TERRORISM FREQUENCY 1/2018 - Pool Re
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
TERRORISM FREQUENCY 1/2018 Quarterly Report Welcome to our first Terrorism Frequency Report /02 Is the IED making a comeback as the Islamist terrorist weapon of choice? /03 Q4/2017 A review of significant incidents /05 Possible al Qaeda–Daesh merger /08 The ‘Virtual Caliphate’ /10 Destructive cyber terrorism: When, not if? /11
02 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
INTRODUCTION
Snapshot
2017 saw a step
change in the terrorist In this first edition of our new threat bulletin, Terrorism Frequency Report, we look at the
threat to the UK: establishment of a ‘Virtual Caliphate’ following the military defeat of Daesh in Iraq and Syria,
and the consequences on counter terrorist (CT) operations and business resilience to
terrorist incidents. It also discusses the threat posed by improvised explosive devices (IEDs),
using online recipes and forums, as a means of causing damage and inflicting mass
casualties in a potential shift towards ‘insurgency style’ terrorist tactics on the streets
of the UK.
5
Successful attacks in the UK In future, these threats are unlikely to reduce,
with Islamist extremism being the main driver.
More attacks should be expected in the UK in
2018 and these are likely to be focused against
crowded places, particularly those linked to
the transport sector, the military, police and
36
politicians. The attackers are likely to claim
Deaths inspiration from Daesh or AQ whilst having
minimal, if any, links to the group’s leadership.
Off the shelf technologies and combined
methodologies, including the use of more
powerful home-made and commercially
available explosives and IEDs, is likely
300+
to increase in 2018.
Injuries
We are delighted that Conrad Prince,
the recently retired Deputy Director of GCHQ,
has shared his thoughts and experiences on
We consider how Daesh may return to its the threat of terrorists enhancing their cyber
al Qaeda (AQ) roots, with the two organisations capabilities to cause physical harm through the
potentially finding more to agree upon. Should use of a cyber-trigger to cause a fire or explosion.
they merge, the resulting jihadi eco-system
could pose a greater threat to the UK, with Pool Re has recently taken steps to close
extremists having access to a wider range of the cyber gap with the inclusion in its cover
human, technical and financial resources to plan (from 1 April 2018) of physical acts of
MI5 and police and undertake attacks at a higher frequency
and severity than has been previously witnessed.
destruction caused by a cyber trigger into the
scheme. We are also working closely with all
response: A merger would also likely to result in a more
resilient terrorist entity.
our stakeholders in identifying and closing the
Protection and Information gaps. We continue
to explore ways of including Non-Damage
10
Disrupted 2017 saw a step change in the terrorism threat Business Interruption (NDBI) into the scheme
attacks posed by both Islamist and Far Right extremists, and, at the same time, seek to increase the
with five successful attacks in the UK, causing take-up of terrorism insurance by the small and
400
Arrested for 36 deaths and over 300 injuries; fortunately, medium-sized enterprises (SMEs) to meet these
terrorism-related another 10 were thwarted by MI5 and the police. unprecedented threats.
offences Over 300,000 items of terrorist-related material
300,000
Items of terrorist have been removed from the Internet since
related material 2010; up from 250,000 in December 2016. The Conclusion
removed from UK’s CT agencies continue to work at capacity As we move into 2018, a year that could
the internet to detect and disrupt further plots and attacks. bring unprecedented levels of terrorism risk
to the UK mainland, the effective partnering
Events in 2017 may have been the tipping point of Government, the insurance industry and
in the way Daesh and AQ have operated over businesses will be critical to the continued
the last four years; 2018 may herald a far more resilience of the UK.
Current UK complex and dangerous period for democracies
fighting extremism, especially with the
threat level: exploitation of the internet and encrypted
messaging. The combined effect of the loss of
the ‘physical so-called Caliphate’ and successful
CRITICAL disruptive CT operations may be leading to a Ed Butler CBE DSO
SEVERE Threat level from trend of more ‘disorganised terrorism’ and the Head of Risk Analysis, Pool Re
international terrorism driving of terrorists into the ungoverned spaces
! to the UK of the Internet and failed states causing a
decentralised and ‘Virtual Caliphate’. If this is
SUBSTANTIAL Threat level from the case, then we will be returning to a similar
Northern Ireland-related situation recognised pre-Caliphate, when
! terrorism to GB successful drone strikes in the Tribal areas of
MODERATE Pakistan forced aspiring terrorists, with nowhere
else to go and fight, to undertake more attacks
LOW
against the Western world.
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0202 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
Q.
Eden Stewart
Analyst
IS THE IED
MAKING
A COMEBACK
AS THE ISLAMIST
TERRORIST
WEAPON OF
CHOICE?
Manchester Arena attack Parsons Green attack
Terrorist use of IEDs has been a long-standing
Carried out six months after Manchester
threat to the UK. However, until the Manchester
Arena bombing in May 2017, terrorists had Key attack characteristics: Key attack characteristics:
not successfully launched such an attack Crowded place targeted Crowded place targeted
in the UK (despite a number of plots) since
Triacetone Triperoxide used within Triacetone Triperoxide used within
the July 7 bombings in 2005. Proscribed
the IED the IED
organisations like AQ and Daesh have
encouraged aspiring attackers in the West to British resident British resident
mount less complex attacks using vehicles and Known to police and MI5 Known to police and MI5
knives as weapons. Most Islamist attacks in Device constructed using available Device constructed using available
Europe since 2013 employed this methodology. instructions online instructions online
However, attacks and plots involving IEDs are
now increasingly likely.
Timer added to the IED
The Manchester bomb was inconsistent with
the perceived trend towards low complexity
attacks, and the vehicle and marauding bladed
attack which started on London Bridge in
June seemingly confirmed the use of an IED
in Manchester as anomalous. However, on
15 September, an IED partially detonated on a
tube train at Parsons Green station. The attack
shared some similarities with the one in
Manchester six months earlier: crowded places
were targeted; Triacetone Triperoxide (TATP)
manufactured from legally available materials
was used in both devices; and the bombers,
both British residents with immigrant TRAC insight:
backgrounds, were known to police and MI5. Guerrilla-like attacks in the UK
In both instances, the UK threat level was raised The reported inclusion of a timer
to CRITICAL while MI5 and the police sought to to the IED at Parsons Green
identify further suspects and to negate the risk could indicate a desire to
of further devices being used in attacks. commence a prolonged
series of attacks,
rather than a single
explosion.
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0302 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
Is the IED making a comeback as the The reported inclusion of a timer to the device
Islamist terrorist weapon of choice? at Parsons Green is significant. The intended
detonation of a bomb, without the operative Links to sources of further information:
Continued
killing themselves in the process, could indicate
a desire to commence a prolonged series of
The successful use of IEDs in two Islamist attacks, rather than a single explosion. Such
attacks within six months of each other methodology is consistent with the intent to
potentially signalled an increase in the capability conduct a sustained bombing campaign. Action Counters Terrorism (ACT)
of terrorists operating in the UK. Both Salman This would mark a further deviation from recent Knowing how to recognise and report
Abedi and Ahmed Hassan (responsible for the plots or attacks which resulted in the death of suspicious activity is important in keeping safe
Manchester and Parsons Green attacks the terrorist at the time and scene of their attack. from terrorism. Read more on the ACT website,
respectively) displayed the ability to construct which offers advice and guidance on how to
explosive devices using commercially available The attacks in Manchester and London highlight report concerns including both physical and
materials, and to deploy those devices without the relative ease with which extremists in the UK online activity.
being detected. Abedi also conducted can construct viable IEDs utilising commercially
pre-attack reconnaissance and identified available ingredients and components. The police
key vulnerabilities of public venues like the and MI5 continue in their efforts to reduce the
Manchester Arena. This suggests that Abedi availability of both precursor chemicals and
may have received training or support from online materials providing instruction on the Centre for the Protection of National
an overseas third party, or used instructional production of explosive devices. Making their Infrastructure (CPNI)
manuals available online. Hassan was able to acquisition more difficult should be a priority for Their website offers a wide range of advice,
construct a viable device, although the timing suppliers in the commercial chain. Companies not just for national infrastructure assets.
of his attack appears to have been premature that trade in the relevant precursor chemicals Read more on their guidance for disrupting
considering the construction of the device and should consider the reputational damage to their hostile reconnaissance here.
its ultimate failure to detonate successfully. organisation if they sell to a terrorist, particularly if
they have been negligent in procedures to check
Terrorist attack plans including those involving customers. Businesses should be aware of the
explosives are frequently disrupted, illustrated increasingly diverse methodologies employed
by the series of arrests in Chesterfield and by UK terrorists, and take appropriate action Cross-sector Safety and Security
Sheffield just before Christmas 2017. The to protect their premises and prepare their Communications
success of Abedi and Hassan, however, is more employees for such an eventuality. Additionally, A partnership between law enforcement
likely attributable to MI5 and police operating at post-incident responses to the use or suspected agencies, local and national government
capacity due to the heightened threat use of explosives by terrorists frequently involve organisations and private sector businesses.
environment, rather than to an increase in the comprehensive cordons which can result in Register your business to receive security
sophistication of threat actors. It is significant significant business interruption for businesses updates on the CSSC website.
that both Abedi and Hassan were not known located near the scene (in addition to the
to be under direction from international terror expected property damage from explosions).
groups (Abedi may, however, have received In 2017, IEDs were the attack method most likely
advice but not explicit instruction), although they to cause damage, whether property was the
are highly likely to have had access to extremist intended target or not. It’s unlikely to be The UK threat levels are set by MI5 and the
media. In contrast, earlier recent Islamist attacks coincidental that the police offered IED specific Joint Terrorism Analysis Centre, JTAC.
in Europe which involved explosives were advice to the business community (available Read more about them and international
conducted by cells with links to Daesh’s external here) the same day as the arrests in December. terrorism via the MI5 website.
operations unit. This could indicate an increased
willingness on the part of ‘inspired’ actors to
undertake more complex attacks using IEDs. Conclusion
Regardless, successful attacks will contribute Should the step change in terror threat
to the motivation of aspiring terrorists. seen this last year be indicative of the likely London Protect
frequency of attacks in the next 12 months, Run by the Metropolitan Police, London Protect
publishes monthly newsletters to provide regular
IT IS SIGNIFICANT further use of IEDs against similar targets
is probable. Those attacks are likely to be updates advising and informing businesses in
the London region of relevant protective security
THAT BOTH Islamist extremist in nature, the IEDs made
from commercially available materials and information. Follow their Twitter here.
ABEDI AND used against a range of targets including
crowded places, transport hubs and iconic
HASSAN WERE sites. The possibility of further IEDs having
timers, rather than used as part of a
See It, Say It, Sorted
NOT KNOWN martyrdom operation, is indicative of a
sustained bombing campaign rather than A campaign to encourage train passengers and
station visitors to report any unusual items or
TO BE UNDER isolated attacks. This would truly mark a
step-change in the contemporary UK threat. activity. Text 61016 or call 0800 40 50 40 to help
keep the UK’s rail network safe.
DIRECTION FROM IN THE RARE EVENT OF
INTERNATIONAL
a firearms or weapons attack
RUN HIDE TELL
TERROR GROUPS
RUN to a place of safety. This is a far better option than
Run, Hide, Tell
to surrender or negotiate. If there’s nowhere to go, then…
HIDE It’s better to hide than to confront. Remember to
turn your phone to silent and turn off vibrate. Barricade
yourself in if you can. Then finally and only when it is safe
to do so…
Information and resources to stay safe if you are
TELL the police by calling 999.
caught up in a a firearms and weapons incident
in the UK.
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0402 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
Q4/2017
A REVIEW OF
SIGNIFICANT
INCIDENTS
Camilla Scrimgeour
Analyst
Frequency of global terrorism
226
Total number
of attacks
43
Total number
of countries
Key:
Europe 4
Latin America & the Caribbean 8
Middle East & North Africa 91
North America 3
Russia & CIS States 6
South Asia 60
South East Asia 7
Sub-Saharan Africa 47
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0502 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
Q4/2017
A review of significant incidents
Continued
Severity of attacks
There were 226 in the last quarter of 2017,
causing at least 2,248 deaths and 2,546
injuries. The most lethal attack took place
in Mogadishu, Somalia. There were four
attacks in Europe, none of which took
place in the United Kingdom.
October November December
2017 2017 2017
1
October 14
Mogadishu,
Somalia
VBIED attacks
Killed: 512
Injured: 300+
3
November 24
Al Rawda Mosque,
Egypt
IED and Firearms
attack
Killed: 305
Injured: 120+
2
October 31
New York City, 4
Fatalities USA December 11
Vehicle attack Port Authority Bus
Killed: 8 Station, USA
Injured: 12 IED attack
Killed: 0
Injured: 3
Injuries
Source: TRAC Terrorism Database
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0602 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
Attacks Plots
1. October 14 3. November 24 5. November 2017
Mogadishu, Somalia Al Rawda Mosque, Egypt Melbourne, Australia
New Year’s Eve plot
VBIED attacks IED and Firearms attack A 20-year-old man was arrested on suspicion of
Killed: 512, injured: 300+ Killed: 305, injured: 120+ planning an attack in Melbourne on New Year’s
Eve. The man was being monitored by police
Two VBIEDs detonated in different areas of Approximately 30 terrorists carrying Daesh flags and had downloaded extremist media, training
Mogadishu. The initial blast occurred when a surrounded the al Rawda Mosque in the Sinai manuals and attempted to acquire a firearm.
truck carrying explosives detonated on a busy Pensinsula during Jumu’ah (Friday prayers).
intersection near Government offices and hotels. They detonated at least one IED before opening Similar to the heightened threat environment
A second device, allegedly a car bomb, fire, setting fire to nearby cars to block roads in the UK, Australian police have thwarted
exploded shortly after, some distance from the and targeting responding ambulances with 14 terrorist plots in the past four years and
initial explosion. No group claimed responsibility gunfire. The terrorists left before security six attacks have taken place. The threat level
for the attack, but the Somali Government forces arrived. remains at ‘Probable’.
blamed al Shabaab.
The attack was the bloodiest in Egyptian history 6. December 5, 2017
Al Shabaab has previously targeted both hotels and represents a departure from methodologies United Kingdom
and Government buildings and the attack was previously employed by terror groups operating Downing Street plot
consistent with methodologies employed by the in the Sinai. No group has claimed responsibility
group, although no previous attacks have been for the attack although Daesh is suspected to Two men, both British nationals, were charged
as deadly. Media reports indicated that 400kg be responsible. Several other groups operating with terrorism offences over an alledged plot to
of explosives, including both military-grade and in the Sinai issued condemnations of the attack. kill the Prime Minister in an attack using an IED
homemade, were used in the truck bomb. This, and bladed weapons. The men had conducted
and secondary effects (including the collapse The attack demonstrated the potential lethality reconnaissance, downloaded Islamist extremist
of buildings and fire from the combustion of a of mixed methodology attacks in which terrorists material, recorded a pledge of allegiance to
nearby tanker truck) likely contributed to the use firearms in combination with IEDs. However, Daesh, and delivered and collected a rucksack
high number of casualties. An investigation into the acquisition of firearms by terrorist actors and bag to be fitted with an IED.
the source of the explosives is ongoing; some in the UK remains unlikely, and extremists
sources suggested that they were stolen from are more likely to use readily available vehicles Whilst an ambitious plot, the men were not
AMISOM, the African Union peacekeeping force and bladed weapons, or attempt to construct in possession of explosives at the time of their
deployed in Somalia. IEDs for attacks. arrest, indicating that MI5 and the police had
a degree of control around the suspects.
Extremist access to military-grade explosives 4. December 11 Politicians, other persons of authority and
in the UK is highly unlikely. Large vehicle-borne Port Authority Bus Station, USA associated sites continue to be targeted
IEDs such as those detonated in Somalia have by extremists.
been used by the IRA in previous years. Ciaran IED attack
Maxwell, who was jailed in 2017 for Northern Killed: 0, injured: 3 7. December 19, 2017
Ireland-related terrorism offences, acquired his United Kingdom
cache of military-grade explosives through theft Three people were injured when a pipe bomb Christmas plot
in his former position as a Royal Marine and had strapped to the body of 27-year-old Akayed
official buildings listed as intended targets. Ullah partially detonated in an underground The total number of plots thwarted in the UK in
However, this was not assessed to indicate the passageway between Port Authority Station and 2017 rose to 10 when police arrested four men
start of a new campaign and the use of large Times Square Station. The attacker is originally in Sheffield and Chesterfield on suspicion of
VBIEDs in the UK remains possible but unlikely. from Bangladesh and moved to the US seven being concerned in the commission, preparation
years ago. He is reported to be a supporter of or instigation of acts of terrorism under Section
2. October 31 Daesh and was inspired by their online media 41 of the Terrorism Act 2000. Two men of Iraqi
New York City, USA urging attacks during the Christmas period. origin have been charged.
Vehicle attack A document submitted to court suggested Ullah The intended target was associated to the
Killed: 8, injured: 12 constructed the pipe bomb using instructions Christmas festivities and recent extremist media
found in an Islamist propaganda magazine posted online had called for attacks in the West
A truck was driven intentionally along a cycle path available on the internet. The latest TRAC against such festive sites. The involvement of
in Manhattan, hitting pedestrians and cyclists. Terrorism Threat & Mitigation Report highlighted armed police and the army during the arrests
The driver left the vehicle and was shot and the link between methodology promoted in suggests the suspects were in possession of,
arrested by police officers. 29-year-old Sayfullo Islamist media and attack methodology used or believed to have, weapons and explosives.
Saipov, a legal US resident from Uzbekistan, in subsequent attacks. Although it has been
has been charged with terrorism offences. claimed by some media outlets that this was It is notable that both plots disrupted in the UK
a ‘failed’ attack, it will be considered a success in December involved the aspiration to build and
The use of vehicles to kill or injure members to Islamist extremists as Ullah was successful use an IED. This appears to be a trend and
of the public is now a common attack in building and detonating an explosive device motivation may have come from the success
methodology and is consistent with previous undetected. Crowded places and Critical of the Manchester and Parsons Green attacks.
attacks conducted by Islamist extremists, National Infrastructure remain desired targets This edition of the Terrorism Frequency Report
including twice in the UK in 2017. The threat for Islamist extremists, especially during busy analyses the long-standing threat of IEDs and
posed by the increased use of this methodology periods such as holidays and rush hour. the implications for the UK.
by terrorists was evident in the police response
in the UK, and the West more widely, during the
Christmas and New Year festivities. Barriers
were erected around Christmas markets and
new ‘Talon’ nets were rolled out by police in
September with the ability to bring vehicles
weighing up to 17 tonnes to a stop. Links to sources of further information:
Terrorism Threat & Mitigation Report
January to July 2017
Terrorism in the United Kingdom and Europe
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0702 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
POSSIBLE AL
QAEDA AND
DAESH MERGER
As predicted, Daesh’s territorial holdings in Iraq and Syria and elsewhere across the globe
have been significantly eroded and the impending collapse of the physical so-called
Caliphate has raised hopes for the group’s end.
Eden Stewart
Analyst
AL QAEDA
DAESH
TRAC insight:
The likely result of a merger
is that the Daesh brand would
endure, at least in the short
term, although in a much-
diminished state, and AQ
would re-emerge as the
preeminent jihadist
organisation.
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0802 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
However, elements of Daesh and its ideology
will very likely persist. The group, scattered and
The death of either Zawahiri or Baghdadi would
remove a significant obstacle to a merger, as THE DEATH OF
operating largely without central command and
control, is returning to the insurgency model
neither would likely accept the loss of prestige
that publicly ceding authority to the other would EITHER ZAWAHIRI
from which it evolved. It is unlikely to be
eradicated from Iraq and Syria entirely. It is
entail. Despite Russian claims, it is probable that
Baghdadi remains alive and in hiding in Iraq or OR BAGHDADI
possible that Daesh or factions within it will
remerge with AQ. This could involve a formal
Syria. If he were to die, his successor would
likely announce Baghdadi’s death in an attempt WOULD REMOVE
merger precipitated by the organisations’
respective leaders, or a hostile takeover of one
to secure their own claim as Caliph and maintain
cohesion across Daesh’s various factions. A SIGNIFICANT
by the other. Such a merger would likely see a
successor organisation strengthened and intent
Regional commanders have taken oaths of
loyalty (Bay’at) to Baghdadi. These personal OBSTACLE TO
on conducting sophisticated attacks against the
West to (re)establish its position at the forefront
bonds would be dissolved in the event of his
death, leaving his subordinates free to realign A MERGER
of the global jihadist movement. This could lead themselves with the now-ascendant AQ.
to an increase in both the severity and frequency
of plots against the UK encouraged or directed Therefore, as long as Baghdadi remains alive,
from overseas. Despite this, the principal threat the Daesh brand is likely to endure, albeit in
to the UK would likely continue to emanate from a much-diminished state. His death would
lone actors and small groups inspired by probably precipitate either the annexation of
extremist ideology to commit attacks employing some Daesh assets by AQ resulting in a rump
a range of methodologies. Caliphate led by Baghdadi’s successor, or a
formal merger instigated by Daesh’s new leader
The split between Daesh and AQ in 2013 was to pre-empt a hostile takeover. In either
driven by divergences in the groups’ doctrines scenario, AQ would re-emerge as the
and tactics, particularly Daesh’s escalating preeminent jihadist terror group.
brutality and disputes over the establishment
of the so-called Caliphate in Iraq and Syria.
Perhaps, most significantly, there was personal Conclusion
enmity between the groups’ respective leaders, Baghdadi’s death would further enhance
al Baghdadi and al Zawahiri. Despite this, the domestic threat, providing motivation
ideological commonalities between AQ and for revenge attacks in the UK, whether
Daesh now are far greater than their differences, specifically claimed in his name or not.
and the effective destruction of the physical An AQ-led successor organisation would
so-called Caliphate in Iraq and Syria has nullified benefit from greater economies of scale and
that major area of strategic contention, increasing the deduplication of efforts with its former
the likelihood of a merger of the groups. AQ is rival, and may experience a boon in
almost certainly alert to the opportunity for fundraising and recruitment. This would
expansion at Daesh’s expense, and its recent likely see the group pursue more aggressive
efforts to boost the profile of Hamza bin Laden, strategies in ungoverned spaces around the
Osama’s son, may be part of a calculated strategy world, adding to the ‘Virtual Caliphate’
to promote a future leader more likely to win the concept. An increase in the number of safe
allegiance of disaffected Daesh members. bases would likely see a corresponding
increase in the volume and sophistication of
AN attacks against the West planned from those
bases. AQ continues to display the intent to
AL QAEDA/DAESH commit ‘spectacular’ attacks, typically
multiple coordinated attacks involving
MERGER FURTHER explosives and targeting aviation or other
transport infrastructure. It is likely that the
DIVERSIFIES THE group would dedicate significant resources
to successfully executing such an attack to
UK THREAT reaffirm its leadership of the global jihadist
movement. However, MI5 and police have
LANDSCAPE proved adept at disrupting transnational
plots, and the UK represents a hard target
for overseas plots relative to other European
countries. Consequently, the principal threat
to the UK, even in the event of a AQ-Daesh
merger, would remain self-radicalised British
residents with no direct connection to either
group seeking to commit attacks on the
UK mainland.
Pool Re
TERRORISM FREQUENCY
Quarterly Report
0902 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
THE
‘do-it-yourself’ guides encouraging supporters typically motivated by jihadi ideology in general,
unable to travel to the Middle East to conduct rather than loyalty to a specific group. Therefore,
low sophistication (and therefore harder to the collapse of Daesh’s physical so-called
disrupt) attacks in their home countries. Caliphate may do little to diminish the ability
‘VIRTUAL Illustrative of the way that terror groups adopt
each other’s successful policies, this type of
material was first distributed by AQ in its Inspire
of jihadist groups to inspire attacks against the
West. This development also represents a de
facto merger of AQ and Daesh online, insofar as
CALIPHATE’
magazine from 2010. However, the their messaging is largely indistinguishable and
methodologies proposed to aspiring attackers shares the same objective of instigating attacks
were often more complex, and despite several by third-party actors.
notable successes, AQ was not able to instigate
nearly as many attacks as Daesh subsequently
A bigger threat than the physical Islamic State? would. In part, this was likely due to the more Conclusion
easily executed methodologies suggested by This ‘Virtual Caliphate’ arguably has far
Eden Stewart Daesh, but perhaps more significantly, Daesh’s greater implications for the UK’s security
Analyst call to action was delivered alongside a far more than overseas developments. British
extensive propaganda campaign centred on the residents will very likely continue to be
With the impending destruction of Daesh’s narrative of the physical so-called Caliphate. radicalised by extremist content online and
physical so-called Caliphate in Iraq and Additionally, the string of successful attacks likely will use available instructional materials to
Syria, the future trajectory of the galvanised other supporters to plot their own. This plan attacks employing a range of
organisation is unclear. However, some dynamic was a primary driver of the step-change methodologies. Inevitably, some will
commentators have warned that the group in threat that the UK witnessed in 2017. succeed and businesses should therefore
will retain global influence after its territorial implement mitigatory measures to protect
collapse by evolving into a ‘Virtual Caliphate’. The quality and quantity of Daesh’s propaganda their premises and employees from such
declined markedly as the group lost territory and an eventuality.
Broadly, the term refers to Daesh’s use of key individuals were killed. Cyber operations
information technology to maintain its relevance mounted by coalition forces also degraded the
in the Jihadist movement by building support group’s media capabilities and Daesh’s ability
and directing or inspiring attacks. It also denotes to exploit widely used social media platforms Links to sources of further information:
an ideological and institutional coherence which decreased as service providers responded to
unifies the group’s affiliates and supporters government pressure to restrict extremist’s use The police offer guidance and support
across the disparate ungoverned spaces, both of their platforms. Despite this, 2017 saw a when dealing with potential extremist
physical and digital, in which they operate. major increase in the number of ‘inspired’ media online.
attacks against the UK. The difficulty of policing Advice can be read here and concerns
Daesh has enjoyed considerable success in the internet, particularly encrypted chat services may be reported to the Government here.
inciting sympathetic individuals with no physical and deep and dark web forums, means that
contact with the group to commit attacks against counter-terrorist efforts are unable to
the West. There have been 28 such attacks in significantly restrict access to extremist material
Europe since Daesh first released its flagship online. Daesh continues to produce
publication Dabiq (since rebranded as Rumiyah) in considerable amounts of lower quality content,
July 2014. Some of the attackers have reportedly while AQ has mimicked their rivals by producing
been guided via encrypted messaging services more accessible material focusing on instigation
by Daesh handlers in Syria and Iraq. However, and instruction. Snapshot
in most cases, the attackers are believed to have SOME OF THE
self-radicalised by viewing extremist content It is possible that the collapse of Daesh’s
online. This illustrates the power of Daesh’s physical so-called Caliphate will sufficiently ATTACKERS IN
propaganda to cultivate support and ultimately undermine the group’s credibility such that EUROPE WERE
mobilise individuals to execute attacks. interest in and supply of propaganda and REPORTEDLY GUIDED
instructional material will decrease significantly.
Daesh’s media output has also disseminated However, as demonstrated by AQ, the loss of VIA ENCRYPTED
instructional information aimed at increasing a safe haven need not be fatal to jihadist groups. MESSAGING
the efficacy of the attacks conducted by these Furthermore, the propaganda efforts of Daesh SERVICES BY DAESH
individuals; the group has published a series of (and AQ to a lesser extent) have succeeded in
creating a corpus of extremist literature which HANDLERS IN SYRIA
is supported by an active community of closed AND IRAQ.
chatrooms and forums. Together, these
constitute an online jihadi ecosystem which
exists to cultivate support for Islamist extremism
and incite sympathisers to commit attacks in
their home countries. In this regard, the ‘Virtual
Caliphate’ is already a reality. Moreover, while
content providers in this ecosystem may be
affiliated with specific organisations like Daesh
or AQ, their audience is largely brand agnostic.
Attackers mobilised by extremist material are
Daesh has also
distributed substantial
quantities of instructional
materials which aim to
increase the efficacy of
the attacks conducted
by these individuals.
Pool Re
TERRORISM FREQUENCY
Quarterly Report
1002 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
DESTRUCTIVE
In December, a new form
of malicious software
which targeted industrial
safety systems was
CYBER TERRORISM: observed, further
illustrating the prevalence
of the threat.
WHEN, NOT IF?
Guest writer: Conrad Prince The threat we face from cyber attacks We should not be surprised at this – terrorist
Former Deputy Head of GCHQ is growing and real. The UK Government movements include plenty of young people who
concluded that it was one of the top four are instinctively tech-savvy. It is natural that they
national security risks as far back as 2010. use social media and the Internet to the full. And
A little over a year ago, the Government then there are those extremists with a more
published its second National Cyber specific technology background and particular
Security Strategy, setting out an ambitious cyber skills they can bring to bear.
and wide-ranging agenda, backed by
£1.9 billion of transformational investment As Daesh lose more and more control of physical
and the creation of the National Cyber territory it seems likely that they will increasingly
Security Centre. focus their efforts on cyber space. The cyber
conflict with Daesh has a long way to run yet.
Cyber crime is rising year on year, including
cyber-enabled fraud and ransomware attacks. So far we have seen examples of terrorist
And there is plenty of evidence of nation states groups conducting ‘cyber vandalism’ – defacing
using cyber as a means to steal intellectual websites. They have possibly also experimented
property, conduct espionage and seek to with denial of service attacks (where target
influence political processes. machines or networks are overwhelmed by traffic
from other devices, rendering them unusable).
Alongside this is the growing recognition that And there is plenty of evidence of a stated intent
non-terrorist actors have used cyber attacks to to use cyber more aggressively. But on the face
cause disruption and destruction to real world of it terrorist groups currently lack the capacity
operational technology. The growing roll call to deliver a serious destructive attack.
includes Stuxnet in 2009 that disrupted Iranian
nuclear centrifuges, the cyber attack in 2012 A couple of observations. The tools needed
that destroyed 30,000 computers belonging to for cyber attacks are being increasingly
Saudi oil company Aramco, the 2014 attack on commoditised – available for purchase or hire
a German steel mill’s control system, and the on the dark web from criminals happy to provide
attacks on Ukrainian power stations in 2015 and their services to the highest bidder. Terrorists
2016, one of which left 225,000 users without are as capable as anyone of purchasing these
power. In December, a new form of malicious capabilities. So the ability to deliver destructive
software which targeted industrial safety cyber attacks, particularly at the cruder end of the
systems was observed, further illustrating the spectrum, will increasingly be within reach of those
prevalence of the threat. Industrial systems are with the ability to pay. And even crude attacks
not the only target; cyber attacks on connected have the potential to create real world impact.
devices such as building heating plants or
transport fuel management systems could Furthermore, terrorists may be able to exploit
potentially directly cause fire or explosion. sophisticated tools and techniques developed
by nation states, should they become available
Destructive cyber attacks are a reality and on the open market as a result of an
we should assume that nation states across unauthorised disclosure.
the world are investing serious resource in
developing capabilities to launch them. In addition, terrorists, as much as nation states,
Today’s inter-connected world and the rapid can exploit the significant advantages of having
development of the Internet of Things, smart someone on the inside. In 2011 Rajib Karim,
cities, autonomous vehicles and the like, a British Airways IT worker, was jailed for 30
create significantly increased opportunities years for plotting to blow up an aircraft. Karim
In 2011 Rajib Karim, a for attackers. But to be successful generally had expressed the intention amongst other
British Airways IT worker, requires a level of analysis, preparation, and things of looking into how to crash BA’s IT
was jailed for thirty years sophisticated technical skill and capability that systems. A well-placed insider can go a long
for plotting to blow up has, to date, been the preserve of nation states way to simplifying the work involved in delivering
an aircraft. Karim had alone. What is the likelihood of terrorist a destructive cyber attack.
expressed the intention organisations having the capability and intent
amongst other things to launch such attacks?
of looking into how to Conclusion
crash BA’s IT systems. The first point to bear in mind is that terrorists, So there can be no doubt that terrorist
A well-placed insider in particular Daesh, are highly effective in their groups, including Daesh, have the intent
can go a long way to exploitation of the Internet. We know to our cost to use the Internet to achieve aggressive,
simplifying the work their sophistication in using social media for destructive effect. Their capability to do
involved in delivering a propaganda. They use encrypted apps for so is limited at present, but all the trends
destructive cyber attack. operational command and control, and use indicate that their ability to deliver such
the internet extensively to gather information attacks will increase over time. We need to
to help in attack preparation. AQ started this be prepared. In the light of this increasing
trend and Daesh have placed it at the core threat, Pool Re’s decision to extend its
of their operations. coverage to include cyber terrorism is timely,
highly relevant, and will improve the
resilience of UK businesses to destructive
Pool Re cyber attacks by terrorist actors.
TERRORISM FREQUENCY
Quarterly Report
1102 Introduction 05 Q4/2017 A review of significant incidents 10 The ‘Virtual Caliphate’
03 Is the IED making a comeback as the 08 Possible al Qaeda–Daesh merger 11 Destructive cyber terrorism: When, not if?
Islamist terrorist weapon of choice?
About us Q4/2017 Region of attacks (Q4 2017)
Pool Re is the UK’s terrorism reinsurance pool,
providing effective protection for the UK economy SIGNIFICANT INCIDENTS 100
and underwriting over £2 trillion of exposure to FACTS SNAPSHOT
terrorism risk in commercial property across the 75
UK mainland. Through its Terrorism Research
and Analysis Centre (TRAC), Pool Re aims to
improve the risk awareness of current and 50
emerging terrorism perils for Members and other
key stakeholders by highlighting the availability 25
of terrorism cover for all UK mainland Commercial
Insurance customers.
0
Europe
Latin America
and the
Caribbean
Middle
East and
North Africa
North
America
Russia and
CIS States
South
Asia
South
East Asia
Sub-Saharan
Africa
About this Terrorism Frequency Report
The Terrorism Frequency report provides an
overview of significant acts of terrorism within
the previous quarter as well as identifying key
trends and themes that we believe are relevant The frequency of attacks was greatest in the
to the terrorism (re)insurance market. Our Middle East and North Africa in the last quarter
methodology is based on the TRAC Terrorism of 2017, attributable mostly to Islamist extremism.
Database, analysis of the wide range of publicly
available open source material and collaboration Global attack methodology (Q4 2017) Global attack target types (Q4 2017)
with subject matter experts.
80 120
Disclaimer 100
This document has been prepared by Pool 60
Reinsurance Company Limited (Pool Re). While 80
this information has been prepared in good faith,
no representation or warranty, express or 40 60
implied, is or will be made and no responsibility 40
or liability is or will be accepted by Pool Re, or 20
by any of its respective directors, officers, 20
employees or agents in relation to the accuracy
or completeness of this document and any such 0 0
Bladed
CBRN
Firearms
IED
PBIED
VBIED
Vehicle
CNI
Crowded
places
Police
Military
Government
Property
Symbolic
Civilian
liability is expressly disclaimed.
In particular, but without limitation, no
representation or warranty is given as to the
reasonableness of future suggestions contained IEDs were the most commonly used weapon Police, military and government targets remain
in this document. in attacks, followed by firearms. the most frequently attacked sector, followed
by civilians in crowded places.
Pool Re is a company limited by guarantee
and registered in England and Wales under NEXT STEPS:
company no. 02798901 having its registered
office at Hanover House, 14 Hanover Square, Terrorism Threat
London W1S 1HP. & Mitigation Report
January – July 2017
© Pool Reinsurance Company Limited 2017 9.3 MB
Terrorism Threat
& Mitigation Report
January – July 2017
TMR–2–17
Discover more Cyber Terrorism: Assessment
Go online to discover more about us,
Cambridge Centre for Risk Studies
Cambridge Risk Framework
of the Threat to Insurance
Cyber Terrorism Insurance Futures 2017
CYBER TERRORISM:
ASSESSMENT OF
our work, methodology and to download THE THREAT TO
INSURANCE
Joint report from Pool Re
our latest publications. and Cambridge Centre for
Risk Studies.
2.7 MB
Email Post Incident Report
TRAC@poolre.co.uk Pool Re
Terrorism Research and Analysis Centre
Three Attacks in Three Months:
Post Incident Report:
Westminster, Manchester and
Three Attacks in Three Months –
Westminster, Manchester and London Bridge
Call Westminster
Attack
22 March 2017
• Aged 52 years old
• ‘Lone actor’
• No network
London Bridge.
+44 (0)20 7337 7170
• No links overseas
0.9 MB
British born Use of vehicle and
perpetrators bladed weapon
Lone attackers Targeting of iconic sites
• Islamist extremism
• Known to police and MI5
• Crowded places
• Use of internet and ideology
Manchester • Methodology promoted online London Bridge
Attack • Timed to maximise casualties
Attack
22 May 2017 03 June 2017
• Complexity and sophistication • Three attackers shows
• Use of home made explosives level of complexity and
• Links to overseas a wider network
• Network of associates
Linkedin 10
weeks
35
deaths
217
injuries
5
terrorists
46
arrests
www.linkedin.com/company/1795229 Pool Re Terrorism Research and Analysis Centre
Terrorism Threat
Twitter & Mitigation Report
@poolreinsurance August – December 2016
6.4 MB
Address Terrorism Threat
Pool Reinsurance Company Limited & Mitigation Report
August – December 2016
Equitable House TMR–1–17
47 King William Street
London
EC4R 9AFYou can also read
