Terrorism Threat & Mitigation Report · the evolving nature of the threat. The UK insurance market ... Pool Re Terrorism Threat & Mitigation Report 2 Overview Purpose The purpose

TMR–2–17

Terrorism Threat & Mitigation ReportJanuary – July 2017

Foreword 01Overview 02 Purpose 02 Contents 02Executive Summary 04Terrorism: The United Kingdom and Europe 06 Terrorism Incidents, Europe 07 UK: Threat Summary 08 Europe: Threat Summary 09 The UK Islamist Threat 10 UK Threat Level: Move to CRITICAL 14 Northern Ireland Related Terrorism 16Global Islamist Threat 18 Islamist Extremism Main Presence 19 Aviation Threat: New Advice, Old Enemies 22 Islamist Extremist Publications 24CBRN, Cyber, Drones 30 CBRN 31 Cyber 33 Drones 35Risk Mitigation and Resilience 36Appendix: Global Terrorism Data 2016 42

Contents

Bladed Use of bladed articles in attack

Vehicle Vehicular-based attack

Firearms Terrorist firearms attack

PBIEDs Person-borne improvised explosive devices

VBIEDs Vehicle-borne improvised explosive devices

IEDs Improvised explosive devices

CBRN Chemical, biological, radiological, nuclear

Cyber Terrorism

Attack types

1

ForewordI am pleased to be able to write this foreword to the Terrorism Threat and Mitigation Report produced by Pool Re. Pool Re has made great progress in understanding the threat posed by contemporary terrorism, of all denominations, and our Terrorism Research and Analysis Centre is quickly establishing itself as both an expert and thought leader in the field of terrorism risk, how to measure it and how to potentially mitigate against it. We continue to support the Home Office with analytical support and are keen to remain engaged in improving the information flow and exchange about the terrorism threat to our Members and wider business community. As the terrorist threat continues to evolve at an ever-increasing rate, so does the gap between traditional terrorism and the cover offered become more exposed. Pool Re remains committed to closing these gaps in coverage and the information and analysis in this latest Threat and Mitigation report is a core part of this process.

The bulk of the UK’s experience with large terrorism losses resulted from the activity of the IRA during the 1990s, who, at least on the mainland, tended to target property, not civilians with a view to causing damage to the economy. The rise in Islamist extremist terrorism, which has plagued continental Europe during recent years, has begun to affect the UK with tragic consequences. Modern Islamist extremists, such as Al Qaeda or so-called ‘Islamic State’ or Daesh, are motivated to inflict massive civilian casualties, representing a fundamental shift in the types of losses experienced.

The clear majority of terrorism insurance policies reflect this traditional property-focused aspect of terrorism and require physical damage to trigger a claim. This creates issues in coverage as recent terrorist events, whilst they have caused significant loss of life, have also resulted in severe disruption to business, and associated financial losses, but with minimal or no damage to commercial property.

Insurance to protect against property damage and business interruption following a terrorist attack in the UK is well established, with around 90% of the market being fulfilled by insurers who cede their exposure to Pool Re,

and 10% through the stand-alone market. As well as the gap described, another limiting factor to the success of this insurance market in mitigating economic loss is likely to be the level of uptake in the SME sector. Larger organisations in the retail and hospitality sector are better placed to absorb losses through resilience of scale; SMEs and franchisees less so. Assessments of similar attacks in Europe suggest that SMEs could be impacted for between 3 and 9 months, either by an event or the perception of reduced security, and suffer losses ranging from 5% to 30% of their annual revenue.

Pool Re has been working to fill the previously unforeseen coverage gap since the attacks in Europe last year. In light of the recent spate of UK attacks, intensive talks at Ministerial level are now under way, since extending Pool Re’s cover requires a change of law, albeit minor.

One proposed model would see non-damage business interruption insurance resulting from terrorism offered to the market, and covered indirectly by the commercial market through reinsurance of Pool Re. Such cover would be inexpensive, widely purchased, and with specific discounted rates for SMEs.

As terrorists’ tactics evolve, insurance must change in response. Pool Re, its government partners, and insurers are anxious to fill the gap that has emerged. The political will exists to implement the necessary changes and we can expect to see an important shift in the market to adapt to the evolving nature of the threat. The UK insurance market is internationally recognised as a distinguished example of mitigating terrorism losses, owing to its successes against the economic damage caused by the IRA in 1990s. Let us all hope that this success can be replicated to meet today’s threat and safeguard future investment in our economy.

Foreword

Julian Enoizi Chief Executive, Pool Re

Pool Re Terrorism Threat & Mitigation Report

2

Overview

PurposeThe purpose of this report is to inform Pool Re Members and wider stakeholders of the current and future terrorism threat and its implications for the resilience of UK businesses and, by extension, the UK’s economy. It will be recalled that Pool Re was created to protect society from the economic consequences of terrorism.

ContentsIn this edition, which covers a time period clearly dominated by the recent tragic attacks in London and Manchester, we have provided a threat summary for the UK and Europe as well as for Islamist Extremism across the globe. We have also covered the threat posed by Islamist extremists to the UK, including women and children, Dissident Republicanism, and the role of extremist publications, and have included a piece on aviation threat.

There is a review on the risk of terrorist use of Chemical, Biological, Radiological and Nuclear (CBRN) materials, and we highlight the key findings from a CBRN workshop Pool Re co-hosted with the Nuclear Threat Initiative (NTI) in March 2017. This workshop focused on the risks posed by radiological security and highlighted ways to mitigate, even eliminate, the risk posed by blood irradiators being stolen from hospitals.

We provide a short update on cyber terrorism, with the main news being the Chancellor and First Secretary to the Treasury recently confirming Government consent for Pool Re to grant cover for physical damage caused by terrorists using a cyber-trigger to cause a fire or explosion. We will be allowing our Members to grant this cover from 1st April 2018 and we will be adding it to our retrocession programme from 1st March 2018.

We have updated the previous section on drones, considering proposals for new regulation in the UK, and remain alive to the threat posed by this novel attack method, especially around commercial aviation sites, and by a swarming of drones into the flight path of a passenger jet.

The Risk Mitigation and Resilience section once again highlights the growing insurance gap resulting from terrorists targeting people over property. This ‘gap’ was clearly amplified by the attacks at Westminster and London Bridge/Borough Market, having been highlighted by Pool Re eighteen months ago after attacks in Europe. Finally, Pool Re’s risk management strategy is explained in outline as are other innovative measures we are taking, and which will improve our proposition and thereby add value to our stakeholders and contribute to the resilience of the UK economy.

Once again, we hope that you find this edition informative and would welcome any feedback that you might have.

Further information about Pool Re can be found on our website at www.poolre.co.uk or by following us on LinkedIn.

Pool Re’s Terrorism Research and Analysis Centre (TRAC) is pleased to present its third Terrorism Threat and Mitigation Report. Our last report was published in February 2017, since when much has happened.In this edition, we have focused on key terrorism events and trends from 1 January to 31 July 2017. We have included an appendix with analysis of terrorist attacks that took place during 2016. We hope that this information will be helpful for our Members as they update their models as well as for other stakeholders, seeking a greater understanding on how the threat to terrorism impacts their particular area of activity.

3

Overview

Target typesSymbolic Iconic sites such as tourist attractions

CP Crowded place

Property Commercial & residential property

CNI Critical National Infrastructure

PMG Police, military & government

MethodologyTRAC’s methodology is based on analysis of the wide range of publicly available open source material, and collaboration with subject matter experts. We define terrorist attacks by excluding acts carried out by terrorist groups in theatres that constitute acts of war or insurgency. The information contained in this report has been verified and corroborated through extensive research drawn from academia, think tanks, social media, security, intelligence and risk conferences as well as extensive subscription-based content. The sum of this provides Pool Re with a unique perspective within the terrorism reinsurance market.

All assessments are made in relation to the threat posed to the UK and are tailored principally to the (re)insurance sector; but it is hoped these assessments are also of use to the wider business community.

Fully to understand the threat to the UK, TRAC gathers information from wider global terrorism threats and incidents that could pose a threat to the UK mainland. TRAC produces Threat Reports, Post Incident Reports on terrorist events and Emerging Risk Reports.

Intelligence cut-off: 31 July 2017

4

Executive SummaryThis reporting period has been dominated by the four attacks (three Islamist extremism and one suspected Far Right extremism all in a seventeen-week period) in London and Manchester, which resulted in the tragic loss of 36 lives and over 200 injuries, many of them life changing. Across Europe, including Turkey,a there have been 37 terrorist attacksb, including 114 deaths and at least 370 injuries. Security and government officials have recently commented that the wave of attacks in the UK is a ‘step change’ in terrorist activity. Between June 2013 and the end of July 2017, a total of eighteen terrorist attack plots had been disrupted by police and MI5, including five since the Westminster attack in March 2017. The Metropolitan Police Commissioner, Cressida Dick, in her Mansion House speech of 20 July, said she expects further attacks to be thwarted and reminded the audience of ‘both the Director General and my predecessor warning that it was perhaps a case of “when not if” for us’.

Against this backdrop, the threat posed by Islamist extremism can be summarised as global, evolving, persistent and ideological. We are now witnessing lone actors and small groups increasingly using low sophistication technology, such as knives and vehicles as weapons, to inflict mass casualties. But we also cannot discount more sophisticated attacks, as demonstrated by Salman Abedi in Manchester, who made and used a viable home-made explosive device—a capability and expertise not seen in Great Britain since 7/7. Nor can we ignore the threat of a spectacular attack by al Qaeda (AQ), against an iconic site or the aviation sector, which would cause catastrophic damages, multiple casualties and a macro loss to the insurance market.

The increase in Far Right extremism, as seen at the Finsbury Park Mosque and the rise in anti-Muslim hate crime, further exacerbates an already complex, high tempo, rapidly mutating threat landscape. The possibility of Dissident Republican groups carrying out a mainland bombing campaign, as illustrated by the conviction of Royal Marine Ciaran Maxwell for terrorism offences, may bring further pressures on already stretched MI5 and police resources.

Regrettably, we should not be surprised by this step change in Islamist extremism, as this was all forecast and predicted by intelligence experts and analysts, including the two previous Director Generals of MI5. In 2014, it was

recognised that Daesh had a ‘three-ring strategy’, of which the ‘outer ring’ was to prosecute far abroad attacks into Europe and the wider West. As shown by attacks in Europe over the last three years and more recently in the UK, we would argue that we are now seeing Daesh becoming fully engaged in its new front and declared war on the West. This action could be as much consequential as opposed to design. The recent military defeat of the so-called Caliphate in Iraq and Syria and the expulsion of thousands of foreign fighters along the Euphrates could provide the capability to attack European targets at a higher tempo than before.

As with former terrorist campaigns, we appear to be well into an enduring and attritional counter-terrorism (CT) response that will sadly see further loss of life and economic damage. I recollect during my time in the Army

discussing with my American colleagues, shortly after 9/11, that there is no such thing as a quick-win CT response and strategy (the basis of our discussion was around the thinking by many in the US administration and US military that AQ could be wiped out relatively quickly). I reminded them that our campaign against the IRA had lasted over thirty years (with the loss of over 3,500 servicemen, women and other security personnel) before a political accommodation and ceasefire were achieved. I went on to say, in simple terms, that we got the first ten years of our approach wrong, and that it took us another ten years to realise this and then the final decade to put it right. My sense is that we may well be in similar territory as we were with the IRA in the middle ‘decade’ (recognising that this was a different terrorist entity with different aims and objectives) and are now realising that we still don’t know enough about Islamist extremism. There is a need to radically review our thinking, CT strategy and resourcing, as well as recognising that deterrence, disruption and detention of terrorists form only one part of the long term solution. Just as the July 2005 attacks demonstrated that a fundamental rethink was required, leading to the creation of the current integrated UK CT network, and a new partnership approach, so too have the recent attacks demonstrated a similar need for an urgent review of the UK’s CT architecture and policy.

Ref. a) It is recognised that Turkey currently sits outside the European Union. It is, however, considered within our analysis because of its geographical position and nexus with the modern terrorism threat landscape.

Ref. b) The TRAC terrorism database is based on open source reporting of terrorist attacks but exclude acts of insurgency or war carried out in recognised areas of conflict.

We are now seeing Daesh becoming fully engaged in its new front and declared war on the West.

Just as the July 2005 attacks demonstrated that a fundamental rethink was required, leading to the creation of the current integrated UK CT network, and a new partnership approach, so too have the recent attacks demonstrated a similar need for an urgent review of the UK’s CT architecture and policy.

Despite the current, unprecedented level of terrorist activity, be it Islamist or Far Right extremism, the fundamental principles of terrorism are not changing. Terrorists are continuing to use evolving methods to attack, causing both mass casualties and damage to property. Propaganda of the deed has always been a recognised terrorist tactic – no more so than with ideologically driven Islamist extremism. Terrorists are quick to evolve their tactics, techniques and procedures; it was often said that we were in a technological arms race with the IRA at the height of that campaign. Islamist extremism is proving no different, and contemporary terrorists are evolving their tactics, techniques and procedures at a higher tempo than the CT policies and measures put in place to prevent them. We are likely to see them use more novel attack methodologies, potentially including CBRN devices and the cyber domain to cause harm. Finally, ‘terrorism breeds terrorism’; the killing of Jo Cox MP, the attack on the Finsbury Park Mosque and the growing statistical evidence of right-wing extremists being convicted or referred to the government’s Prevent programme underline this trend. The scale of the current threat is the differentiator, their tactics and approach less so.

Predicting what might happen next in these unprecedented times is a complex challenge. The ‘industrialisation of terrorism’ by Daesh, which encourages individuals to use readily available weapons and cause mass casualties rather than inflict damage on infrastructure, is likely to continue. The police and MI5 will face increasing challenges posed by battle-hardened returning fighters along with frustrated and inspired travellers unable to find a way out to Syria and Iraq. An additional challenge is how to deal with those individuals who are operating on the fringe of the criminal justice system but are not committing a terrorist offence.

Domestic and international threats will become increasingly interrelated, and these will be further enabled by the exploitation of the internet, social media and end-to-end encryption. We cannot ignore the possibility of AQ and Daesh finding increasingly common ground. Rhetoric, offensive action and attacks by Far Right groups as well as possible Dissident Republicanism activities (such as the targeting of VIPs, military and police personnel) on the mainland are likely to enflame an already fragile security situation. As we know all too well from previous CT campaigns, our response needs to be legal, measured and proportionate.

The government and police have acknowledged that the magnitude of this threat cannot be contained by the public sector alone and that business has a vital role to play. The private sector continues to seek greater engagement with the government, especially as its assets and people are very much on the front line of the current and future CT battle. There is growing momentum for greater collaboration and information-sharing between the public and private sectors, thereby improving knowledge about appropriate risk mitigation measures and training for businesses and their employees. Furthermore, the attacks in Westminster and Borough Market have further highlighted the insurance gap that currently exists, with traditional terrorism cover being focused on property losses as opposed to covering people and non-damage business interruption.

Pool Re remains committed to contributing to the resilience of the UK economy, by providing a private-sector solution to a public policy objective. Improving public–private sector engagement, encouraging information exchange and promoting greater collaboration across the whole business community are core strands of enhancing our economic and wider resilience. Insurance can influence behavioural change among its consumers more so than any other sector. We believe that the insurance market is very well placed to assist in mitigating the enduring terrorist threat and can play a key role in UK’s overall CT strategy.

Executive Summary

Ed Butler CBE DSO Head of Risk Analysis, Pool Re

‘ We cannot and must not pretend that things can continue as they are. Things need to change’Prime Minister Theresa May, 4 June 2017

5

‘Industrialisation of terrorism’ by Daesh is likely to continue.

Terrorism: The United Kingdom and Europe

7


LondonHamburg

LutskKiev

Batman

Paris

Antwerp

Brussels

St Petersburg

Belfast

Istanbul

Malgobek

Izmir

Muradiya

Van

GothenburgStockholm

Manchester

Hakkari

Diyarbakir

Baykan

Viranşehir

Perpetrators:

Islamist Unknown Kurdish separatists

Dissident republicans Far rightFar left

Attack types:

Methodology

BladedThere were five incidents involving bladed weapons in the reporting period. Two of the attacks took place in the UK, two in France and one in Germany.

FirearmsThere were twelve incidents involving firearms in the reporting period. The majority of attacks took place in Turkey.

IEDThere were thirteen attacks involving IEDs in the reporting period. Four were attributed to Far Left groups.

PBIEDThere were two attacks involving PBIEDs or suicide bombings in the reporting period. One attack was in the UK and one in Russia. Both attacks targeted crowded places and CNI.

VBIEDThere were three attacks involving VBIEDs in the reporting period. All three were in Turkey and have been attributed to Kurdish separatists.

VehicleThere were six attacks involving vehicles as a weapon in the reporting period. Three of the attacks took place in the UK, including one Far Right attack. The UK was the only country to experience a combination of vehicles and bladed weapons.

Strabane

Terrorism Incidents, Europe (inc. Turkey), 2017

Firearms BladedVBIED/Firearms

Vehicle/BladedIED PBIED VehicleGrenade

launcher

Athens

Rome


8

UK: Threat Summary

Attack type Bladed Vehicle Firearms PBIED VBIED CBRN

Target type CP CP CP CP CP CP

Symbolic Symbolic Symbolic Symbolic Symbolic Symbolic

Property Property Property Property Property Property

CNI CNI CNI CNI CNI CNI

PMG PMG PMG PMG PMG PMG

Threat level

The Joint Terrorism Analysis Centre (JTAC) assesses that the threat from international terrorism to the United Kingdom (UK) remains SEVERE, meaning an attack is highly likely. MI5 assesses that the threat from Northern Ireland-related terrorism to Great Britain remains SUBSTANTIAL, meaning an attack is a strong possibility.

During the reporting period, the threat from international terrorism was raised to CRITICAL on 23 May 2017 following the attack at Manchester Arena. This meant that further attacks were assessed to be imminent and police and MI5 did not have controls around other potential suspects and networks. The level was reduced to SEVERE four days later.

Key actors

Islamist extremistsIslamist extremists remain the principal threat to the UK. Daesh and AQ associates remain the key threat actors and likely targets remain crowded places, national infrastructure and police and military institutions and personnel.

The reporting period has been dominated by the three Islamist attacks in the UK in a three-month period; Westminster, Manchester Arena and London Bridge. Police and MI5 have disrupted eighteen Islamist plots since June 2013, including five since the Westminster attack in March 2017. This level of activity is unlikely to reduce in the near future, and the frequency of disrupted plots is likely to place a greater demand upon CT resources.

There was a focus on al Muhajiroun (ALM), a proscribed organisation based in the UK, during the reporting period after it was revealed in the media that one of the London Bridge attackers was linked to the group and appeared in a Channel 4 documentary on London extremists in 2016. It is clear the ideology espoused by key ALM preachers such as Anjem Choudary continues to radicalise young men and women in the UK; an ALM associate was jailed in July 2017 for plotting to bomb an Elton John concert in Hyde Park in 2016. Further and more frequent arrests associated with the group should be expected.

Dissident Republican GroupsThe Dissident Republican threat to Great Britain is unlikely to reduce, although aspirations to carry out an attack may currently exceed capabilities. The case of Ciaran Maxwell, the Royal Marine convicted of terrorist offences, and his suspected affiliations with the Continuity IRA (CIRA) appear to be an isolated incident and not indicative of a new coordinated campaign of hostilities against the mainland.

Far Right Extremism in the UKA year on from the murder of Jo Cox MP, the threat from Far Right extremism continues in the UK. The reporting period included one suspected Far Right attack in Finsbury Park in June. Politicians and Muslim communities and institutions remain likely targets. A quarter of those referred to the government’s Channel programme are now suspected Far Right extremists. The Security Minister, Ben Wallace MP, warned in June 2017 that the number of people arrested for domestic terrorism offences had increased nearly fivefold in the twelve previous months. After the London Bridge attack in June 2017, reported anti-Muslim hate crime rose to fifty-four incidents a day in London versus an average of thirty-eight a day for the rest of 2017. As the UK experiences an increase in Islamist terrorist attacks on the Western way of life, further right-wing attacks may be likely.

Arrests and enforcement

Intelligence officials stated that there is a total of 23,000 people of interest to MI5 in the UK, 3,000 of whom are considered to be subjects of specific interest. The Home Office arrest data (financial year ending 31 March 2017) showed 304 arrests for terrorism-related offences were made in Great Britain, an increase of 18% with the previous year. Of these arrests, 108 (36%) resulted in a charge, 91 (84%) of which were terrorism-related offences. This financial year represents the highest number of arrests in any year on record since the Home Office data collection began in September 2001. The age group with the largest increase was 30 and over.

Assessment Islamist extremist attacks are likely to continue and may not be directed by senior leadership overseas. The methodology of attacks may be wide ranging, and, while the most frequent may be low sophistication – for example, vehicles and blades – attacks involving home-made Improvised Explosive Devices (IEDs) should not be discounted. Likely targets remain crowded places, national infrastructure and police and military institutions and personnel. Far Right extremism is likely to continue, with violence directed towards the Muslim community.

UK Threat Levels

CRITICALthreat level from international terrorism to

the UK

SEVEREthreat level from

Northern Ireland- related terrorism

to GB

SUBSTANTIAL MODERATE LOW

9

Europe: Threat Summary

Attack type Bladed Vehicle Firearms PBIED VBIED CBRN

Target type CP CP CP CP CP CP

Symbolic Symbolic Symbolic Symbolic Symbolic Symbolic

Property Property Property Property Property Property

CNI CNI CNI CNI CNI CNI

PMG PMG PMG PMG PMG PMG

Threat level

Europe continues to face a high terrorist threat, demonstrated over recent years by several mass casualty attacks but also more recently with frequent, low sophistication, attacks. The reporting period saw thirty-seven attacks across Europe, including six attacks in France and two attempted attacks in Belgium, a significant increase from previous years. As seen in several of these, figures of authority, especially the police, remain a desirable target, and Islamist extremists remain the principal threat to Europe. While mass casualty attacks have been attempted, there has not been the same level of success as in previous years; the most casualties in the reporting period have come from the attacks in the UK.

Key actors

Islamist extremistsDaesh and AQ have both the intent and the capability to conduct attacks across Europe, and they remain the principal threat. National infrastructure – for example, airports – and crowded places, specifically those reflective of Western life such as sports stadia and other leisure and entertainment venues, are likely to be targeted by both Daesh and AQ. Motivation for attacks is likely to continue to be Western governments’ military intervention in Afghanistan, Iraq and Syria.

Far Right extremismDuring the reporting period a plot to behead President Emmanuel Macron on Bastille Day 2017 was disrupted by the French police and internal security service. Although the perpetrator had expressed explicit intent and was in possession of kitchen knives, his capabilities were questionable, as he had made rudimentary enquiries to obtain a firearm online. Disruption at such an early stage is indicative of the reluctance of governments in Europe to take significant risks, such that they are intervening at early opportunities. The continued issue of immigration and the refugee crisis is a likely driver for Far Right extremism.

Far Left extremism European officials have been subject to a number of parcel bombs in the reporting period, including one sent to the German Finance Minister in Berlin and one at the IMF office in Paris. The parcels have been claimed by The Conspiracy of Fire Nuclei, a Greek anarchist group that was designated a terrorist group by the United States in October 2011. Additional parcel bombs found were targeted at key European financial institutions and personnel. The economic landscape of Greece is likely further to motivate extreme left-wing factions to undertake an aggressive campaign against the establishment.

Arrests and enforcement

According to the Europol European Union Terrorism Situation and Trend (TeSat) Report 2017, 1,002 people were arrested throughout Europe in 2016 for terrorism offences. This figure was lower than the previous year, in which 1,077 people were arrested. Of these, 718 arrests were Islamist extremists, 84 were left-wing offences and 12 were Far Right; 291 were under the age of 25 years old.1

Turkey The year 2017 began with the attack on the Reina nightclub in Istanbul, which killed thirty-nine people. The threat Turkey faces within Europe is unique in that, in addition to Islamist extremism, it also faces a sustained campaign from Kurdish elements, particularly the Kurdistan Workers’ Party (PKK). Following a high number of attacks and the attempted military coup in July 2016, the subsequent action from the Erdogan regime, showing a low tolerance of any form of subversion or extremism, may have limited the capabilities and therefore successes of extremists in the past six months.

Assessment Islamist attacks will continue with frequency, although coordinated, complex plots may be less successful owing to sustained efforts of domestic security services. Europe is more likely to see the use of explosive devices and firearms in mainland attacks, although bladed and vehicle attacks may potentially be more frequent. Targets are likely to remain figures of authority, such as police and military, and crowded places.


More Likely

Possible

Less Likely

Probability Assessment:


10

The current level of the Islamist extremism threat to the UK is unprecedented. The frequency of attacks and the range of methodology used in them this year has now surpassed a single period of intensity and represents a clear and defined escalation of hostilities. This is demonstrated by the five attack plots disrupted since March 2017 and the admission that MI5 and the police are now dealing with over 500 live investigations. It is likely that those investigations now carry a significantly higher number of attack plots, replacing the previous demand that mitigating extremist travel to Iraq and Syria placed upon intelligence officers and investigators. We should expect operational activity to remain at this current pace, or potentially to increase in the near future.

A likely trigger for further attacks in the UK could be the confirmation of the reported death of Daesh leader Abu Bakr al Baghdadi. Despite recent Russian claims of his death, it remains possible he is alive and hiding in Daesh’s remaining territory in Iraq or Syria, giving justification for his claim as Caliph. If he were to die, it is likely his death would be promptly announced by his successor to cement this successor’s position in the organisation and to attempt to maintain cohesion across Daesh’s various factions. The death of al Baghdadi would be a significant blow to Daesh, and would likely cause internal splits, particularly between foreign and local fighters in Iraq and Syria and global branches, who would have to decide whether they would pledge allegiance to his successor or realign loyalties.

The UK Islamist Threat

Westminster Attack22 March 2017• Aged 52 years old• ‘Lone actor’• No network• No links overseas

Manchester Attack22 May 2017• Complexity and sophistication• Use of home made explosives• Links to overseas• Network of associates

Use of vehicle and bladed weapon

Targeting of iconic sites

British born perpetrators

Lone attackers

London Bridge Attack03 June 2017• Three attackers shows

level of complexity and a wider network

• Islamist extremism• Known to police and MI5

• Crowded places • Use of internet and ideology

• Methodology promoted online• Timed to maximise casualties

Figure 1. Comparison of UK Islamist attacks in 2017

11

This may provide AQ with an opportunity to reclaim more of the global Islamist movement. The death of al Baghdadi, however, is likely to enhance the domestic threat, providing motivation for revenge attacks in the UK, whether they are specifically claimed in his name, or not.

Khalid Masood’s attack in Westminster on 22 March 2017 was conducted in a manner consistent with attacks claimed by Daesh across mainland Europe and in a way promoted by extremist publications such as Inspire and Rumiyah. Although no confirmed association has yet been made between Masood and any prohibited terrorist organisation, the methodology of his attack was sufficient for it to be declared ‘terrorist’ under the provisions of Reinsurance (Acts of Terrorism) Act 1993. This could now indicate that the concept of lone actors being ‘inspired by’ established terrorist groups is obsolete.

It is also noteworthy that none of the recent UK terrorists appears to have left a martyrdom video, which makes attribution to a specific organisation even more difficult.

It is now more likely, if their actions are consistent with contemporary Islamist terrorism, that they are part of a general narrative rather than being a member of, or acting in support of, any specific group or affiliation. In comparison to the attack by Masood, Salman Abedi’s attack in Manchester on 22 May was more sophisticated. The extent to which he received support in bomb-making remains debated, with both online advice and AQ instruction in Libya being cited. The attack, the first use of a bomb by Islamists in the UK since July 2005, emphasised the catalogue of tactics available to extremists.

This was further proven by the London Bridge and Borough Market attack on 3 June by Khuram Butt, Rachid Radouane and Youssef Zaghba.

It is significant that none of these attacks involved firearms, especially as the locations where both the offenders lived and the attacks took place have high levels of organised and armed criminality. It is therefore probable that both Abedi and the members of the London Bridge cell attempted to acquire firearms, but failed. This suggests that extremists in the UK still find it difficult to acquire guns, and future attacks are more likely to continue to see use of knives, vehicles and potentially home-made bombs. The UK is also likely to experience an increasing number of women and under-18s involved in attack-planning, which would deviate from their historical involvement in offences, such as failing to notify authorities of terrorism. These attacks have placed unprecedented demand on MI5 and the CT police network. The pace of arrests that continue to take place suggests authorities have a low threshold for taking risk in terrorism investigations, which means it is probable that more subjects of interest will have to be managed by the police. This is likely to manifest in increased referrals to Prevent for early stage, overt intervention. This will be an enduring issue, considering that all the Islamist attackers were known to MI5 or the CT police to varying degrees. The current role of ALM is also significant and a likely priority for disruption, with the organisation retaining an influential contribution to the domestic threat despite the break in leadership resulting from the imprisonment of Anjem Choudary.


‘ There will be terrorist attacks in this country’Andrew Parker, Director General of MI5, 1 November 2016

People of interest to MI5 in the UK

Soldiers deployed on the streets of the UK when at CRITICAL

People considered subjects of specific interest to MI5 in the UK

Days at SEVERE in the UK, before the move to CRITICAL on 23 May 2017

Active CT investigations in the UK

500

23,000

450

3,800

18

3,000

11

998

Fighters returned from Iraq and Syria to the UK

UK attack plots disrupted since June 2013

Days at CRITICAL in the UK since 2006

While the methodology of recent Islamist extremist attacks in the UK has varied, all of them were committed by adult men.

The arrests of three women in London in April 2017, and their suspected involvement in the commission, preparation and instigation of terrorism acts, however, suggest that this threat may be diversifying, with women playing a greater role in attack planning. In 2016, the UK experienced an increase in women undertaking extremist travel to Syria and Iraq compared to 2015, and the average age of travel reduced significantly.2 Some women travelled with their children, others travelled alone intending to marry Daesh fighters. However, reports suggest that at least ten of these women have returned to the UK from the so-called Caliphate in 2017,3 owing either

to disillusionment with the lifestyle or to the death of their husbands. It is possible that some of these women and children have received military training and may pose a threat as they return. Other women and children may have had their intended outward travel plans disrupted by authorities and remained in the UK, further contributing to the domestic threat.

The three women arrested in Willesden, London, were reported to be part of an ‘active terror plot’ to carry out a bladed attack. The police tactics at the time of their arrest – namely, the use of CS gas and the shooting of one of the women – is a likely indication of the imminence of the plot and possession of weapons.

The role of women in extremism has not previously been combative. Sally Anne Jones, the widow of Junaid Hussain, reportedly joined the Anwar al-Awlaki Battalion and focused on preparing Western female fighters to return home and carry out attacks in English-speaking countries. Tweeting

Women and children: a new threat paradigm?

Women Arrested, Charged and Convicted of Terrorism-Related Offences in Great Britain


12

Figure 2.

Arrested Convicted Charged

40

35

30

25

20

15

10

5

02001/02 02/03 03/04 04/05 05/06 06/07 07/08 08/09 09/10 10/11 11/12 12/13 13/14 14/15 15/16 16/17


under the name Umm Hassain al-Britani, Jones has posted threats of UK attacks on social media, encouraging ‘sisters in the UK (to) rise at Ramadan’.4 Her important role within the organisation has been recognised as a key component of the threat, and she is now a target on the US ‘kill list’.

The changing role of children in extremism has also been recognised. Great Britain has seen a growth in the involvement of under-18s in terror plots. Daesh frequently releases extremist media, such as videos and magazines, featuring and showcasing the ‘cubs of the Caliphate’. More than a quarter of arrests for terror offences since 2001 have happened since Daesh announced the establishment of the so-called Caliphate in 2014, indicating the effectiveness of Daesh’s strategy in appealing to children. Additionally, 54% of individuals referred to the UK government’s Prevent programme in 2015 were children.

To conclude, while the reason for the increasingly aggressive role of women and children in Islamist extremism may not be explicitly clear, it has been encouraged by Daesh online; the July edition of the group’s Rumiyah magazine encourages women to take up arms in combative jihad.5 Furthermore, as Daesh continues to lose territory in the so-called Caliphate, it may strategically broaden towards a ‘defensive jihad’ stance, allowing everyone, including women and children, to fight.6 This would be a significant development for the UK threat picture.

The July edition of Rumiyah magazine encourages women to take up arms in combative jihad.

Under-18s Arrested, Charged and Convicted of Terrorism-Related Offences in Great Britain

13

Figure 3.

Arrested Convicted Charged

15

12

9

6

3

0

2001/02 02/03 03/04 04/05 05/06 06/07 07/08 08/09 09/10 10/11 11/12 12/13 13/14 14/15 15/16 16/17


The threat level from international terrorism to the UK was raised from SEVERE to CRITICAL on 23 May 2017 as a result of the Manchester Arena attack and subsequent investigation.

The UK has been at CRITICAL for only eleven days in the last eleven years, the last being in 2007 after the Glasgow Airport attack.

Pool Re conducted a survey into the response of security professionals to the raising of the threat level and the three Islamist attacks in the UK this year; the survey produced a mixed response. A third of respondents stood up their Crisis Management Teams (CMTs) for all three UK attacks; a third of CMTs did not respond to any. Others acted only for Manchester and London Bridge, or just for the London attacks. The majority of organisations had carried out CMT exercises in the previous six months, but only 67% had put into place lessons identified before the Westminster attack.

The raising of the threat level also received a mixed response, with some companies continuing business as usual and others advising their staff to work at home.

UK Threat Level: Move to CRITICAL

The Joint Terrorism Analysis Centre (JTAC)JTAC is responsible for the independent and timely assessment of the international terrorist threat to the UK and interests overseas. Housed by MI5 at its London headquarters, it is a self-standing organisation with staff seconded from around sixteen government agencies.

JTAC decides on various threat levels; the only unclassified one is the UK threat level. The threat levels range from CRITICAL (highest) to LOW. Since being made public in 2006, the UK threat level has never been below SUBSTANTIAL (meaning an attack is a strong possibility). This level does not include threats from Dissident Republicans or domestic extremism and extreme right-wing activity.

10 August 2006Liquid bomb

plot foiled

23 May 2017Manchester

Arena

30 June 2007Glasgow Airport

14


The majority of respondents provided different advice to their staff at CRITICAL from that given at SEVERE, citing ‘Run Hide Tell’ protocol, restricting access to buildings, pulling down blinds to reduce view and increasing guard presence. The information source most used was the police, especially its social media account, followed by news reporting. The threat and associated risks were communicated to staff mostly by email and in person. All respondents felt that there was enough and appropriate information for their CMT leader to take the necessary decisions. Following the three attacks, half of respondents put in place additional mitigation measures, including improved communications between CMT members, sharing the ‘Run Hide Tell’ video and a security leaflet with staff members, and suggesting the download and use of security and alert applications; half of respondents did not.

Valuable lessons have been identified from this recent change in threat status, including the need for better official advice on what the threat entails, how this should be communicated to staff, what crisis management and business continuity plans should be put in place and what de-escalation measures are needed. Updated advice is particularly needed for the Small Medium Enterprise (SME) sector, which does not have embedded security professionals or knowledge of where to find the necessary information. It is likely the government will conduct a review of the UK threat levels following the three Islamist attacks to ensure vigilance and to avoid complacency, especially during long periods of time at SEVERE.

Threat Level Date Attacks/Plots

SEVERE 27 May 2017 Manchester Arena

CRITICAL 23 May 2017

SEVERE 11 May 2016

SEVERE 29 August 2014

SUBSTANTIAL 24 October 2012

SUBSTANTIAL 11 July 2011

SEVERE 24 September 2010

SEVERE 22 January 2010

SUBSTANTIAL 20 July 2009

SEVERE 4 July 2007 Glasgow Airport

CRITICAL 30 June 2007


CRITICAL 10 August 2006 Liquid bomb plot foiled


15

‘ Sharing national threat levels with the general public keeps everyone informed. It explains the context for the various security measures which we may encounter in our daily lives’

MI5 website


16

The Provisional IRA (PIRA) and other loyalist groups ceased their terrorist campaigns in April 1998 when the Good Friday Agreement allowed a devolved Northern Ireland Executive based on power-sharing between unionist and nationalist political parties7.

Some factions, however, did not welcome or agree with the political approach and remained committed to pursuing violent means. A Northern Ireland Related Terrorism (NIRT) attack in Great Britain was possible, but unlikely.In May 2016, however, the threat level to Great Britain from a NIRT attack was raised from MODERATE to SUBSTANTIAL, which meant an attack was now a strong possibility. This announcement was publicly unexpected, and the Home Secretary’s statement did not specify any reasons for the change. While community-based violence had continued in Northern Ireland, an attack on the mainland had not happened for over ten years. Hostile intent had been retained by Dissident Republican groups, although their capabilities to mount external attacks had been limited by MI5 and the Police Service of Northern Ireland (PSNI). Yet the discovery of a number of explosive and weapons caches and the pace of attacks attributed to the New IRA in Northern Ireland was enough to change government opinion and the threat level to Great Britain.

The New IRA was formed in 2012 and consists of anti-ceasefire factions from the Real IRA, the Republican Action Against Drugs and groups from East Tyrone, notably former members of PIRA’s East Tyrone Brigade, which represents a particularly dangerous dynamic for the mainland, as many of the operatives were integral to the transportation of VBIEDs detonated in British cities during the 1990s8. The New IRA retained key Republicans experienced in ‘The Troubles’, with uncorroborated reports stating they included a key PIRA bomb-maker along with access to weaponry and explosives.

Dissident Republican groups, including the New IRA, are believed to undertake paramilitary activity within communities as so-called punishment for antisocial activities. This is thought to be at an all-time high in Belfast9. Such vigilante attacks and the extortion of illicit goods dealers may exploit fault lines in community cohesion, potentially increasing community tensions and public fear of reprisals for any cooperation with the PSNI. Tensions in Northern Ireland are also likely to be sustained, with the New IRA targeting figures of authority such as the military, police and prison officers.

This targeting was made apparent by the murder of Adrian Ismay in March 2016, which also illustrated the sophistication of New IRA attacks. The prison officer was killed when an IED detonated under his car, with numerous reports suggesting Semtex was the explosive used in the attack10. This attack and many of the others are a strong indication that the group possesses the explosive, probably as a result of previous PIRA caches, with some reports suggesting the group has obtained up to a quarter of a tonne11.

Undercar IEDs, including use of armour-piercing bombs known as Explosively Formed Projectiles (EFPs), have previously been used by insurgents in Iraq and Afghanistan to attack military vehicles. Use of EFPs in Belfast and Derry has been attributed to the New IRA, which suggests that the group’s bomb-making skills are more advanced than those of other dissident groups12.

Northern Ireland Related Terrorism

Tensions in Northern Ireland are also likely to be sustained, with the New IRA targeting figures of authority such as the military, police and prison officers.

The range of tactics used by the group also include more traditional methods associated with NIRT attacks. In 2014, a number of military recruitment centres in England received small crude but viable IEDs sent in the post. This, together with use of code words given to British authorities, was reminiscent of attacks during the 1970s and onwards. Those bombs could easily have been the start of a campaign on the mainland, and the subsequent statement from the New IRA claiming responsibility stated that ‘attacks will continue when and where the IRA see fit’13.

The targeting of military personnel in Great Britain in 2014 is consistent with New IRA activity in Northern Ireland and potentially indicative of the group’s main focus now. The New IRA has a likely credible intention to attack Great Britain, and probable targets are police and military personnel—those also prioritised by Islamist extremists. Dissident Republicans, unlike Islamist extremists, however, are more likely to seek key individuals or premises for attack, rather than risk indiscriminate civilian casualties. The most likely methodology of a NIRT attack is the use of IEDs, particularly under vehicle devices, emphasising the precision of their targeting and attacks.

The New IRA has clear aspirations for an attack on the mainland, with some statements in the press confirming England remains a key target in the armed campaigns14. The arrest and conviction of Ciaran Maxwell offers a potential example of the reach of Dissident Republicans into Great Britain.

Ciaran Maxwell, while serving as a Royal Marine, stored a cache of weapons including military-grade explosives and home-made IEDs at locations in England and Northern Ireland. Reports suggest that, while at least fourteen pipe bombs were found, he had enough material and the knowledge to make a further nineteen15. The subsequent police investigation established his association with Dissident Republican groups, particularly the Continuity IRA (CIRA). This is an interesting development, as previously the CIRA had been judged to be confined to around twenty activists with limited capabilities. In comparison, the New IRA is believed to have more than 50 members with around 200 supporters offering logistical help16.

Maxwell is reported to have admitted the devices were intended for the CIRA to use in attacks on police stations in Northern Ireland. Additionally, however, reports state he was in possession of a list of significant locations in London, including the headquarters of the National Crime Agency, the National Security Vetting Office and the Northern Ireland Office17. These are all locations representative of Dissident Republican targets, and Maxwell’s case illustrates their reach onto the mainland.

Over twenty years, the IRA strategy shifted away from targeting military, government and security personnel to trying to cause economic damage to the UK’s financial centre18. While not expected imminently, NIRT attacks in Great Britain would now be more likely to revert to targeting key locations or figures of government authority, rather than indiscriminate attacks against the public or attacks resulting solely in large-scale property losses.

With the pace of violence in Northern Ireland likely to remain severe and the New IRA being widely recognised as the biggest Dissident Republican threat in decades, its intent to attack Great Britain must be recognised. Pool Re was established in 1993 as a response to the insurance market failure triggered by NIRT attacks, specifically the cost of the PIRA’s mainland bombing campaign. The evidence revealed by the prosecution of Maxwell illustrates the contemporary capabilities of individuals with hostile intent on the mainland and their affiliations to Northern Ireland. Official security measures have been applied to hazardous chemical procurement and sites over recent years, because of Islamist extremist plots, which has reduced the availability to precursors required for home-made IEDs. The case of Maxwell, however, proves that Dissident Republicans have a far more resilient capability to acquire military grade equipment or build sophisticated and viable devices for use in attacks. The case of Maxwell may well be an isolated incident and not the start of a new campaign, but it illustrates that NIRT attacks have not gone away.

17


‘ Attacks will continue when and where the IRA see fit’

New IRA press statement, February 2014

The most likely methodology of a NIRT attack (in Great Britain) is the use of IEDs, particularly under vehicle devices.

Global Islamist Threat

19


Islamist Extremism Main Presence, 2017 Threat posed to the UK homeland by Islamist extremist groups overseas

RUSSIA

NIGERIA

SAUDI ARABIA

AFGHANISTAN

PAKISTAN

BANGLADESH

PHILIPPINES

INDONESIA

YEMEN

SOMALIA

ALGERIA

MALI

LIBYA EGYPT

SYRIA

IRAQ

Caucasus

Sinai Peninsula

Threat Actor Area of Operations Capability Recent Activity and Attacks Relevant to Western Targets

Contribution to the UK Threat

Daesh core Inspire and direct attacks against Western targets.

Significant loss of territorial control in Iraq and Syria in 2017, including the defeat in Mosul.

Istanbul, January 2017; London, March 2017; Paris, April 2017; Manchester, May 2017; London, June 2017; Australia, June 2017.

More Likely

Trend

December

2016

September

2017

More Likely

Possible

Less Likely


20



Daesh affiliate

Daesh Sinai Province

Focus on Egyptian military and police targets and local religious minority groups.

While Western tourists have been targeted in attacks in Egypt, there has yet to be a corroborated claim from Daesh Sinai.

Possible

Trend

December

2016

July 2017

Daesh affiliate

Boko HaramConduct and direct attacks in West Africa.

Ongoing operations against regional forces (Nigeria, Niger, Cameroon and Chad). Indiscriminate attacks on the University of Maiduguri.

No specific targeting of Westerners in the attacks in the reporting period, although attacks can be indiscriminate. The FCO warns of the threat of kidnapping of tourists and foreigners in areas with a Boko Haram presence.

Abduction of women and children continues. The kidnapping of the Chibok schoolgirls in April 2014 is ongoing. At least 82 have been released this year but 113 remain missing.

Less Likely

Trend

December

2016

July 2017

AQ branch

Al Qaeda in the Arabian Peninsula (AQAP)

Territorial control in Yemen and ongoing operations in Yemen’s civil conflict.

Access to heavy weaponry and sophisticated bomb- making material.

No specific targeting of Westerners in the attacks in the reporting period, although attacks can be indiscriminate.

Increased activity by the US military in Yemen this year is a likely indicator of AQAP’s continuing capability and intent to target the aviation sector and the West in general.

More Likely

Trend

December

2016

July 2017

More Likely

Possible

Less Likely



21



AQ branch

Al Qaeda in the Islamic Maghreb (AQIM)

Conduct and direct attacks in West and north Africa with the aim of overthrowing the Algerian government.

Focused on Western targets within North and West Africa, including foreign, particularly French, interests and tourist resorts.

Territorial safe haven in Trans Sahel region and fragile states.

Targeting of the United Nations Multidimensional Integrated Stabilisation Mission in Mali (MINUSMA) and tourist resorts.

Release of a Swedish hostage held for five and a half years, June 2017.

More Likely

Trend

December

2016

July 2017

AQ branch

Al Qaeda in the Indian Subcontinent (AQIS)

Regularly conducts targeted assassinations in Bangladesh.

Operationally focused on Pakistani and Afghan military.

No specific targeting of Westerners in the attacks in the reporting period.

Evidence suggests AQIS’s main focus is on the Indian subcontinent and does not present a threat to the UK homeland.

Less Likely

Trend

December

2016

July 2017

AQ affiliate

Al-ShabaabConduct and direct attacks in the Horn of Africa and Arabian Peninsula.

Ongoing operations in Somalia’s civil conflict.

There is a constant threat of terrorist attacks and kidnappings in Mogadishu and against Westerners. 2017 attack targets have included markets, hotels and the vicinity of Mogadishu International airport.

Less Likely

Trend

December

2016

July 2017

Former AQ branch

Hay’at Tahrir al-Sham (formerly Jabhat Fateh al-Sham and Al Nusra Front)

Group formed in January 2017 by absorbing smaller factions.

Ongoing operations in Syria’s civil conflict.

No specific targeting of Westerners in the attacks in the reporting period.

Possible

Trend

December

2016

July 2017


More Likely

Possible

Less Likely



22

20 January 2017 marked the inauguration of Donald Trump as the 45th President of the United States of America. On the same day, a United States (US) unmanned aerial vehicle (UAV) strike killed an al Qaeda in the Arabian Peninsula (AQAP) operative in Bayda province, Yemen19. That strike, the first in over eighty so far this year, is likely to be an indication of how AQAP is dominating the AQ brand and is an enduring threat to the West and its allies. US military action, responsible for the deaths of over fifty AQAP operatives in Yemen this year20, is likely related to the aviation security measures issued by the US and UK governments in March. Aviation remains a highly desired target by terrorists worldwide. The security measures, banning laptops and other electronic devices from the cabins of commercial aircraft originating from certain countries, have the hallmarks of countering complex bomb designs first promoted by AQAP. Of all potential terrorist methodologies targeting aircrafts and passengers inflight, an explosive device on board is now the most likely.

The correlation between the AQAP threat and overt security advice is not new. The increase of the UK threat level to SEVERE in January 2010 should be considered in conjunction with the attempted bombing of Northwest Airlines Flight 253 on Christmas Day 2009 by Umar Farouk Abdulmutallab (‘the Underpants Bomber’), which gave clear indications of external attack planning against aviation by AQAP and affiliated groups21. Those aspirations were manifested again in October 2010 with the ‘inkjet cartridge plot’, which was claimed by AQAP and saw two explosive devices discovered on planes in Dubai and the UK that had taken off from Yemen.

The UK threat level was again raised to SEVERE in August 2014, with AQAP’s capability to attack civil aviation with non-metal content (NMC) bombs a likely driver. Just prior to the change in the UK threat level, new travel restrictions were implemented for uncharged electronic devices on United States-bound planes, with the threat from AQAP and AQ-affiliated groups cited in open source reporting22. The travel restrictions are a likely indicator that the battery compartment of the device had been removed to house the main charge of the bomb, meaning power to the device would have had to be added manually once someone was actually on board the aircraft. The sophistication of this design is typical of AQAP knowledge, and the resulting security measures on flights are indicative of how authorities are attempting to tailor advice specifically against the developing designs of the bombs.

Military action after mid-2014 directed against AQAP and AQ-associated groups, such as the Khorasan Group23, resulting in the deaths of high-value targets including David Drugeon, Nasir al-Wuhayshi and Muhsin al-Fadhli, is likely evidence of the weight they contributed to the threat against the West24. This could account for the current and ongoing military action in Yemen.

AQ proved its resilience with the publication of Inspire 13 in December 2014, containing advice on defeating airport security measures, instructions on how to make a NMC bomb and encouragement to blow up Western airlines. This knowledge, previously held by a few individuals, was subsequently shared across the internet and was manifested in further attacks, so assisting the capabilities of other Islamist extremist groups. For example, it is highly likely the downing of Metrojet flight 9268 in October 2015, in an attack claimed by

Aviation Threat: New Advice, Old Enemies

The correlation between the AQAP threat and overt security advice is not new.

23

‘ I can tell you that aviation is still, for many reasons, one of the number one targets of interest for terrorist groups and individuals who are connected to them.’ Peter Neffenger, former Transport Security Administration Administrator, 22 March 2017

Daesh Sinai, was caused by an IED onboard facilitated by someone with access at the airport, rather than by a person-borne bomb. That would also corroborate some of the details released by Daesh Sinai in its claim.

In 2016 al Shabaab conducted its first IED attack against aviation at Mogadishu airport onboard a Daallo Airlines jet. It is likely that the IED, believed to be concealed within a laptop, was facilitated through the airport by someone with access. While the attack did not bring down the plane, it did cause significant damage, and the terrorist was killed in the explosion. This is a likely indicator that the IED still required initiation by human hand, unlike the device onboard Metrojet flight 9268. As such, either banning certain devices from the cabin or combining restrictions with enhanced screening measures at airports appears necessary to mitigate the current terrorist threat against aviation.

These two attacks also broke the perception of robust security measures at airport, which may have been preventing previous aviation-themed attack plots. Further attack plots against aviation may now be more likely.

A significant proportion of the threat against aviation appears to continue to emanate from Yemen. Nine days after his inauguration, President Trump approved his first military action as Commander-in-Chief, sending a military team into Yemen that saw the death of fourteen terrorists, twenty-five civilians and a US Navy SEAL. While many subsequent news reports focused on the death of the US serviceman25, the terrorists killed included three AQAP seniors, described as operational planners and weapons experts as well as being relatives of Anwar al-Awlaki, a deceased AQAP senior and radical cleric who inspired many attacks against the West. This recent action is indicative of new intelligence emphasising a resurgent threat.

The nature of the recent security measures suggests mitigation against IEDs consistent with previous AQAP designs. The requirements for enhanced screening measures at some airports, revealed by the US government in June26, are consistent with the threat posed by extremists or staff vulnerable to corruption in facilitating devices past security checks at airports. The restrictions on some electronic devices in the cabins of aircrafts are reflective of passenger-borne devices, which need to be connected to power for the explosive device to be initiated27.

This is a stark reminder that Western aviation remains a desired target by AQ and other Islamist extremist groups.

An attack downing a commercial aircraft would be a spectacular achievement for the group concerned; AQAP may have posed a significant threat consider the US military action in Yemen. For many Islamist extremists, aviation remains symbolic of the West and allied relationships and significant to the strength of a country’s economy. An attack causes fear among the public and results in visible losses to business. The AQ attacks of 11 September 2001 caused colossal economic damage, in addition to the vast loss of human life. More recently, the attacks against Brussels airport in March 2016 and Ataturk Airport, Istanbul, in June 2016 show how the wider aviation sector may be targeted, particularly by Daesh.

Daesh is highly likely to have played a significant role in the disrupted plot in July 2017 to attack a plane leaving Sydney airport28, with strong connections to senior leaders based in Turkey. This may illustrate a new operations base for the group following its losses in Iraq and Syria. Media reports on a potential chemical aspect to the disrupted plot are significant and may indicate a further evolution of attack methodology, although it is less likely that aviation was the intended target of that aspect of the plot. Aviation could, however, be vulnerable to chemical weapon style attack if precursor chemicals and other substances required to produce toxins onboard an aircraft are currently more difficult to detect at airport security checkpoints than explosives. While military action against Daesh may be more publicised, the fight against AQ continues. That fight may manifest itself in declared military operations overseas or in the adjustment of overt domestic security protocols, the reasoning behind which may not be immediately obvious or explicit, but which are tailored to a very specific and dangerous threat – a threat that is still focusing firmly on aviation.


A significant proportion of the threat against aviation appears to continue to emanate from Yemen.


24

This graphic (Figure 4), maps out each edition of Islamist magazines Inspire, Dabiq and Rumiyah between March 2014 and July 2017, the significant attacks in the West and wider Western targets during this time period and the methodology used.

This period can be divided into two distinct phases: May 2014 to June 2016 and June 2016 to July 2017, when there is an apparent shift in terrorist attack methodology from the use of firearms to the use of lower sophistication weapons.

Islamist Extremist Publications

The influence of Jihadist magazines on terrorist attack methodology

Figure 4.

March 2014INSPIRE no.12

29 June 2014Declaration of Caliphate

July 2014DABIQ no.1

Oct 2014DABIQ no.4

Dec 2014DABIQ no.6

Mar 2015DABIQ no.8

Sept 2015DABIQ no.11

June 2015DABIQ no.10

Nov 2014DABIQ no.5

Feb 2015DABIQ no.7

April 2015DABIQ no.9

Jan 2016DABIQ no.13

Aug 2014DABIQ no.2

Sept 2014DABIQ no.3

Dec 2014INSPIRE no.13

5 Dec 2015Leytonstone

Tube Stabbing, London,Bladed

26 June 2015Sousse, Tunisia

Firearms

15 Dec 2014Hostage Crisis, Lindt Café

Sydney, Firearms

18 Mar 2015Bardo Museum, Tunisia

Firearms

31 Oct 2015Metronet Flight 9268

Sinai, EgyptIED

March 2014 Jan 2015 Jan 2016

2 Dec 2015San Bernadino,

CaliforniaFirearms

15 Feb 2015Copenhagen, Denmark

Firearms

22 Oct 2014Parliament Hill,

Ottawa, Canada,Firearms

24 May 2014Jewish Museum, Brussels,

Firearms

21 Aug 2015Thalys Train Attack, France

Firearms/Bladed22 Sept 2014Adnani

‘Lord Ever Watchful Speech’

7 Jan 2015Charlie Hebdo, Paris

Firearms

Sept 2015INSPIRE no.14

Nov 2015DABIQ no.12

13 Nov 2015Bataclan Attack, Paris

Firearms

Publication

INSPIRE DABIQ RUMIYAH

25

The first period includes the release of all but one edition of Daesh’s Dabiq magazine and four intermittent, but significant, releases of al Qaeda’s Inspire magazine. The second period is dominated almost entirely by Daesh’s Rumiyah.

In the first period, May 2014 to June 2016, there were fifteen significant attacks; of these, eleven involved the use of firearms, three involved IEDs and two involved bladed weapons.

In the second period, June 2016 to July 2017, there was a sharp increase in the number of attacks, to nineteen within twelve months. Compared to the first period, this period shows a noticeable decline in the use of firearms in attacks (only three), but a wide range of attack methodology, including six IEDs, four bladed weapons, six vehicles and one hostage-taking.


1 Jan 2017Istanbul, Turkey

Firearms

19 Dec 2016Berlin, Germany

Vehicle

22 Mar 2017Westminster, London

Vehicle / Bladed

March 2016INSPIRE no.15

April 2016DABIQ no.14

July 2016DABIQ no.16

May 2016INSPIRE no.16

11 Nov 2016RUMIYAH no.3

4 April 2017RUMIYAH no.87 Dec 2017

RUMIYAH no.4

4 May 2017RUMIYAH no.9

7 June 2017RUMIYAH no.10

4 Feb 2017RUMIYAH no.6

7 March 2017RUMIYAH no.7

13 July 2017RUMIYAH no.11

4 Oct 2016RUMIYAH no.2

5 Sept 2016RUMIYAH no.1

26 July 2016Normandy Church Attack,

France,Bladed

3 June 2017Borough Market, London Bridge

Vehicle / Bladed

28 Nov 2016Ohio, USA

Vehicle

19 Dec 2016Assassination of Ambassodor Andrei Karlov, Ankara, Turkey

Firearms

22 May 2017Manchester Arena Attack

PBIED

19 June 2017Attack on Police Car,

Champs ElyseesVBIED

22 March 2016Brussels Airport

BombingBrussels,

PBIED

20 April 2017Police killed on

Champs Elysees,Paris, France

Firearms

Jul 2017Jan 2017

12 June 2016Pulse Nightclub, Florida

Firearms

28 July 2017Hamburg, GermanyBladed

20 June 2017Brussels

Central StationIED

5 June 2017Melbourne,

AustraliaHostage Taking

6 June 2017Notre Dame attack

on PoliceHammer

7 April 2017Stockholm, Sweden

Vehicle

3 April 2017St Petersburg Metro Bomb

PBIED14 July 2016Nice, France

Vehicle

24 July 2016Ansbach Bombing,

PBIED

Ref. c) Note that it is an offence under Section 58 of the Terrorism Act 2000 to collect, make a record of, or possess information or a document ‘of a kind likely to be useful to a person committing or preparing an act of terrorism’.

17 Sept 2016New York and

New Jersey Bombings, IED (Pressure Cooker)

6 Jan 2017RUMIYAH no.5

Attack type

Firearms Bladed IEDs PBIEDs VBIEDs Vehicle Hammer Hostage taking


The publication of online magazines, videos and social media material is a fundamental part of promoting Islamist extremism strategy and ideology. The content of Inspire, Dabiq and Rumiyah magazines has been linked to numerous attacks in the past few years, and post-attack investigations have revealed attackers frequently to be in possession of publications. The use of these media, to spread ideology beyond territories in the Middle East and to recruit and inspire others to act, remains a challenge for police and intelligence agencies.

The influence of these magazines is likely to play a role in Prevent and counter-extremism work, and their role in

radicalisation may feature in any refresh of the Counter-Terrorism Strategy (CONTEST).

The release of magazines by groups such as Daesh is not new; al Qaeda in the Arabian Peninsula (AQAP) had published eleven editions of its magazine Inspire before the release of Daesh’s Dabiq magazine in 2014. AQ used its extremist publication to spread its ideology and as a way for members of the senior leadership to ensure their knowledge and expertise lasted past their death, providing how-to guides and detailed instructions on making explosive devices. The declaration of the so-called Caliphate by Daesh on 29 June 2014 was quickly followed by the first edition of Dabiq magazine, entitled ‘The Return of the Khilafah’.

Islamist Extremist Publications continued

‘Just Terror Tactics’ in Rumiyah, 2016–2017

Edition of Date Just Terror Attack methodology Rumiyah released Tactics number highlighted

2 October 2016 None Knife attacks

3 November 2016 Just Terror Tactics 1 Vehicle attacks and

4 December 2016 Just Terror Tactics 2 Knife attacks

5 January 2017 Just Terror Tactics 3 Arson attacks

9 May 2017 Just Terror Tactics 4 Hostage-taking

additional weapons

Figure 5.

26

27

This was a likely step to communicate their rhetoric and ideology far beyond the territorial boundaries in the Middle East at a time when governments across the West were taking steps to prevent their citizens from travelling to Iraq and Syria. Dabiq took its name from the town in Syria in which, according to the group’s ideology, the final showdown between Muslims and their ‘Roman enemies’ was to take place. However, when it became clear in October 2016 that Daesh was losing the symbolic town to the Free Syrian Army, Dabiq was replaced with Rumiyah magazine, a reference to the final conquering of Rome after Dabiq and the subsequent fall of the West.

As seen in Figure 4, there was a high frequency of firearms attacks during the period May 2014–June 2016, and a shift towards less complex, less sophisticated attacks using a variety of different methodologies between July 2016 and July 2017. The difference in methodology used in period one and period two can be linked to the extremist media and communications at each time. During period one, more complex attacks, using sophisticated weapons and requiring training and planning, were being used, as advocated by AQ in the previous eleven editions of its Inspire magazine, which was released intermittently between June 2010 and November 2016. Dabiq magazine’s fifteen editions provided many pages of Islamist extremist religious rhetoric and a utopian image of the group and the new so-called Caliphate. Both guides are accessible online, and Inspire provides step-by-step photographic approaches to building and using weapons. However, the materials, devices and methods of attack highlighted by AQ are relatively complex compared to the attack methodology witnessed in the West today and require a degree of advanced planning and sophistication, therefore occurring less frequently. These methods, including making home-made explosives, remote control detonators, acetone peroxide, and non-metal content explosive devices and using AK47s and handguns, were evidenced in attacks in Sydney, Copenhagen, Paris, Sousse and San Bernardino. It has been reported that the male perpetrator in the San Bernadino attack had been influenced by Inspire magazine.

In 2016, as extremist travel and attendance at training camps overseas became harder, Daesh’s territory was shrinking and the quantity of their propaganda decreased.29 Daesh released its new magazine, Rumiyah. There was a shift to a more aggressive, warlike rhetoric, and the magazine aimed to inspire those unable to travel to the so-called Caliphate, by providing a series of online, ‘do-it-yourself’ instructions called ‘Just Terror Tactics’ (see Figure 5). Lone actors were encouraged to fight in their own countries with very little, if any, contact or connection or training with senior members of Daesh in the Middle East. Compared to the sophistication of those in AQ’s Inspire magazine, the instructions in Rumiyah are easy to follow and carry out with less planning, and therefore with less likelihood of being detected by domestic security services.

The ‘Just Terror Tactics’ section has featured prominently in the media recently. The evolution of the terrorist threat in the UK and Europe from larger, more complex attacks to low sophistication attacks using easy to obtain weapons has seen the rise in the use of knives and vehicles. This low complexity methodology has been described and outlined in Rumiyah’s ‘Just Terror Tactics’ sections in four different editions (see Figure 5). The increase in frequency of these types of attacks after July 2016, as Rumiyah was released, would appear to show that this magazine had a profound effect in changing the methodology and timing of attacks in the West, as seen subsequently in attacks carried out in Ohio, Berlin, London and Stockholm.


‘ We must stop terrorists spreading their hate online’.

Prime Minister Theresa May, 26 May 2017


28

It would appear, from the release dates and content, that the attack methodology highlighted by magazines such as Rumiyah has a direct correlation with the methodology used in subsequent attacks in Western countries – since the release of Rumiyah there have been five vehicle attacks; before that there had been only one (Nice, France) – as well as with the detail of attacks – the attacks at London Bridge used a Hertz-branded van, the same brand featured in ‘Just Terror Tactics 1’. However, evidence shows that these methodologies were in fact being used and encouraged long before the release of Rumiyah. Prior to its first release in September 2016, the murder of Fusilier Lee Rigby, the Leytonstone stabbing, the Nice vehicle attack and the killing of Priest Jacques Hamel in Normandy had all taken place using combinations of bladed weapons and vehicles. Bladed and vehicle attacks have been used by other groups – for example, in the Israel Palestine conflict – for several years. AQ’s Inspire magazine back in October 2010 advocated the use of trucks for weapons, as ‘The Ultimate Mowing Machine’. Additionally, the increase in attacks and the calling for lone operatives to act without direction or direct affiliation with the group have been linked back to other extremist media, including speeches by senior AQ leader Anwar al-Awlaki and the influential ‘Indeed your Lord is Ever Watchful’ speech by senior Daesh leader al Adnani in September 2014.

The more sophisticated content of AQ’s magazine compared to Daesh’s may provide evidence of differing strategies; although AQ has promoted quick and simple attacks successfully (for example, the attack on Stephen Timms MP in London in 2010), the group continues to focus on infrequent, ‘spectacular’ attacks with preparation, versus Daesh’s push for frequent, quick, low complexity and small-scale have-a-go attacks. While Daesh has capitalised on the use of social media and the internet, AQ has proved its resilience and maturity, even online, with methodology of attacks seen on the streets now that were highlighted in Inspire back in 2010.

While it is clear that the methodology outlined in the magazines and wider extremist media contributes to the methodology used in an attack, it does not appear to be dependent on the most recent advice. Some advice is heeded immediately (‘Just Terror Tactics 4’ highlighted hostage-taking, which was followed by the June 2017 hostage-taking in Melbourne, Australia), while some is not (arson,d kidnapping children). Instead, extremist publications provide a library of options for Islamist extremists with a varying degree of complexity.

A challenge for the UK government is how to act against the effective media campaign of groups such as Daesh, and it has been active in this space; the UK is one of seventy-three members of Global Coalition, which aims to tackle Daesh’s propaganda with counter-messaging. Defence Secretary Sir Michael Fallon confirmed, in October 2016, that GCHQ has been conducting ‘offensive cyber’ operations against Daesh,30 and Home Secretary Amber Rudd recently told technology firms to do more to combat the spread of extremist media online and has suggested banning encryption apps such as WhatsApp. The Westminster Bridge attacker had been active on WhatsApp moments before conducting his attack, and extremist media are regularly shared on Telegram channels. The Indonesian government recently took action against instant messaging platforms by partially blocking access

Islamist Extremist Publications continued

Ref. d) There are reports that a number of petrol bombs were removed from the van used in the London Bridge attack. It is not clear why the terrorists did not use them, but this could have potentially caused many more casualties and property loss.

29


to Telegram because of its believed use by terrorists in attack planning. As its physical territory shrinks, Daesh will continue to move to the virtual space to spread its ideology. Despite the work by the government, the battle will continue, because, as soon as one site or channel is taken down, another appears. Daesh’s effective use of the internet and social media is not likely to abate soon; instead, with the further loss of territory in Iraq and Syria and an effective means of communicating from the so-called Caliphate, extremist magazines are likely to continue to motivate Islamist extremists to attack in their own countries.

Figure 6. The difference in attack methodology used during May 2014-June 2016 and July 2016-July 2017. Period 1 shows the prevalence of firearms which then spread into a range of methodologies in period 2, all of which were highlighted in Islamist extremist magazines.

The Difference in Attack Methodology Used during Periods 1 and 2

May 2014-June 2016

12

10

8

6

4

2

0

July 2016-July 2017

Hostage Taking Vehicle Bladed IED Firearms

‘ Terrorists, in ungoverned spaces, disseminate poisonous propaganda and training materials to attract troubled souls around the world to their cause. They encourage these individuals to travel, but if they can’t travel, they motivate them to act at home.’James B. Comey, Director, FBI, 08 October 2015

CBRN, Cyber & Drones

31

CBRN, Cyber, Drones

CBRNA terrorist attack using military grade chemical weapons (CW) remains unlikely in the UK, however we cannot discount the use of hazardous chemicals or other toxic material. There have been continued reports of CW being used in Syria, attributed to government forces, with the most recent incident on 4 April 2017 involving Sarin nerve agent, which killed more than 80 people and wounded over 300 others. It is probable the Syrian government will retain a CW capability. The capability, however, of Islamist extremists in this field is likely to have diminished with the loss of territory and assets of the so-called Caliphate and the targeted killings of the group’s CW specialists.31 The apparent absence of the widespread use of CW suggests the feared capability from captured stockpile or manufactured weapons has not transpired, and the continuing emphasis of probable CW use by the Syrian government remains the focus of international attention.

In the UK, there have been no public reports of disrupted plots involving CW. This suggests extremists are seeking to undertake attacks that do not require the complexity of CW acquisition or manufacture. Islamist extremists remain the most likely group to undertake a CW attack, as unlikely as the event would be. There remains frequent discussion between extremists on deep web internet forums, with both AQ and Daesh offering ideas and encouragement in weapon manufacture and targets. These discussions appear indicative of aspirations that have not yet matured into attack planning.

It is likely, however, that senior Daesh leaders in Turkey played a significant role in the reported plan for Sydney-based extremists to undertake a CW attack in Australia. The CW aspect of the plot appears to have been considered after an unsuccessful attempt to place an IED onboard a plane. This illustrates not only the resolve of extremists to undertake spectacular attacks, but also the extent to which they may be willing to consider alternative methodology to achieve them. The plot may also demonstrate the overseas knowledge base with CW, which impacts on domestic threats. It is likely that knowledge was obtained through experiences in the so-called Caliphate, and, following its fall, fighters returning to home countries or those now resident in other countries may seek to share this knowledge through new associations and networks or via the internet and instant messaging platforms.

Pool Re has covered acts of terrorism involving CBRN methods since 2003, and has been working with Cranfield University, in association with Guy Carpenter, for the past eighteen months to model the possible effects, and enhance our understanding, of such attacks in the UK.

‘ We have seen the use of chemical weapons in Iraq and Syria and in principle there is the risk that those could also be used in the West and in the UK, and I absolutely feel that we should be alert to that.’

Lord Evans of Weardale, Former Head of MI5, August 2017

Hydrogen sulphide (H2S)The disrupted Australian extremists intended to use H2S, a colourless, flammable and extremely toxic gas. Encouragement and instructions in the use of H2S have been circulated online by Islamist extremists. It may prove to be a relatively low complex CBRN attack method by extremists in the UK.


32

On 6 April 2017 Pool Re co-hosted a conference with the Nuclear Threat Initiative (NTI) in London to share knowledge, ideas and experiences of the threat posed by Radiological Dispersal Devices (RDDs) and identify insurance mitigation strategies to reduce the risk posed by commercially available isotopes in the UK. The conference included an in-depth case study on the US healthcare sector and the related vulnerabilities associated with UK hospitals and medical isotopes. Several cities and countries are already taking steps to eliminate the risk posed by these isotopes by removing blood irradiation devices containing cesium-137 and replacing them with safer, effective alternatives. France and Norway have removed all their devices, Japan more than 70% of them, and New York City is currently undertaking the replacement of approximately thirty machines. The damage caused by an RDD in the UK, and the post-event clean-up, could cost billions of pounds. Access to the contaminated area could be denied for years, causing significant business interruption. Dealing with an RDD claim would be unprecedented.

Pool Re and the insurance industry have a long history of evolving in the face of threats and redefining themselves to ensure they can continue to protect vital commerce worldwide. The conference highlighted not only the economic impacts associated with potential terrorist attacks and this methodology, but also the impact the insurance industry can have by influencing the behaviour of its customers, encouraging mitigation steps in hospitals and spreading awareness on this subject, which Pool Re and NTI did most recently at the International Forum of Terrorism Risk (Re)Insurance Pools conference in Paris in June 2017. Public-private partnerships are crucial in covering this type of terrorism risk.

The conference was timely, as groups such as Daesh have stated their interest in using weapons of mass destruction or disruption against Western targets. Although Daesh’s CW capability in the so-called Caliphate is assessed to have diminished significantly, individuals with technical expertise may return to their homelands as their hold on territory shrinks. Three months after the joint Pool Re and NTI conference on this subject, it was reported in the media that Daesh had access to, but had failed to use, two radiological therapy machines at the University of Mosul containing cobalt-60.32 The apparent lack of knowledge by the group to use the material as a weapon suggests a lack of capabilities; however, their proximity to the radiological material is a clear contribution to the threat.

Joint Pool Re NTI Conference

Above: Lord Browne. Above right (from left to right) Steve Coates, Andrew Bieniawski, Deborah Rosenblum, Julian Enoizi and Ed Butler. Below right: Steve Coates

33

CBRN, Cyber, Drones

CyberThe global cyber market is estimated to be worth between $3 and $3.5 billion,33 and in 2016 cyber attacks were estimated to cost businesses as much as $450 billion a year globally.34 Cyber terrorism is unlike any other peril in the insurance market because of its theoretical ability to affect almost any insurance class. The term ‘cyber’, when relating to its use by Islamist extremists, has several different meanings and uses. Groups such as AQ and Daesh continue to enable their operations through online platforms, which are used to release extremist media, magazines, speeches and material, to recruit new members, to inspire lone individuals to carry out attacks, to fundraise and to communicate with extremists overseas.

Pool Re assesses there has been no marked change in cyber terrorism capability or aspiration in the reporting period, although 2017 has seen a high level of interest in cyber activity, mainly surrounding the WannaCry and NotPetya attacks and the prolific spread of these malware around the world. Amid this, the UK saw its first court case and sentencing in May 2017 of a ‘new and dangerous breed of terrorist, a cyber terrorist’. Samata Ullah, 34 years old from Cardiff, was jailed for eight years for supplying documents and computer expertise saved on thirty pairs of USB storage devices disguised as cufflinks to the Cyber Caliphate Army. The material that he had stored is largely available online and relates to encryption and cyber security rather than destructive cyber capabilities. However, this was the first member of the Cyber Caliphate Army to be charged in the UK, and the case provides evidence of the continuing threat from these groups and thus the need for Pool Re to cover cyber terrorism increases.

Any increasing capability in cyber terrorism in the future is likely to involve recruiting skilled individuals, similar to Ullah, Junaid Hussain and other computer engineers, and the proliferation of unsophisticated enabling and disruptive activity. Low-skilled enablers are likely to continue to shape the environment, and Daesh’s Cyber Caliphate and its cyber toolkit remain in their infancy. There is the possibility of convergence between cyber criminals and cyber terrorists, and it is plausible that cyber criminals could sell stolen

credentials and malware to terrorists, or enable them to cripple public or private services, as seen in the recent WannaCry attack. Cyber criminals may also play an enabling role in terrorism attacks, including hindering CCTV footage or the communications technology of the emergency services.

Destructive acts of cyber terrorism currently remain unlikely, although Pool Re has been working with Cambridge University Judge Business School to model potential destructive cyber terrorism scenarios.

WannaCry and NotPetyaThe WannaCry attack in May 2017 was the largest global ransomware incident to date and infected up to 300,000 computers in 150 countries, including 60 NHS Trusts in the UK. The ransomware had the potential to cause significant damage to medical machinery and destroy vital medical records and lab samples. It significantly reduced the working of NHS Trusts for several days. The attack highlighted the vulnerability of the NHS and its computer systems but appeared to fail to raise the amount of ransom and funds that previous similar attacks have achieved.

Similarly, NotPetya impacted on sixty-four countries (Ukraine and Eastern Europe disproportionally) in June 2017 and targeted critical industries and infrastructure, including banking and finance sectors, shipping and power generation facilities. Although NotPetya was more technically sophisticated than WannaCry, the attack was again not very successful in achieving the goals of ransomware (principally to make a profit) and may have been designed as a destructive disk wiper and not as a ransomware. Although the WannaCry and NotPetya attacks are likely to have been state sponsored and not terrorism, both attacks raised international awareness of the cyber threat and the economic impact that can ensue.

Attribution of a cyber attack, be it criminal, state or terrorist, remains the biggest challenge for the government. From an insurance perspective, if attribution is not feasible, then certification of such an act will be complex.

‘ As you well know, a cyber attack could have the same impact as a well-placed bomb.’

Former FBI Director Robert Mueller, March 2010


34

Enabling

Online activities that support the operations of terrorist groups such as publicity and propaganda, fundraising, recruitment, reconnaissance, clandestine communications between members and disseminating manuals and know-how to incite and facilitate attacks by others.

Disruptive

Online activities that disrupt the information technology of opponents including proactive cyber breaches of networks, dissemination of malware, exfiltration of digital information, financial theft and fraud, denial of service attacks, phishing and other information technology hacking activities.

Destructive

Cyber-attacks that trigger physical damage or injury through spoofing operation technology and digital control systems.

Assessed Cyber Threat Capability Chart, Q2 2017

A. Enabling Activity B. Disruptive Activity C. Destructive ActivityA1

. Ter

ror g

roup

w

ebsit

e

A2. V

ideo

&

socia

l med

ia

A3. F

undi

ng o

pera

tions

m

anua

ls

A4. E

ncry

pted

co

mm

unica

tions

B1. D

efac

emen

t of

web

sites

B2. D

DoS

web

site

ta

ke-d

own

B3. D

ata

exfilt

ratio

n

hack

B4. C

yber

fin

ancia

l heis

t

C1. S

enso

r sp

oofin

g

C2. C

ontro

l eng

inee

ring

com

prom

ise

C3. D

amag

ing/

disa

blin

g in

frast

ruct

ure

C4. S

caled

des

truct

ion

on

mul

ti ta

rget

s

Threat Group 1 e.g. al-Qaeda

Threat Group 2e.g. Islamic State United Cyber Caliphate

Threat Group 3e.g. Cyber group loosely affiliated to a nation state X

Threat Group 4e.g. Hacktivists, Militant Destructive

Threat Group 5e.g. Organised criminal group with terror links

Chart colouring indicates frequency of event and confidence in attribution at time of writing.

Most incidents

Incident key:

Several incidentsFewer incidents

Figure 7. Cyber Threat Capability Chart, showing evidence for which threat actors have attained capabilities on a 12-point scale, left to right, towards ‘Destructive’ capabilities, research undertaken by Cambridge Judge Business School and Pool Re

35

United Cyber CaliphateThe United Cyber Caliphate (UCC) was established in April 2016 as a merger of several smaller hacking groups. Junaid Hussain was a prominent member and Samata Ullah was charged in the UK in May 2017 for his involvement with the group. The UCC released a hitlist in April 2017 of 8,700 people (politicians, celebrities, religious leaders) for lone attackers.

Hezbollah Cyber Group An Iranian backed cyber unit, the Hezbollah Cyber Group is suspected of being responsible for cyber attacks against oil and gas companies in the Persian Gulf – named ‘the most destructive cyber assaults against the private sector’ by US Defence Secretary Leon Panetta.

Syrian Electronic ArmyEstablished in 2011 to support the government of Bashar al-Assad, the Syrian Electronic Army (SEA) carries out website defacements and malware and denial-of-service attacks. The USA recently named and charged three members of the SEA for attacks, including one on the Associated Press Twitter account in March 2016. One man, Peter Romar, was arrested in Germany, and the other two are believed to be in Syria.

Afaaq Electronic Foundation Established in 2016, the Afaaq Electronic Foundation helps fighters and jihadi supporters understand internet security and how to register safely for Telegraph and Twitter.

CBRN, Cyber, Drones

Prominent Islamist Cyber Groups

DronesA report in July 2017 by the UK Department of Transport on mid-air collisions with drones recommended any user of a drone weighing over 250g should register his or her name and address on a database and sit an online safety and security test. The report highlighted the danger to helicopters in particular. There have been forty-six Airprox incidents involving drones between January and July 2017.e

While this regulation will facilitate the police investigations after a drone incident, it remains that regulation is only effective if adhered to or enforced. This regulation alone will not be sufficient to prevent a near-miss between an aircraft and a drone but it is significant that the government has recognised and begun to address this issue.

Ref. e) An Airprox is a situation in which, in the opinion of a pilot or air traffic services personnel, the distance between aircraft as well as their relative positions and speed have been such that the safety of the aircraft involved may have been compromised.

Risk Mitigation and Resilience

37


Four terrorist attacks in seventeen weeks, causing the loss of 36 lives and serious injuries to more than 200 people, have further exposed the difference between the impacts of terrorism acts intended to kill people and the effects of those intended to damage property. Insurance to protect against property damage and associated business interruption following a terrorist attack in the UK is well established, with around 90% of the market being fulfilled by Pool Re. However, the attacks in Manchester and London have highlighted a key area where a gap has emerged between the coverage available and the manifestation of the current threat. They have led to considerable business interruption and denial of access caused by extensive cordons, with the possibility of further loss to the economy and business from a reduction in future visitor numbers; early indications are that these will not be significant. The hardest hit by the Borough Market attack was the SME sector, which traditionally does not take out terrorism cover. According to Darren Henaghan, the Managing Director of Borough Market, the losses were £1.4m at the ‘absolute minimum’. Terrorism cover is available to all businesses; the challenge is to make it affordable, accessible, adequate, simple to understand and up to date with the current threat. SMEs also need to be aware that the cover is available to them in the first place.

Despite the high number of terrorist incidents across Europe over the last four years and more recently in the UK, there is still very little take-up of terrorism cover outside the major cities, especially among the SME community; Pool Re assesses this take-up to be less than 10%.

This is due to several factors, including: a lack of understanding of the threat, by both the business community and regional brokers (the buyer and seller); the (incorrect) belief that terrorism cover is included in standard property cover; the affordability of buying additional insurance on top of current cover; and the perception that the government will simply ‘pick up the bill’ for any loss. The problem of government de-incentivising the purchase of insurance by feeling obliged to step in can be avoided by ensuring the wide availability of appropriate products, at a fair price, that are perceived as adding value – so making them accessible.

If businesses are equipped with a better understanding of the nature of the threat, they are more likely to consider their management of terrorism risks, including the purchase of appropriate cover. Improving risk awareness and educating about current and evolving threats will help close the ‘information gap’, leading to improved risk management. The government and police now recognise that an ‘information gap’ exists between government and businesses that are keen to do more to protect themselves, their assets and their employees. The events of London and Manchester continue to highlight the pressing need for ongoing information exchange, both routinely, and in response to attacks when they happen. Both the public and private sectors have identified many lessons from these events that should be communicated and shared. Many initiatives are currently underway, with a number of them highlighted at the Step Change Security Summit, held in London’s Guildhall in July 2017, which was attended by 400 business representatives from across industry.

Terrorism cover is available to all businesses; the challenge is to make it affordable, accessible, adequate.

Closing the Gaps


38

The UK could have experienced more terrorist attacks, causing both financial and human losses, if the police and MI5 had not interdicted a further five plots since the attack in Westminster in March, or if they had not continued to arrest, on average, one suspect per day. The Metropolitan Police Commissioner, Cressida Dick, at her Mansion House speech on 20 July 2017, reminded the audience that, in the light of the ‘shift’ rather than the ‘spike’ in threat, more is now required from the business community. Furthermore, the police will now be ‘looking to the private sector to take more responsibility for protecting the public who use their services’.

Pool Re has already taken a number of steps to close these gaps in coverage, penetration and information, including investing further in its Terrorism Research and Analysis Centre as well as hiring an experienced Distribution Manager to improve penetration into the SME sector. We are confident of gaining, in the near future, both Treasury and Regulatory endorsement for the provision of cover for physical damage to commercial property caused by an act of terrorism and triggered by remote electronic means. There will also be strong encouragement for an Insured to comply with one of the range of national and international security frameworks. These will range from straightforward mechanisms, such as Cyber Essentials, to complex standards, such as ISO 270001. We will work with our Members and other stakeholders, ensuring that there is a broader understanding of the emergent threat posed by terrorist use of destructive electronic means to cause physical loss (fire or explosion). As part of this process, we continue to work with the Centre for Risk Studies at the Cambridge Judge Business School to understand the threat vectors, model the cyber terrorism peril and provide more accurate loss data.

Pool Re continues to play a part in managing and mitigating risk, by incentivising behavioural change through premium discounts (Loss Mitigation Credits) in exchange for the implementation of security measures. We have been working with the National Counter-Terrorism Security Office (NaCTSO) for two years, providing a 2.5% discount to clients within their Crowded Places Programme. This applies to businesses and organisations that have put in place mitigation measures and security improvements, consistent with Protective Security Improvement Activity (PSIA), to protect key public sites and venues from terrorist attacks. We are currently considering a new solution that will provide a 5% loss mitigation discount, adapting the NaCTSO methodology, to a much greater number of Pool Re clients.

In addition, we are in discussions with the Regulator regarding whether terrorism insurance should be a mandatory offer to customers, if not a compulsory purchase, since, in our view, this is the only way to be sure that the issue can be fully resolved.

The bigger issue of a systemic gap in coverage for the current preferred attack type requires a collaborative approach between Pool Re and the commercial terrorism markets. Some ‘standalone’ solutions for non-damage business interruption already exist, and the preferred solution for both Pool Re and the Treasury would be for the commercial markets to ‘fill the gap’. For Pool Re to take a full role, it would probably be necessary for the primary legislation underpinning the Pool to be amended. This seems unlikely, owing to pressures on the parliamentary timetable, particularly during the period of Brexit negotiations. Pool Re is already investigating how it might support terrorism markets in building an innovative commercial solution.

The police will now be looking to the private sector to take more responsibility for protecting the public who use their services.

Risk Mitigation and Resilience continued

‘ This widening cohort of people that we are concerned about, our ability to keep our radar on them – that’s no longer just a job for the police and Security Service […] it’s going to take a whole community effect’

Assistant Commissioner Mark Rowley, 11 August 2017

39


The more frequent use of motor vehicles as weapons has bought focus into the area of terrorism liability. Vehicle insurance in the UK provides unlimited liability to third parties in respect of bodily injury, and it is possible we may see premiums for auto insurance rise further as the financial impacts of Westminster and London Bridge become clearer. This is consistent with a wider question relating to terrorism liability exposures, particularly for organisations that operate in crowded places, such as transport hubs or entertainment venues. Moreover, there is potential inequity in compensation between victims of the same terrorist incident depending on the method by which they were injured.

Terrorism is as much a global phenomenon as a local issue, and the evolution of terrorist methodologies is likely to continue. As a result, we continue to work closely with our partners in academia and our international peers in terrorism reinsurance pools and intend to deepen and strengthen both these relationships.

Pool Re and Cranfield University are co-funding the establishment of a Professor of Terrorism Risk Management and Resilience, and we are exploring with the University the opportunity jointly to establish a Centre of Excellence in Counter-Terrorism. Our intention, working closely with government partners, is to identify, analyse and disseminate information on the nature of, and threat from, terrorism, as well as ways in which these threats can be mitigated.

Pool Re remains the secretariat for the International Forum of Terrorism Risk (Re)Insurance Pools (IFTRIP), which held its third annual conference in June 2017 in Paris. IFTRIP provides an increasingly important role in bringing together fifteen international terrorism reinsurance pools to share knowledge and experience of the global terror threat, post-incident lessons learned, risk management strategies and reinsurance mechanisms and scheme development.

In summary, CT will require long-term partnerships between the public and private sectors, built on trust, closer cooperation and collaboration, information-sharing as well as improved training opportunities and knowledge exchange. There is a discernible will from both sides to make this work; the challenge is to convert this growing momentum into positive and sustainable action to keep the public safe and our economy resilient to further shocks. The terrorism (re)insurance market has a significant and unique role to play in influencing behavioural change among its insureds and can have a great impact on building the resilience of the country and therefore the economy. Innovative solutions in bridging the gaps in coverage, penetration and information are now time critical when judged against the ever-present threats and risks that the police and MI5 continually warn us about.

Risk Mitigation and Resilience continued

The terrorism (re)insurance market has a significant and unique role to play in influencing behavioural change among its insureds.


40

CONTESTThe Government’s Counter-Terrorism Strategy (CONTEST) will be further reviewed in the light of the recent attacks in the UK. It was expected that an updated version of the 2011 CONTEST strategy would have been announced earlier in the year, but this was delayed by the 2017 general election campaign. Greater investment in the Prevent pillar can be expected.

Step Change Security SummitOver 400 business representatives attended the Step Change Security Summit on 17 July 2017. This was organised by DAC Lucy D’Orsi, on behalf of ACC Mark Rowley, and was chaired by Sir David Veness. The aim of the Summit was: ‘To achieve a national gear change in business engagement on Protect and Prepare in order to achieve wider awareness of the terrorist threat and enhanced public and private sector activities, including implementation of CT initiatives, to support overall UK safety, security and resilience.’ Speakers included the Minister of State for Security, ACC Mark Rowley and other senior representatives from government and industry. Ten key priorities have already been recognised that will help deliver the Summit’s aims and objectives.

Recent Government Policy, Advice and Initiatives

London ProtectNational Counter-Terrorism Policing now produces a monthly London Regional Counter-Terrorism Protective Security Update, which provides summaries of recent incidents, security and risk mitigation advice as well as signposting official CT advice for businesses and the members of the public. The police intend to roll this out nationwide with a newly designed product called ‘National Protect’.

41


New £2 million Home Office fund for research into crowded places securityOn 27 July 2017, the Rt Hon Ben Wallace MP, Minister of State for Security, announced that the Defence and Security Accelerator has launched a competition, in partnership with the Home Office, to find the best academics, researchers, engineers and technology developers and bring them together to combat the current terror threat. Businesses will be able to submit innovative ideas to the ‘Improving Crowd Resilience’ competition to detect the use of explosives and weapons in busy public spaces by using the crowd as a sensor.

‘Run, Hide, Tell’The ‘Run, Hide, Tell’ guidance issued by the National Police Chief’s Council (NPCC) was put into effect for the first time during the London Borough Market attack. This proved to be sound advice, is likely to have limited casualties, and should be followed.

Training for personnel in the travel industry

In response to the 2015 Sousse beach attack in Tunisia, the government, in partnership with the travel industry, has recently trained over 23,000 people who work in the domestic and overseas travel industry. This training includes advice on how to spot suspicious items and activity, as well as what to do in the event of a major incident.

Appendix: Global Terrorism Data 2016

43

Appendix: Global Terrorism Data, 2016

This is the first edition of Pool Re’s quantitative assessment of global terrorism incidents. It analyses the frequency and severity of worldwide terrorism events in 2016, identifying trends and making evidence-based judgements. This quantitative analysis supports the qualitative analysis that Pool Re’s Terrorism Research and Analysis Centre (TRAC) undertakes. The primary user of this product will be Pool Re and its actuarial team to inform our own modelling and pricing. In addition, we hope that this will provide our Members with useful analysis on the peril, and wider stakeholders and international peers better to understand the threat.

Owing to the recent establishment of the TRAC, 2017 is the first year that Pool Re could draw on its own in-house database and analysis of global terrorism events during 2016. We are aware that our analysis is limited to one year of data, but going forward we will continue to use the TRAC terrorism database to examine historic, statistical data of the threat.

The TRAC terrorism database excludes acts of insurgency or war in recognised areas of conflict.

Terrorist activity is considered over seven regions of the world: Europe (including Turkey – see box), the Middle East, Asia, North America, South America, Africa and Oceania.

Key Findings on Terrorism in 2016• Europe, including Turkey, was the region that experienced

the highest number of terrorist attacks (66% of the worldwide total). Attacks in Turkey accounted for the highest number in the region (72%), owing to an escalation in activity from the Kurdish Worker’s Party (PKK).

• Both France and Germany experienced six attacks, with all but one in each country claimed by Daesh. This illustrates how Daesh saw activity in mainland Europe as a priority in 2016, and motivation for these attacks was likely to have been a country’s participation in military intervention in Iraq and Syria.

• March saw the highest number of terrorist attacks (18), mainly because of a period of intense activity in Turkey, which was attributed to, or claimed by, the PKK.

• June, July and August also had high numbers of attacks (11, 12 and 11). This suggests the period immediately before and over Ramadan experienced higher levels of both acts of political violence and terrorist attacks.

• IEDs were the most frequently used attack method worldwide, representing around 24% of all attacks. Of these, 71% took place in Europe. VBIEDs represented the second most used method, representing around 22% of attacks. All but one of the VBIED attacks took place in Turkey.

• In Europe, including Turkey, 48% of attacks were directed towards police, military or government targets. These figures of authority were mainly targeted by the PKK in Turkey as well as by Daesh. Attacks against this target type resulted in 213 deaths.

• Crowded places across the other world regions were the second most attacked target (15%). Islamist extremists were responsible for these, and locations representative of Western life, including bars and restaurants, were frequently targeted. Attacks against crowded places resulted in 364 deaths.

• Terrorist attacks resulted in a total of 779 deaths and 3,044 injuries. Out of the five attacks that killed the most people in 2016, four of them were claimed by Daesh, making it the most lethal terrorist organisation in 2016.

• The most lethal attack took place in Nice, France, on 14 July; this resulted in 86 deaths (around 11% of the total deaths in 2016) and 433 injuries. The attack was claimed by Daesh.

• In 2016, around 25% of terrorist attacks worldwide resulted in property damage. IEDs were the attack method most likely to cause damage, whether property was the intended target of the bomb or not. This signifies that traditional terrorism cover of property damage remains relevant.

• In 2016, there were no Islamist attacks in the UK, although the frequency and severity of Daesh activity came closer to the country.

Turkey It is recognised that Turkey currently sits outside the European Union. It is, however, considered within our analysis because of its geographical position and nexus with the modern terrorism threat landscape. In this appendix, Turkey is always included within the region of Europe.

Terrorism overview: 2016


44

In 2016, a total of 1,821 acts of terrorism took place worldwide. From those acts, the TRAC terrorism database excluded acts of insurgency or war in recognised areas of conflict.This left 115 events that could be defined as terrorist attacks, causing 779 deaths and 3,044 injuries. Out of those 115 attacks, the majority (66%) took place within Europe, including Turkey, and these resulted in 557 deaths and around 2,471 injuries.

Daesh claimed four of the top five most fatal attacks in 2016. Those four Daesh attacks resulted in the deaths of 225 people (29% of the total killed in 2016). Daesh was responsible for all four attacks causing the most injuries.

The most lethal attack took place in Nice, France, causing 86 deaths and 433 injuries. This was the first instance of a terrorist using a vehicle, driven at high speeds, against large crowds of people in Europe. It is likely the attack highlighted the effectiveness of this methodology, as it was subsequently followed by the truck attack in Berlin in December 2016, which caused the third highest number of deaths in mainland Europe. Both of these attacks were carried out by lone actors.

Out of the 115 attacks in 2016, 72 can be assessed for how many perpetrators were involved. Of these attacks, 51 (71%) were carried out by lone actors and 21 (29%) were carried out by more than one person. Islamist extremists, whether acting by themselves or with others, represented the biggest threat.

Europe, including Turkey Every month, Europe, including Turkey, consistently sustained the highest number of attacks globally. Terrorist attacks in Turkey dominated the regional threat picture. The highest number of attacks (12) took place during March 2016, mainly because of a period of intense activity attributed to, or claimed by, the PKK. While Turkey suffered significant attacks from Daesh (around 5% of attacks), around 70% of its attacks were attributable to Kurdish separatists, notably the PKK. Turkey faces not only a domestic struggle with Kurdish Separatists, but also attacks from Islamist extremists.

Attacks in Europe, including Turkey, using one method were the most common (88%), of which VBIEDs were the most used (around 31%), followed by IEDs (around 25%).

The most common methodology on mainland Europe was bladed weapons (47%). Of Europe’s 76 attacks (12%), 9 were carried out using combined methodology. Outside Turkey, this occurred only in the UK (the murder of Jo Cox MP) and Germany (the Berlin Christmas Market). Globally, Europe was the only region to have experienced attacks using every methodology.

Police, military and government institutions and personnel were the most frequently targeted in Europe (72%). While attacks in Turkey accounted for 82% of those, the targeting of figures of authority has been encouraged by senior leaders in Islamist groups, including by al Adnani in his ‘Indeed Your Lord is Ever Watchful’ speech in 2014: ‘Strike their police, security, and intelligence members, as well as their treacherous agents’. Crowded places were the second most frequently targeted in Europe.

France and Germany were the most attacked mainland European countries in 2016. This is likely to be due to the countries’ involvement in military intervention in Iraq and Syria. France faced a sustained threat, with five of the six attacks either claimed by or pledged to Daesh. The country remained at its enhanced state of emergency throughout the year, and, although the Euro 2016 football tournament passed without incident, the attack in Nice in July demonstrated the enduring threat from Daesh. That attack killed 86 people and injured 433, being the most lethal in 2016. It also illustrated how effective the low complex use of vehicles in attacks was, paving the way for their increased use into 2017.

No Islamist attacks took place in the UK in 2016, which may be accredited to at least 12 terrorist attacks being disrupted by MI5 and police in the year. The UK did experience an attack by a Far Right extremist who murdered Jo Cox MP, and, although Northern Ireland experienced six significant incidents of violence by Dissident Republican groups, only the murder of prison officer Adrian Ismay by the New IRA has been listed on the TRAC terrorism database.

1,821Total acts of

terrorism in 2016

45

Country Number of terrorist Number of attacks claimed attacks by, or pledged to, Daesh

Turkey 55 3France 6 5Germany 6 5Belgium 3 2Greece 2 -Great Britain 1 -Northern Ireland 1 -Sweden 1 -Netherlands 1 - TOTAL 76 15


Figure 8.

Figure 9.

*

Key FindingsRegion Number of Deaths Injuries Property terrorist attacks damage

Europe inc. Turkey 76 557 2471 18 Middle East 18 33 141 2Asia 9 60 188 5North America 6 49 103 1Africa 5 80 140 3Oceania 1 - 1 -TOTAL 115 779 3044 29

Six attacksBoth France and Germany each experienced six attacks

5555 attacks took place in Turkey, the highest number worldwide

* including attack in Jakarta on two target types

66%of attacks in 2016 took place in Europe, including Turkey


46

Rest of world The Middle East experienced the next highest level of terrorist attacks (18), even after excluding acts of war and insurgency in Iraq and Syria. Asia experienced nine attacks, five of them claimed by Daesh, who appeared to extend their reach into the region. Africa experienced five terrorist attacks, including a significant strike against aviation, with al Shabaab detonating an IED onboard a flight from Mogadishu Airport. This attack probably highlighted vulnerabilities in airport security measures, inciting other groups to plan attacks against the sector. Aviation remains a highly desired target by Islamist extremists.North America experienced six terrorist attacks and a high level of Daesh activity, with the group claiming three out of the five Islamist attacks in the region. The attack at The Pulse Nightclub in Orlando, Florida, resulted in 49 deaths, the third most lethal attack in 2016 and the attack that caused the highest number of deaths outside of Europe.There were 34 attacks (87%) carried out using a single methodology worldwide (excluding Europe and Turkey), of which bladed and firearms were the most used (32%). Israel and Palestine accounted for the majority use of bladed

weapons and firearms. Five of the 39 attacks (13%) were carried out using combined methodologies. Daesh claimed three of these, of which two were in Indonesia. Crowded places were most frequently targeted (46%). All attacks upon crowded places were conducted by Islamist extremists (two by AQIM in Africa and eight by Daesh). Seven attacks targeted restaurants, bars and nightclubs and three were against popular hotels. Such locations may be attacked as representations of Western lifestyles. Police, military and government were the second most frequently targeted.

Damage to property In 2016, 25% of attacks resulted in damage to property, whether that damage was intentional or not. In both Europe and the rest of the world, this signifies that traditional terrorism cover of property damage is still relevant considering the frequency of these attacks. The methodology that resulted in the most property damage was IEDs (13), including vehicle and person borne, followed by firearms (5). Of these 25%, only one attack is likely to have caused damage to property above the value of £1 million – the Brussels Airport and metro attack in March.

Figure 10.

Key FindingsRegion Damage No damage Total to property to property

Europe, including Turkey 18 (24%) 58 (76%) 76Rest of World 11 (28%) 28 (72%) 39 TOTAL 29 (25%) 86 (75%) 115

Figure 11.

Region Property Damage Property Damage Unknown likely cost < £1m likely cost > £1m

Europe, including Turkey 10 1 7Rest of World 11 0 0 TOTAL 21 1 7

25% of terrorist attacks worldwide resulted in property damage

March attacksMarch saw the highest number of terrorist attacks mainly because of a period of intense activity in Turkey, which was attributed to, or claimed by, the PKK.

47

Frequency


Total acts of terrorism TRAC terrorism database

250

200

150

100

50

0

Janu

ary

Febru

ary April

June

March

May July

Augus

t

Septem

ber

Octobe

r

Novem

ber

Decem

ber

Figure 12.

Month Total acts TRAC terrorism of terrorism database

January 104 13 February 72 10March 112 18April 152 8May 204 5June 231 11July 191 12August 139 11September 130 5October 170 7November 166 9December 150 6


48

Figure 13.

Number of terrorist attacks by region and attributionRegion Number of Attribution of Number of attacks claim attacks attacks by or pledged to, Daesh

Europe, inc. Turkey 76 Islamist 20 15 - Far Right 4 - - Far Left 2 - - Kurdish Separatists 39 - - Dissident Republicans 1 - - Other 10 -Middle East 18 Islamist 17 1 - Other 1 -

Asia 9 Islamist 7 5 - Other 2 -

North America 6 Islamist 5 3 - Other 1 -

Africa 5 Islamist 5 2

Oceania 1 Islamist 1 1

75% of Islamist attacks in Europe were claimed by, or pledged to, Daesh

66% of all terrorist attacks around the world were carried out in Europe

70% of attacks in Turkey were attributable to Kurdish Separatists

49


Figure 14.

Number of terrorist attacks by month and region Month Europe Middle Asia North Africa Oceania (inc. Turkey) East America

January 5 4 1 1 2 -February 5 3 - 1 1 -March 12 4 - 1 1 -April 7 1 - - - -May 5 - - - - -June 5 3 2 1 - -July 8 2 2 - - -August 9 - 2 - - -September 2 - 1 1 - 1October 7 - - - - -November 7 - 1 1 - -December 4 1 - - 1 -

Attack methodology

Attacks with single methodology

101Total number of attacks

115Attacks with combined

methodologies

14

VBIED Attacks All but one of the VBIED attacks took place in Turkey

IEDs were the most frequently used attack method worldwide representing around 24% of attacks


50

Figure 16.

Figure 17.

Single methodologies worldwide by region

Single methodologies in Europe, including Turkey, by country

Region Bladed Firearms IEDs Other (arson) PBIED VBIED Vehicle

Africa 1 2 1 - 1 - -Asia - 3 3 - - 1 -Europe inc. Turkey 10 10 17 1 6 21 2Middle East 7 4 2 - 2 - 1North America 2 2 1 - - - -Oceania 1 - - - - - -TOTAL 21 21 24 1 9 22 3

Region Bladed Firearms IEDs Other (arson) PBIED VBIED Vehicle

Turkey 1 9 13 - 4 21 -France 4 - - - - - 2Germany 3 1 - - 1 - -Belgium 2 1 Greece - - 2 - - - -Great Britain - - - - - - -Sweden - - 1 - - - -Netherlands - - - 1 - - -Northern Ireland - - 1 - - - -

IEDsVBIEDs BladedFirearmsOther (arson)Vehicle

Figure 15.

24

2221

21

9

3 1

Attack methodology

51


Figure 19.

Figure 20.

Combined methodologies worldwide by region

Combined methodologies in Europe, including Turkey, by country

Africa - - - - - - - -Asia 1 - - - - 1 - -Europe inc. Turkey 1 1 3 2 1 - - 1Middle East 1 1 - - - - - -North America - - - - - - - -Oceania - - - - - - 1 -TOTAL 3 2 3 2 1 1 1 1

Turkey 1 - 3 2 - - - 1France - - - - - - - -Germany - - - - 1 - - -Belgium - - - - - - - -Greece - - - - - - - -Great Britain - 1 - - - - - -Sweden - - - - - - - -Netherlands - - - - - - - -N. Ireland - - - - - - - -

Firearms / PBIED Firearms / Bladed Firearms / VBIED Firearms / IEDs Firearms / Vehicle Bladed / PBIED Bladed / Vehicle PBIED / VBIED

3

2

23

11

1

1

Figure 18.

Region Firearms Firearms Firearms Firearms Firearms Bladed Bladed PBIED /PBIED /Bladed /VBIED /IED /Vehicle /PBIED /Vehicle /VBIED

Region Firearms Firearms Firearms Firearms Firearms Bladed Bladed PBIED /PBIED /Bladed /VBIED /IED /Vehicle /PBIED /Vehicle /VBIED

48%of attacks in Europe including Turkey were directed towards police, military or government targets resulting in 213 deaths


52

Number of attacks by target type worldwideTarget type Number of attacks Europe Rest of the World

Police, military 67 55 12 and government Crowded places 29 11 18Symbolic sites 12 6 6Critical National Infrastructure 5 3 2Property 2 1 1Total 115 76 39

Frequency of Target Types in the Rest of the World

Frequency of Target Types in Europe including Turkey

Target types

Police/Military/Government Symbolic CNI PropertyCrowded Place

Figure 21.

1812

62 1

5511

63

1

53


Number of attacks by target type and attribution

Attacks worldwide claiming the highest number of deaths

Attacks worldwide claiming the highest number of injuries

Target type Dissident Far Far Islamist Kurdish Palestinian Unknown Republican Left Right Separatist Nationalist

CNI - - - 4 1 - -

Crowded Places - - 1 17 2 3 5

Police, military 1 2 1 12 35 7 9 and government

Property - - 1 1 - - -

Symbolic - - 1 10 1 - -

Number of deaths Date Location Claim

86 14 July Nice, France Daesh

57 20 August Gaziantep, Turkey Disputed

49 12 June Florida, USA Daesh

45 28 June Istanbul, Turkey Daesh

45 10 December Istanbul, Turkey Daesh

Number of injuries Date Location Claim

433 14 July Nice, France Daesh

340 22 March Brussels, Belgium Daesh

235 28 June Istanbul, Turkey Daesh

155 10 December Istanbul, Turkey Daesh

Note: Excluding one attack on two target types in Jakarta.

Severity

Figure 22.

Figure 23.

Figure 24.


54

Deaths Injuries

Deaths and injuries per month in Europe, including Turkey

Month Deaths Injuries

January 16 17

February 40 62

March 92 598

April 9 93

May 16 107

June 67 322

July 102 502

August 89 289

September 1 0

October 37 77

November 17 134

December 71 270

Figure 25.

700

600

500

400

300

200

100

0

Janu

ary

Febru

ary April

June

March

May July

Augus

t

Septem

ber

Octobe

r

Novem

ber

Decem

ber

55


Deaths Injuries

Figure 26.

Crowded PlacesAttacks in crowd places resulted in 364 deaths

Casualties by single methodology

Methodology Deaths Injuries

Bladed 6 44

Firearms 193 355

IED 45 199

Other (arson) 0 0

PBIED 138 578

VBIED 147 736

Vehicle 86 438

TOTAL 605 2320

32% of deathswhere one attack method was used, were caused by firearms

800

700

600

500

400

300

200

100

0

Bladed Firearms IEDs Other (arson) PBIED VBIED Vehicle


56

Casualties by combined methodology

Combined Methodology Deaths Injuries

Firearms/PBIED 53 292

Firearms/Bladed 2 2

Firearms/VBIED 57 197

Firearms/IED 5 8

Firearms/Vehicle 12 56

Bladed/PBIED 0 3

Bladed/Vehicle 0 11

PBIED/VBIED 45 155

TOTAL 174 724

Figure 27.

350

300

250

200

150

100

50

0

Firearms/PBIED

Firearms/Bladed

Firearms/Vehicle

Firearms/VBIED

Bladed/PBIED

Bladed/Vehicle

Firearms/IEDs

PBIED/VBIED

Deaths Injuries

40%of injuries, where two attack methods were used, were caused by firearms and PBIEDs

57


Single methodologies resulting in the highest number of deaths

Combined methodologies resulting in the highest number of deaths

Deaths Injuries Method Details Date

86 433 Vehicle Bastille Day attack, Nice 14 July

57 91 PBIED Attack at a wedding in Turkey 20 August

49 53 Firearms Pulse nightclub attack, Orlando 12 June

32 340 PBIED Airport and Metro attacks, Brussels 22 March

Deaths Injuries Method Method Details Date

45 235 PBIED Firearms Ataturk Airport attack, 28 June Turkey 45 155 PBIED VBIED Vodafone Stadium, 10 December Turkey

37 125 Firearms VBIED Transport hub, 13 March Turkey

18 26 Firearms VBIED Military checkpoint, 09 October Turkey

12 56 Firearms Vehicle Berlin Christmas market, 19 December Germany

Figure 28.

Figure 29.

The most lethalAttack took place in Nice resulting in 86 deaths

The attack was claimed by Daesh

11% of the total deaths in 2016


58


58

Deaths and injuries by target type

Deaths by target type using single methodology

Injuries by target type using single methodology

Target type Deaths Injuries

Total Europe Rest of Worldwide Europe Rest of inc. Turkey World inc. Turkey World CNI 114 114 - 723 700 23Crowded Places 364 215 149 1,186 831 355 Police, military 235 213 22 986 914 72 and governmentProperty - - - 2 - 2Symbolic 66 15 51 147 26 121

Target type Bladed Firearms IED Other PBIED VBIED Vehicle (arson) CNI - - - - 32 - -CP 2 137 17 - 61 - 86Police, military 3 31 27 - - 147 - and government Property - - - - - - - Symbolic 1 15 1 - 45 - -

Target type Bladed Firearms IED Other PBIED VBIED Vehicle (arson) CNI - - 2 - 361 - -CP 17 232 116 - 142 - 433Police, military 23 64 76 - - 736 5 and government Property - - 2 - - - -Symbolic 4 29 3 - 75 - -

Figure 30.

Figure 31.

Figure 32.

59


Deaths by target type using combined methodologies

Injuries by target type using combined methodologies

Note: Excluding one attack in Jakarta on two target types.

Note: Excluding one attack in Jakarta on two target types.

Target type Firearms Firearms Firearms Firearms Firearms Bladed Bladed PBIED /PBIED /Bladed /VBIED /IED /Vehicle /PBIED /Vehicle /VBIED CNI 235 125

CP 155 11 56

Police, military 2 8 72

and government

Property

Symbolic 33 3

Figure 33.

Figure 34.

Target type Firearms Firearms Firearms Firearms Firearms Bladed Bladed PBIED /PBIED /Bladed /VBIED /IED /Vehicle /PBIED /Vehicle /VBIED CNI 45 37

CP 45 12

Police, military 2 5 20

and government

Property

Symbolic 4

In 2016, there were no Islamist attacks in the UK

0deaths took place in crowded areas

46%people killed and 433

injured in Nice, the most lethal attack of 2016

86


Number of attackers per attack worldwide

Deaths caused by lone actors

Number of attackers Total attacks Islamist Other

One attacker 51 42 9

2+ attackers 21 17 4

Unknown number 43 - -

TOTAL 115 attacks 72 attributable attacks

Number of attackers Number of deaths Number of attacks that caused by attacks did not cause any deaths

Lone actors 135 23

2+ 169 8

Sub total 604 31

Unknown 175 10

TOTAL 779 41

Number of attackersFigure 35.

Figure 36.

IEDswere the attack method most likely to cause damage, whether property was the intended target or not

60

61

Deaths caused by number of attackersNumber of attackers Number of deaths Number of attacks that Number of deaths caused by attacks did not cause any deaths caused by attacks

1 51 23 4352 10 5 113 4 2 464 1 0 45 2 1 326 1 0 226 or 7 1 0 307 2 0 24

Figure 37.

Worldwide attacks involving the highest number of attackers

Number of attackers Date Location Dead Injured

7 14 January Indonesia 4 24

7 01 July Bangladesh 20 30

6 or 7 15–16 January Burkina Faso 30 56

6 13 March Côte d’Ivoire 20 33

5 27 February Netherlands 0 0

5 22 March Brussels Airport, Belgium 32 340

Figure 38.

779 deathsTerrorist attacks resulted in a total of 779 deaths and 3,044 injuries

71%of attacks were conducted by lone actors



62

1 European Union Terrorism Situation and Trend (TeSat) Report 2017 (Europol, 2017).

2 Ibid.

3 ‘British Jihadi Brides Return Home after Being Widowed or Sent Back To Husbands Preparing Last Isil Stand’, Telegraph, 22 May 2017 (http://www.telegraph.co.uk/news/2017/05/22/british-jihadi-brides-returning-home-widowed-sent-home-husbands/).

4 ‘Sally Jones: Isis Recruiter “Issues Series of Terror Threats against UK cities” over Twitter’, Independent, 25 May 2016 (www.independentco.uk%2Fnews%2Fworld%2Fmiddle-east%2Fsally-jones-isis-recruiter-issues-series-of-terror-threats-to-uk-cities-over-twitter-a7049066.html).

5 CTC Sentinel, 10/7 (August 2017).

6 Ibid. 10/5 (May 2017).

7 MI5 website (https://www.mi5.gov.uk/northern-ireland ).

8 ‘Police “Are Facing Severe Terror Threat from IRA”’, Guardian, 15 May 2016 (https://www.theguardian.com/uk-news/2016/may/14/police-severe-terror-threat-ira-northern-ireland-bomb-attacks).

9 ‘New IRA the “Biggest Terrorist Threat to State since the Provos”’, Independent, 24 August 2017 (http://www.independent.ie/irish-news/new-ira-the-biggest-terrorist-threat-to-state-since-the-provos-35932203.html).

10 ‘What is the New IRA and how Dangerous is it?’, The Week, 12 May 2016 (http://www.theweek.co.uk/72541/what-is-the-new-ira-and-how-dangerous-is-it ).

11 Ibid

12 ‘Dissidents Developing Armour-Penetrating IEDs – PSNI’, RTE, 9 January 2015 (https://www.rte.ie/news/2015/0109/671333-psni-dissidents/)

13 ‘New IRA Sent Bombs to Army Recruitment Centres, Met Confirms’, Guardian, 17 February 2014 (https://www.theguardian.com/uk-news/2014/feb/17/new-ira-sent-bombs-army-recruitment-centres-britain).

14 Ibid.

15 ‘Marine Made 14 Pipe Bombs for IRA Attacks’, The Times, 27 July 2017 (https://www.thetimes.co.uk/article/marine-made-14-pipe-bombs-for-ira-attacks-cd6pbrt7d) .

16 ‘Senior Garda Says “IRA” Pose Most Significant Threat to Peace’, Irish News, 15 July 2017 (http://www.irishnews.com/news/northernirelandnews/2017/07/15/news/senior-garda-says-ira-pose-most-significant-threat-to-peace-1084942/).

17 ‘Royal Marine with Irish Republican Links Built Bombs Used in Dissident Attacks’, Telegraph, 26 July 2017 (http://www.telegraph.co.uk/news/2017/07/26/royal-marine-irish-republican-links-built-bombs-used-dissident/).

18 ‘London: Past Terror Attacks’, Guardian, 7 July 2005 (https://www.theguardian.com/uk/2005/jul/07/terrorism.july73).

19 ‘Yemen: Reported US Covert Actions 2017’, Bureau of Investigative Journalism, (https://www.thebureauinvestigates.com/drone-war/data/yemen-reported-us-covert-actions-2017#strike-logs).

20 Ibid

21 ‘UK Terror Threat Level Raised to “Severe”’, BBC News, 29 August 2014 (http://www.bbc.co.uk/news/uk-28986271).

22 ‘”Uncharged” or Broken Electronic Devices Banned from Flights’, ITV report, 8 July 2014 (http://www.itv.com/news/2014-07-08/explainer-uncharged-or-broken-electronic-devices-banned-from-flights/).

23 ‘Al Qaeda Veterans Targeted In Syria Airstrikes’, Sky News, 23 September 2014 (http://news.sky.com/story/al-qaeda-veterans-targeted-in-syria-airstrikes-10388837).

24 ‘Khorasan: Behind the Group “Following bin Laden’s Vision”, CBS News, 23 September 2014 (https://www.cbsnews.com/news/khorasan-behind-the-cell-following-bin-ladens-vision/).

Notes

63

Notes

25 ‘U.S. Commando Killed in Yemen in Trump’s first Counterterrorism Operation’, New York Times, 29 January 2017 (https://www.nytimes.com/2017/01/29/world/middleeast/american-commando-killed-in-yemen-in-trumps-first-counterterror-operation.html).

26 ‘US Unveils New Airline Security Measures to Avoid Laptop Ban’, Guardian, 28 June 2017 (https://www.theguardian.com/world/2017/jun/28/new-us-airline-security-measures-no-laptop-ban).

27 ‘US and UK Ban Cabin Laptops on Some Inbound Flights’, BBC News, 21 March 2017 (http://www.bbc.co.uk/news/world-us-canada-39333424).

28 ‘Australia Details “Sophisticated” Plot by ISIS to Take Down Plane’, New York Times, 4 August 2017 (https://www.nytimes.com/2017/08/04/world/australia/sydney-airport-terror-plot-isis.html).

29 European Union Terrorism Situation and Trend (TeSat) Report 2017 (Europol, 2017).

30 ‘Michael Fallon: Britain Using Cyber Warfare against IS’, BBC News, 20 October 2017 (http://www.bbc.co.uk/news/uk-37721147).

31 ‘Islamic State’s Chemical Weapons Capability Degraded, IHS Markit Says’, IHS Markit, 13 June 2017 (http://news.ihsmarkit.com/press-release/aerospace-defense-security/islamic-states-chemical-weapons-capability-degraded-ihs-mar).

32 ‘How IS Nearly Stumbled on the Ingredients for a ‘”Dirty Bomb”’, Washington Post, 22 July 2017 (https://www.washingtonpost.com/world/national-security/how-isis-nearly-stumbled-on-the-ingredients-for-a-dirty-bomb/2017/07/22/6a966746-6e31-11e7-b9e2-2056e768a7e5_story.html?utm_term=.f09c2c94ca25).

33 Interview with C. Stanley, 2017, as quoted in ‘Counting the Cost: Cyber Exposure Decoded’, Lloyd’s and Cyence (2017).

34 ‘Cybercrime Costs the Global Economy $450 Billion: CEO’, CNBC, 7 February 2017 (https://www.cnbc.com/2017/02/07/cybercrime-costs-the-global-economy-450-billion-ceo.html).

35 Met Commissioner Cressida Dick’s Mansion House Speech, 20 July 2017.

Notes


64

Disclaimer

This document was prepared by Pool Reinsurance Company Limited (Pool Re). While this information has been prepared in good faith, no representation or warranty, express or implied, is or will be made and no responsibility or liability is or will be accepted by Pool Re, or by any of its respective directors, officers, employees or agents in relation to the accuracy or completeness of this document, and any such liability is expressly disclaimed.

In particular, but without limitation, no representation or warranty is given as to the reasonableness of future suggestions contained in this document.

Pool Re is a company limited by guarantee and registered in England and Wales under company no. 02798901, having its registered office at Hanover House, 14 Hanover Square, London W1S 1HP.

© Pool Re’s Terrorism Research and Analysis Centre 2017

Designed by MHP Communications mhpc.com

65


66

Pool Reinsurance Company LimitedEquitable House 47 King William Street London EC4R 9AF

ContactE [email protected] +44 (0)20 7337 7170F +44 (0)20 7337 7171W poolre.co.uk

@poolreinsurance linkedin.com/company/pool-re

Pool Re was established in 1993 as a response to the market failure triggered by the bombing of the Baltic Exchange. The costs of the Provisional IRA’s mainland bombing campaign in the 1990s led to reinsurers withdrawing cover for terrorism-related damage, with insurers compelled to follow suit. Pool Re was founded by the insurance industry in cooperation with, and backed by funding from, Her Majesty’s Treasury to form a private-sector solution to a public policy objective.

Since its foundation, Pool Re has provided effective protection for the UK economy and currently underwrites over £2 trillion of exposure to terrorism risk in commercial property across the UK mainland. To date, Pool Re has dealt with sixteen certified terrorist events and paid out claims of more than £600 million at no cost to the UK taxpayer. The largest claim, £262 million, resulted from the 1993 Bishopsgate bombing in the City of London. The exposures in the same area today would be significantly in excess of that figure.

Documents

Terrorism Threat & Mitigation Report · the evolving nature of the threat. The UK insurance market ... Pool Re Terrorism Threat & Mitigation Report 2 Overview Purpose The purpose