What is Terrorism?

While these are a good starting point, for our purposes we will also consider terrorism to be any unlawful or criminal act directed against persons or property in order to further a political or religious ideology. Thus, terrorism can encompass events from 9/11 to the British hacker Gary McKinnon, recently (November, 2002) charged with hacking into nearly one hundred governmental and private sector computers.

Terrorism in the Recent Past—
A Key to the Future

The focus of terrorism has shifted in the past decades, as has our way of viewing it. Application of the term terrorist act to many events has been of recent vintage in the United States. For example, acts committed in the early 1970s, such as burning the ROTC building at Kent State and ransacking downtown Kent, were viewed as acts by anti-war protesters and not labeled terrorism per se. After the Vietnam War ended, however, left-wing extremist groups continued action through the 1980s. Some attacks were carried out by Puerto Rican separatist groups; others by organizations such as the United Freedom Front, responsible for the 1983 bombing of the U.S. Capital Building.

The 1990s saw the demise of the left-wing groups, but the right wing groups began to emerge as a new terror threat. Some were characterized as white supremacist; others as anti-government. The 1995 bombing of the Murrah Federal Building was viewed by some as an anti-government protest in retaliation for the 1993 incident at Waco. There are other indications that the perpetrator, Timothy McVeigh, was influenced by the Christian Identity Movement, a group holding extreme anti-Semitic, anti-government, and racist views.

In the late 1990s two distinct types of terrorism emerged. The first is terrorism that has religion as its base. Before the Muslim terrorist groups gained notoriety there were bombings carried out by the Provisional Irish Republican Army (Catholic) against British interests both in Northern Ireland and England. Retaliation by the Ulster Defense League (Protestant) became common. There have been several IRA attacks: bombs in London (1992, 1993, 1996, and 2000) and one in Manchester in 1996. There have also been rocket launcher attacks on the MI6 Headquarters and on Heathrow Airport. These bombings have property damage as their focus, and unlike other terrorist attacks, a telephoned warning often precedes the bomb's detonation. (In the Manchester bombing, warning was given at 9:41 A.M.; the bomb exploded at 11:20 A.M. However, in the other attacks noted above, many persons died.)

The second type of terrorist activity is that carried out by extremist environmental or animal rights groups, notably the Earth Liberation Front (ELF) and the Animal Liberation Movement (ALF). Both of these groups are international in scope and violent in nature. These groups often act together. In June, 1998, two U.S. Department of Agriculture buildings in Olympia, Washington, were set afire, resulting in lost research and destruction of the buildings. Both groups claimed responsibility. Both groups are suspected in connection with the fire bombing of a GAP store in Seattle in November, 1999.

During 1999, ALF was responsible for several destructive acts, among them a Eugene, Oregon meat packing plant ($500,000 damage) and a building housing a research lab at the University of Minnesota, St. Paul ($2 million damage). A visit to the group's Web site shows hooded individuals as well as instructions on making incendiary devices (http://www.animalliberation.net). ELF's destruction ranges from the October, 1998 fire at Vail, Colorado ($12 million) to several incidents of burning down homes under construction (Long Island, New York, December 2000). ELF also claims credit for vandalizing two new buildings, one of them a bank, in Louisville, Kentucky because of urban sprawl, and proclaims “This was the first, be it minor, direct action….more actions are planned in the future” (http://www.earthliberationfront.com). ELF specifically targets the biotech industry, and any business connected with it by extension.

All this is by way of demonstrating that a business may consider itself safe from any terrorism, only to find that it is a target either directly or indirectly, since an attack against one business can affect other businesses. It is not only the multi-national corporation that poses a threat in the eyes of many terrorist organizations.

Identifying the Risk

The first thing to determine is whether the business presents any type of target. It should be clear from the examples given above that nearly every kind of endeavor can be on someone's “hit list.” The risk manager should get a clear picture of the business, including type of business, building(s), products manufactured, supply sources, customer base, shipping arrangements, and personnel. Then decide what form a terrorist activity is likely to take. For example, any lab involved in animal experimentation is likely to be a vandalism target. In the case of a biotech research organization or planned suburban sprawl, fire bombing resulting in destruction of the property is more likely. Does the organization do business with a politically sensitive country? Guilt by association with a resultant attack might occur.

The risk manager should also consider a threat because of the organization's personnel. In the case of the organization's executives, consider any outside boards of directors they may sit on. Will the organization be viewed as a target by association? Or, could the organization be a target because key personnel are outspoken on any one of a number of current issues or events?

Protecting Personnel

The risk manager should have a clear picture of any specific exposures facing executives, or, indeed, other employees as well. Kidnapping has become not only a means for personal gain, but is also used to finance terrorist activities or to make a political statement. Statistics involving kidnap and ransom are not exact, since many corporations and governments do not often release details. In the Western Hemisphere, countries of greatest risk are currently Columbia and Venezuela. In the Eastern Hemisphere, they are the former USSR countries (with the breakdown of the former USSR, the Russian Mafia has become particularly active), Nigeria, Ivory Coast, Zimbabwe, Indonesia, Iraq, Qatar, Yemen, Lebanon, Afghanistan, Pakistan, Kuwait, and the Philippines. Countries dangerous for other reasons are India and Israel.

Any American traveling abroad should exercise caution, but particularly those working for a high-profile company. (Or a target company. Even Starbucks has come under fire recently [August 2002] for not buying enough “free trade coffee” in Mexico.)

Someone in the organization should be responsible for knowing at all times where key personnel are, and regularly monitor travel plans including countries visited. It is, for example, much easier to enter, say, Israel from Lebanon than Lebanon from Israel. If a businessman is traveling, the organization should know what flights are being taken and where the person is. If people make their own flight reservations over the Internet, someone in the organization should still be informed. (One of the things to come out of the WTC disaster was that no one knew who was in the office and who was on the road. Real-time back-up of information as to who is in the office would be ideal, though probably impractical.) Personnel who travel abroad should observe common sense precautions, among them:

·Dress casually. Do not wear expensive watches or other jewelry.

·Use direct flights on regularly scheduled airlines if at all possible.

·Do not linger in the terminal. Ticketing areas are not secure.

·Book flights and hotel reservations in the name of the individual, not the corporation. Avoid corporate luggage tags or other corporate insignia.

·When possible, be met at a foreign airport by colleagues. Avoid taxis other than those arranged by the hotel. (This depends upon the particular country.)

·Avoid predictable patterns. For example, do not always use the same rental car agency.

·Remember that passports must often be surrendered when checking into a hotel. Take note that a traveler checking into a hotel in, say, Lebanon following a stop in Israel may be viewed suspiciously.

·An executive whose corporation has purchased kidnap and ransom insurance should not advertise that fact. (See Royal & SunAlliance's web site, http://www.rsa-profin.co.uk/KR/kr_prevention.htm for valuable information.)

Kidnap and ransom insurance is available. (Kemper, Chubb, and Royal & SunAlliance are among the carriers offering coverage.) There is a new “growth industry” of security firms offering twenty-four hour hot lines for traveling executives. These firms are set up differently; some are staffed by ex-military; others have regular switchboard operators who direct calls to the appropriate specialist. Many of the firms regularly send e-mails alerting clients to potential danger spots, and maintain data banks containing escape routes. Consider utilizing their services.

The safety of employees other than those traveling should also be taken into account. Some organizations are considering background checks. This is a corporate decision based on what the business is willing to tolerate. For example, a business hiring laborers might overlook a driving record, but a school bus operator cannot.

Many corporations now utilize photo IDs which an employee must always wear in plain sight. For smaller organizations, this is probably neither feasible nor necessary; however, some means of controlling access to a premises should be considered, whether it is a magnetic key card or an alert receptionist. In any event, unescorted visitors should not be allowed to wander at will throughout the building. Visitors can be given an identification tag, so that employees will be aware if a visitor is not where he or she should be. Employees should be encouraged to report any visitor's suspicious behavior or any objects left where they should not be. A visitor shoving a package high up out of sight on a shelf is not doing so for a beneficial purpose.

Consider whether key executives can normally be found at the same places on a regular basis. For example, does the CEO drive a certain make of car and always drive onto the premises at the same time? Vary this routine. (This is particularly true if the executive lives in one of the countries mentioned above.)

Draft an emergency evacuation plan for employees, and follow up with a drill. Make sure the plan includes assistance for those employees who need help. The risk manager in consultation with management should designate persons who have sufficient knowledge and training to implement necessary procedures in event of an attack. These persons will take responsibility for safety procedures, such as closing fire doors, moving people away from the hazard (including deciding whether in event of a bomb detonation outside the building it is better to remain in a secure area inside, or risk injury from falling glass and masonry outside), and switching off the ventilation system.

Protecting the Building

It is impossible to completely secure a building. The risk manager may have considered all possible scenarios with regard to his or her own building, while a bomb attack at the international conglomerate across the street may just as surely spell disaster. For this reason, emergency plans should include a scenario involving a nearby business.

If a new building is being built, consider first the site. Is it a street-front? Remember the Murrah Federal Building, and consider that a set-back from the street may be preferable. Of course, this is not always practical, in which case the building's security should be achieved by means of other methods, such as enforced no parking in front.

Will the new building be a high-rise? Current building design considers extreme wind stress as well as the possibility of a plane's crashing into the building. The World Trade Center towers utilized “tube” construction, that is, there were closely spaced columns and beams in the outer walls to withstand wind, with an inner core of habitable space. Many believe that what brought the towers down ultimately were the extremely hot fires, although a report in the Associated Press (Oct. 27, 2002) indicated that weak floor supports and bolts that failed to secure the floor trusses were to blame. The blueprints and specifications for a new building must therefore be reviewed carefully, with serious questions raised.

Fire is always a concern, even if not the result of a terrorist attack, and plans should be made for occupants' safety. Some buildings now include specially designed interior rooms every so many floors built to withstand fire. But even something so simple as having exit signs on the floor rather than over doors where they may be obscured by heavy smoke can easily be incorporated.

The risk manager should review parking. If the building stands alone with parking around it, security cameras can be mounted to monitor the area. If there is parking under the building, consider access. If the parking is restricted to employees, then it should be accessible only to employees. This seems logical, but remember many businesses' security is limited to a sign stating “Employee Parking Only.” Take into account that the parking may not be restricted or there may be no control over the parking area, as in the case of a multi-tenant building or public parking, and plan accordingly. Remember that the first WTC bombing in 1993 occurred when an explosive-laden van detonated in the underground garage. It may be possible to get agreement that vehicles other than private passenger ones should be denied access.

Space planning is a consideration. The inside of buildings, away from exterior glass, is generally safest. Sensitive computer systems, executive offices, or places where large numbers of persons congregate should be located towards the interior rather than the exterior of the building. When possible, bomb-resistant glass should be incorporated. For those organizations targeted by firebombers, high impact glass should be considered. Fire bombers typically throw incendiary devices through windows; if unable to penetrate the building, they may turn their attention elsewhere. (Although it should be noted that research on the Internet into organizations, particularly the eco-terrorists, stresses their persistency. Hence the need for employee vigilance.)

Consider access to the building:

·Is there a loading dock? How secure is it?

·Is parking secure?

·How many entrances into the building are there? What kind of locks are on doors? Are doors left unlocked during business hours?

·Is there a reception area? How easy is it for someone to walk into the business?

·Does someone verify authorization for outside workers who may need to enter the premises?

·Can someone gain access through a skylight or ventilation system?

·Should electronic monitoring or closed-circuit TV be considered?

The above precautions are targeted at persons or vehicles either gaining access or proximity. But terrorists can carry out biological or chemical attacks without actually entering the building. Ventilation intake systems should be evaluated for accessibility. In event of an emergency, can they be closed? Can areas of the building be sealed off?

How is mail received? Has the mail room staff been instructed in proper handling procedures? If a suspect package or letter is received, be able to trace the item back through the system so anyone handling the item can be identified. Here are some general mail handling tips:

·Be suspicious of any package unusually heavy given the size.

·Be alert to hand-written, misspelled, or poorly typed addresses, or packages or letters with no return address.

·Open packages with minimum movement, using a letter opener or box cutter.

·Keep hands away from nose and mouth while handling mail; wash hands when finished.

·Do not blow into envelopes to open them, shake, or pour out contents.

For some valuable information on business response to terrorist threat, see publications from the United Kingdom Home Office. Great Britain, as noted earlier, has experienced attacks from the IRA as well as extremist animal rights groups and the experience has taught valuable lessons. See, for example, Business as Usual, at http://www.mipt.org/pdf/ukhomeoffice_businessasusual.pdf, and Bombs—Protecting People and Property, at http://www.ukresilience.info/contingencies/business/bombs.pdf.

Protecting Computer Systems

Cyber-terrorism is on the increase. Some cyber-terrorism involves hacking into Web sites and vandalizing or defacing them. But on Monday, October 21, 2002, nine of the thirteen key Internet computers, or root servers (the ones that manage worldwide traffic), were shut down following a cyber-attack. This was accomplished by subjecting the computers to such a large volume of data that they were unable to respond. Past attacks of this sort have targeted individual Web sites such as E-Bay, resulting in denial of service messages to legitimate customers. The October 21 attack was different in that the entire Internet was targeted. It appears that this was a coordinated effort, and not just an attempt by a few casual hackers. No one has claimed responsibility; however, it should be remembered that international terrorism strives to disrupt the American economy.

The risk manager, therefore, in collaboration with the information technology department, should assess the organization's dependency upon its computer system and recognize that the best security systems are effective only until the next attack.

Cyber-crime is on the increase as well. Because the security measures for cyber-terrorism and crime are the same, and to give an idea as to the scope of the problem, we quote from the “2002 Computer Crime and Security Survey” of security practitioners in American business, government, and educational establishments as published by the Computer Security Institute (http://www.gocsi.com/):

·Ninety percent of respondents (primarily large corporations and government agencies) detected computer security breaches within the last twelve months.

·Eighty percent acknowledged financial losses due to computer breaches.

·As in previous years, the most serious financial losses occurred through theft of proprietary information (26 respondents reported $170,827,000) and financial fraud (25 respondents reported $115,753,000).

·For the fifth year in a row, more respondents (74 percent) cited their Internet connection as a frequent point of attack than cited their internal systems as a frequent point of attack (33 percent).

Among the other types of attacks indicated by respondents were theft of transaction information, vandalism, and computer viruses.

A problem facing computer security is the rise of wireless networks. Which leads to “war drives.” This is the name for office-scanning drive-bys in which computer types use laptops, scanners, and antennas to try to intercept signals from the wireless networks used by corporations to link their computers to each other and the Internet. Of course, once the hackers have spotted the “free” network they can use it for their own Web surfing, e-mail, or possibly even to hack into the corporate network to access confidential business information.

The information technology department is the first defense, and can likely provide information as to where the organization is vulnerable. The department's help should be an integral part of the overall terrorism management program. The IT department should also be responsible for regular back-up of the organization's data, and keep copies securely off site.

A Final Note

We have not examined the business income exposure in this discussion. There are indications that, following the WTC bombing of 1993, business interruption loss accounted for a third of the total loss. Although an organization can make an educated guess about the amount necessary for a loss at its own location, it is impossible to make any conclusions about loss of access. The 1992 Bishopsgate bomb in London left some 200 tons of glass in the street, so imagine the period of time necessary just to clean up the debris, let alone inspect buildings for structural damage. And, although a business may not have sustained a property damage loss, the loss of income because of lack of foot traffic may be substantial. For a small business, this could prove devastating, and should be considered.

In addition to the sources given throughout this discussion, see Business at Risk, by Kevin Quinley, CPCU, ARM, and Donald L. Schmidt, ARM (The National Underwriter Company, Cincinnati, OH 2002), for much useful information. The Commercial Property Coverage Guide, by Bruce Hillman, J.D., and Michael McCracken, CPCU (The National Underwriter Company, 2001) and its supplement is helpful in assessing the insured exposure. Also, see Anthrax Testing and Insurance Coverage .