The terrorist threat to business has changed beyond all recognition since the 1990s. Terrorist groups were localised: the IRA might attack the UK and ETA might attack Spain, but ETA attacking the UK was not a possibility, and this was well understood. While the threat from such nationalist groups has not receded, others, who follow no geographical boundary, have sprung up and joined them; they are not mutually exclusive. The events of September 11, and the ensuing military action in Afghanistan and Iraq, saw an increase in the radicalisation of terrorist groups. The instant demonisation of Osama Bin Laden may well have given the US a hate figure, but it has also acted as a rallying point for disaffected Muslim youth. His philosophy is not one that the West can modify or negotiate with, demanding a complete destruction of democratic society and many of the values that we hold dear. He is not trying to change the system; he is trying to destroy it.
This fundamental change in terrorist ideology has also seen a change in weapons. While high explosive devices are still effective, they are the tools of the conventional terrorist and are well understood by government and the public – they have lost their terror impact. Explosives have a finite limit as well. The greater the statement, the larger the bomb needs to be, and physics puts a limit on the amount of explosive that can be used and remain transportable. However, a small amount of explosive surrounded by chemical or radiological agents, can produce a far greater psychological impact than any conventional explosion.
This is due to the nature of chemical, biological and radiological weapons (often called CBRN for short). Conventional explosions have a single effect, and the blast is constrained by the amount of explosive present. CBRN weapons may well have this localised explosion, but then the agent is carried by the wind and can be driven kilometres away from the initial site – remaining lethal throughout.
This has the added effect of spreading terror. Individuals on the fringe of the event, perhaps showing no ill effects, could be forced through the indignity of decontamination (clothes destroyed and individuals scrubbed by a stranger). The security forces containing the situation are dehumanised in their respirators and protective suits, which further adds to the feeling that something terrible has happened. Finally, people may be forced out of their normal habitat, with offices and homes closed for weeks for decontamination, while use of biological agents will mean quarantine and prolonged separation from loved ones.
Added together, these factors allow a terrorist organisation to cause mass panic, and will guarantee it worldwide headlines. A successful attack will increase their membership and coffers, as wealthy supporters make donations. Thus the devastation caused by a successful CBRN attack makes such attacks an extremely attractive weapon for terrorists. Indeed, some of their funds are being converted into research on these weapons, as finds in Afghanistan showed. Unfortunately, such research can bear fruit quite quickly. The science behind the weapons does not have to be complex, nor are the ingredients hard to get hold of. The vast proportion of chemical weapons can be made with the average chemistry set, and a number of the biological ones can be made with a home fermentation kit. The difficulty with CBRN weapons is not making them, but delivering them effectively.
The target set has also changed. Previously, terrorist targets were government or military institutions, or areas of high civilian density. Successful attacks would allow the terrorists better cards at the negotiating table. But terrorist groups such as Al Qaeda have no desire to negotiate, and their target set is not so nicely defined. Their interest lies in disrupting a country's infrastructure, or in attacking corporations that represent a way of life. So while British Nuclear Fuels may be a 'legitimate' target, so might Disney or Microsoft. Petrochemical, pharmaceutical and agrochemical companies will also be high on terrorists' lists. Mobil and McDonald's are as good a target as Whitehall and the White House, and the former are a lot easier to attack.
The very nature of the dispersal of CBRN weapons makes them attractive to terrorists – once released they are often indiscriminate. There is usually a degree of specialisation in certain urban areas, such as Wall Street or the City of London, and the ability to affect them all is attractive. For example, while your chief target may be Corporation A, all other businesses downwind are affected. Militarily, this was seen as the advantage of chemical weapons; they were able to make an area uninhabitable (or only inhabitable under strict conditions). This ability has returned to haunt western civilisation. It is not just ground levels that are affected. Urban meteorology is extremely complex, and some storeys will be contaminated while others in the same building will not be.
The effect on a business and its workers will depend on what agent is used, but all of them will disrupt normal business. Radiological weapons, typically radioactive material dispersed by an explosion, have a far greater impact on buildings than on people. Casualties are likely to be low and may not appear for many years. Yet radioactive material has the longest active life once released, counted in years as opposed to months.
Chemical weapons are likely to cause the greatest number of immediate casualties – Tokyo suffered a small release and had 6,000 casualties – and some agents, such as VX, are potent for an extremely long time. Biological agents on the other hand are likely to be the most virulent. Many biological agents mimic the effects of more benign agents (such as flu) and, unless explosively released, could remain undetected and spreading for days. Bacteria must be identified and the correct antidote administered within a few days, otherwise chances of survival are often slim. While some biological agents are chosen for their virulence and morbidity rate, others are chosen for their ability to incapacitate quickly, but then to allow an almost complete recovery. This may mean that your staff would recover in two to three weeks, leaving you trying to find a replacement for 600 members of staff, who all contracted Q Fever over the weekend, as fast as possible – not conducive to good business continuity.
Train and educate
This all paints a very bleak picture – it is easy to exaggerate these weapons into doomsday devices. Yet, if the right procedures are developed, and staff educated and trained, it need be nothing more than an uncomfortable half hour. Training and education are at the heart of this; many of the problems caused by these weapons stems from cross contamination, and unthinking panic is the greatest friend to cross contamination. Staff need to realise that procedures are there to protect them, and that any diversion from them is likely to cause them harm. This is not the case in other emergency drills: fire, for example, has a lot more flexibility. Those most at risk – security and mail personnel – will need briefings to educate them about likely agents, so they understand the limitations of these weapons and what can be done for them if they are infected. Security needs to understand the various methods by which the agents can be dispersed and ensure, like firearms or explosives, that they are not allowed on the site.
Dealing with CBRN weapons is all about understanding procedures and sticking to them. The most basic procedure is the 'dirty line': a line behind which everything is deemed to be dirty and in front of which everything is judged to be clean. Anything that crosses the line, even for a brief period, must be judged dirty, and decontaminated before it crosses back; there can be no exceptions. This line must be placed upwind of the infected site and may have to be moved several times if the wind speed drops, so numerous sites may have to be planned in advance. The 'dirty line' is a simple concept, but is crucial – some of the casualties from the Tokyo sarin attack were caused by having poor dirty line procedures. Financially it costs nothing to set up; it is a matter of planning and training. But if it goes wrong the cost in lives could be great, so it needs to be planned before the event.
Protect and detect
There is also a range of technology available for those companies that believe they are likely to be high up the threat assessment. These range from protective equipment, suits and masks, to detection devices that provide the early warning that will save lives – a lot of CBRN agents are invisible and odourless. Currently, such devices are only being considered by some multinationals, but there is no reason why all corporations should not consider them. Richard Le Fleming of Siemens Environmental Systems, world leaders in radiological dosimeters, suggested that while some work was being done it was not enough. "It is perhaps not as widespread as one might suppose. There is more paranoia in the US than in Europe and the UK; it is a non-issue in France, but in New York they are gearing up for it".
This is a good example of the level of understanding of non-conventional weapons in the world. The US is planning to spend billions through its Department of Homeland Security, and this level of preparation is filtering into business too. France has a history of dealing with conventional terrorist attacks, but as the ricin seizures in London show, some terrorist groups are thinking down new avenues. Mr Le Fleming admitted that, "The majority of the interest is still coming from the military. Homeland Security is gathering speed, but not so much as one might have thought".
Dosimeters are the ideal device for companies who are serious about the terrorist threat, in this case a radiological one. They are small (the size of a pager) and relatively cheap. Mounted on the outside of buildings they could give the critical alert to shut off the air conditioning while there is still time: unlike chemical weapons you may not know you have been attacked by a radiological weapon until it is too late. Yet few companies other than a handful of accountancy and petrochemical companies are taking this threat seriously. The UK's resilience committees have made no enquiries.
Other devices, such as ACADA (from Smiths Industries) or RAPID (from Bruker-Daltonik) can detect chemical agents in the air and 4Warn (from General Dynamics Canada) and BioSeeq (from Smiths) can track biological agents. Currently there can be problems with buying these devices. In the UK, for example, the Government will not let companies sell them to corporate individuals (though this has been bent in some circumstances). According to Tim Otter, Chairman of NBC UK (the NBC industry body), this may well have changed by time of going to print, though restrictions may still affect foreign companies, so choice may be limited.
It need not be high-tech though. Airborne agents are spread by the wind, so if staff can get upwind of them their chances of being affected are slight. The Met Office cannot provide accurate micro-met information in an urban environment, so having meteorological stations that can measure wind speed and direction may make a great difference to staff. While evacuation is not always recommended, it is worthwhile having a planned route if it becomes necessary, and individual companies will have to plan where the likely wind flow is and where people can muster in safety.
Equipment, like procedures, need to be practised with and understood before it can be relied upon – and companies have to be prepared to deal with false alarms (industrial cleaning agents, such as ammonia, will trigger a chemical alarm for example) and retain faith in the technology.
Collective protection, or COLPRO, may well have to be thought about. These are sometimes called panic rooms, and are places which allow staff to gather and wait for help in complete safety. These must be fitted out by experts however; experience of people trying to do this themselves has resulted in injury even before chemical agents are used. COLPRO usually consist of an airlock, a handheld detection device and a filtered air conditioner that only allows clean air into the room.
The threat from terrorists with CBRN weapons is real. A growing body of evidence shows that various groups around the world have these weapons and are refining them for use. Once released, they are indiscriminate, so all companies, regardless of size, should spend time considering their emergency procedures. By doing the wrong thing at the wrong time, it is very easy for individuals with the best of motives to escalate a CBRN attack from a minor problem to a major catastrophe, and only the correct procedures will safeguard staff and allow business to resume quickly. Many of the lessons are common sense, but need to be thought about. So, the sooner the thought process starts, the more likely it is that these situations are contained with the minimum loss of life.
Businesses should get in touch with their homeland defence departments (there are excellent ones in Sweden, Switzerland, Norway and Australia for example), or their local 'resilience team' in the UK (although these are very patchy) as a first port of call. For companies who feel that they are higher up in the threat spectrum there are consultancies that specialise in helping business prepare, and these should be contacted. The power of CBRN weapons lies in their ability to cause terror and spread panic. The best defence against this is knowledge.
Gwyn Winfield is a journalist specialising in defence mailroom security
Pitney Bowes Management Services (PBMS) claims that the mailroom is the primary communications gateway for a company and could be a leading target for terrorist attacks.
In April, PBMS held a forum to discuss the implications of recent terrorist threats for the corporate mailroom. This gave an overview of the increased risk to companies as well as an insight into the practical steps, which they could take to minimise the threat in the context of handling and distributing mail. The event also discussed the importance of recognising how peoples' changed behaviour in a crisis should be considered in organisations' crisis planning and management.
Speakers at the event included:
- Asset Risks
- Business Continuity
- Claims Management
- Communicating Risk
- Physical Secuirty
- Political Instability
- Political Risk
- Risk Assessment
- Risk Identification
- Risk Modelling
- Risk Type
- Strategic Risks
- Supply Chain Risks
- Training & Education