Terrorism Modeling: The Challenges of Keeping One Step Ahead

A version of this article was published by Insurance Day

Terrorism is asymmetric warfare, and terrorism risk analysis entails knowing not only what has occurred in past terrorist campaigns, but also everything that could have occurred. Carl von Clausewitz, the foremost Prussian military theorist, insisted that perfecting the art of warfare entailed knowing not only what had occurred in previous wars, but also everything that could have occurred. The catalog of successful terrorist attacks is only a small subset of the much longer list of terrorist plots, most of which have been interdicted through the diligent surveillance and pre-emptive action of the counter-terrorism forces.

And, operating a security service can be compared to the role of a soccer goalkeeper, insists Professor Paul Wilkinson, the doyen of terrorism academics; you can stop most everything that comes at you, but you will be remembered for what gets past. Therefore, the success of the security operations at the 2018 FIFA World Cup in Russia is that it will not be remembered, as it passed largely without incident. Faced with persistent ISIS threats against the World Cup, the Russian security service rounded up terrorist suspects in the Caucasus and throughout Russia well before the start of the tournament. The French winners of the World Cup will hail this as no small achievement; on November 13, 2015, the French national stadium in Paris was the target of a suicide bomb attack.

To address recent trends in the threat landscape, like the rise of the lone-wolf attack and market challenges such as understanding the geography spread of risk within major cities, RMS has recently released the latest version of the RMS Probabilistic Terrorism Model (PTM) and updated RiskLink Version 18 of the RMS Terrorism Scenario Model (TSM). This update will equip terrorism model licensees with the tools they need.

Although overall plot and attack frequency remain unchanged in U.S., U.K., Canada, Italy, Denmark, and France, this release updates the conditional probability of various attack types to reflect the current risk landscape. In the U.K. and Belgium, the release updates the target database in the greater London area and in Brussels to reflect construction of new targets and removal of targets with diminished risk. The models now cover over 4,600 targets across the U.S., U.K. and Belgium; such as foreign consulates, government buildings, train stations and tourist attractions.

Based on recent plots, the incidence of armed attacks as a preferred mode of attack has increased. To comply with this scenario, we have reduced the relative likelihood of conventional bomb attacks and increased the likelihood of armed attack in these countries.

The Lone Wolf Threat

In recent years, low-profile terrorist plots involving lone wolves or pairs of operatives have been a mainstay of the terrorist threat against the western alliance. This is in response to heightened intrusive counter-terrorism surveillance, and was anticipated by RMS in 2011 with an innovative analysis of the dependence of plot interdiction on the number of operatives: too many terrorists spoil the plot.

The FBI director, Christopher Wray, testified in May to a U.S. congressional committee that lone wolves currently represent the highest counter-terrorism priority. Indeed, the FBI is pursuing a thousand investigations into lone wolf militants. One of those trapped by the FBI is a young Texas student who allegedly intended to carry out a mass shooting at a Dallas shopping mall.  Lone wolves roam all over the western alliance. On July 18, an ISIS terrorist, Naaimur Rahman, was convicted of plotting to bomb the gates of 10 Downing Street, kill guards and then attack U.K. Prime Minister with a knife or gun. Terrorism is the language of being noticed, and a massive vehicle bomb is not needed to achieve the media coverage terrorists crave.

The attack weapon shift away from vehicle bombing to guns, knives, improvised explosive devices and vehicle ramming is reflected in the 2018 update of the RMS terrorism risk model. Part of the terrorist calculus for this shift in attack mode, reiterated by the Dallas supporter of ISIS, is that even if the property damage is much lower than with a vehicle bomb, the cost of heightened security, ratcheted up by fear, will be a massive drain on the economic resources of the region attacked.

The increase in lone-wolf attacks at soft targets, such as hotels and transportation hubs, continues to be the focus of Islamic militants, given these targets are relatively unprotected due to their public access. Night clubs and other afterhours venues remain an attractive target, as these establishments are often tightly packed with crowds of people with limited exit routes, therefore enabling mass casualties. For these reasons, RMS expects more plots against these types of targets and has added a specific category to both models.

Weapons of Mass Destruction

On July 6, 2018, Shoko Asahara, the leader of the apocalyptic cult Aum Shinrikyo and mastermind of a sarin gas terrorist attack on the Tokyo subway on March 20, 1995, was finally put to death, after several decades of legal appeals. To date, this is the worst chemical weapon attack perpetrated by any terrorist organization. This predated the post-9/11 advent of terrorism risk modeling, which has always recognized the possibility of a chemical attack similar or even greater than that in 1995, which killed about a dozen people, and might have killed many more had the sarin gas release process been more effective.

Apart from the deaths of those contaminated by a toxic chemical, the business interruption consequences could be enormous. This was illustrated in the nerve agent poisoning of a former Russian military officer and his daughter in the English city of Salisbury on March 4, 2018. The chemical poison used, Novichok, is not a weapon that can be manufactured by non-state terrorists. It requires the highest-grade state laboratories and expertise. Novichok consists of two separate components that, when mixed, become an active nerve agent.  Nearly four months after the Novichok attack, on June 30, 2018, two local residents were hospitalized for Novichok contamination through a perfume bottle which they had picked up. One has since died.  A former Russian chemical weapons scientist has asserted that Novichok is so powerful that extremely small doses could remain a danger to public health for years. Even after thorough decontamination, residual concern amongst visitors may depress the tourism economy in Salisbury for months.

President Trump’s summit meeting in Helsinki with President Putin on July 16 has not diminished the threat of another Russian chemical attack. However, his summit meeting in Singapore with the North Korean leader Kim Jong-Un on June 12 has mitigated the risk of a nuclear weapon falling into the hands of a terrorist organization. Al Qaeda has eagerly sought to acquire a nuclear weapon, and North Korea has been the most likely rogue state source. The RMS terrorism risk model has always included acquisition of a nuclear weapon as a low-probability terrorist attack mode. The denuclearization accord gives added model confidence that the nuclear threat has not been underestimated.

On the first anniversary of the Westminster attack on March 22, 2017, Pool Re announced that it would be able to provide cover for terrorism related non-damage business interruption. This narrows a significant insurance protection gap, and would be a manifestly useful extension of cover for a conventional attack such as closed the historic London Borough market for ten days from June 3, 2017. However, the business interruption from the Novichok attack in Salisbury would be much harder to cover, due to the open-ended clean-up duration. It remains a major challenge for terrorism insurers to cover weapons of mass destruction, but also a potential opportunity if the scope of coverage is carefully limited and precisely worded.

Terrorism insurers should also not be complacent at the defeat of ISIS in Syria and Iraq. Jihadism is on the rise in Africa, and western attacks have been organized from Libya. So, the frequency of terrorist attacks should not be expected to diminish. Andrew Parker, the head of the U.K.’s MI5, has warned that ISIS is aspiring to commit devastating attacks in Europe, and revealed that two dozen U.K. terrorist plots have been interdicted over the past five years.

Effective terrorism risk modeling requires continual vigilance of the threat landscape and its interaction with insured exposure, and to always ask “what if?”, borrowing Professor Paul Wilkinson’s analogy — looking at the shots at the soccer goal that were successfully saved, the missed shots as well as the occasional ball that reaches the back of the net.