In this blog, I aim to consider the potential impact that the recent terrorist onslaught experienced most notably in France and to a lesser extent in Germany could have on the risk management profile of our organisations. I will then explore one of the underlying issues and suggest ways to enable our organisations to respond to the challenges that this recent terrorist activity brings.
In writing this blog, I do not wish to detract from the physical and emotional suffering of both the victims and witnesses of the various atrocious attacks but I do feel it is important to learn what we can from these attacks whilst continuing to live our lives as routinely as possible.
The despicable attacks in Paris at the offices of ‘Charlie Hebdo’ in January 2015 and at the ‘Stade De France’ and ‘Bataclan Theatre’ in November 2015 involving organised terrorists with automatic weapons rightly governed the headlines for weeks but these were the type of incidents that authorities expected as they took the same form as the ‘Mumbai’ attacks of November 2008. There were however 2 incidents that were reported far less; these were shortly before the ‘Charlie Hebdo’ attacks and took place in Nantes and Dijon in December 2014.
In Dijon a driver ploughed his vehicle into pedestrians waiting at a bus stop, injuring 13 people. This was followed in Nantes by a man driving a van into shoppers at a Christmas market leaving 10 people injured. In both incidents the perpetrators were heard to be shouting "Allahu Akbar" (God is Great). In the investigations after both incidents investigators found that the perpetrators were ‘unbalanced’ or suffered from ‘psychiatric problems’.
Understanding a key difference in these attacks:
The first significant point from the attacks in Nantes and Dijon were that it introduced a new method of operation to the terrorist model, Previously terrorists needed the funding and connections to obtain firearms to commit murder on a large scale or they needed the knowledge of which ingredients to obtain from shops and a sufficient understanding of chemistry in order to manufacture their own bombs. All of which in business speak increase the ‘barrier of entry’ for terrorists in a way that separates the aggrieved from the fully committed.
The use of vehicles in Nantes and Dijon reduced the ‘barrier of entry’ to the level of anyone that can drive and own or hire a vehicle. The significance of this wasn’t fully recognized by the authorities at the time but I would suggest subsequently lead to the horrendous attack in Nice on Bastille Day 2016 when the attacker hired an 18-tonne lorry to embark on his reign of carnage killing 84 people and leaving 308 people injured.
I recognize that there is significant difference between the Paris attacks and the attacks in Nantes, Dijon and Nice; specifically that the former was organised by a networks of highly organised and committed individuals whereas the later were instigated by either one person or a much smaller network of individuals. We have police and security services focusing huge resources on identifying, tracking, and disrupting both the large organised networks and the smaller networks but finding these smaller networks is far more challenging.
Why is this is important to our organisations?
Wherever we are based our organizations are and want to be part of the community and to this end I don’t believe we would want any preventable suffering within those communities. We also have a wider duty of care to all of our stakeholders to ensure that any of our activities are performed with a due consideration for the safety of others.
Its not just important to perform this duty of care because it is the right thing to do, it is also important to do it in order to maintain a good reputation with our stakeholders.
The business that hired the lorry to the Nice attacker would not want their vehicle used for such purposes but following the incident they were faced with the media filming the outside of their premises and seeking interviews with employees. That organization acted in the best of faith but is now faced with a tarnished reputation associated with the terrorist incident. They can demonstrate that they had controls in place and cooperate with the authorities but despite this there is a real possibility that their customers could decide that they do not wish to be associated with a company that is linked with so many deaths and as a result the very existence of that business could be in doubt.
In addition to the reputational damage, this incident places that organisation under the scrutiny of authorities. This could lead to a review of all aspects of the organisations compliance with laws and regulations from employment practices to vehicle safety. Any potential breach could lead to legal action with the potential for fines, disqualifications or suspension of operating licenses. Such action allied with the customer perception just increases the risk that the organisation will be unable to stay in business.
Finally that organization may need to consider re-branding, a possible business relocation and other additional costs which even if successful would have an impact on the overall profitability of the organisation.
What can our organisations do to respond to this?
When considering how our organizations can respond we need consider the issues relating directly to the activities of our organisation and the potential impact of our organization on the external environment separately.
Sale of Products - that could be used for terrorist purposes:
Having worked for an organisation that sold a product which if used in a different way to that intended formed one of the ingredients needed to make a bomb; I understand both the need and the processes to adequately control this. For other organisations that might sell or use a similar product here are a few controls that I suggest are considered to manage the risk of inappropriate use of that product:
1) Ensure processes are in place to accurately calculate and control the quantity of that product held in stock by the business. This will need to cover all points of the supply chain from:
a. Ensuring that there are effective physical security controls of the goods in the form of segregation, locks, alarms, and security guards.
b. Having appropriate validation processes over the recruitment and induction of both permanent and interim employees that have access to these goods or have responsibility for the accurate custodianship of the product.
c. Having a control that the initial receipt of goods is matched to expected delivery quantities
d. Recording the actual and perpetual inventory held in warehouses, in-transit and in any shops
e. keeping accurate records of the quantity of that product sold and any returned by the customer or returned to the vendor or stolen/damaged.
f. Ensuring that appropriate operating instructions exist for the product; that include how it should be used and the risks that can result from its incorrect use.
g. Implementing processes that validate that all personnel using the product are adequately trained and that customers using the product are appropriately certified or have the required knowledge to use the product safely.
h. Creating controls that trigger an alert if excessive quantities (greater than needed for routine business) are sold or found to be missing.
Having recorded this information it is essential that there are adequate resources to analyse the data, create trends and identify any potential anomalies or triggers that have been flagged. An anomaly would result from an attempt by a customer to purchase a greater quantity than defined as necessary for routine business, the identification of a stock loss or a break-in resulting in theft of a large quantity of the product.
2) Engage in an open and honest conversation with anti-terrorism authorities and voluntarily disclose the processes that your organisation has to control inappropriate use (examples suggested in point 1 above).
3) Report any loss of the product as identified in the monitoring mentioned in point 1 above.
Use of Vehicles: - that could harm people
There are 2 considerations relating to vehicles; the use of vehicles within the organisation and controls over the vehicles sold or hired from the organisation.
1) Vehicles used within the organisation:
These considerations relate to the risk that a vehicle used by a company employee could be used in an incident that causes injury or death to other parties:
a) Ensure that the organisation has clear policies that define the criteria that should exist for a member of the organisation to use a vehicle and that individuals are validated against this criteria prior to being allowed to use any such vehicles.
b) Any in built controls that restrict the vehicle been driven above a certain speed or alarms that alert if the vehicle is reversing should be regularly checked to ensure they are working and reported to maintenance for repair in the event that they are not working.
c) Although it is fairly obvious just as organizations have policies for road safety governing the use of mobile phones or the amount of driving time allowed without a break; there should be policies that clearly define the lawful use of company vehicles.
d) A monitoring process should exist that verifies regularly that drivers are still qualified, authorised, licensed and insured to drive vehicles.
2) Vehicles sold or hired from the organization:
a) If your organisation hires or sells vehicles to customers then their needs to be adequate standards defined and controls in place to validate the accuracy of the customers identity and authorisation to use the vehicle. This could include checks made to driving licenses, address details, and payment information, especially anti-money laundering checks where cash transactions are involved.
b) Personnel should be trained sufficiently to identify any peculiarities or inconsistencies that a customer may have which could suggest that there are concerns over the motives for using vehicles or potential mental health issues. In such circumstances an acceleration process to formally raise these issues with more senior personnel within the organization and potentially to external authorities needs to exist.
c) Any vehicles returned from hire need to be checked to identify any potential damage and where there are suspicions that this could have resulted in injury or death or others a timely process for investigation or acceleration should exist.
d) If vehicles are sold or returned to a leasing company after they have been used by the organisation, a process should exist to ensure that any company branding is removed from the vehicle so that any future use cannot be associated with the organisation.
The suggestions above I believe are practical ways that an organisation can mitigate one of the potential ways that a terrorist cell could access vehicles in order to commit a Nice style attack and may also help an organisation manage its reputation more effectively in such matters.
In my next blog I shall consider the potential impact of some of our organizations activities on the external environment and how these could relate to the organisations risk management in relation to the terrorism risk.