Simon Garrett CFIOSH, a threat analysis specialist, looks at the way in which the risks to businesses and staff travellers has changed, and what we should be doing now that the scale and the nature of the terrorist threat has fundamentally changed.
Amongst the mayhem in Paris on Friday 13th of November the armed assault on the Bataclan Theatre and the murder of 89 occupants brings home the reality of just how vulnerable public events and spaces are to attacks of this nature. The frequency and ferocity of these attacks mean that we need to examine the nature of this threat to our staff both at home and overseas. More specifically global companies need to look at their operational footprint and profile and assess their exposure to risk generally. Many companies already have robust plans and planning processes in place and train staff to deal with a crisis. These arrangements need to be reviewed to ensure they remain fit for purpose.
Threat is defined as a combination of intent to harm and capability to do so. Terrorist outrages are not new and in previous decades we have had the Red Brigade, Baader-Meinhof, the IRA and others who bombed public places and fought gun battles on our city streets. The capability of ISIL in particular cannot be doubted. Since 31 October they have destroyed a Russian passenger jet, bombed a street in Beirut, and carried out six simultaneous assaults on targets in Paris amounting to three attacks of mass murder in three different countries inside a fortnight. No terrorist group in modern history, including Al-Qaeda, have demonstrated such operational breadth and direct reach in terms of destructive capability or the ability to inspire other terrorist groups to commit similar atrocities. In summary we face a terrorist threat in terms of intent and capability which is more destructive and far reaching than ever before.
Most European countries have well trained counter insurgency police and troops that can respond quickly to an attack and contain it. Notwithstanding, since the attackers do not usually fear death or capture they are prepared to mount bold assaults in public places. The Bataclan Theatre is a case in point. Even against the famously aggressive and well-trained French anti- terrorist police three ISIL gunmen armed with assault rifles held them off for two hours and forty minutes whilst inside the building, firing into the tightly-packed audience of 1,500. It begs the question as to how effectively any business can plan or prepare for such an eventuality.
At board level and for key investors the essential question is whether the analysis of the threat changes the viability of any business undertaking in terms of whether the commercial benefits are worth the risk, particularly the risks to staff. In some cases the question is academic as official government advice against travelling has invalidated travel insurance which was the case in Sharm el Sheikh. The same has been seen with cancellations from those planning to take part in business conventions in Paris in the next few weeks. Insurers or other controlling stakeholders have simply vetoed participation.
More likely the problem will be passed down to an operational level to review risk assessment, planning processes and security arrangements. Traditionally worst case scenario planning envisages a serious fire or an explosive device causing multiple loss of life. In either case the drill is to use the fire exits to get away from the hazard with the assumption that the emergency services would be quickly on the scene. We now face the problem that the drill of making one’s way quickly and calmly to the nearest fire exit may be the very opposite of the best course of action in the face of, for example, marauding gunmen with assault rifles. The question is how we nuance our emergency drills to take account of the change in threat without over complicating them. What is the response if, as seems more likely, employees are caught up in an attack on their hotel or multiple attacks close by in the city in which they happen to be staying?
In sub Saharan Africa the threat from groups like Boko Haram in Nigeria and Al Shaabab in Kenya is typified by the latter’s activities killing 67 in Nairobi’s upmarket Westgate shopping mall which Kenyan security forces took four days to control. In April four members held hostage over 500 students for ten hours at Garissa University. It took seven hours for a response to be deployed, long after the media had already arrived, and another three hours to mount a rescue by which time 148 students had been killed. The growing threat in African states is exacerbated by the apparent weakness of their anti-terrorist security forces and their failures in intelligence and response. It is not certain that a group like Al Shaabab would be capable of attacking an international airport but it is reasonable to assume that they could successfully attack a much more lightly protected convention centre or an executive hotel in the style of the attack on the Taj Hotel in Mumbai in 2008 and now in Mali. Business executives spend a great deal of their time in these places and companies should ask themselves whether they even fully understand the true nature of the threat to their staff in some of the countries in which they operate.
In conclusion, it is important not to lose our sense of perspective or indeed become fixated with the events in Paris since global businesses are exposed to a range of threats and other risks. Perhaps the key issue here is that the scale and the nature of the threat has fundamentally changed. Even in the worst case scenarios for which we train, the emergency and security services are quickly on hand to take control and yet we have seen that, depending on where you are in the world, that can take hours or even days. The unpalatable conclusion is that following the events in Paris our worst case scenarios for planning and training just got worse by some measure.
Simon Garrett is a Chartered Fellow and has military background specialising in threat analysis.
