Has the risk profile to airports changed post pandemic?
As key players within the UK economy and vital aspects of the UK’s Critical National Infrastructure, it is unsurprising that airports remain high value targets for terrorist attacks.
The Pool Re Solutions latest Aviation Sector Risk Report - an analysis of open source information and interviews with senior security officials from UK airports - examines what’s changed
Traditionally, malicious actors have primarily targeted aircraft. However, significant security improvements and mitigations have shifted the threat onto airports themselves and in particular landside areas. While low complexity methods have dominated the terrorist threat landscape in the UK in recent years, and would undoubtedly cause significant costs if used to target airports, the threat posed by terrorist use of explosives against airports remains.
Despite strict airside security measures, landside areas are at an increased risk due to their status as Publicly Accessible Locations (PALs) and increased crowding as a result of the current staffing crisis. The staffing crisis has also caused an increased risk of insider threats resulting from mass recruitment to combat the crisis. As a result, it is assessed that there is a moderate terrorist threat towards airports in the UK. Despite the vital mitigations already in place within airports, there is space for improvement with regards to landside areas, particularly as the terrorist threat will remain in the long term. See the key findings in the panel opposite.
Civil aviation forms a significant part of the UK’s Critical National Infrastructure (CNI) and contributes considerably to the British economy both directly and indirectly. In 2019, the entire aviation industry contributed almost £22 billion to the UK economy with UK airports handling almost 300 million passengers each year. Furthermore, following the fall in passenger numbers as a result of the COVID-19 pandemic, the International Air Transport Association (IATA) expects global passenger numbers to reach four-billion in 2024, exceeding pre-pandemic levels. As key economic players and vital CNI sites, airports therefore make attractive targets for terrorists. The continuing terrorist threat to the UK, combined with the recent staffing shortages and significant queueing witnessed at many of the UK’s major airports, has further increased the threat to airports. This underlines the continuing importance of appropriate threat awareness, understanding of possible vulnerabilities, and implementation of risk mitigation measures to protect airports.
Historically, UK airports have witnessed plots carried out by a variety of actors, including the 1994 IRA mortar attacks at Heathrow airport and the 2007 Glasgow airport attack. However, security advances following the 9/11 attacks have made aviation security more stringent and attacks on aircraft more difficult. Consequently, the threat to airports and landside areas has increased as terrorist actors still seek high-value and high-profile targets.
Airports are currently at a heightened risk in the UK as a result of a staffing crisis. As the media continues to report on understaffing and long queues at airport terminals, it is possible that malicious actors will seek to exploit airport deficiencies highlighted by the media in order to carry out an attack. Furthermore, the current fast-tracked recruitment to combat staff shortages increases the risk of lowered recruitment standards, and/or inadequate background checks and training – increasing the ‘insider threat’.
The threat of a terrorist attack targeting an airport in the UK is currently assessed as moderate. Terrorist targeting of airports is powerful and symbolic, with the potential for significant economic and societal consequences. The landside areas within airports also provide a publicly accessible alternative to targeting aircraft and highly secured airside areas, whilst inflicting a similar impact. Therefore, airports will remain a targeting priority for malicious actors in the long term.
Threat actors based in Great Britain, regardless of their ideological motives, have relatively limited capabilities.
This is largely due to the difficulty in obtaining weaponry, ammunition, or explosive precursor materials as a result of strict regulations, purchase monitoring, and strong counter-terrorism capabilities within the security services.
As a result of restrictions on weaponry and precursor materials, terrorists are most likely to use low complexity methods to target an airport such as attacks using bladed weapons or using Vehicles.
As a Weapon (VAW). While less likely, Islamist extremists continue to demonstrate a desire to employ Person-Borne Improvised Explosive Devices (PBIEDs) which could cause mass casualties, property damage, business interruption and economic losses.
There is a realistic possibility that extremists will use cyber-attacks or drones within future plots. In the UK, we are yet to see a viable attempt at weaponising drones for destructive purposes; however, based on previous drone usage, it is more likely they will be used to disrupt airport operations or air travel. Environmental extremist groups and activists, though not yet officially designated as terrorist organisations, have demonstrated a desire to use drones disruptively towards airports in protest against the aviation industry’s impact on climate change. Such disruption would unlikely lead to property damage or casualties, unless a drone was the cause of an aircraft crash, but this cannot be ruled out in the future.
Different tactics are explored below that might be deployed against airports and outline their potential effects:
Person-Borne Improvised Explosive Devices (PBIED) - Research based upon the RAND-MIPT Terrorism Incident Database found portable explosives to be the most frequent and deadly mode of attack from a sample of 75 airport attacks worldwide since 1980. Terrorist use of PBIEDs in attacks against UK airports remains a realistic possibility in the medium term, with passengers in check-in zones and landside areas being the likely targets. The damage caused by such an attack is likely to increase if there are multiple transport hubs within a single location, such as a bus station, train/tube station and airport.
A PBIED attack would require a high level of planning, access to explosive materials and a level of reconnaissance. This tactic if successfully deployed would be likely to result in significant casualties, costly property damage and long-term business interruption.
Low Complexity Methods (Bladed Weapons or Vehicle As a Weapon (VAW) - With experts estimating that there will be approximately six billion aviation passengers annually by 2030, airports increasingly present crowded places, which terrorists could successfully exploit using lower complexity methods.
A bladed weapons attack would require minimal prior planning or preparation and could easily target landside areas, including airport check-in and arrival zones. Despite the panic and hysteria this method would cause, these attacks would likely result in relatively few casualties and limited to no property damage or long-term business interruption. Equally, a VAW attack requires minimal planning and capability but has the ability to cause significant human casualties, high levels of property damage and business interruption.
Drones - The use of multi-drone displays has been recently seen in celebrations such as the Queen’s platinum jubilee. It is therefore possible that terrorists could be inspired by these displays and attempt to use drone swarms for disruptive purposes or to target aircraft. Whilst evidence is yet to be seen of the ability to arm drones with explosives within the UK, this cannot be ruled out in the long term.
A terrorist attack on an airport would likely result in economic losses and business interruption. Higher complexity terrorist attacks would likely cause moderate to significant physical damage dependent on the tactic used. However, lower complexity methods or even hoaxes have the potential to cause a huge economic impact through non-damage business interruption (NDBI), regardless of any physical damage.
Following discussions with senior security officials at several UK airports it is estimated that the NDBI costs could amount to between £125,000 and £600,000 for a 7-hour evacuation, irrespective of the cause of the evacuation. These costs would obviously be dependent on the time of day, time of the year, passenger profile, and airport size. Following a successful attack requiring longer periods of evacuation and site closure, NDBI costs alone could reach millions of pounds.
The International Civil Aviation Organization (ICAO) have international baseline standards for areas - including design and security regulations - which airports across the globe are required to follow. Most nations also have their own additional standards alongside the requirements outlined by the ICAO. In the UK these are set by the Civil Aviation Authority (CAA), whose standards are more stringent than those set by ICAO and place the UK as one of the most proficiently regulated bodies with regards to airport regulation, safety, and security.
The Aviation Security in Airport Development (ASIAD) guidance was implemented by the UK Department for Transport in 1996 and revised in 2018 to mandate particular design elements and standards that will improve resistance to bomb blasts; including multi-laminated glass and post-blast retained structural barriers to protect against physical attacks.
ASIAD requires those planning, designing and developing airports and terminals to mitigate the impact of a large-scale terrorist attack on airport infrastructure. However, this does not account for unprotected queues outside airport buildings and, as such, these areas need further security considerations.
UK airports also require all airside staff to carry out General Security Awareness Training (GSAT), with some airports including this requirement for landside staff. While this is the baseline training required, airports typically also provide bespoke in-house training to ensure airport-specific security standards are maintained.
The forthcoming Protect Duty legislation will further enhance the requirement to protect the public at airports; airport operators will need to demonstrate that they have proportionate mitigation measures in place. However, potential issues about standards of staff training, missed or skipped procedures due to crowd pressures, insider threats from inadequate vetting or failure to protect crowds queueing in more vulnerable areas, including outside terminals, could raise questions over liability where insurance cover bought is traditionally lower for terrorism than other forms of liability such as health and safety.
Despite the mitigations in place, there are a several enduring issues which require further attention to reduce the risks they pose.
Insider Threat- The insider threat to airports comes from an individual with authorised access to information, facilities, people or resources within the airport. An insider threat could include the use of access to facilitate an act of violence, cybercrime, sabotage, or destruction of property. The insider threat to airports is consistently a concern to airport security officials with the current staffing crisis emphasising the risk. As airports attempt to re-establish sufficient workforces, it is possible that malicious actors could gain employment as recruitment standards are relaxed to meet demand.
A leaked letter from the UK aviation minister in April this year revealed the Government’s plans to relax vetting rules, permitting new employees to access landside areas and begin their training before security checks are completed. Allowing un-vetted individuals into the airport and issues regarding access to training increases the risk of these processes being exploited by insider threats.
The mass recruitment of individuals uninterested in their jobs also presents terrorists with a potential pool of easily impressionable airport employees who may be willing to share inside information in exchange for monetary rewards. Therefore, sacrificing the wait for completion of security checks prior to training to counter the backlog of vetting poses a significant risk to airports.
Consequential impact of the terrorist threat to aircraft - A consequence of stringent security measures within airports with regards to accessing airside and aircraft is to transfer risk from aircraft to airports. Threat actors wishing to target aircraft may be prevented from accessing airside areas of the airport and instead the threat to the airport itself increases as terrorists make a last resort effort to conduct an attack. A further consequential threat to airports comes from an attack on an aircraft taking place shortly after take-off or before landing whilst the aircraft is above the airport footprint.
Pool Re Solutions composed this report in order to gain a comprehensive understanding of threat landscape surrounding UK airports and the current risk mitigation measures put in place to protect against them