Terrorism - Learning from the Paris attacks.

The shocking events that unfolded in Paris on Friday, 13 November 2015 inevitably prompts those within the insurance industry to reflect on whether we are fully meeting our clients' needs, both in terms of advice and indemnification the advice below was supplied by JLT.

Though tragic, an attack of this nature was not unexpected. The insurance industry has begun to adapt its products to meet this threat and this latest marauding attack highlights the need for change. Organisations can do little to prevent future events from occurring but they can take a proactive approach to resilience; this should include an effective crisis management plan, access to expertise, robust physical security and appropriate insurance.

AN EVOLVING THREAT

Terrorist activity has been increasing in Europe, with the number of attempted attacks growing steadily in recent years, along with the number of arrests on terrorism charges. The number of attacks attributed to the ‘religiously motivated’ category (defined as ‘Islamist’ until 2010) that have taken place in Europe reached 50% in 2014, from a low of 20% in 2009. The availability of assault weapons for attacks has not reduced, with governments in Eastern Europe struggling to contain the black markets that feeds Western Europe. The Paris attacks should also be considered in the context of the evolving situation in the Levant, the recent attacks in Tunisia and Egypt and the EU response to the refugee crisis.

CAPABILITY

Suicide Vests: Triacetone Triperoxide (TATP) was used in the construction of the explosive vests and appears to have been the primary explosive employed in the attacks. TATP is substantially less stable than Trinitrotoluene (TNT), a firm tap can cause detonation, but can be up to 80% more powerful per kilogram, as well as being very difficult to detect using conventional methods. TATP can be produced using over the counter chemicals that are available in pharmacies. According to a former French intelligence chief, the level of sophistication apparent in the explosives suggests that a munitions specialist was employed to produce the explosives, which may have weighed in the order of 5kg. Such vest are generally intended to be a fragmentation rather than blast weapon relying on ball bearings, nuts, bolts or similar as the primary source of shrapnel.

ISLAMIC STATE

Islamic State (IS) and its transnational presence IS’ robustness and broad-based appeal should not be under-estimated. It is the first terrorist group to be able to successfully hold such a significant territory, while also fighting an air campaign, two ground wars and sanctions. It currently has 30-40,000 foreign fighters, an estimated 3,000 of which are from Western Europe (with the consequent future risk inherent in these people one day returning home). IS’ increasing tactical sophistication and focus on civilian targets will fuel the current trend for greater lethality in terrorist attacks into 2016. IS’s rise has influenced an 81% increase in the average number of people killed per attack across the globe between 2013 and 2014. Over thirty terrorist organisations have pledged their allegiance to IS and remain determined to demonstrate their capabilities, illustrating the galvanising appeal of IS.

Retaliatory attacks in the Middle East and the West will intensify

The robust response of the international community to IS’ advance means that the risk to civilian and commercial targets linked to those countries involved is heightened. Given IS’ clearly stated expansionist aims, it is inevitable that it will attempt further large-scale attacks in the West. Potential targets include transport infrastructure and crowded places. IS has embarked on a strategy of “crowd-sourcing” terror by suggesting that, rather than join them in the Middle East, recruits should take action where they live. Small scale assaults by small groups, or lone wolves, such as the attacks in Paris, Sydney, and Boston are indicative of a growing trend for extremists to carry out attacks that are arguably more simplistic from an operational perspective, but regardless still produce the desired effect of creating panic, causing a media frenzy, and complicating government policy-making.

The global terrorism threat emanating from IS differs to that faced from Al Qaeda (AQ). Reportedly, IS receives approximately USD 30 million per month, which equates to nearly 10 years’ worth of funding for AQ. Reportedly IS earned over USD 8 million between December 2014 and January 2015 in Deir Ezzor, an oil-rich province in eastern Syria under IS control since early 2014. IS likely secured these funds from extortion and kidnapping alongside, to a lesser extent, from taxes trade and oil sales. IS places emphasis on expanding the influence of the caliphate rather than acts of terrorism, however, there is a likelihood of this focus adjusting in the short to medium term.

There appears to be a deliberate attempt to destabilise countries that are reliant on tourism, with a view to precipitating a ‘failed state’. IS’ ability to expand its influence in North Africa will certainly be aided by reduced tourism spend.

AQ’s operating model differs in that it has a broadly centralised control meaning that the lead time for an event taking place is longer. Rather than use this ‘terrorism cell’ approach, IS inspired lone wolf actions which are harder to anticipate and prevent. In 2014 there were reportedly 15 IS attacks outside their controlled territory, whilst in 2015 there have been 150 attacks to date, with a significant focus of attacks against people as well as government and military institutions. This statistic exceeds the 99 attacks claimed by AQ between 1999 and 2012.

RISK MANAGEMENT

An ‘active shooter’ type attack can be considered in separate phases, each providing opportunities to mitigate the risk. These phases are reconnaissance, approach, assault and extraction.

There are opportunities to deter an attack during the recce and approach. If these phases identify that the assault and extraction cannot readily be achieved the attack may be abandoned or deflected elsewhere. Once the assault does occur any measure to delay and disrupt the assault and expedite emergency response will be beneficial. If extraction is intended any actions that would make the attack more audacious or chances of successful extraction less likely will be beneficial.

An effective crisis management plan underpinned by a regularly rehearsed crisis management team can ensure that in the event of such incidents decisions are made by the appropriate people, at the right time, protecting people, assets and brand.

Recce, implementation and approach

There are multiple opportunities to reduce target attractiveness and reduce an attacker’s opportunity during the recce, implementation and approach. It is beneficial for an organisation to maintain good communications with neighbouring organisations, organisations within the same sector and security stakeholders such as the police. This will allow them to be well informed of emerging trends in threat and also security incidents as they evolve. This may provide vital prior warning. Observation of the immediate surroundings can be achieved by staff or CCTV. This provides both a deterrent as well as surveillance. Observed suspicious behaviour must trigger a response. The organisation could consider minimising visual and physical distractions in their immediate vicinity. Where possible the exclusion of people and vehicles or prevention of loitering will provide more clear space and a buffer zone. The behaviour of front of house staff is key. Brand appropriate, attentive staff will prevent individuals with malicious intent from going undetected. Organisations should remain flexible with admittance policies and measures able to scale up or down as the threat changes.

Assault and extraction

In a benign environment main entrances to a property are often open and spacious providing and impressive sense of arrival and through-put efficiencies. Alternative entry points may be beneficial when the threat is raised and control becomes a dominant objective. Multiple exit points in opposite orientations are also beneficial depending on the direction of threat. This will also aid emergency first responders needing to enter the property. The appropriateness of searching and screening should be considered. Convenience, flow rate and ‘brand feel’ are important factors. Such measures can be blended into the fabric of the building and as technology improves more options are becoming available. Back of house as well as front of house should be considered; processes for mail scanning and deliveries should be considered. Modern buildings are often open plan however the accessibility of the building and the benefits of horizontal and vertical segregation are important considerations for marauding threats. Where possible, measures should delay an attacker’s progress and if possible deny access to key areas. Access control coupled with surveillance and alarm technology can with assist with this. It may also be beneficial to consider safe havens within a building. Depending on the threat and the building’s occupants, this might include mass evacuation, panic rooms and staff front of house refuge.

INSURANCE CONSIDERATIONS

Many terrorism policies for terrorism are tailored for the impacts of large explosive devices where property damage is significant and the business interruption is a direct consequence of that physical loss; the marauding attacks seen in Paris have differing impacts. Property damage may still occur, but to a less significant degree. Businesses may suffer disruption if they are in the locality, without a property damage trigger. Key members of staff may be involved impacting on the services a business can deliver. Time deductibles on traditional policies may be too large to offer benefit to the insured for marauding attacks. The impacts on people are significant and personal accident, workers compensation or liability policies may need to reflect this. In such an attack the insured may be in need of specialist advice rather than purely indemnifying the loss. Such advice may include assistance with crisis management, communication, response and extraction of staff; benefits more akin to a kidnap and ransom policy. As well as offering assistance to staff and business operations, such assistance can help to protect brand and reputation. The insurance industry is beginning to respond to these type of incidents and we have recently seen the introduction of specific products designed to meet these needs.

GAREAT

In France, terrorism coverage is compulsory on all insurance policies covering property damage therefore all the insured property damage from the attacks in Paris is likely to be covered by France’s Gestion de l’Assurance et de la Reassurance des Risques d’Attentats et Terrorisme (GAREAT) terrorism pool. This will cover both the property damage and business interruption losses, following the same terms set out in the insurance contract. GAREAT does not provide cover for bodily injury.

SUMMARY

The tragic events in Paris pose significant questions for risk and insurance professionals. Whilst the attack is consistent with a threat that has been evolving since Mumbai in November 2008, this event, when considered in the wider context is both shocking and hugely significant. Insurance on its own does not fully address the threat and a risk management approach is required. Organsiations should have a multifaceted approach to resilience, which includes an effective crisis management plan, access to expertise, robust physical security and appropriate insurance.