990 Advanced Markets since 1990 with the preferred modus operandi of deaths in Advanced MARKETS SINCE 1990 Advanced Markets ADVANCED MARKETS combined. Even excluding 9/11, fewer a yearly average of 201 deaths, of Islamist and, increasingly, right-wing Markets since 1990 between 2014 and SINCE 1990 COMBINED than 30 individual attacks caused a compared to a yearly average of 72 extremists who account for a larger 2018 share of attacks in recent years. TERRORISM THREAT & MITIGATION REPORT 2019 19/ 53

ATTACKS IN ADVANCED MARKETS OBSERVATIONS & CONTEXT / More than $50m Property Damage loss / More than 12 fatalities The majority of attacks that resulted More recent attacks have caused / 1990-2018 (excl. 9/11) in large property damage losses considerably more deaths but less have generally caused fewer deaths, material damage, with most attacks although there are exceptions like the in the 2000s and 2010s causing less 2,000 1995 Oklahoma City bombing which than $1 million in property damage. Bishopsgate ‘93 caused widespread damage and over The exceptions to this include the Manchester ‘96 100 fatalities. Those attacks resulting 2011 Norway attacks, where the 1,000 Baltic Exchange ‘92 World Trade Center ‘93 in the largest losses, the 1993 attacker used VBIED against a Bishopsgate bombing and 1996 government office in Oslo, and a 500 Manchester bombing, caused a single marauding firearms attack against London Docklands ‘96 death, (although several hundred a summer camp outside the capital. people were injured). Attacks resulting This combined methodology resulted 200 in widespread material damage largely in both high levels of property damage Staples Corner ‘92 Amerithrax ‘01 Oklahoma City ‘95 happened in the 1990s, when and a large number of fatalities. groups such as the Provisional Irish 100 Weiterstadt Barajas Airport Madrid ‘06 Prison ‘93 Republican Army (PIRA) sought to Similarly, the 2015 Paris attacks caused London 7/7 ‘05 attack financial infrastructure with many fatalities and considerable property 50 large vehicle-borne explosive devices damage due to the employment of both Oslo/Utøya ‘11 (VBIEDs). Due to increasing restrictions firearms and explosives (albeit much Brussels ‘16 on explosive materials and the smaller devices than the one used in 20 prioritisation of mass casualty attacks Oslo). Explosive attacks against transport by the most prolific threat actors, infrastructure, like the 2004 Madrid such attacks have become infrequent. bombing and 2005 London bombings, 10 Madrid ‘04 also resulted in high levels of property Manchester Arena ‘17 damage and casualties. 5

$USD (millions) 2 Paris ‘15 80%of the costliest 70%of the deadliest 1 Berlin Christmas Market ‘16 Pulse Nightclub, Orlando ‘16 Nice ‘16 attacks in Advanced attacks in Advanced Markets occurred in Markets occurred in 0.5 the 1990s the 2010s

0.2 THE MAJORITY OF ATTACKS THAT RESULTED IN LARGE PROPERTY DAMAGE LOSSES HAVE 0.1 GENERALLY CAUSED FEWER DEATHS

0.05

0.02 Charlie Hebdo ‘15 San Bernardino ‘15 0 20 40 60 80 100 120 140 160 180 200 Number of attack fatalities TERRORISM THREAT & MITIGATION REPORT 2019 20/ 53

AVERAGE NUMBER OF ATTACKS WORLDWIDE AND IN ADVANCED MARKETS BY TARGET / 1990-2018

Worldwide Advanced markets

000 00

00 000

00

000

300

Number of attacks 000 Number of attacks 00

3000 00

0 1990 1992 199 199 199 2000 2002 200 200 200 2010 2012 201 201 201 0 1990 1992 199 199 199 2000 2002 200 200 200 2010 2012 201 201 201

Group Aviation Critical National Infrastructure Commercial Media & Education Place of worship / minority group Police, Military & Government Private Citizens & Crowded Places

OBSERVATIONS & CONTEXT Since 1990, police, military or While police, military or government attacks in Advanced Markets in 1990, There is very little variation in the government targets have been the most targets, private citizens and crowded to 5% in 2015-2018. Equally, there number of attacks targeting of critical THE FREQUENCY OF ATTACKS AGAINST frequently attacked target type, followed places were also the most common has been a dramatic rise in attacks national infrastructure (CNI) and ATTACKS WORLDWIDE COMMERCIAL by crowded places and private citizens, target types in Advanced Markets, against places of worship and sites aviation since 1990, suggesting % AGAINST POLICE, MILITARY, TARGETS DECLINED together accounting for 74% of all attacks the frequency of attacks against these associated with minority groups in an equilibrium between terrorist 16.7of attacks in Advanced Markets OR GOVERNMENT SIGNIFICANTLY worldwide. The majority of these attacks has fallen significantly since the early Advanced Markets since 2012. This capabilities and security measures and since 1990 targeted commercial occurred in conflict zones, and since 1990s. Attacks against commercial corresponds with the increase in that the desire to attack these target interests TARGETS HAS FALLEN IN ADVANCED 2000, reflecting increasing violence in the targets also declined significantly over attacks by right-wing terrorists. types has remained relatively constant. SIGNIFICANTLY SINCE MARKETS OVER Middle East, Africa and South Asia since the 30-year period, from 18% of all the turn of the millennium. THE EARLY 1990S THE 30-YEAR PERIOD TERRORISM THREAT & MITIGATION REPORT 2019 21/ 53

NUMBER OF ATTACKS WORLDWIDE AND IN ADVANCED MARKETS BY GRANULAR TARGET TYPE / 1990-2018

Worldwide Advanced markets Police, Military & Government Police, Military & Government Place of worship / Private Citizens minority group Financial & Public Area Professional Services Place of worship / Private Citizens minority group Transportation Tourism, Hospitality & Leisure (excl Marine & Aviation) Transportation Utilities (excl Marine & Aviation) Retail Political Target Other Business Education Not for pro t Tourism, Hospitality & Leisure (NGO/charity/heritage) Abortion Related Retail Financial & Entertainment & Media Professional Services Education Entertainment & Media Not for pro t Public Area (NGO/charity/heritage) Utilities Other Business Real Estate, Aviation Property & Construction Manufacturing Food & Agriculture Political Target Telecommunications Real Estate, Property Pharmaceuticals / Healthcare & Construction Telecommunications Manufacturing Food & Agriculture Aviation Pharmaceuticals / Energy & Extractive Industries Healthcare Marine Marine Energy & Extractive Industries Abortion Related 0 20,000 40,000 60,000 80,000 0 500 1,000 1,500 2,000 2,500 Number of attacks Number of attacks 2010s 2000s 1990s

OBSERVATIONS & CONTEXT While police, military or government For instance, financial and professional (PMG) targets were the most services were the third most common frequently attacked target type across target type in Advanced Markets the period, in both Advanced Markets (although attacks in the 1990s largely and worldwide, there is considerable account for this), whereas they account 447attacks on places of worship & 177attacks on places of worship & target-type divergence between the for a relatively small percentage of minority groups in 2010s in minority groups in 1990s in two geographic groupings. global attacks. Conversely, utilities Advanced Markets Advanced Markets accounted for a significant proportion of global attacks, but this was not reflected in Advanced Markets. TERRORISM THREAT & MITIGATION REPORT 2019 22/ 53

PERCENTAGE OF ATTACKS IN ADVANCED MARKETS BY WEAPON COMPLEXITY / 1990-2018

00

igh 22 igh igh 0 igh

0

o 0 Weapons complexity methodology: Weapons complexity references how o o difficult a weapon type is to obtain o and it’s potential to cause widespread damage. High-complexity weaponry 0 would typically include methodologies such as car-bombs, suicide bombs, improvised explosive devises and CBRN-related weapons. Low complexity weaponry includes guns, grenades, bladed objects and cars used as a battering ram. 0 1990s 2000s 2010201 201201

OBSERVATIONS & CONTEXT Low-complexity weapons were used in These trends partly reflect the improved The greater prevalence of attacks using around half of attacks in advanced ability of police and intelligence services low-complexity weapons in recent years LOW-COMPLEXITY EXTREMIST MEDIA HAS ACTIVELY markets 1990-2015. Since 2015, there to disrupt sophisticated plots involving also reflects a shift in targeting priorities WEAPONS WERE USED PROMOTED THE USE OF LOW- has been a large increase in the use of the use of high-complexity weapons, towards conducting mass casualty % IN AROUND HALF OF COMPLEXITY WEAPONS TO OFFSET simpler methodologies, with 78% of compelling terrorists to use simpler attacks against unprotected targets, for 78of attacks in Advanced Markets ATTACKS IN ADVANCED THE INCREASING EFFICACY OF attacks in the three years to 2018 alternatives. Extremist media has actively which simpler methodologies can be between 2015 and 2018 used involving low-complexity weapons. Low- promoted the use of low-complexity equally effective as those involving more low-complexity weapons MARKETS 1990-2015 COUNTER-TERRORISM EFFORTS complexity weapons also now account weapons to offset the increasing efficacy complex weapons. for a much greater share of deaths in of counter-terrorism efforts. Advanced Markets than previously. TERRORISM THREAT & MITIGATION REPORT 2019 23/ 53

ATTACKS BY OFFENDER TYPE IN ADVANCED MARKETS BY WEAPON COMPLEXITY OBSERVATIONS & CONTEXT / 1990-2018 Since the 1990s, separatist terrorists In contrast, recent years have seen have most frequently employed right-wing and Islamist extremist complex weapons in attacks, whereas attacks in advanced markets nknon 2 Islamist and right-wing extremists have increasingly employ less complex 00 nknon nknon nknon nknon made greater use of lower complexity methodologies, due to their ease of weapons. This reflects both the access and use, efficacy at causing different targeting priorities of these mass casualties and the lower risk of groups, and the generally greater detection by authorities. sophistication (in terms of organisation, o procurement and operational security) 2 of separatist groups.

0 o o 0 % % 70of separatist attacks in Advanced 67of Islamist attacks in Advanced Markets since 1990 involved the Markets since 1990 involved the o use of high-complexity weapons use of low-complexity weapons o 0 SEPARATIST RECENT YEARS TERRORISTS HAVE HAVE SEEN RIGHT- MOST FREQUENTLY WING AND ISLAMIST EMPLOYED COMPLEX EXTREMIST ATTACKS IN WEAPONS IN ATTACKS ADVANCED MARKETS igh INCREASINGLY EMPLOY 0 0 LESS COMPLEX METHODOLOGIES

igh igh Weapons complexity methodology: Weapons complexity references how 0 igh difficult a weapon type is to obtain 2 and it’s potential to cause widespread Group damage. High-complexity weaponry Islamist Extremists would typically include methodologies igh Far Right such as car-bombs, suicide bombs, 1 Separatists improvised explosive devises and Far Left CBRN-related weapons. Low complexity weaponry includes guns, Anarchists 0 grenades, bladed objects and cars slamist ar ight Separatists ar eft Anarchists used as a battering ram. TERRORISM THREAT & MITIGATION REPORT 2019 24/ 53

FREQUENCY OF ATTACKS IN ADVANCED MARKETS BY WEAPON TYPE / 1990-2018

00

00 Number of attacks

200

0 1990 1991 1992 199 199 199 199 199 1999 2000 2001 2002 200 200 200 200 200 200 2009 2010 2011 2012 201 201 201 201 201 201

CBRN Explosives Firearms Incendiary Melee Sabotage Equipment Vehicle

OBSERVATIONS & CONTEXT In advanced markets, explosives have Incendiary devices have been the There has also been a significant THERE HAS BEEN A EXPLOSIVES HAVE broadly remained the most utilised second most utilised methodology increase since 2014 in attacks methodology of attack since the 1990s, since the 1990s. This high number is employing improvised weapons like SIGNIFICANT INCREASE IN BROADLY REMAINED although the frequency of attacks has reflective of the ease of manufacturing vehicles and bladed/blunt weapons. % % ADVANCED MARKETS SINCE THE MOST UTILISED 50of attacks in Advanced Markets of1.4 attacks in Advanced significantly decreased since 1996. This viable incendiary devices, and of the This corresponds with the incitement 2014 IN ATTACKS EMPLOYING METHODOLOGY OF is partly due to tighter restrictions prevalence of the methodology among of attacks using such weapons in since 1990 involved explosives Markets since 1990 involved placed on materials needed to make left- and right-wing actors. extremist media. However, these a CBRN component IMPROVISED WEAPONS LIKE ATTACK IN ADVANCED explosives and increased capabilities methodologies continue to represent VEHICLES AND BLADED/ MARKETS SINCE by intelligence agencies to detect and a small proportion of all attacks. BLUNT WEAPONS THE 1990S disrupt plots using explosives. TERRORISM THREAT & MITIGATION REPORT 2019 25/ 53

AVERAGE NUMBER OF ATTACKS IN ADVANCED MARKETS BY OFFENDER TYPE OBSERVATIONS & / 1990-2018 2010-2018 in focus CONTEXT There has been a sharp decrease in 20 0 the number of separatist attacks in advanced markets since the 1990s, with separatists now accounting for the least active ideology after anti-government extremists.

Far-right terrorists were the second most active offender type in advanced 200 0 markets during the 1990s, although this decreased substantially after the millennium. However, since 2011 there has been a sustained rise in the number of attacks by right-wing terrorists. The far-right actors were the most prolific offender type in 2018.

Islamist extremists were responsible 10 0 for a relatively small proportion of all attacks in Advanced Markets from 1990-2010, but were far more lethal than other offender types. Since 2014, the frequency of Islamist attacks has increased significantly, corresponding with the rise of Daesh and its

Number of attacks Number of attacks incitement of attacks in the West. 100 20 % 36of attacks in Advanced Markets in 2018 attributed to right-wing terrorists 0 10 % 55of attacks in Advanced Markets in 1990 attributed to separatists

0 0 FAR-RIGHT TERRORISTS 1990 1992 199 199 199 2000 2002 200 200 200 2010 2012 201 201 201 2010 2011 2012 201 201 201 201 201 201 WERE THE SECOND MOST ACTIVE OFFENDER TYPE Anarchists Anti-government Extremists Far Left Far Right Islamist Extremists Separatists IN ADVANCED MARKETS DURING THE 1990S TERRORISM THREAT & MITIGATION REPORT 2019 26/ 53

NUMBER OF ATTACK FATALITIES IN ADVANCED MARKETS BY OFFENDER TYPE NIRT ATTACK FATALITIES ADDITIONAL INFORMATION/ / 1990-2018 (excl. 9/11) IN THE UK MAINLAND AND NI / 1990-2018

220 2010s

200 2000s 180

160

140

120 1990s

100

80 Number of attack fatalities

60 Northern Ireland UK Mainland 40

20

1990 1991 1992 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 Anti-government Extremists Anarchists, Far Left, Environmental, Student Far Right Islamist Extremists Separatists

OBSERVATIONS & CONTEXT Attack fatalities due to Northern Ireland that was ongoing at the time. However, Related Terrorism were substantially since the 1998 Good Friday Agreement, Islamist extremists have been the casualty attacks by Islamist actors majority of attack fatalities in the UK, targeting property). However, since higher in the Province than on the UK deaths on the UK mainland due to NIRT most lethal threat actors in Advanced in Advanced Markets prior to 2001. if the entirety of the UK is considered 2011, right-wing terrorists have mainland during the 1990s. The majority have been extremely low, with only one Markets since 1990 by a wide margin. rather just mainland Great Britain). increasingly employed methodologies of attacks carried out by the Irish in the 2000s and two in the 2010s. Even excluding 9/11, attacks by Despite being the most active offender similar to Islamist extremists, with the Republican Army on the UK mainland, Similarly, attacks in the Province have Islamist extremists accounted for type, separatists caused markedly Right-wing terrorists have become intent of causing mass casualties. such as the 1993 Bishopsgate dropped substantially. Attacks in almost three times the number of fewer casualties in advanced markets much more lethal in the past decade. In 2018, right-wing terrorists were bombing, targeted financial centres Northern Ireland are likely to continue, casualties as the next deadliest than either Islamist or right-wing While responsible for a large proportion responsible for more fatalities in that had a high-economic impact but however, due to uncertainty surrounding offender type (right-wing terrorists), extremists (however, violent dissident of attacks in the 1990s, they caused Advanced Markets than any other caused very few casualties. Attacks in the Irish border following Brexit, and despite there being very few mass republicans were responsible for the relatively few deaths (with attacks often offender type. Northern Ireland were extremely high there is a possibility that this could during the 1990s, reflecting the conflict begin to affect the UK mainland too. TERRORISM THREAT & MITIGATION REPORT 2019 27/ 53

STATISTICAL METHODOLOGY

The underlying data was sourced Mappings As a reference point, the NaCTSO Calculations Exclusions Geographical criteria from the Global Terrorism Database The original GTD data uses a very definition of a crowded place was The GTD does not provide a unique Several events in the GTD data had The Swiss Re category of “Advanced (‘GTD’). Their methodology is well granular schema for attributing aligned with the GTD target types number of victim deaths for events; high numbers of victim deaths but were Markets” was applied to the GTD to documented in the GTD codebook, terrorist attacks to actors, resulting and sub-types to create the “Private rather, it includes the deaths of likely not genuine cases of terrorism; create a set of events which took place available here https://www.start.umd. in 468 unique terrorist actors in Citizens & Crowded Places grouping)1. terrorist with their victims, as well these were excluded from the data and in countries with advanced insurance edu/gtd/downloads/Codebook.pdf Advanced Markets alone, and 2,484 All these target schema changes were as recording the number of terrorist are listed below: protection. Swiss Re’s definition of actors globally across the date range. performed using a Python script. deaths in a separate field. Advanced Markets is based on Please note that the GTD does not Therefore, in order to identify trends, it Additionally, when the number of • 1992 Taiwan Hotel insurance density and penetration provide data for 1993. Records for was necessary to group similar actors Weapons were classed by both their deaths is unknown, the GTD records Fire(ID:199210200007) rates (as a percentage of GDP). incidents in 1993 were lost prior to the together. This mapping scheme can complexity to acquire and execute this as –99, thus leading to incorrect University of Maryland’s compilation be provided to readers on request. an attack with, and their damage totals when the deaths across events • 1996 Taiwan County Magistrate Within this grouping, Israel and of the GTD from multiple collection potential. This mapping scheme can are added. The number of victim Murders(ID:199611210005) Northern Ireland were excluded, efforts, and retrospective analysis was The GTD has 23 target types and be provided to readers on request. deaths for each event was therefore leaving a total of 29 countries: able to identify only a small proportion 207 target sub-types. These were calculated using a python script; • 2001 Zug Local Assembly Australia, Austria, Belgium, Canada, of estimated events to have occurred grouped into two new target schema Any attack within Advanced Markets events with an unknown number Shooting(ID:200109270003) Cyprus, Denmark, Finland, France, in 1993. Therefore, the database – “target types”, with seven target with more than seven deaths had of deaths (recorded as –99 in the Germany, Greece, Hong Kong, excludes the entire year for categories; and, “granular target a unified attack name assigned to GTD) were treated as having no • 2013 Fertiliser Factory Fire (Texas) Iceland, Ireland, Italy, Japan, consistency. A full explanation can be types” with 25 target categories. it to facilitate highlighting these victim deaths. (ID:201304170041) Luxembourg, Malta, Netherlands, found on p.4 of the GTD codebook. The definitions of these grouping can significant events in various graphs. Norway, New Zealand, Portugal be provided to readers on request. All mappings were applied using a • 2016 EgyptAir Plane Crash Singapore, South Korea, Spain, The following outlines the additional The purpose of these two target python script. (ID:201605190058 Sweden, Switzerland, Taiwan, the data cleaning and enhancement work schemas is to provide a high-level United Kingdom (excl. Northern that was conducted using the raw view of the target selection trends Ireland), and the United States. GTD data. (“target types”), as well as a more granular and sector-focused view (“granular target types”). 1 https://assets.publishing.service.gov.uk/ government/uploads/system/uploads/ attachment_data/file/820082/170614_ crowded-places-guidance_v1b.pdf TERRORISM THREAT & MITIGATION REPORT 2019 28/ 53 04/ TERRORISM THREAT & MITIGATION REPORT 2019 29/ 53

TERRORIST DRONES COULD BE USE OF EMPLOYED WITH LITTLE DRONES OR NO MODIFICATIONS Terrorists have long had the intent, To date, terrorist use of drones and in some cases the capability remains largely confined to active to used unmanned aerial vehicles conflict zones. This is partly due to TO CAUSE PUBLIC (drones) in attacks. However the the continued viability of simpler, proliferation of cheap, commercially lower risk methodologies for causing DISRUPTIONS AND available drones has significantly mass casualties – the primary intent increased the likelihood of them of most extremists operating in the SPREAD FEAR being used in attacks. West. A related factor is the difficulty of effectively weaponising drone The well-document use of drones by technology without relevant material Daesh in Iraq and Syria, for targeting and expertise. Despite this, drones and surveillance and to deliver could be employed with little or explosive payloads demonstrated no modifications to cause public Eden Stewart the potential for such systems to be disruptions and spread fear. Senior Analyst exploited by terrorists. By 2017/18, Therefore, changes in the intent / Pool Re Daesh’s use of drones had become and targeting priorities of malicious highly sophisticated. Other non-state actors could result in much greater Eden Stewart joined Pool Re as an actors subsequently adopted the exploitation of drone technology analyst on the Risk Awareness team technology for use in combat, and, in for terrorist purposes. in October 2017. Prior to joining Pool August 2018, off-the-shelf ‘quadcopter’ Re, Eden worked as an intelligence modified to carry IEDs were used in an analyst specialising in cybercrime. attack on the Venezuelan President at Eden holds a Master’s Degree in a parade in Caracas. Security and Intelligence Studies from Brunel University, and a BA in History from the University of Leeds. TERRORISM THREAT & MITIGATION REPORT 2019 30/ 53

THE THREAT DRONES AS DRONES AS DISPERSAL METHOD FOR CHEMICAL, TO AVIATION AIRBORNE IEDS BIOLOGICAL OR RADIOLOGICAL (CBR) AGENTS The aviation sector remains a priority of an aircraft. However, modified Drones potentially confer numerous The advantages of drone technology The most destructive methodology target for terrorists, and Islamist drones potentially pose a greater advantages to terrorists preparing to terrorists are less pronounced if the in the UK would be if a terrorist actor extremists in particular. There has threat to inflight aircraft. Airliners are attacks, including their ability to intent is to cause indiscriminate mass used a drone to disseminate chemical, been considerable public speculation most vulnerable to drone strikes while bypass terrestrial security measures casualties. The ubiquity of relatively biological or radiological material. about the potential for drones to be at low altitudes during take-off or and carry out attacks remotely, unprotected crowded places which do The use of CBR material in any used to target in-flight commercial landing. Therefore, exposures most thereby reducing the risk of detection not require circumvention of terrestrial circumstance could cause a significant aircraft. At present, it is unclear how at risk from attacks on aviation and disruption. However, to exploit security measures means most current amount of damage within a very short much of a threat drones pose to civil involving drones are properties in the technology fully, terrorists must UK threat actors will likely forego the period of time. This is assessed to aviation, or whether terrorists have built-up areas below flight paths near first be able to weaponise drones in complexity of using drone-borne IEDs be of low probability but with high given serious consideration to using airports, including airport terminals their possession. The relatively small in favour of simpler, conventional impact against all target types. the technology to target aircraft. To and buildings themselves. size and weight of commercially conveyance methods. However, any date, there have been few verified available drones restricts their utility changes to the targeting priorities of A chemical attack, utilising a drone, in collisions between airliners and More likely than attacks on aircraft as an unmanned firearms platforms UK-based terrorists could increase the the UK is considered to be possible3, drones, and little testing has been hulls is the use of drones to disrupt or kinetic projectiles. Therefore, likelihood of drones being used as although manufacturing a military done on the potential effects of commercial aviation operations by from flying in airspace where drones in these scenarios, drones are airborne IEDs. grade CBR device is complex and collisions or the ingestion of drones invading protected airspace around have been sighted. Threat actors can more likely to be used by terrorists risky; the use of HAZMAT material is by aircraft engines. However, the likely airports; a swarm of drones against exploit this to prevent aircraft to convey either explosive or The relatively small payload of most more likely, for example a petrol damage of either scenario involving an aircraft cannot be discounted. operations and cause significant chemical, biological or radiological commercial drones in the UK also tanker being hijacked and then set an unmodified drone is not believed High safety standards and low risk disruption, as demonstrated by events (CBR) material to a target. limits their utility as a delivery method; ablaze in a crowded place. Such an to be materially worse than that appetites in commercial aviation mean at Gatwick Airport in December 2018. the most popular drones currently sold incident would cause considerable caused by bird strikes, and it is safety regulations in the UK and other There is potential for non-damage Explosives: Commercially available in the UK have a payload of less than business interruption and there would unlikely to result in the complete loss developed countries prohibit aircraft business interruption claims in a similar drones have been adapted by terrorists 2kg, while few carry more than 4kg. likely be a large police cordon erected scenario if it was certified as a terrorist for use both as loitering munitions and The Manchester Arena and Parsons in all areas deemed to have been attack. However, the perpetrator unmanned aerial combat vehicles. Green attacks in 2017 employed IEDs affected by the attack. The material or DRONES POTENTIALLY would have to be found to have had While the transmission of such weighing approximately 14kg and 4kg substance would require identification terrorist motivations. Most proscribed methodologies from overseas to the respectively. Therefore, while possible and the subsequent decontamination CONFER NUMEROUS terrorist actors in the UK are currently UK is a concern, the difficulties in either to use currently available drone process could be extensive in terms considered less likely to employ such acquiring off-the-shelf explosives or technology to deliver IEDs, the size of time and area. If a drone was used ADVANTAGES TO TERRORISTS tactics. However, the use of drones manufacturing homemade devices and destructive power of such devices as a delivery method several areas to disrupt commercial aviation would mean the likelihood of such would be limited and, therefore, more could be contaminated in a short PREPARING ATTACKS represent a viable methodology for tactics being employed in the UK is suited to targeted attacks than period of time. The small, localised actors whose main intent is to inflict low. Furthermore, drones are a less indiscriminate, mass casualty ones. event in Salisbury left some damage on the UK’s economy – as reliable delivery mechanism compared businesses closed for months, demonstrated by Extinction Rebellion2. to vehicle or person-borne IEDs, and and one for over a year. the requisite modifications demand specialist knowledge and material, increasing the risks associated with their use. TERRORISM THREAT & MITIGATION REPORT 2019 31/ 53

SIGNIFICANT ACTIVITY/ CARACAS DRONE ATTACK

Two drones carrying IEDs targeted a military parade in an alleged assassination attempt against Maduro. One drone detonated above the parade, injuring soldiers below. The other crashed into a nearby building. The drones’ failure to reach Maduro was possibly due the use of electronic countermeasures by Venezuelan security forces. The limited damage caused by the attack reflects the small payloads of such drones. The incident was the first use of commercially available drones as aerial IEDs outside a conflict zone. Further attacks of this nature are anticipated in future.

DATE: 04 Aug 2018 LOCATION: Caracas, Venezuela OFFENDER: Unknown METHODOLOGY: Drone-borne Improvised Explosive Device DEATHS: 0 INJURIES: 8 TERRORISM THREAT & MITIGATION REPORT 2019 32/ 53

ADDITIONAL INFORMATION/

MITIGATING THE RISK Current counter-drone technology built-up areas, and other solutions malicious use of drones from legal, can largely be divided into ‘detectors’ like jamming carry the risk of targeted largely recreational activity. Equally, and ‘effectors’; the former are drones causing collateral damage improved recording and reporting designed to detect, track and classify when downed. Furthermore, there of incidents will provide a better drones, while the latter are intended is currently no legal basis for private understanding of the threat and help to bring down hostile drones. Most bodies to seize or destroy drones inform the development of incident countermeasures have been operating over private property. response guidance. Other potential designed for the military market and Consequently, while detector regulatory responses include are therefore often unsuitable for technology can by employed in the mandating the incorporation of safety use in a civilian environment (due to UK by private users with the correct features such as ‘geo-fencing’ (the collateral damage issues). The civilian permissions, the use of effectors is establishment of virtual boundaries for drone market is also being inundated currently restricted to law enforcement geographic areas, the transgression with new and evolving drone designs bodies. Private organisations of which would override the and technologies. Therefore, the considering the acquisition of drone commands of the drone operator) detector technology needs to countermeasures should ensure into commercially available drones. continue to adapt at pace to mitigate that they fully understand procured Although such measures could be the full spectrum of threats. Thus, technology and have the relevant circumvented by more sophisticated while detecting and countering knowledge and the permissions terrorists with the requisite drones is largely possible with current necessary for its correct employment. knowledge, it would make the technology, doing so in a safe, legal malicious use of drones more difficult. and proportionate manner in a The relative immaturity of drone domestic setting remains challenging. technology means that regulatory For most businesses, investment in Both detectors and effectors have the responses to the threat continue to specific counter-drone technology is potential to interfere with electronic mature and there is currently no ‘silver unnecessary, with resources better and communications systems and bullet’ in countering them. While committed to improving awareness technologies (such as mobile phone wide-ranging restrictions on the use of the threat, and developing signals) and must therefore be of drones are unlikely, forthcoming procedures for identifying, reporting judiciously used to avoid disrupting regulations aim to ensure drones are and responding to drone sightings. many of the systems modern life only employed by competent users Understanding the implications of depends on. This challenge is for legal purposes. While unlikely trying to impose post-incident cordons exacerbated in signal-rich to deter terrorists from acquiring on something ‘which you can’t see’ environments like airports. The use or using drones, this, and the should also be considered by security of effectors is also problematic; establishment of operating norms directors and risk managers. kinetic effectors (e.g. missiles, lasers, and best practices, will enhance the firearms etc.) are unsafe to use in ability of authorities to differentiate the TERRORISM THREAT & MITIGATION REPORT 2019 33/ 53

RECENT DEVELOPMENTS TERRORIST USE OF CYBER IN OFFENSIVE CYBER CONTINUES TO BE PRIMARILY OPERATIONS AND IN TRADITIONAL AREAS LIKE THE IMPLICATIONS COMMUNICATIONS AND FOR TERRORISM PROPAGANDA Pool Re is continuing to assess However, the potential to exploit cyber terrorist use of cyber, working with our will always be present. And various partners at the Centre for Risk Studies factors could rapidly increase terrorists’ at Cambridge University’s Judge capabilities. These might include Business School. Our focus is on the specialist support from a hostile nation potential for terrorists to use cyber for state, the appearance of destructive destructive effect to property. This is malware on the open market (either not an easy area to assess. Terrorists as a result of unauthorised disclosure are hard targets to penetrate even for of nation state capability, or the the best intelligence agencies, and development and release of malware there is a lot of chaff to wade through by an independent actor), or the in open source material, the truth of availability of a sympathetic insider Conrad Prince which is often hard to assess. whose job might make a particular / Senior Cyber Terrorism cyber-attack more achievable. Advisor to Pool Re That said, there remains little or no evidence of terrorists developing One factor to keep an eye on is any Conrad Prince served as the Director cyber capabilities that have destructive evidence of terrorists using cyber for General for Operations and Deputy effect. Terrorist use of digital more sophisticated purposes, which Director of GCHQ from 2008 to 2015. technology continues to be primarily in might stop short of disruptive or In those roles he led GCHQ’s traditional areas like communications destructive effect, but which get them intelligence operations and oversaw and propaganda. Indeed, there are along that path. At present there is little the development of the UK’s national some indications that the use of the sign of this. However, there is arguably offensive cyber capability. From 2015 internet for sophisticated propaganda at least one exception, in the shape of to 2018 he was the UK’s first Cyber by Islamist terrorists is on the decline, the Palestinian group, Hamas. Security Ambassador, leading cyber perhaps in part as a result of security capacity building work with disruption operations by Western Precise attribution is always going a number of key UK allies. He retired agencies. A few references to cyber to be difficult, as is saying for sure after 28 years of Government service in have been noted in extremist whether particular cyber activity is January 2018, and now holds a range publications, but these are not truly directed by a specific group. of advisory roles in cyber and security. prominent. And there is some However, there is good evidence to suggestion of Islamist terrorist groups show Hamas moving up the ‘cyber seeking to hijack dormant Twitter value chain’ over the last few years. accounts for propaganda purposes, At least a decade ago, they were but this is not very sophisticated stuff. conducting website defacements and sporadic denial of service attacks. More recently, however, analysts have concluded that Hamas has been undertaking more sophisticated cyber espionage operations. TERRORISM THREAT & MITIGATION REPORT 2019 34/ 53

In 2017, the Israeli Defence Force (IDF) We can only speculate as to the That said, this is still a long way from detailed an alleged Hamas cyber details here, but it is possible that the use of cyber-attack for serious espionage campaign targeting IDF the cyber-attack the Israelis say they destructive purposes. There are soldiers by initiating chats through fake defeated was of a more aggressive relatively few examples of destructive online profiles. These culminated in kind than the espionage activities attacks taking place, but it has persuading the soldier to download previously undertaken by Hamas. The happened. The most striking cases a fake video chat app, which was in fact that it took place during a period include Stuxnet, the cyber sabotage fact malware infecting their mobile of conventional kinetic operations – of centrifuges at an Iranian uranium device, reportedly stealing data and and was perhaps co-ordinated enrichment plant in around 2007; an geolocating it. The cyber company with them – may also be relevant. attack on a German steel mill reported Kaspersky reported on the same by the German authorities in 2014, campaign. Then in Summer 2018 It is unclear whether this has put paid which prevented a blast furnace from there was reporting of a further Hamas to Hamas’ cyber capabilities. Ten days being shut down, causing significant cyber espionage campaign, along after the IDF air strike, media reporting damage; and the 2015 attack on the similar lines, followed a few weeks indicated that unspecified hackers had Ukrainian power system, which took later by allegations that Hamas had briefly interrupted an Israeli webcast of around 30 substations offline denying released mobile malware that imitated the Eurovision song contest semi-final power to a quarter of a million people the Israeli rocket warning app. by replacing the broadcast with a fake for several hours. warning about an attack on Tel Aviv. The story of Hamas cyber operations The Israeli national broadcaster And concerns are growing about reached a dramatic culmination in May blamed Hamas, though there is no hostile nation state use of offensive this year. During a period of intense hard evidence for this. cyber for destructive effect. In June fighting in the Gaza Strip, the IDF 2019, Chris Krebs, Director of the US reported it thwarted an unspecified The Hamas example is interesting in that Department for Homeland Security’s Hamas cyber-attack, which they it seems to demonstrate terrorists using Cybersecurity and Infrastructure described as aimed at ‘harming the cyber for more sophisticated purposes Security Agency stated that his agency quality of life of Israeli citizens’. The than simply propaganda and deploying was aware of ‘a recent rise in malicious IDF then launched an air strike on the a range of capabilities in doing so. It is cyber activity directed at US industries building reportedly housing Hamas’s impossible to say how far Hamas may and government agencies by Iranian cyber team. Following the strike, the have got with this progressive increase regime actors and proxies’. Krebs IDF announced that Hamas no longer in the scale of their cyber operations. noted that Iranian actors were had cyber capabilities. But the fact it culminated in Israeli ‘increasingly using destructive ‘wiper’ military action is striking. attacks, looking to do much more than just steal data and money’. TERRORISM THREAT & MITIGATION REPORT 2019 35/ 53

ADDITIONAL INFORMATION/

Meanwhile, there has been continued officials as stating that the USA was An acceptance that cyberspace is reporting from cyber security experts stepping up its cyber incursions into inevitably a domain of destructive relating to threat actors associated Russia’s electric power grid, placing action, not just propaganda or with the TRITON malware. This implants on the electricity network that espionage, and that all nations malware was used in a 2017 attack on could be used for disruptive purposes with serious aspirations will develop a Saudi chemical and refining facility when needed. It is impossible to judge and potentially deploy destructive during which it apparently successfully the truth of this report, which the capabilities. At a time where there moved from the facility’s administrative DoD described as ‘inaccurate’. is little by way of accepted cyber IT systems onto its operational norms of behaviour or deterrence technology or industrial control Meanwhile, there was widespread doctrine, this will be a cause of systems. Researchers have suggested reporting shortly afterwards that the concern for some. that the purpose of this attack was USA had launched a cyber-attack on not to steal data but to enable the Iranian rocket and missile associated We may still be a long way from disruption of the facility’s operations. command and control infrastructure, terrorist groups using these against the backdrop of escalating capabilities. But as they become In June this year, a cyber threat tension in the region including the more widely developed and adopted, company that has been studying the downing by Iran of an American the potential for terrorist use threat actor associated with TRITON unmanned aerial vehicle. increases, not least through the kinds reported repeated reconnaissance of factors described earlier, such as attempts targeting electric utilities in In the UK, there has been press support from a state sponsor. For this North America, Europe and Asia speculation suggesting the impending reason alone we need to retain a Pacific, asserting additionally that creation of a national cyber force, clear focus on this potential threat multiple industrial control system further developing the UK’s own and how it develops in our unstable vendors had also been targeted, offensive cyber capabilities. This international environment. perhaps to enable supply chain would reportedly combine resources attacks. There are different views Russia and China as strategic threats, from GCHQ and MoD, potentially with as to the identity of the threat actor, THERE REMAINS LITTLE OR the strategy states that the USA will a significant uplift in funding. GCHQ’s with cyber security company FireEye ‘conduct cyberspace operations to… Director, Jeremy Fleming, has spoken 1 https://www.bbc.co.uk/news/uk-england- suggesting it is associated with Russia. NO EVIDENCE OF TERRORISTS prepare military cyber capabilities publicly of UK offensive cyber manchester-49645627 to be used in the event of crisis operations against Daesh, and of the 2 https://www.hstoday.us/subject-matter- So there are continuing indications of DEVELOPING CYBER CAPABILITIES or conflict’ and that the DoD will need for nations to have the ability, areas/terrorism-study/terrorists-use-of- hostile nation states exploring cyber ‘persistently contest malicious cyber in extremis and in accordance with drones-promises-to-extend-beyond- capabilities with potentially destructive THAT HAVE DESTRUCTIVE EFFECT activity in day-to-day competition’. international law, ‘to project cyber caliphate-battles/ effect. And the West is responding. In power to disrupt, deny and degrade.’ 3 https://uk.reuters.com/article/uk-britain- 2018 the US Department of Defense This more assertive tone may be being security/possibility-of-chemical-attack-in- issued its new cyber strategy, setting reflected in actual action. In June this Taken together, these developments uk-getting-closer-security-minister- out the ‘defend forward’ doctrine. The year the New York Times reported might be seen to reflect an increasing idUKKCN1MJ1HW tone is striking. Specifically calling out current and former US government normalisation of offensive cyber. TERRORISM THREAT & MITIGATION REPORT 2019 36/ 53

CBRN PROLIFERATION AND THE THREAT TO THE UK There have been no successful Eighteen months after the poisoning With most losses in such a scenario terrorist attacks involving chemical, of Sergei and Yulia Skripal, Salisbury’s likely to arise from the response of the biological, radiological or nuclear economy continues to suffer from authorities and the public, business (CBRN) material in the UK or other decontamination and clean-up should prepare for such a crisis by developed economies over the past operations and business interruption planning and rehearsing relocation 12 months. However, terrorists retain costs. This relatively small incident and alternative work systems as the intent to employ such weapons also put significant pressure on part of their resilience preparation. against the UK, due to their potential emergency services and specialist This should include appropriate crisis to kill and maim on a large scale, and responders, underlining the potential communication tools to reassure their outsized psychological impact for CBRN attacks to overwhelm and inform perceptions to ensure that relative to conventional methodologies. authorities and cause catastrophic fear, uncertainty and doubt do not human and financial losses. unnecessarily exacerbate the situation. Jerry Smith While the challenges for non-state / CHC Consulting actors for successfully acquiring, weaponising and deploying CBRN Jerry Smith OBE is a senior partner material means such attacks are at CHC Global, an independent unlikely, advances in technology TERRORISTS RETAIN THE London-based special risks and the dissemination of terrorist intermediary and advisory company. tradecraft online have reduced these INTENT TO EMPLOY CBRN He has over 25 years’ experience barriers. Furthermore, the continued of security risks and crisis response, use of chemical weapons by state WEAPONRY AGAINST THE UK specialising in the management actors has underlined the fragility of CBRN perils. He is a former of arms control agreements and DUE TO THEIR POTENTIAL TO bomb disposal officer and increased the risk of proliferation KILL AND MAIM ON A LARGE UN weapons inspector. to terrorist groups. Equally, while Daesh’s territorial collapse in Iraq SCALE, AND THEIR OUTSIZED and Syria has limited the group’s ability to develop and deploy CBRN PSYCHOLOGICAL IMPACT weapons, the phenomenon of ‘returning fighters’ may have dispersed those members with relevant knowledge, increasing the risk of CBRN attacks in other regions. TERRORISM THREAT & MITIGATION REPORT 2019 37/ 53

BIOLOGICAL CHEMICAL ATTACKS CONVERGENCE As the Syrian conflict moves to its next Biological attacks thankfully remain There is also significant concern phase, there has been a reduction in THERE IS even more infrequent than chemical around the increasing levels of the reporting of chemical weapon events. Though biological weapons antimicrobial resistance (AMR), attacks. Along with the improving A REALISTIC have been used in war for centuries, whereby harmful bacteria are evolving fortunes of the Assad regime, it is producing an effective weaponised immunity to many antibiotic drugs. possible that the successful introduction POSSIBILITY pathogen remains difficult. However, Warnings have already been given of an attribution mechanism within the the smaller scale use of toxins (naturally by a number of government health chemical weapons treaty guardians, THAT occurring poisons) by non-state actors organisations. Without integrated and the Organisation for the Prohibition of has been seen on recent occasions. coordinated action, there is a realistic Chemical Weapons (OPCW), has been PREVIOUSLY Two individuals in Cologne are currently possibility that previously treatable a measure of deterrence. The self-same TREATABLE accused of acquiring and preparing to diseases and infections will again organisation sent an international team use ricin, a toxin from the castor bean become a risk to human health. The of investigators to conduct independent DISEASE AND plant, in a terror attack in Germany. US Biomedical Advance Research analysis of the Salisbury attack, with and Development Authority (BARDA) their results supporting the UK’s INFECTIONS On a wider scale, we have seen the considers AMR now to be a homeland identification of Novichok, a rare enduring tragedy of the Ebola outbreak security issue not only because of and super-toxic nerve agent. WILL BECOME in the Democratic Republic of Congo. the reduction in capability to treat a Whilst this has not originated from malicious bacterial attack, but also A previous poisoning attack in 2017 A RISK TO malicious intent, it has certainly been because it threatens the viability of occurred against Kim Jong-nam, HUMAN HEALTH exacerbated by violent non-state mass medical intervention in the case the half-brother of the current North actors, as well as an under-developed of a conventional terrorist event. Korean leader, who was killed by VX healthcare system. Although there is nerve agent in Kuala Lumpur airport little direct link to the UK, the outbreak departures. The nature of the attack and the international community’s and the chosen poison suggests reaction indicates how a response to that the use of a chemical weapon an affected population could have a for targeted extra-judicial killings substantial impact on outcomes. remains a tool for governments, content to have implausible deniability of their direct actions. Whilst these two events were not declared as terrorism, the blurring of division between state and non-state actors means it is entirely conceivable that a future use of chemicals in an attack could be ‘contracted out’ to a proxy organisation into what could be defined as a terrorist attack. TERRORISM THREAT & MITIGATION REPORT 2019 38/ 53

NUCLEAR NEW UK REFORMS CBRN PROLIFERATION TECHNOLOGIES RESPONSE CAPABILITY Understandably, nuclear threat The increasing civilian use and In the wake of the Salisbury poisoning concerns tend to focus on weapons technological advances of UAVs (drones) attack, the government announced and, more recently, the development have the potential to allow terrorist actors £48 million to fund a new ‘Chemical efforts by Russia of a missile propelled to deploy toxic material directly to a Weapons Defence Centre’ in by a nuclear engine. State-on-State target. Such delivery systems can be addition to £11 million to boost the issues, be it US-Iran or Pakistan-India, built or modified to overcome a range of development of broader counter- may appear remote. But a growth in control measures, such as geo-fencing CBRN capabilities. The Army has now weapon numbers, particularly of and GPS location spoofing, although this taken responsibility for CBRN defence smaller battlefield systems, potentially requires a degree of specialist knowledge and formed a Royal Engineers increases the vulnerability of illicit beyond the capability of many terrorist regiment to lead a military response. acquisition by a non-state actor with actors. However, consideration of further intentions of deployment in the West. drone countermeasures is likely to As part of the 2018 ‘Step Change’ continue apace. initiative, a national policing body has Perhaps of more strategic interest is been driving for closer collaboration the upwards trend in the construction The use of a cyber means to disrupt with commercial entities that of nuclear power plants, with over 450 industrial control systems (ICS) is contribute in supporting counter- facilities in use globally and responsible another area where hazardous advanced gene manipulation could terrorism and resilience efforts. Whilst for generating 11% of the world’s industrial material, be it chemical, change the global risk assessment THE USE OF A CYBER MEANS there appears to have been minimal electricity. A number of countries, biological or radiological in nature, for so-called designer pathogens. commercial involvement in the including Russia and South Korea, could be maliciously released. There In 2017, a Canadian university was TO DISRUPT INDUSTRIAL Salisbury and Amesbury remediation now have turn-key plants available is increasing recognition that more able to purchase various biological work, the Department for Farming for sale. The nuclear safety watchdog, must be done to ensure cyber materials that allowed them to ‘make’ CONTROL SYSTEMS IS ANOTHER and Rural Affairs (DEFRA) has the the International Atomic Energy security extends to ICS networks. the horsepox virus in the university responsibility to lead on private sector Agency (IAEA) has a number of well- laboratory. Whilst this is harmless to AREA WHERE HAZARDOUS involvement in contamination removal established rules around reactors Perhaps the most troubling technology humans, experts state that it is not from a terrorist CBR attack. ‘Defra capable of making nuclear material for issue on the horizon is that of synthetic a great leap to alter a number of INDUSTRIAL MATERIAL COULD CBRN Emergencies’ (formerly known weaponisation. So, the principal risk biology. Warnings from organisations elements to develop a human BE MALICIOUSLY RELEASED as the Government Decontamination is more to do with the acquisition and as disparate as the World Economic pathogen, such as smallpox. Such Service, GDS) coordinates contractor- use of nuclear fuel as a radiological Forum, the Wellcome Foundation a disease could have a devastating involvement in contamination clean- weapon, rather than that of a bomb. and Nuclear Threat Initiative (NTI) all impact on a population. up, with suppliers typically coming With nuclear plants now being express concern that the advent of from the industrial chemical and waste constructed in developing nations, management sectors. It is entirely there is a risk that financial constraints plausible that in a larger CBRN event could lead to the IAEA-mandated all available resources, both civilian safety and security governance not and military, would be required. being followed as well as it should be. This again could be an opportunity for terrorists to acquire material for use in some form of improvised device. TERRORISM THREAT & MITIGATION REPORT 2019 39/ 53 05/ TERRORISM THREAT & MITIGATION REPORT 2019 40/ 53

HOW TERRORISTS THINK ABOUT THE ECONOMIC IMPACT OF ATTACKS It has long been recognised that Terrorist violence is often portrayed in the terrorism can be a remarkably media as mindless and indiscriminate, effective low-cost form of conflict. but in reality, terrorist attacks are usually IDEOLOGY SPELLS OUT WHAT For modest outlays on the part the result of deliberate and considered of perpetrators, terrorist violence planning, and the weighing up of can inflict disproportionately high different choices and options. Some TARGETS ARE CONSIDERED economic costs. The potential for terrorist attacks take years to plan. heavy economic impacts was a key Others just days or even hours. LEGITIMATE AND WHICH factor behind the formation of Pool Re in the UK and other terrorism For clandestine and secretive actors, reinsurance schemes internationally. terrorist movements are often ONES ARE PRIORITIES surprisingly explicit around their While the insurance sector is aware ideologies and strategy. Most publish Andrew Silke of the possible large economic and manifestos and guides intended to Professor of Terrorism, commercial impacts of terrorism, educate new recruits and supporters Risk and Resilience what is less well understood is how and these are frequently widely / Cranfield Forensic Institute terrorists themselves appreciate available on the internet. For those / Cranfield University and think about the economic interested in understanding the drivers consequences of their attacks. behind terrorist targeting, these can Andrew Silke is Professor of To what extent does this play a role provide crucial insight into the nature Terrorism, Risk Management and in terrorist targeting and strategy? of the threat. Resilience at Cranfield University. What role does ideology play in He is internationally recognised as the process? Are some terrorist a leading expert on terrorism and movements more likely to select counter-terrorism and has published economic and commercial targets widely on these subjects. He is a than others? This paper aims to shed member of the UK Government’s light on how and why some terrorists Cabinet Office National Risk deliberately aim for economic targets Assessment Behavioural Science and impacts while others ignore them. Expert Group. TERRORISM THREAT & MITIGATION REPORT 2019 41/ 53

IDEOLOGY IS A CRITICAL FACTOR IN TERRORIST TARGET SELECTION Ideology sets the wider context for the Such insight can be followed up by To make the Six Counties as at terrorist movement. It establishes who examining further documentation present and for the past several the enemy is and what the terrorists such as the instruction manuals many years ungovernable except by are fighting to achieve. Ideologies also groups produce and use. Having colonial military rule. spell out what targets are considered established an appropriate range of legitimate and which ones are targets for violence, these manuals • To sustain the war and gain support priorities. Some groups place a high and other writings often follow this for its ends by National and importance on economic impact. by providing instruction to members International propaganda and For example, with regard to Islamist on how to plan, prepare for and publicity campaigns. terrorism, the writings of Al Qaeda’s then carry out attacks (e.g. giving current leader, Ayman al Zawahiri, instructions on how to construct • By defending the war of liberation consistently stress a focus on weapons and carry out by punishing criminals, collaborators economic impact: reconnaissance of potential targets). and informers.

One sees the same trends with other Interestingly, from the IRA’s “The first front is to inflict terrorist groups which come from very perspective, economic impact was losses on the western different contexts and backgrounds. the second most important part of crusader, especially For example, the IRA’s instruction their overall strategy and certainly an manual, The Green Book, outlines examination of the IRA’s campaign to its economic very clearly the overall strategy of of violence prior to the 1998 Good infrastructure with the organisation for new members. Friday Agreement shows a repeated focus on hitting high profile economic strikes that would make This states that the IRA’s aims are to and commercial targets. The current it bleed for years. The carry out: capacity of active dissident groups to strikes on New York, follow suit is much more limited, but • A war of attrition against enemy a desire to do so appears to remain. Washington, Madrid personnel which is aimed at causing as and London are the many casualties and deaths as possible best examples for that.” so as to create a demand from their people at home for their withdrawal. – Ayman al Zawahiri 2006 • A bombing campaign aimed at making the enemy’s financial interest in our country unprofitable while at the same time curbing long term financial investment in our country. TERRORISM THREAT & MITIGATION REPORT 2019 42/ 53

POOL RE CLAIMS POOL RE CLAIMS ECONOMIC COST OF TERRORISM / London, UK / UK (excluding London) / 1990-2018 / Advanced markets

Pool Re Claims Economic cost of terrorism

1993 Bishopsgate Bombing £840,034,282 1996 Manchester Bombing £508,528,92 1992 Baltic Exchange $938m 1996 Manchester Bombing $1b Building, London 1993 Bournemouth Bombings £1,403,604 2001 BBC Television Centre Bombing £1,323,545 2001 11th September $100b 1992 Staples Corner, London $134m World Trade Centre 1994 West End Firebombing £599,191 2001 Ealing Broadway Bombing £12,272,745 1993 Bishopsgate Bombing $1,266b 2004 Madrid Bombing $9m 1994 West End Firebombing £1,814,648 2005 London 7/7 £13,401,000 1993 Weiterstadt Prison Germany $99m 2005 London 7/7 $82m 1994 Israel Embassy Bombing £5,275,160 2013 Portishead Arson Attack £18,000,000 1993 World Trade Center $872m 2006 Barajas Airport Madrid $65m 1994 Balfour House Bombing £1,148,391 2017 Westminster Bridge Attack £4,000 Oklahoma City Bombing $203m Norway Attacks $29m 1994 Bognor Regis Bombing £94,400 2017 Manchester Arena Bombing £4,700,000 1995 2011 1996 London Docklands Bombing £236,806,436 2017 London Bridge Attack £840,000 1996 London Docklands Bombing $362m TERRORISM THREAT & MITIGATION REPORT 2019 43/ 53

ACADEMIC PARTNERSHIPS/

Terrorist attacks often have multiple While the rationales for targeting Even this secondary element for objectives from the views of the economic and commercial targets are economic impact is unusual for Pool Re collaborates with academia perpetrators. An attack which receives often similar even if the ideological far-right extremism. Examining to better understand the peril and a great deal of media attention is motives behind the attacks are the manifestos of some of the improve the UK’s resilience to usually seen as much more successful radically different, some terrorist more notorious far-right terrorists terrorism. Pool Re collaborates than an attack which receives relatively ideologies seem less interested emphasises that economics does not with Cranfield University on a little (even if the human casualties and in economic impact than others. feature in their thinking. For example, number of initiatives, including physical damage caused by both We have already seen that economic Anders Breivik who was responsible CBRN and blast modelling, the attacks are similar). Indeed, even if an impact is prominent in Islamist and for killing 77 people in attacks in training of risk engineers and attack results in the death or capture some nationalist-separatist terrorism, Norway in 2011 released a 1,500 the sponsorship of students of all the terrorists involved it can still but economic targets are much less page long manifesto on the internet undertaking counter-terrorism be regarded as highly successful if it significant in the thinking of far-right shortly before his attack. In this, MSc courses. Pool Re co-sponsors has received intense international extremists. When it does feature it he highlighted a list of “prioritised the Chair in Terrorism, Risk and media attention. tends to be a secondary objective targets” which he encouraged other Resilience at Cranfield University. rather than a priority. For example, right-wing extremists to attack. That many terrorist groups explicitly While the leadership of terrorist in 1996 Eric Rudolph carried out a The list included buildings, meetings target economic and commercial Pool Re works with the Centre movements are often keenly aware bomb attack targeting the Atlanta and individuals associated with left- targets is not surprising. Terrorism’s for Risk Studies at the University of the strategic value in selecting Olympics. Rudolph was a lone actor wing political parties, media centres asymmetric nature invites attention of Cambridge’s Judge Business economic targets, in practice their motivated by a fundamentalist and journalists, government buildings, towards maximising the economic School to further understand the tactics and target selection are limited Christian ideology whose previous university buildings, and finally impact of the violence and many nature of the cyber terrorism by the capability of the terrorist group. attacks had mainly targeted abortion mosques and other Islamic targets. ideologies embrace this and flag threat, through threat monitoring Terrorists have finite resources clinics. In targeting the Olympics, There was no mention of explicitly it as a priority for the cause. While and modelling of the risk. in time, money, information, skills he later said “the purpose of the economic or commercial targets, economic attacks can be strategically and expertise. Lone actors are even attack … was to confound, anger however, and overall this was not a and ideologically desirable from the more limited than groups. Thus, and embarrass the Washington feature of the strategy he advocated. terrorists’ perspective, practical terrorist planning and preparation government in the eyes of the world Any economic impact resulting from limitations often restrict terrorists’ will never be perfect. for its abominable sanctioning of attacks was incidental (at least from abilities to carry through on this. abortion on demand.” He added the perspective of the right-wing Nevertheless, paying attention to that a secondary aim was to “create terrorist) and was not a significant terrorist ideologies and writings a state of insecurity to empty the aim in the decision-making around gives us critical insight into the streets around the venues and the attacks. factors driving their attack planning thereby eat into the vast amounts and decision-making, and represents of money invested”. a crucial element in anticipating threats and introducing effective prevention and mitigation measures. TERRORISM THREAT & MITIGATION REPORT 2019 44/ 5363 06/ TERRORISM THREAT & MITIGATION REPORT 2019 45/ 53

CAN DATA SCIENCE IDENTIFY ALL THE RISKS? Recent years have seen an increased Lord Anderson’s recently published focus on the use of data science implementation stock-take of the THERE IS STRONG methods for counter-terrorism risk 2017 attacks provides further insights assessment. Following the 2017 into how this ‘step change’ in data PRESSURE ON attacks in London and Manchester, a exploitation might work in practice. joint Operational Improvement Review The report describes ‘the identification GOVERNMENT conducted by the Security Service of capabilities and data needed to (MI5) and Counter Terrorism Policing develop relevant behavioural triggers’,2 AGENCIES TO proposed a ‘step change’ in how the which will be achieved by ‘increasingly organisations use data. This included sophisticated use of artificial USE DATA MORE the need for ‘improvements in the intelligence and behavioural analytics EFFECTIVELY ability of MI5 and police to exploit to extract information from bulk data to detect activity of concern, datasets.’3 The report concludes that TO PREVENT Alexander Babuta particularly on the part of closed ‘Behavioural analytics is here to stay, / Research Fellow in National SOIs (subjects of interest) but in and its techniques may be effective INDIVIDUALS Security Studies relation also to active SOIs and not just in refining the assessment / Royal United Services Institute previously unknown individuals.’1 of risk from existing leads and SOIs FROM ‘SLIPPING but in discovering new leads who Alexander Babuta is a Research There is strong pressure on would not otherwise have come THROUGH THE NET’ Fellow in National Security Studies government agencies to use data to the attention of authorities. at RUSI. He leads the Institute’s more effectively to prevent individuals Some indicators are geared to research on intelligence, surveillance from ‘slipping through the net.’ identifying immediate pre-attack and policing, with a focus on big Several of the 2017 attackers were behaviour, such as attempts to obtain data, artificial intelligence and closed SOIs at the time of their firearms or researching attack behavioural science. attacks; they were known to the methodologies. More general authorities but assessed as not indicators – for example, personal posing an immediate threat to frustrations or changes in baseline national security. One was a live SOI, behaviour – may also have their place under active investigation by MI5. when applied to persons who are As is customary in UK media in the already under suspicion.’4 aftermath of an attack, many have questioned whether the agencies So, is this a realistic prospect? To failed to ‘connect the dots’ – i.e. what extent is it possible to apply whether better use of data might these behavioural analytics techniques have helped them join those dots to counter-terrorism intelligence and identify the threats before analysis? And what questions could they materialised. this type of analysis help answer? TERRORISM THREAT & MITIGATION REPORT 2019 46/ 53

While big data and machine learning This is not to say that behavioural We might look to non-terrorist In reality, this is far more difficult than undoubtedly offer numerous analytics is incompatible with counter- offender management processes to one might expect. opportunities for improving the terrorism. More effective use of such better understand the kind of analysis efficiency of intelligence gathering technology could almost certainly Anderson is alluding to. Across the Research tells us that there is no and analysis capabilities, the ability of assist in identifying ‘immediate pre- criminal justice system, statistical consistent ‘terrorist profile’.9 The wide this technology to conduct complex attack behaviour’, such as unusual scoring systems are widely used variation in both the demographic behavioural analysis on individual travel patterns, suspicious purchases for assessing likelihood of future characteristics and the personal, subjects has almost certainly been or online activity. Predictive analytics offending at the individual level. political and social drivers that lead overstated. Based on all available applied to aggregated data from Tools such as the Offender individuals to engage in terrorist evidence, it seems neither feasible multiple sources could also assist in Assessment System (OASys) and violence, render it infeasible to identify nor desirable to develop an AI- identifying locations and times where the Offender Group Reconviction statistically significant ‘risk factors’ powered ‘scoring system’ to predict attacks are most likely to occur, Scale (OGRS) are routinely used by that can be used to develop a or prioritise terrorism risk at the allowing more evidence-based HM Prison and Probation Service statistical prediction tool at the individual level. deployment of target-hardening (HMPPS) to calculate numerical individual level. As terrorism is such measures. Anderson’s second scores corresponding to an offender’s Surely, given the vast quantity of a rare and infrequent occurrence in The reasons for this are twofold: suggestion – the use of predicted likelihood of reoffending.5 digital data available to the police and Western countries, there is insufficient first, terrorist attacks are too rare to behavioural analytics to identify Various other systems have been security services, it must be possible historic data to build a statistical provide the data needed to develop warning markers such as ‘personal developed for specific purposes, to take these existing technologies model to any reasonable degree of an individual-level statistical scoring frustrations’ or ‘changes in baseline such as risk assessment of young and repurpose them to identify and predictive power. As summarised by system; second, the profiles and behaviour’ among a group of known offenders,6 violent offenders7 and predict terrorism-related behaviour? John Monahan, ‘existing research has backgrounds of offenders are too individuals – poses greater challenges. sexual offenders.8 Large volumes Perhaps such a system could be largely failed to find valid non-trivial diverse to identify generalisable of historical data are analysed to used to assign ‘risk scores’ to each risk factors for terrorism. Without the ‘risk factors’ which would cover identify statistically significant factors subject of interest, enabling the identification of valid risk factors, the the full spectrum of possible risk. correlated to offending risk. These risk agencies to more intelligently prioritise individual risk assessment of terrorism factors are coded into a statistical investigations depending on which is impossible.’10 model which is then applied subjects are identified as posing the predictively on new data, to assign greatest risk? individuals ‘risk scores’ corresponding THE ABILITY OF THIS to their likelihood of future offending. These risk scores assist agencies TECHNOLOGY TO CONDUCT such as HMPPS in triaging, screening and prioritising a subset of offenders COMPLEX BEHAVIOURAL within a larger group who may require ANALYSIS ON INDIVIDUAL further, more detailed risk assessment. SUBJECTS HAS ALMOST CERTAINLY BEEN OVERSTATED. TERRORISM THREAT & MITIGATION REPORT 2019 47/ 53

But despite this lack of statistical For some, these existing non- single, seemingly irrelevant piece of 1 David Anderson, ‘Attacks in London and Antecedent Behaviors of Lone-Actor data, research has nevertheless technological methods may seem information, the dots will not join up Manchester, March – June 2017: Terrorists’, Journal of Forensic Sciences CONNECTING Independent assessment of MI5 and police (Vol. 59, No. 2, March 2014), p. 434; identified discernible behavioural outdated. The authorities have a legal to create the full picture. To add to this internal reviews’, p. 32 (December 2017). Spaaij, ‘The Enigma of Lone Wolf markers that can be used as and societal duty to protect the public challenge, certain variables may not be THOSE DOTS IN Terrorism’, pp. 854–70; Paul Gill. Lone- ‘indicators’ of terrorist intent.11 These from threats to their safety, and a strong predictors of violence in isolation 2 David Anderson, ‘2017 Terrorist attacks actor terrorists: A behavioural analysis. THE RIGHT WAY MI5 and CTP reviews: Implementation Routledge, 2015. indicators can then be used to reluctance to adopt new methods but interact with other risk factors in stock-take’, p. 14 (June 2019). structure and systematise intelligence that may allow them to do this more complex ways that are not apparent in 10 Monahan, John. “The individual risk analysis related to counter-terrorism effectively could be perceived as a statistical analyses. Individual factors WILL ALWAYS 3 David Anderson, ‘2017 Terrorist attacks assessment of terrorism.” Psychology, MI5 and CTP reviews: Implementation Public Policy, and Law 18, no. 2 (2012), p. risk assessment. Several frameworks failure to fulfil this duty. may not be strong ‘behavioural stock-take’, p. 18 (June 2019). have been developed to assist triggers’, but when they appear in DEPEND ON 19. practitioners in identifying and But even if it were possible to develop combination with other factors they 4 David Anderson, ‘2017 Terrorist attacks 11 See Paul Gill, Lone-actor terrorists: A THE SINGLE MI5 and CTP reviews: Implementation behavioural analysis. Routledge, 2015. assessing terrorism risk according a big data system that could identify can become highly relevant. stock-take’, p. 19 (June 2019). to these known criteria. Examples and detect behavioural triggers in GREATEST 12 Monica Lloyd and Christopher Dean, bulk datasets, this would not solve The machines might help us to 5 National Offender Management Service, ‘A ‘The development of structured guidelines include the Extremism Risk Guidance compendium of research and analysis on 12 for assessing risk in extremist offenders’, (ERG 22+), the Violent Extremism the fundamental challenge of identify which dots are most relevant. ASSET THAT the Offender Assessment System (OASys), 13 ‘connecting the dots’. Conversely, Journal of Threat Assessment and Risk Assessment (VERA), and the 2009-2013 (2015); Howard, Philip and Management, vol. 2, no. 1 (2015), pp. Terrorist Radicalization Assessment increased reliance on technological So, is behavioural analytics really COULD NEVER Francis, Brian and Soothill, Keith and 40-52. Protocol (TRAP-18).14 These are not methods could in fact lead to ‘here to stay’? Perhaps, but not for Humphreys, Leslie (2009) OGRS 3: The statistical scoring systems. Instead, important case-specific information the purposes that some may expect. BE REPLICATED revised Offender Group Reconviction Scale. 13 Pressman, D. E. and John Flockton, (2012) Rather than enabling automated risk Research Summary, 7/09. Ministry of “Calibrating risk for violent political they follow a method known as being overlooked. BY EVEN Justice, London. extremists and terrorists: the VERA 2 ‘Structured Professional Judgement’ assessment and prioritisation of structured assessment”, The British Journal (SPJ), a systematic approach to risk As statistical scoring systems rely on individuals based on behavioural 6 Wilson, E., & Hinks, S. (2011). Assessing of Forensic Practice, Vol. 14 Issue: 4, THE MOST the predictive validity of the Asset youth risk pp.237-251; Monica Lloyd, ‘Extremism assessment that aims to bridge the identifying correlations in historic data markers, the true value of this assessment tool using the Juvenile Cohort to identify risk factors, practitioners technology lies in its ability to rapidly Risk Assessment: A Directory’, Centre for gap between professional judgement INTELLIGENT Study (JCS). Ministry of Justice Research Research and Evidence on Security and statistical prediction.15 In doing may fail to identify highly relevant risk extract information from multiple, Series, 10(11) Threats, March 2019, p. 39 so, the SPJ approach enables users factors because they were not found disparate data sets, and present it ALGORITHM: 7 Quinsey, V.L., Harris, G.T., Rice, M.E. and to be statistically significant in historic in a coherent format for the human 14 Meloy, J. Reid. “The Operational to provide logical and coherent Cormier, C.A., 2006. Violent offenders: Development and Empirical Testing of the reasoning as to how they arrived at a data. The analyst is provided with decision-maker to analyse and HUMAN Appraising and managing risk. American Terrorist Radicalization Assessment certain judgement, while maintaining a filtered subset of data which the interpret. Making sense of the Psychological Association, p. 121. Protocol (TRAP–18).” Journal of personality a clear link between identified risk algorithm has assessed as most relevance and importance of that JUDGEMENT 8 Craig, L.A., Beech, A. and Browne, K.D., assessment 100, no. 5 (2018): 483-492; factors and the ultimate intervention. relevant to the investigative task data in relation to an individual’s future 2006. Cross-validation of the risk matrix Monica Lloyd, ‘Extremism Risk at hand, but if the algorithm has risk requires complex behavioural 2000 sexual and violent scales. Journal of Assessment: A Directory’, Centre for interpersonal violence, 21(5), p. 616. Research and Evidence on Security incorrectly ‘filtered out’ even a assessments which could not possibly Threats, March 2019, p. 34. be replicated by a statistical model. 9 Raffaello Pantucci, Clare Ellis and Lorien Chaplais, ‘Lone-Actor Terrorism: Literature 15 Douglas, Kevin S., and P. Randall Kropp. Review’, Countering Lone-Actor Terrorism “A prevention-based paradigm for violence Series, No. 1, p, 2015, RUSI; Paul Gill, risk assessment: Clinical and research John Horgan and Paige Deckert, ‘Bombing applications.” Criminal Justice and Behavior Alone: Tracing the Motivations and 29, no. 5 (2002): 617-658. TERRORISM THREAT & MITIGATION REPORT 2019 48/ 53 07/ TERRORISM THREAT & MITIGATION REPORT 2019 49/ 53

WHAT DAESH’S DAESH HAS PROVEN COMMUNICATIONS HIGHLY ADEPT AT STRATEGIC STRATEGY MEANS COMMUNICATIONS, REACHING FOR THE UK LARGE AUDIENCES AROUND THE GLOBE The collapse of Daesh’s so-called Daesh has proven highly adept at ‘caliphate’ has diminished the group’s strategic communications, effectively mass appeal and crippled its ability exploiting information technologies to direct and coordinate strategic to reach large audiences around the communications. While the group’s globe. The group has also proved ability to propagandise is unlikely to capable of adapting its narrative and be extinguished in the medium-term, messaging in response to changing it no longer possesses the resources, circumstances in its Levantine heartland. momentum or freedom of operation With the collapse of its territorial holdings necessary to meaningfully reach in Iraq and Syria, Daesh has recalibrated overseas audiences on the scale or its propaganda efforts in line with its new with the efficacy it had previously. strategic situation. Therefore, while attacks in the West by ‘self-radicalised’ or ‘inspired’ At its greatest territorial extent, Daesh’s Eden Stewart individuals are unlikely to abate al-Hayat media wing managed a Senior Analyst entirely (while those supporters who sophisticated propaganda effort, / Pool Re were prevented from joining Daesh overseeing the production of slick overseas remain free), far fewer and voluminous online content for Eden Stewart joined Pool Re as an of attacks directed from Daesh receptive audiences around the world. analyst on the Risk Awareness team members in Syria and Iraq are The group’s propaganda emphasised in October 2017. Prior to joining Pool anticipated in coming years. The the purported military, social and Re, Eden worked as an intelligence group is instead likely to focus its religious accomplishments of its proto analyst specialising in cybercrime. efforts on its most devoted followers state, encouraging Hijra (emigration) Eden holds a Master’s Degree in in support of the new amorphous, by sympathisers to Iraq and Syria. Security and Intelligence Studies from transnational operating model which Brunel University, and a BA in History the group appears to have adopted. From 2016, with Daesh under growing from the University of Leeds. This could lead to intensification pressure from Coalition action and of overseas attack planning by extremist travel to the Middle East committed Daesh supporters. increasingly difficult, the group reframed These plots, while much harder to its call for attacks by supporters in the execute than the low-complexity West (first proposed in 2014) as a duty methodologies favoured by rather than an alternative to emigration. ‘inspired’ actors, are typically more The call to action was accompanied by sophisticated and have greater impact in terms of both loss of life and damage to property if successful. TERRORISM THREAT & MITIGATION REPORT 2019 50/ 53

detailed advice for mounting attacks propaganda focused on sustaining This was accompanied by a It appears the message has largely alone, credited with influencing the the morale of core supporters rather ATTACKS reorganisation of Daesh’s Wilyat been accepted by the group’s most employment of low-complexity than cultivating mass appeal abroad, (notional province) structure, starting committed supporters.9 While the methodologies used by numerous with the last edition of Daesh’s IN LESS in late 2018, which minimised the extent of Daesh’s involvement in the terrorists since then. The tone flagship foreign language publication importance of formerly held territory Easter bombings remains unclear, the of Daesh’s propaganda had also Rumiyah (formerly Dabiq) released in RESTLESS in Iraq and Syria as only two attack was a major propaganda coup changed considerably. Themes of September 2017. components of a much larger global for the group, providing substance to loyalty, sacrifice and revenge supplanted AREAS WILL, IN ‘caliphate’. While the administrative Daesh’s claims and demonstrating it the more positive messaging This corresponded with a drop-off in reorganisation belies the tenuous links was still capable of orchestrating commonplace in earlier material.1 the number of attacks in Europe and PROPAGANDA between Daesh’s leadership and its major attacks overseas. However, North America in 2018.5 Enhanced TERMS, BE more distant adherents, it reflects the without its eponymous state in Iraq The approach was an apparent intelligence, security and risk movement’s attempt to maintain its and Syria, Daesh is increasingly reliant success, with the frequency of mitigation measures undoubtedly MUCH MORE relevance to current and potential on these kinds of attack to sustain inspired attacks in the West played a crucial role in disrupting supporters and project an image its grandiose vision and retain the continuing to climb through to plots but, while correlation does not REWARDING of strength while it regroups in its commitment of its supporters. While the second half of 2017.2 However, imply causation, it is plausible that Iraqi heartland.7 attacks in ungoverned or under- by this time, the quantity and quality the declining volume, accessibility FOR DAESH governed spaces will continue to be of propaganda released by the group and efficacy of Daesh’s propaganda To this end, Abu Bakr Al-Baghdadi, claimed and advertised by the group, had declined markedly as the group’s did contribute to the reduction in the Daesh’s leader, made his first video those in less restless regions will, in efforts came under increasing number of successful attacks. appearance in five years in April. propaganda terms, be much more pressure from Coalition kinetic and In his speech Baghdadi claimed rewarding for Daesh; attacks which network operations. While partially The existence of Daesh’s so-called responsibility for the Easter bombings demonstrate Daesh’s adaptability and offset by global affiliates and ‘caliphate’ and its subsequent erosion in Sri Lanka and accepted Bayat organisational prowess even more so. grassroots supporters, by 2018 not only granted the group abundant (pledges of allegiance) from groups in Daesh was producing a fraction of media coverage and elevated its Africa, while articulating a transnational Therefore, the group is likely to the material it had two years earlier.3 stature above that of terrorist groups; future for the group. In addition redouble efforts to carry out complex It struggled to maintain a persistent it was an animating force and to refuting claims of his death, attacks against Western interests. presence on social media networks, powerful recruiting sergeant for the speech was likely intended to While British and allied intelligence and the group became more reliant the global violent Islamist milieu. assert Baghdadi’s continuing authority services are alert to this threat, on less accessible encrypted over Daesh’s distant franchises and resource constraints inevitably mean channels to communicate with With the imminent loss of the last of its remnants in the Levant and outline that not every lead will be pursued, supporters. Content segmentation its territory in Syria, Daesh recast its a strategy for the group’s future.8 and the threat picture is further also became less pronounced as the narrative, positing that the fall of its group’s core suffered from lack of proto state was merely a temporary resources and came to rely more on setback, and that the loss of territory disparate franchises and individual was ultimately immaterial as the more influencers.4 Centrally issued significant objective of galvanising a global movement had been achieved.6 TERRORISM THREAT & MITIGATION REPORT 2019 51/ 53

ADDITIONAL INFORMATION/

complicated by the diaspora of Daesh and execute attacks overseas. Among 1 https://www.bbc.co.uk/news/world- fighters which scattered following the these are organised British-based middle-east-41845285 DAESH RETAINS group’s territorial collapse, and whose extremists who either avoided 2 https://trac.poolre.co.uk/tmr-2018/ whereabouts are now uncertain. More prosecution or have recently been DataCentre A CORE than 200 British citizens alone who released from prison.12 In the wake of 3 https://www.wired.co.uk/article/isis- travelled to the Middle East to fight the loss of the last of its territory in Iraq islamic-state-propaganda-content- OF HIGHLY with Daesh still remain unaccounted and Syria, the use of these capabilities strategy COMMITTED for (the figure for Europe is believed to is now critical to demonstrating the 4 https://icsr.info/wp-content/ be roughly 2000)10,11. It is likely that a continued relevance of the group and uploads/2018/07/ICSR-Report-A-Tale-of- FOLLOWERS significant proportion of those still sustaining its grand ambitions. Equally, Two-Caliphates-Comparing-the-Islamic- State%E2%80%99s-Internal-and- alive and at liberty remain committed the threat posed by other Islamist External-Messaging-Priorities.pdf WITH THE to Daesh. Their linguistic and cultural extremist groups, while overshadowed knowledge represent a significant by Daesh, has not waned. Al Qaeda 5 https://trac.poolre.co.uk/tmr-2018/ ABILITY TO asset for Daesh and could be in particular continues to harbour the DataCentre exploited for attack planning or intent to conduct ‘spectacular attacks’ 6 https://www.theatlantic.com/ideas/ FUND, PLAN developing cells in Europe. against Western interests. archive/2019/04/the-sri-lanka-bombings- were-a-preview-of-isiss-future/588175/ AND EXECUTE Attacks by individuals inspired by Therefore, the UK will continue to face 7 https://www.brookings.edu/blog/ Daesh’s ideology but acting the prospect of complex attacks for markaz/2018/01/18/what-happens- ATTACKS independently are unlikely to abate some time yet. While the targets when-isis-goes-underground/ OVERSEAS entirely and these remain difficult to favoured by Daesh—crowded places 8 https://www.rand.org/blog/2019/04/ detect and interdict. Nonetheless, the and symbolic sites—are unlikely to what-the-baghdadi-video-means.html very public setbacks faced by Daesh change, plots executed by well- 9 https://www.theatlantic.com/ideas/ do appear to have diminished the funded and trained terrorists are archive/2019/04/the-sri-lanka-bombings- group’s ability to further incite these likely to result in greater damage to were-a-preview-of-isiss-future/588175/ types of attacks. However, Daesh property and more widespread 10 https://www.independent.co.uk/news/ retains a core of highly committed business interruption. world/middle-east/uk-isis-recruits-syria- followers with the ability to fund, plan return-british-caliphate-terrorism- jihadis-a8781056.html 11 https://www.nytimes.com/2019/08/03/ world/middleeast/islamic-state-attacks- europe.html 12 https://www.nytimes.com/2019/05/18/ world/europe/uk-extremist-cell-anjem- choudary.html TERRORISM THREAT & MITIGATION REPORT 2019 52/ 53

ATTACKS BY OFFENDER TYPE IN ADVANCED MARKETS BY WEAPON COMPLEXITY / 1990-2018

nknon 2 00 nknon nknon nknon nknon % % 70of separatist attacks in Advanced 67of Islamist attacks in Advanced Markets since 1990 involved the Markets since 1990 involved the use o use of high-complexity weapons of low-complexity weapons 2

SEPARATIST RECENT YEARS 0 TERRORISTS HAVE HAVE SEEN RIGHT- o MOST FREQUENTLY WING AND ISLAMIST o EMPLOYED COMPLEX EXTREMIST ATTACKS IN 0 WEAPONS IN ATTACKS ADVANCED MARKETS INCREASINGLY EMPLOY o o LESS COMPLEX 0 METHODOLOGIES

igh 0 0

igh igh 0 Group igh 2 Islamist Extremists Far Right Separatists igh 1 Far Left, Environmental, Student Activists Anarchists 0 slamist ar ight Separatists ar eft Anarchists TERRORISM THREAT & MITIGATION REPORT 2019 53/ 53

The Pool Re Terrorism Threat & Purpose Methodology About Pool Re Disclaimer Photography credits Mitigation Report provides an overview The purpose of this report is to Pool Re Solutions’ methodology is Pool Re is the UK’s terrorism This website has been prepared by Page 14 – 1993 Bishopsgate ABOUT THIS of significant acts of terrorism during inform Pool Re Members and wider based on analysis of a wide range of reinsurance pool, providing effective Pool Reinsurance Company Limited bombing, City of London the year as well as identifying key stakeholders of the current and future publicly available open source material, protection for the UK economy (Pool Re). While this information has Police trends and themes that we believe terrorism threat and its implications and collaboration with subject matter and underwriting over £2 trillion been prepared in good faith, no REPORT are relevant to the terrorism for the resilience of UK businesses experts. The information contained of exposure to terrorism risk in representation or warranty, expressed Page 29 – Caracas drone attack, (re)insurance market. and, by extension, the UK’s economy. in this report has been verified and commercial property across the UK or implied, is or will be made and Xinhua Pool Re was created 26 years ago corroborated through extensive mainland. Through its Risk Awareness no responsibility or liability is or will Our methodology is based on to protect society from the economic research drawn from academia, Team Pool Re aims to improve the be accepted by Pool Re, or by any analysis of the wide range of publicly consequences of terrorism. The think tanks, social media, security, risk awareness of current and of its respective directors, officers, available open source material and landscape more than a quarter of a intelligence and risk conferences as emerging terrorism perils for employees or agents in relation to collaboration with subject matter century on is far more complex and well as extensive subscription-based Members and other key stakeholders the accuracy or completeness of this experts. We also used the Global diffuse, principally because in 1993 content. The sum of this provides by highlighting the availability of document and any such liability is Terrorism Database, compiled by there was one main threat actor, Pool Re with a unique perspective terrorism cover for all UK mainland expressly disclaimed. In particular, but the University of Maryland, to assess militant republicans in the form of the within the terrorism reinsurance market. Commercial Insurance customers. without limitation, no representation the frequency and severity of global Irish Republican Army (IRA), targeting or warranty is given as to the terrorism since 1990. the UK; now there is a wider spectrum All assessments are made in relation Intelligence cut-off date reasonableness of future suggestions of terrorist entities, using a broad to the threat posed to the UK and are The analysis in this report was contained in this document. Pool Re We hope that this qualitative and range of methodologies, targeting tailored principally to the (re)insurance current as of 31 Aug 2019 and is a company limited by guarantee quantative analysis of terrorist our citizens, assets and economies. sector; but it is hoped these has not been updated to reflect and registered in England and Wales incidents, trends and themes will be We hope that this annual report will assessments are also of use to the developments since. under company no. 02798901 having helpful for our Members and other go some way in providing further wider business community. In order to its registered office at Hanover stakeholders as they seek a greater clarity and knowledge for our fully understand the threat to the UK, House, 14 Hanover Square, London understanding on the frequency and Members and other stakeholders. Pool Re Solutions gathers information W1S 1HP. severity of terrorist events and how from wider global terrorism threats and the evolving threat impacts on their Further information about Pool Re incidents that could pose a threat to particular area of activity. can be found on our website at the UK mainland. www.poolre.co.uk or by following In this edition, we have focused on key us on LinkedIn. terrorism events and trends in 2019. TERRORISM THREAT & MITIGATION REPORT 2019