SIAM
Security Impact Assessment
Measures
Past Events & Threat Scenarios
Deliverable D 6.1
Past Events & Threat Scenarios
Project number
261826
Call (part) identifier
FP7-Security-2010-1
Funding scheme
Collaborative Project
Interdisciplinary
Center for Technology
Analysis & Forecasting
At Tel Aviv University
13.04.2012
1
Table of Contents
Executive Summary....................................................................................................................3
General Introduction..................................................................................................................6
Past events & Threat Scenarios ...................................................................................................8
Methodology ............................................................................................................................8
Background............................................................................................................................. 10
Worldwide Past Security Events ................................................................................................ 15
Country Reports - Past Security Events ....................................................................................... 20
Germany................................................................................................................................. 20
Israel ...................................................................................................................................... 43
Italy........................................................................................................................................ 64
UK.......................................................................................................................................... 73
Threat Scenarios ...................................................................................................................... 90
Findings & Conclusions ........................................................................................................... 113
References ............................................................................................................................ 116
2
Executive Summary
In this report we present a summary of the efforts done in task 1 of WP6. In this task we
described past threat events which occurred in mass transportation systems as air traffic
systems and train platforms, covering the five threat categories our research deals with –
terror (T), illegal immigration (II), cyber (C), white collar (WC) and organized crime (OC).
We have covered some worldwide events, but focused on events collected by the partners,
each in its country, and specifically related to each of the four case studies we base our
research on – BGIA (Ben-Gurion International Airport), BER (the soon to be opened new
Berlin's Airport), London's Underground and Turino's Train System.
The following table maps the partners country's collected events divided by each of the
threat categories:
Table No. 1: Collected Past Events Categorization
3
The following table lists the threat scenarios as offered by SIAM partners:
Table No. 2: Threat Scenarios List
Terror (T), Illegal Immigration (II), Cyber (C), White Collar (WC) and Organized Crime (OC).
No.
Threat Category
Scenario
1
T
Toxic Gas Attack on a subway train
2
T
Sniper attack
3
T
Suitcase bombs, self made explosives
4
T
Gun rampage
5
T
Dirty bomb
6
T
7
T
Missile attack on a starting/landing passenger aircraft
(train..?)
The junky's mummy 1 – coffin contains corpse filled with
explosives (similar to #17)
8
T
The deadly porter – hotel porter plants explosives/explosive
device in an innocent resident
9
T
The leaky passenger – terrorist with explosives in his guts
10
T
Terror on a railway – remote control / pressure activated
explosive device
11
T
Contamination injected into fuel supply chain
12
T
Armed cell trained commandos (native born) seizes control
on a main station
13
T
Detonation a massive Ammonium nitrate fertilizer bomb on
a train in central London during 2012 Olympics
14
C/T
Hacking an underground computer by a loose network of
highly skilled individuals.
15
C/T
Total shutdown of airport radio communication by terrorists
armed with high-power radio transmitters
16
C /WC
Same like #15, but caused by pirate radio nearby
17
OC
18
Other (D.O)
The junky's mummy 2 – coffin contains corpse filled with
drugs
(similar to #7)
The human flotilla – combine efforts of many people to
reach certain location in order to demonstrate
4
The following table maps the offered scenarios based on the above collected country events,
similarly divided by each of the threats categories:
Table No. 3: Country's Threat Scenarios Map based on the collected events
The data was analyzed and a list of various scenarios was obtained for further investigation.
As can be seen, most of the events as well as most of the presented scenarios are related to
the Terrorism category. While Cyber can be referred to as terror attack or as a crime, the
three other crime categories are rarely covered and were found less relevant in relation to
the mass transportation security.
During the work done, certain issues were raised, regarding the five challenges that SIAM is
focusing on. The first issue was about the question whether or not Illegal Immigration should
be one of the challenges. An additional challenge that arose was whether the project should
also focus on civil disorders in transportation systems. At this stage, the five base challenges
were left as is, without change.
5
General Introduction
The objective of work package 6 is to provide scenarios that give insights about possible targets for
selected crimes. One of the key objectives in WP6 is to come to a deeper understanding of the
security challenges that were selected in SIAM, and the impact these challenges might have on
concrete targets or contexts. Work in WP6 until now has shown that such expertise is available in
literature: global or regional threat assessments already exist. They provide valuable information
about emerging and developing security threats on a global or regional level. But these expert reports
do not provide information about likelihood or probable outcomes of security threats (occurrence,
location, societal and economic cost) and it is beyond the scope of SIAM to calculate the relevant
probabilities.
The main objective of WP6 is to create a knowledge base of threat scenarios and security incidents
representing security challenges to mass transportation systems. The focus is on airports and
subways systems, which are in the core of the SIAM projects.
The preparation of this knowledge base will be based on six steps:
a. Collection of information on specific relevant security events, based on media discourses,
interviews, etc.
b. A literature review survey of current scientific research and threat analysis.
c. Expert workshops to discuss the security events, scenarios, SMT's role.
d. Expert workshops to discuss scenario's building techniques and risk analysis.
e. Processing and integrating the security events collected into a series of structured generic
threat scenarios report.
f. Integration of the scenarios into SIAM's database.
Security events or incidents refer to past incidents which occurred in public transportation systems
(airports, undergrounds, trains, etc.) that included acts of terror, illegal immigration, or crime (cyber,
white collar, organized):
a. The events we were looking for could be those which happened IN transportation systems (e.g.
carrying drugs through airports or using trains for illegal immigration) or those which where
aimed AT the transportation systems themselves.(e.g. suicide bombing, hijacking planes)
b. The above categories appeared in the proposal but we were not limited to them.
The impact of the past events was expected to cover the following issues:
 Economy – High cost damages, potential damages to economic growth, markets, fiscal
policies, taxation, industries, banks, insurance companies;
 Environment – potential damages to biodiversity, materials, resources, climate, pollution,
wastes;
 Infrastructures – potential damage to energy supply, transportation systems, communications
systems, etc.;
 People – potential damage to individuals, groups, mass populations;
 Political systems – Impact on the political system, potential damage to political structures,
activities, leadership, power relations, stakeholders, policies;
 Values - Threat events might lead to changes of values, such as changing attitudes towards
ethnic minorities, impact on privacy changing of the sense of safety.
WP6 has begun in M1 of SIAM (2/11).
6
Following our first plan for WP6 and the discussion that took place during the kickoff meeting in
Berlin, ICTAF issued guidelines to the partners for carrying out the abovementioned relevant tasks.
This was later revised after the first consortium meeting in New Castle.
7
Past events & Threat Scenarios
This report is a summary of the efforts done in task 1, collecting and describing past events and
offering a list of suitable scenarios.
These scenarios are expected to cover the five security challenges addressed by the SIAM project:
acts of terror, illegal immigration, or crime (cyber, white collar, organized).
In this context we use the following definitions:
a. A security event - A specific event that happened in the past in which a breach of security
happened in its broad sense including criminal acts, terrorism, illegal activities and others.
b. Security threat scenario - A generic anticipated event, which will breach security in its broad
sense. A scenario includes descriptions of all stages needed to realize the potential event and
the anticipated impacts of it.
Methodology
The following methodologies have been used to collect and list the events and related scenarios:
a. Past security events literature review of 15-20 worldwide incidents that have occurred in the
last 20 years. The review was based on sources such as published articles, books, websites and
the like. The review focused on worldwide security events that didn’t occur in Europe
(European events have been collected in the case studies (Main task for VUB). To limit the
scope the review focused on events related to airports, airplanes and public transport.
b. Past events country reviews. Each partner in the case study countries (Israel, GB, Italy, and
Germany) prepared a report on past events that have occurred in the last 20 years in his
country. The report is based on internal sources including governmental, public and private
sources that may provide a complete picture on relevant past events. This was achieved by
surveying published reports and media sources such as newspapers, TV, radio etc. (Main task
for ICTAF, SiTi, UNEW and UNIKASSEL).
c. Interviews. Partners have conducted face-to-face interviews with relevant experts who
described additional threat events or provide more insight to events that were already
collected. The Interviewees included security experts, research institutes (focusing on security
transportation), police sources, journalists and so on.
d. Two sets of country workshops for discussing the collected events, developing scenarios and
their risk analysis technique.
e. Each partner has developed threat scenarios based on the worldwide and the country security
events collected. By scenario we mean in this stage, an anticipated incident that may happen
in the future, and which is based on past events and current technologies.
f. Both the past events and their related threat scenarios were listed according to the following
template:
8
Event Summary
1
2
3
4
5
6
Name
Category of security event*
Type of event*
Date
Where - Field / Area
Who
7
Event Description
Give a nick name
Terrorism, illegal immigration…*
Smuggling, suicide, hijacking,
When did it happen
Ben Gurion air port / terminal area
short description of the perpetrators
Detailed as possible - e.g. How the perpetrators were organized
and prepared for the event, means used,
8
Effects and impacts
Direct and long terms on people, infrastructure, environment,
economic, values , political systems and others
9
10
SMT / CIT involved
Other issues involved
11
*
Existing systems and method applied during the event
Gender, legal…
operational lessons learnt, technological needs identified,
Security Challenges
methods needed….
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
The first stage of the work done was to map past security events, in order to develop suitable set of
scenarios based of. Each of the partners who had case study to base on, e.g. BGIA for ICTAF, focused
their collected events on their country experience, and concentrated mainly on such related to their
case study. Another partner has collected general past security events worldwide. The later
developed scenarios will serve the SIAM data base.
9
Backgroundi
The objective of this deliverable is to build a list of security threat scenarios for the five security
challenges SIAM is dealing with. As described in the methodology chapter above, the work was
focused on collecting a list of events and related scenarios rather than discussing the definitions of
each challenge. Even though as a background only, some common definitions will be mentioned in
order to demonstrate the differences between the different challenges.
Terrorismii
Most common definitions of terrorism refer to those violent acts which are intended to create fear
(terror), are perpetrated for a religious, political or ideological goal, deliberately target or disregard
the safety of non-combatants (civilians), and are committed by non-government agencies. A
definition proposed by Carsten Bockstette at the George C. Marshall Center for European Security
Studies iii underlines the psychological and tactical aspects of terrorism: “Terrorism is defined as
political violence in an asymmetrical conflict that is designed to induce terror and psychic fear
(sometimes indiscriminate) through the violent victimization and destruction of noncombatant
targets (sometimes iconic symbols). Such acts are meant to send a message from an illicit clandestine
organization. The purpose of terrorism is to exploit the media in order to achieve maximum
attainable publicity as an amplifying force multiplier in order to influence the targeted audience(s) in
order to reach short and midterm political goals and/or desired long-term end states”iv.
Terrorism actions can be classified into six categories:

Political terrorism – violent criminal behavior designed primarily to generate fear in the
community, or substantial segment of it, for political purposes.

Non-Political terrorism – terrorism that is not aimed at political purposes but which exhibits
“conscious design to create and maintain a high degree of fear for coercive purposes, but the
end is individual or collective gain rather than the achievement of a political objective.”v

Quasi-terrorism – the activities incidental to the commission of crimes of violence that are
similar in form and method to ‘genuine‘ terrorism but which nevertheless lack its essential
ingredient. It is not the main purpose of the quasi-terrorists to induce terror in the immediate
victim as in the case of genuine terrorism, but the quasi-terrorist uses the modalities and
techniques of the genuine terrorist and produces similar consequences and reaction. For
example, the fleeing felon who takes hostages is a quasi-terrorist, whose methods are similar
to those of the genuine terrorist but whose purposes are quite different.

Limited political terrorism – acts committed for ideological or political motives but which are
not part of a concerted campaign to capture control of the state.

Official or state terrorism – acts committed by Nations whose rule is based upon fear and
oppression that reach similar to terrorism or such proportions. It may also be referred to as
Structural Terrorism defined broadly as terrorist acts carried out by governments in pursuit of
political objectives, often as part of their foreign policy.
Terrorist attacks are usually carried out to maximize the severity and duration of the psychological
impact. Terrorists typically attack national symbols, to attempt to shake the foundation of the
country or society they are opposed to. This clearly negatively affects governments, increasing
community’s fear and the reputation of the given terrorist organization and/or ideology behind a
terrorist act.
Cyber crime
Cybercrime (computer crime) has been defined as 'criminal acts committed using electronic
communications networks and information systems or against such networks and systems' (European
10
Commission 2007 vi). With the increased use of and reliance on the internet and information and
communications technology, cybercrime is a growing international problem which affects all sectors
of society - critical infrastructures, business and the general public. Organized crime groups are
increasingly sophisticated in the way they use technology and exploit communications systems.
Cybercrime can cross borders in fractions of a second and touch several people in different countries
at the same time. It can involve a broad range of activities which are generally divided into three
categories: traditional forms of crime, illegal content and crimes unique to electronic networks
(European Commission 2007).
a) Traditional forms of Crime using Computers as a Tool
Identity theftvii, phishingviii, spamsix, and malicious codesx, may be used to commit fraud or forgery.
Other traditional crimes conducted using computers as a tool include the storage of illegal images,
or illegal downloads, or internet-based trade in illegal goods.
b) Publication of illegal content over electronic communications networks
There has been a growth on international markets in the number of illegal content electronic sites
with, inter alia, child pornography, displays of violence, incitement to racial hatred and incitement
to terrorism. Action against such sites is difficult because site owners and administrators are often
located in different countries from the target one, and moreover sites can be hidden or moved to
another domain very quickly.
c) Crimes unique to electronic networks
Cybercrime also includes electronic attacks against information systems or organisations and
individuals. 'Denial of Service attacks' prevent computer resources being available to intended
users by flooding web servers with more data than they can process, forcing the websites to go
offline. Other such crimes can be committed by gaining unauthorised access to a computer system
(hacking), or writing a virus (a type of malicious software to delete stored data). The aims of these
attacks may be toxi:
access information stored on a computer; information may have a monetary value (corporate
espionage), may be valuable to the owner (ransom opportunity) or may be useful for further
illegal activity such as fraud;
impede or alter the functioning of the computer itself;
Control a computer and utilize it to send spam, host illegal content, or conduct further
attacks.
Transnational organized crime
The term “organized crime” entails a wide range of crime categories, such as Drugs Trafficking,
Money Laundering, Intellectual Property Crime, and Human Smuggling/Trafficking. In the following
paragraphs these categories are discussed and analyzed.
11
Drugs Trafficking
The trafficking and supply of drugs is one of the most prominent and lucrative of organized crime
activities. The Europol Organized Crime Threat Assessment (2009) xii reports that drug trafficking into
and across Europe is made possible by various trans-national organized criminal groups. As example,
the Netherlands is Europe's main distribution centre for both cocaine, originating from South
America, via Spain and West Africa, and heroin, the Netherlands is also the world's largest producer
of ecstasy, although production in Eastern Europe is growing. Morocco is originating from
Afghanistan, mainly via Turkey. Together with Belgium, the main supplier of cannabis resin, while
there is also an increasing European trend in local indoor cannabis cultivation.
Intellectual Property Crime
Intellectual Property (IP) refers to the legal rights owned by individuals and organizations in
inventions, designs, goods and other creations, produced by intellectual activity in the industrial,
scientific and artistic fields. Intellectual property rights protect the creators and makers of such
products through patents on inventions, trademarks, industrial designs, as well as copyright on
artistic works like books, films, music and paintings. Just like physical property, intellectual property
can be stolen. IP crime is committed when products are copied and marketed for profit, as if made by
the owner but without their consent.
There are two types of IP crime: counterfeiting and piracy. 'Counterfeiting involves the illegal copying
of trade marks on products such as clothing and pharmaceuticals. Piracy involves the illegal copying
of content such as music, film, sports events, literary works, broadcasts, computer games and
software for commercial gain, also including illegal copying and downloading of digital content.'
Organized crime groups use the trade in fake goods to generate profit and to fund other forms of
organized crime, such as human trafficking, money laundering, and illegal drugs. The internet and
digital technology have presented criminals with an efficient, high speed and anonymous way to
conduct IP crime across borders and continents. While luxury goods have traditionally been targeted
for counterfeiting and piracy, today a wider variety of mass consumption goods (e.g. foodstuffs,
cosmetics, spare parts for cars toys and various types of technical or electrical equipment) are
affected. Due to the clandestine nature of many counterfeiting and piracy activities it is difficult to
accurately assess their scale. The OECD estimate that, in 2007, global trade in fake goods was worth
up to $250 billion and that does not include goods produced and consumed within countries. The real
figure is, therefore, far higher.
Money Laundering
Money laundering is the process of creating an appearance that large amounts of money obtained
from criminal activity originated from a legitimate source. As organized criminal activity is generally
aimed at making money, the ability to launder this money in order to conceal its origins and prevent
it being associated with criminal activity is a major concern for all organized crime groups. It is also a
means of maximizing the disposal of illegal profits and reducing the risk of exposure to law
enforcement agencies and rival criminals which holding large quantities of cash can present. It is an
international concern and international bodies and national governments have been taking major
steps in recent decades to combat it. Europol view money laundering as the common denominator of
all organized criminal activities.
12
Human Smuggling/Trafficking
Human smuggling and the trafficking of human beings are profitable forms of crime, involving both
individuals and organized criminal networks both within and outside the Countries. According to
Europol (2009) human traffickers and smugglers are likely to be involved in other types of crime like
drug trafficking, identity fraud, counterfeiting and money laundering. Both the trafficking of human
beings and people smuggling may involve the use of forged travel documents and the abuse of legal
forms of entry, although people legally entered in EU countries may also become victims of human
trafficking.
Human trafficking is often described as a modern form of slavery (Walsh 2009 xiii). While people
smuggling and the trafficking of human beings are linked and can involve the same networks, there
are fundamental differences between the two. Human smuggling involves migrants being facilitated
with entry into a State through illegal means. The trafficking of human beings is defined as
"procuring, recruiting, ... transporting ... or providing a person with accommodation or employment
by means of the threat or use of force or other forms of coercion, of abduction, of fraud, of
deception....for the purpose of exploitation... for sexual exploitation, forced labor ...or the removal of
organsxiv". In the case of adults, there must be an action (procuring or transporting or harboring),
means (coercion or deception, etc.) and purpose (for sexual or labor exploitation or removal of body
organs) for human trafficking to occur. In the case of trafficking of children there only needs to be the
action and purpose elements present to meet the definition for human trafficking, irrespective of the
means used. Human smuggling can lead to trafficking if, for example, the circumstances of the
smuggled persons change during the journey or on arrival in the State leading to them becoming
victims of violence and exploitation.
Illegal immigration
Illegal immigration is the migration of foreign citizens into a Country in circumstances where people
do not meet the legal requirements for immigrating in that country, that is, when they are violating
the immigration laws of that jurisdiction. It is important to note that the status of "unauthorized
immigrant" may be replaced by the status of "asylum seeker" for emigrants who have escaped a war
or repression and have unlawfully crossed their State's borders. If they are recognized as "legitimate"
asylum-seekers by the destination state, they gain an official legal status. The Article 31 of Convention
Relating to the Status of Refugees prohibits the Contracting States to impose penalties on refugees
for their illegal enter or presence, who come directly from a territory where their life or freedom are
threatened. However, if potential asylum-seekers are unwilling to apply or have been denied of
asylum status, are categorized as "unauthorized immigrants" and may be subject to punishment.
Illegal immigration has many complex causes. The most common motivation for illegal immigrants is
the pursuit of greater economic opportunities and quality of life in the destination state, and the net
flow of illegal immigration pattern is almost entirely from countries of lower socioeconomic levels to
countries of higher socioeconomic levels. Under the basic cost/benefit argument for illegal
immigration, potential immigrants believe the probability and benefits of successfully migrating to
the destination country are greater than the costs. These costs may include restrictions living as an
illegal immigrant in the destination country, leaving family and ways of life behind, and the
probability of being caught and resulting sanctions.
Illegal immigration has a heavy impact on many political, economical, social and ethical issues.
Moreover, there are many relevant dangers that unauthorized immigrants expose themselves to,
while engaged in travelling to another country. Aside from the possibility that they may be
intercepted and deported, unauthorized immigrants may be trafficked for exploitation (slavery
13
and/or sexual exploitation) or exposed to death while travelling in unsecured/uncontrolled
conditions.
White collar crime
White-collar crime has been defined by Edwin Sutherland as "a crime committed by a person of
respectability and high social status in the course of his occupation". White-collar crime includes
fraud, bribery, insider trading, embezzlement, copyright infringement, money laundering, identity
theft, and forgery.
The harm caused by these crimes, directly or indirectly, can be quite substantial. A major fraud, for
example, can have more relevant long-term impacts on individuals and economies than the offences
of many street criminalsxv. Over the past years, debate on the response of the criminal justice system
to white collar crime has moved to centre stage, in large part due to the fallout from the international
financial crisis. The general public has become more sensitive to white collar crime and also media
attention has increased significantly. Much of the debate focuses on the view that white collar
offenders are treated differently to 'street' criminals, with particular concerns expressed about the
length of time required to investigate allegations of white collar crime as well as a historical tendency
for sanctions to be more lenient.
One reason for the lower rate of prosecution and conviction in white collar crime is the difficulty in
defining, detecting and investigating it. For some types of white collar crime, such as fraud or
embezzlement, the criminal intent is unambiguous. In other instances, the intent is less
straightforward, and the persons under investigation may argue that they believed their actions were
legal and that they have been guilty, at worst, of misinterpreting complex accounting regulations or
having made poor business decisions.
Even where criminal intent is clear, white collar crime is typically committed in privacy, unlike 'street
crime'. The victim will often be unaware of the crime, or occasionally, may be reluctant to report the
crime. There is often no eyewitness other than the perpetrator. In the absence of eyewitness
testimony, proof is more likely to depend upon evidence amassed from a complex trail of data.
Modern technology generates enormous amounts of material, including on computer hard-drives,
telephone records and emails, which need to be assessed and evaluated. Therefore, the investigation
of white collar cases such as sophisticated fraud, money laundering or other financial crimes are
resource intensive, both in terms of duration and expertise.
14
Worldwide Past Security Events
As mentioned above, part of the work done, was to collect past security events to base develop
scenarios based on. The following presents some typical worldwide collected past events of each of
the five threats categories covered by SIAM:
Terrorism
1.
Name
Category of security event
Type of event
Date
Where-field/area
Who
Event description
9/11
Terrorism
Suicide attack
11-09-2001
USA – World Trade Center, NY City; the Pentagon in Arlington,
Virginia; Shanksville, Pennsylvania.
Al-Qaeda
On September 11, 2001 19 members of the terrorist network alQaeda executed a coordinated suicide attack on targets in the USA.
4 passenger jets were hijacked. Two jets were flown into the World
Trade Center in NY City. One jet was flown into the Pentagon. The
fourth jet crashed near Shanksville, Pennsylvania. The attacks
resulted in 2996 fatalities.
2.
Name
Category of security event
Type of event
Date
Where-field/area
Who
Event description
SuperFerry 14 bombing
Terrorism
Bombing
February 27, 2004
Manila Bay, Philippines / sea-ferry transport
Abu Sayyaf
“SuperFerry 14” was a 10,192-ton ferry that sailed out on the
night of the 27th of February for Cagayan de Oro City with 899
recorded passengers and crew aboard. Redondo Cain Dellosa, a
Rajah Sulaiman Movement member working for the Abu Sayyaf
group, had placed 3,6 kgs of TNT in a television set in the lower
decks of the ferry. +- 1hr after departure, the bomb exploded.
Total fatalities: 116 people. The SuperFerry 14 bombing is the
world’s deadliest terrorist attack at sea.
3.
Name
Category of security event
Type of event
Date
Where-field/area
Who
Madrid 4/11
Terrorism
Backpack bombings
11 March 2004
Madrid Commuter Train System
A collective of Moroccan, Syrian, and Algerian Muslims and two
Guardia Civil and Spanish police informants
In the morning of March 11, 2004, a coordinated attack was
executed at the Madrid Commuter Train System, using backpack
Event description
15
bombs. Total fatalities: 191. Injured: 2050.
Transnational organized crime
4.
Name
Category of security event
Type of event
Date
Where-field/area
Who
Event description
Operation “Ramp Rats”
Organized crime
Drugs smuggling, arms and explosives trafficking
August 25, 1999 – September 9, 1999
Miami International Airport USA
Airline employees
Operation Ramp Rats I was a DEA – operation that ended on
august 25, 1999 with the arrest of 59 individuals associated with
American Airlines. The investigations disclosed large-scale
smuggling of heroin and cocaine into the United States by these
employees along with the distribution of drugs, weapons and
explosives throughout the United States. One significant result of
the investigation was the disclosure of serious security breaches
at MIA.
Operation Ramp Rats II was concluded on September 9, 1999,
with the arrests by DEA and U.S. Customs of 15 ramp workers
associated with airlines other than American Airlines. Further
security breaches were disclosed by this operation.
5.
Name
Category of security event
Type of event
Date
Where-field/area
Who
Event description
Operation “Maxim”
Organized crime
Human trafficking
4-11-2004
Surrey, South-west and south-east London, Hamburg, Cologne
Snakeheads
On November 4, 2004, Scotland Yard broke a human trafficking
ring thought responsible for smuggling hundreds of Turkish
people into Britain in the last few years. The illegal immigrants
were brought in by air, road and sea through Germany, France
and Belgium to provide cheap labour in London.
16
Illegal migration
6.
7.
Name
Category of security
event
Type of event
Date
Where-field/area
Who
Event description
Name
Category of security event
Type of event
Date
Where-field/area
Who
Event description
Illegal aliens working at Dulles International Airport
Illegal Migration
Illegal residency / unlawful employment
13-08-2008
Dulles International Airport
42 illegal residents
In the morning of 13/08/2008, the U.S. Immigration and
Customs Enforcement (ICE) arrested 42 illegal residents at
Dulles International Airport as part of a critical infrastructure
protection (CIP) operation. ICE agents interviewed more than
200 individuals to verify their identities, immigration status, and
eligibility for lawful employment in the U.S. Most of the
individuals arrested by ICE agents, with support of airport
security agencies, worked on construction projects at the
airport.
Air China
Illegal Migration
Illegal Migration
27-12-1997
Shanghai International Airport
Unknown
December 27, 1997, 8 Fujianese individuals,who were about to
board Air China flight, were detained by chinese customs to
further inspect their Chinese passports and US Immigration
VISA’s. All VISA’s were found to be false.
Cybercrime
8.
Name
Category of security
event
Type of event
Date
Where-field/area
Who
Event description
Sasser
Cyber crime
Computer worm
April 30, 2004
Rotenburg, Lower Saxony, Germany
18-year old German computer science student Sven Jaschan
Sasser was a computer worm, designed by Sven Jaschan, that
affects the Microsoft operating systems Windows XP and
Windows 2000. One of the effects was that Delta Air Lines had to
cancel several trans-atlantic flights because its computer systems
had been swamped by the worm.
17
9.
Name
Category of security
event
Type of event
Date
Where-field/area
Who
Event description
'Anonymous' hackers launch cyber attack on San Francisco's
BART website
Cyber crime
Hacking
August 15, 2011
San Francisco Bay Area Rapid Transit (BART)
hacker collective Anonymous
‘Anonymous’ launched a cyberattack in response to the BART's
decision to block wireless service in several of its San Francisco
stations. BART officials intended to block wireless access to
disrupt the organization of a demonstration protesting the July 3
shooting death of a 45-year-old man by BART police, who said
the victim was wielding a knife. BART officials argued that the
protest had been designed to disrupt the evening commute.
Anonymous hacked the website and exposed the personal
contact information of over 2,000 customers.
10.
Name
Category of security
event
Type of event
Date
Where-field/area
Who
Event description
Juvenile Computer Hacker Cuts Off FAA Tower at Regional
Airport
Cyber crime
Hacking
March 10, 1997
Worcester Airport, Massachusetts, USA
Juvenile hacker
A computer hacker disabled a key telephone company computer
servicing the Worcester airport. As a result of a series of
commands sent from the hacker's personal computer, vital
services to the FAA control tower were disabled for six hours in
March of 1997. At +- 9:00 a.m., the juvenile computer hacker
accessed the loop carrier system servicing the Worcester Airport.
He then sent a series of computer commands to it that altered
and impaired the integrity of data on which the system relied,
thereby disabling it. Public health and safety were threatened by
the outage which resulted in the loss of telephone service, until
approximately 3:30 p.m., to the Federal Aviation Administration
Tower at the Worcester Airport, to the Worcester Airport Fire
Department and to other related concerns such as airport
security, the weather service, and various private airfreight
companies. Further, as a result of the outage, both the main
radio transmitter, which is connected to the tower by the loop
carrier system, and a circuit which enables aircraft to send an
electric signal to activate the runway lights on approach were not
operational for this same period of time.
18
Transnational white-collar crime
11.
Name
Category of security event
Type of event
Date
Where-field/area
Who
Event description
Corruption in South-Africa
White-collar crime
Fraud and corruption
May 2011
South-Africa
Government officials
The Department of Home Affairs, and its Anti-Corruption
Unit, arrested 12 of its employees for facilitating the
illegal entry and stay of foreign immigrants in South
Africa, registering hundreds of fraudulent marriages
involving foreign nationals and South African citizens,
and issuing a marriage certificate to a deceased person
at the OR Tambo Airport, Durban, Grahamstown and
Mount Frere.
19
Country Reports - Past Security Events
Each of the partners who had case study to base on, e.g. BGIA for ICTAF, focused their collected
events on their country experience, and concentrated mainly on such related to their case study.
Germany
A review of media sources shows that most major events in the Federal Republic of Germany
predated the specified timeframe and did not involve public transport.
The most severe terrorist bombing in post-war Germany was the “Oktoberfestattentat” (Oktoberfest
bombing) in Munich on September 26th 1980, when thirteen people died in the explosion of a pipe
bomb set by rightist extremist Gundolf Köhler (and possibly others).xvi Another well-known terrorist
attack was the “Munich massacre” during the 1972 Summer Olympics in Munich when members of
the Israeli delegation were killed by the Islamic group “Black September”.xvii Numerous acts of
terrorism were committed by the left-radical terrorist group “Rote Armee Fraktion” (Red Army
Faction, RAF), especially during the so-called “German Autumn” (Deutscher Herbst) of 1977.xviii These
include among others the kidnapping of Hanns-Martin Schleyer (1977), the murder of Jürgen Ponto
(1977), Alfred Herrhausen (1989) and Detlev Rohwedder (1991) and the bombing of Weiterstadt
penitentiary (1993).xix
A significant part of terrorism in Germany was directed against US-soldiers (e.g. “La Belle”
discotheque bombing of 1986; Hepp-Kexel-group; bombing of US Air Base Rhein-Main 1977; shelling
of the US-embassy in Bonn 1991)xx, another against asylum-seekers and persons who are perceived as
foreigners, especially in the form of arson, which peaked in the years after the German reunification
(e.g. Hoyerswerda excesses 1991, riot of Rostock-Lichtenhagen 1992, murder of Mölln 1992, Solingen
arson attack 1993).xxi
Extremists of both sides of the political spectrum often had close ties to Palestinian terror groups (e.g.
RAF, Hepp-Kexel-group).xxii
A significant number of events that did in fact involve public transport were aircraft hijackings. From
1969 until the end of 1999 24 passenger aircrafts were directed to Germany from abroad by
hijackers. Until the German reunification in 1990 most hijacked planes came from the Eastern bloc.xxiii
While most of the hijackers were politically motivated, there were also a significant number of
mentally ill hijackers.xxiv The vast majority of these hijackings ended without bloodshed after the
hijackers were overpowered or simply gave up.
The following list is limited to high-profile events that occurred from 1991 until today in the context
of public transport and that involve terrorism, illegal migration and crime (cyber, organized and
white-collar).
Since the number of such events in Germany is rather small, the definitions of the abovementioned
categories are construed extensively where appropriate. For the same reason, the list is followed by a
section that includes selected high-profile events preceding the specified time frame of twenty years.
20
Past Event G1
Name
Category of
security event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and
impacts
SMT / CIT
involved
Other issues
involved
Security
challenges
Sources
Hijacking of KLM flight KL 100
Terrorism
Hijacking
15 / 16 August 1993
Flight KL 100 (a Boeing 737-400) of Dutch airline KLM travelling from Tunis to
Amsterdam is hijacked in the skies over Germany and taken to Düsseldorf airport.
An Egyptian constructor (age 55)
The hijacker passed a note for the pilot written in English to a crew member. In
the note he claimed to have a bomb strapped to his body and said that he wanted
to be taken to New York. He also demanded the release of Sheik Omar AbdelRahman, an Egyptian cleric and the alleged wire-puller behind the World Trade
Center bombing of 26 February 1993, held in New York and that the United
Nations enforce sanctions against Serbia more strictly. After he was told that the
aircraft was incapable of reaching New York, the hijacker was persuaded by the
pilot to permit landing at the nearest airport (Düsseldorf). The pilot’s behaviour in
this situation was standard procedure at the time and still is today.
At Düsseldorf Rhein-Ruhr Airport (today: Düsseldorf International Airport), the
aircraft was directed to a remote area of the airport and parked there while the
hijacker negotiated with the police by radio. Shortly after the landing the hijacker
was successfully persuaded to release all passengers and four crew members,
leaving only himself, the pilot, the co-pilot and a steward on board. Later, the
female co-pilot was also released.
When it became clear, that he himself could not reach New York to pick up
Rahman, the hijacker instead demanded Rahman to be flown to Egypt. After a
standoff of eleven hours, at 2 am, the two remaining hostages managed to
escape through a cockpit window. Members of the special forces unit GSG9 of the
German Federal police simultaneously stormed the aircraft and overpowered the
hijacker who was at that time using the aircraft toilets. It was then discovered
that he did not carry any explosives or weapons whatsoever.
The aircraft had 131 passengers and 7 crew members on board. There was
however no real danger to them, since the hijacker did not carry any dangerous
weapons or materials.
A passenger later stated that he had noticed the hijacker at the check-in in Tunis
and that he had seemed to be very nervous to him. Other passengers however
described the hijacker as calm and friendly.
http://www.spiegel.de/panorama/a-48287.html;
http://archiv.rhein-zeitung.de/on/01/03/16/topnews/tupochro.html;
http://www.independent.co.uk/news/world/hijacker-seeks-sheikhs-release1461406.html;
http://articles.latimes.com/1993-08-16/news/mn-24360_1_muslim-cleric.
21
Past Event G2
Name
Category of
security event
Type of event
Date
Where – Field /
Area
Who
Event
Description
Effects and
impacts
SMT / CIT
involved
Other issues
involved
Security
challenges
Sources
Hijacking of an Austrian commercial aircraft
Illegal immigration / terrorism
Hijacking
7 January 1997
Flight AuA 104 (a McDonnell-Douglas 87) travelling from Berlin to Vienna is hijacked
in the skies over Germany.
Salko Loncaric (age 39, from Bosnia, asylum seeker) is supposed to be deported on
15 January 1997. He had been living in Rostock since 1994 and was suffering from a
psychosis.
Salko Loncaric, armed with a kitchen knife (10cm blade) and two 45cm long wooden
clubs, intoxicated, managed to hijack an Austrian Airlines commercial aircraft
travelling from Berlin to Vienna shortly before landing. He entered the cockpit and
forced the pilot to turn around and go back to Berlin-Tegel airport. He threatened
the pilot and co-pilot by hammering his club against the seats and the cockpit door
case and by pointing his knife at them.
He first demanded to be taken to the USA, but the aircraft did not have enough fuel.
He then demanded to talk to German foreign minister Klaus Kinkel and ordered the
pilot to return to Berlin.
After the landing in Berlin, the aircraft was directed to a remote part of the airport
and surrounded by special forces. However, two ordinary policemen had already
managed to enter the aircraft unnoticed and overpowered the hijacker.
The hijacker was sentenced to seven years of confinement in the psychiatric ward of
Tegel penitentiary. On 29 December 1997 he hung himself in his cell using a girdle
and the window cross. During his trial, Loncaric stated that he did not expect to be
able to pass airport security controls with his knife and clubs.
The security controls at the airport were conducted by private company Securitas.
The personnel had only had one week of training before starting work at the
checkpoint. Fellow travellers in the aircraft stated that the hijacker had attracted
their attention because of his shabby clothing and the smell of alcohol he emitted.
After the incident Securitas was heavily criticised. Loncaric’s lawyer, Jutta Lüdicke,
said that it was made very easy for him to carry out his plan (“Man hat es meinem
Mandanten leicht gemacht.”). The hijacker was also carrying 45 cigarette lighters
when he entered the security checkpoint. Unlike the knife and club which he carried
on his body and another club in his luggage, they were discovered and confiscated.
Loncaric’s lawyer claimed during the trial that a falsely completed form led to the
deportation.
Insufficient passenger screening
http://www.berlinonline.de/berlinerzeitung/archiv/.bin/dump.fcgi/1997/0704/lokales/0039/index.html;
http://www.berlinonline.de/berlinerzeitung/archiv/.bin/dump.fcgi/1997/0705/lokales/0081/index.html;
http://www.spiegel.de/spiegel/print/d-20289300.html.
22
Past Event G3
Name
Category of
security event
Type of event
Date
Where – Field /
Area
Who
Event
Description
Effects and
impacts
SMT / CIT
involved
Other issues
involved
Security
challenges
Sources
Bomb discovery at Dresden central station
(Terrorism), blackmail
Bombing
6 June 2003
Dresden central station; the bomb was found between two food vending
machines.
A 62 year-old highly indebted financial broker from Falkenstein im Vogtland (a
small town in Saxony) built and planted the bomb.
The perpetrator wanted to blackmail the Deutsche Bank into giving him 120m
Euros. To do this he placed a bomb hidden inside a suitcase at Dresden central
station and simultaneously sent a blackmail letter to the Deutsche Bank
headquarters in Frankfurt am Main. In that letter he threatened to plant a second
bomb in Frankfurt, unless his instructions were followed. However, the bomb in
Dresden was found after security personnel discovered the unattended piece of
luggage and disarmed by police special forces using a water gun. Since the bomb
timer was destroyed during the disarming, it is unknown when the bomb would
have exploded. After his arrest, the bomb planter denied that the bomb was
armed, but police believe this to be a defensive lie.
Police were able to find him through DNA on the suitcase and the fact that the
letter had been posted in Dresden.
After his arrest, police found enough explosives in his flat to build a second bomb.
A functional, professionally constructed bomb containing 1.6 kilogram of TNT and
6 kg crushed stone in a pressure cooker hidden inside a wheeled suitcase was
used. The explosion would have been strong enough to go through steel plates.
DNA testing, CCTV cameras did not record
After the bomb was found, police received a false claim of responsibility from the
“Caucasian Liberation Front Abu Achikoba”, a rebel group from Chechnya.
At the time the bomb was found, police believed that the bomb was part of a
terrorist plot since only a few months earlier four Algerians had been convicted of
planning a bombing in Strasbourg, France also using a pressure cooker. Therefore
the media treated the event like a terrorist attack and speculated on a possible
Islamist or right/left extremist background.
Another important issue in this case was an apparent lack of security at railway
stations: CCTV cameras installed at Dresden central station might have helped to
identify the bomb planter, but they were not set to record anything. Federal
minister of the interior Otto Schily pressed for more and better video surveillance
at railway stations after the event.
http://www.spiegel.de/panorama/0,1518,252643,00.html;
http://www.sueddeutsche.de/politik/polizei-festnahme-im-fall-dresdnerkofferbombe-1.896761;
http://www.handelsblatt.com/bekennerschreiben-zu-dresdnerkofferbombe/2253566.html.
23
Past Event G 4
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Past Event G 5
Name
“Geiseldrama von Ennepetal” 2005, Ennepetal hostage crisis
Terrorism / illegal migration
Kidnapping
12 April 2005
Urban bus in Ennepetal (city in North Rhine-Westphalia)
Man, no name given (age 50), mentally ill; from Iran, but living in
Ennepetal since 1997 as an asylum-seeker; his request for asylum had
been denied conclusively and he was supposed to be returned to his
country of origin in May 2005
The man entered an urban bus with 10 students on their way home from
a local school. He threatened the driver with two butcher knives and
started tying up the children using washing lines. Then he forced the
children to leave the bus. Outside, six of the hostages managed to flee.
The kidnapper left a note in Arabic in the bus.
When he noticed a woman nearby trying to open the door to her home,
he overpowered the owner, entered the house and barricaded himself in
the cellar with the remaining four hostages, three thirteen year-old girls
and another sixteen year-old girl.
After five hours a special unit of the German police stormed the cellar.
During the rescue operation the hostage-taker managed to injure one of
the girls.
The kidnapper later claimed that it had never been his intention to harm
the girls. He had however planned the kidnapping for a long time.
After the trial, the man was taken to a mental institution. He had been in
psychiatric therapy before.
10 students were threatened with two butcher knives.
Police special forces
The kidnapping was a last resort after several failed legal actions, over 60
letters to the authorities, two hunger strikes and two suicide attempts to
make the immigration office recognise him and his family, which was still
in Iran, as victims of political repression and therefore allow him to stay
and his family to be brought to Germany.
With the kidnapping he had hoped to draw the federal government’s
attention to his situation.
http://www.spiegel.de/panorama/0,1518,350967,00.html;
http://www.sueddeutsche.de/panorama/ennepetal-geiselnahme-endetglimpflich-1.922114;
http://www.stern.de/politik/deutschland/ennepetal-geiseln-sind-frei538980.html;
http://www.stern.de/politik/deutschland/ennepetal-geiselnehmer-warin-psychatrischer-behandlung-539023.html.
German train bombing plot, “Kofferbomber von Köln” (Cologne
24
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and impacts
suitcase bombers)
Terrorism
Bombing
31 July 2006
Regional trains departing Köln Central Station (Regionalexpress 10121
from Aachen to Hamm and Regionalbahn 12519 from
Mönchengladbach to Koblenz), bombs were timed to explode near
Hamm and Koblenz
Jihad Hamad (age 20) and Youssef Mohamad El Hajdib (age 21, lived
in Germany since 2004 as a student of mechatronics in Kiel); called
“Kofferbomber von Köln” (Cologne suitcase bombers) by the media;
others that are suspected to have helped to plan the attack are
Ayman Hawa, Khaled Khair-Eddin el Hajdib, Khalil al-Boubou and
Saddam el-Hajdib; all from Lebanon; arrests took place in Germany
(Youssef Mohamad El Hajdib) and Lebanon (rest); all were
sympathizers of Al Qaeda and presumably linked to the Lebanese
terrorist group Fatah al-Islam
The two abovementioned suspects placed two wheelie bag suitcases
containing bombs on regional trains departing Köln Central Station.
They took their respective trains until the first stop (Troisdorf/KölnDeutz) and then left the train, acting as if they had simply forgotten
their luggage.
The bombs were constructed using propane canisters with timed
detonators attached. The detonators went off at 2:30 PM, but they
did not ignite the gas due to faulty construction (lack of oxygen in the
canisters).
At 2:40 pm the first suitcase was discovered by a conductor and taken
to the lost property office of Dortmund Central Station where upon
opening the suitcase the bomb was discovered. The federal police
was called and the bomb was disposed by explosives experts.
The second suitcase was also discovered by a conductor and taken to
an office at Koblenz Central Station, but the bomb was not discovered
until the next day, when the suitcase was opened.
On the day of the attempted attack, both suspects left Germany via
Köln-Bonn airport. They first travelled to Istanbul and then from there
to Lebanon. Youssef Mohamad al-Hajdib returned to Germany on 8
August 2006 via Frankfurt am Main Airport.
Jihad Hamad and Youssef Mohamad El Hajdib were identified using
footage from security cameras installed at Köln Central Station, which
allowed a manhunt using pictures and video footage. A 50,000 €
reward was announced for leads to their whereabouts.
The attacks had the potential to kill hundreds of people; the force of
the explosions would have been similar to those of the terrorist
attacks on 7 July 2005 in London.
During the trial against Youssef Mohamad El Hajdib at the Higher
Regional Court of Düsseldorf chief judge Ottmar Breidling said that
25
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Germany had escaped from a catastrophe only because of the
technical inadequateness of the accused (“Deutschland ist nur
aufgrund der technischen Unzulänglichkeit des Angeklagten einer
Katastrophe entgangen.”).
The incident sparked a public discussion on the safety of Germany’s
infrastructure and its vulnerability to terrorist attacks from Islamic
terror cells.
Advertency of conductors towards unattended luggage, CCTV
The plans for the bombs were supposedly downloaded from the
internet, but the suspects diverged from the plans and made
technical mistakes that caused the bomb’s malfunction. The suspects
also considered attacks on a football stadium during the 2006 FIFA
World Cup in Germany and on the Hohenzollern Bridge in Köln, but
they were unable to get a sufficient amount of explosive materials.
The suspects were inspired to act by the prophet caricatures
published in the Danish newspaper “Jyllands Posten” on 30
September 2005 and the killing of Iraqi Al Qaeda leader Abu Musab
al-Zarqawi on 7 June 2006 by the US military.
OLG Düsseldorf, 9.12.2008 – 2 StE 7/07-3;
BGH, 24.11.2009 – 3 StR 327/09;
Latsch, G., et al., Alptraum der Fahnder, Der Spiegel 35/2006, 20 f.;
Meyer, C. / Ulrich, A. / Widmann, M., Der dritte Mann, Der Spiegel
36/2006, 42;
Brandt, A. / Kaiser, S. / Meyer, C. / Ulrich, A., Drohung aus dem
Libanon?, Der Spiegel 34/2006, 36 f.
http://en.wikipedia.org/wiki/2006_German_train_bombing_plot;
http://de.wikipedia.org/wiki/Versuchte_Bombenanschläge_vom_31.
_Juli_2006;
http://www.n-tv.de/politik/Angriff-auf-WM-Stadion-geplantarticle286537.html;
http://www.faz.net/-00ndnl;
http://www.aina.org/news/20060823102444.htm
http://www.spiegel.de/thema/kofferbomber/.
26
Past Event G 6
Name
Category of
security event
Type of event
Date
Where – Field /
Area
Who
German bomb plot of 2007, “Sauerland-Gruppe” (Sauerland group)
Terrorism
Bombing
4 September 2007 (date of arrest)
A holiday home in Oberschlemdorn, Sauerland (the Sauerland is a rural area in
the south-east of North Rhine-Westphalia)
Fritz Gelowicz (age 28, from Munich, group leader), Daniel Schneider (age 21,
from Saarbrücken), both converted to Islam as teenagers; Adem Yilmaz (age 28,
from Turkey, came to Germany in 1993); they met at a training camp of the
Islamic Jihad Union (IJU) in Pakistan and had links to Al Qaeda; seven other
suspects (presumably from Turkey) are still searched for, but not all are known
by name; the radicalisation of the group was started by the Egyptian physician
Yehia Yousif in Neu-Ulm.
Event Description The suspects were under observation by the police since 2006 after Fritz
Gelowicz had been seen staking out the US Air Force facility near Hanau. At a
holiday home in Oberschlemdorn, where they were arrested on 4 September
2007, the group had amassed 700kg of hydrogen peroxide which had been
purchased legally and 26 military grade detonators (not all of them working).
Police were monitoring the group members’ phone calls and the group was
aware that they were under observation by the police. In July 2007 the
hydrogen peroxide was secretly replaced with a harmless liquid. The
observation (codename “Operation Alberich”) involved 400 officers of the
German police, the German Secret Service (BND) and the German Military
Counterintelligence Service (MAD) that worked together in the Joint Terrorism
Defence Centre (GTAZ) founded on 14 December 2004. The GTAZ worked
closely together with the CIA on this case. A police officer was shot in the hand
when the suspects tried to resist arrest.
Effects and
The group considered attacks on a discotheque in Gießen frequented by US
impacts
soldiers, the US Air Base at Ramstein and Frankfurt airport using self-made car
bombs.
New anti-terrorism legislation was proposed by minister of justice Brigitte
Zypries that would make it an offence to visit terrorist training camps
(“Terrorcamps”) and to obtain plans or substances for the construction of
bombs. This new law came into effect on 4 August 2009 as the “Gesetz zur
Verfolgung der Vorbereitung von schweren staatsgefährdenden
Gewaltstraftaten” (BGBl. I S. 2437 Nr. 49) / “Act for the persecution of the
preparation of severe seditious criminal actions involving force”.
SMT / CIT
Covert listening devices, observation
involved
Other issues
The fact that two of the members of the Sauerland group were converts with
involved
German roots sparked a debate on the existence of home-grown terrorists
(scope, potential for violence) and the consequences for German homeland
security in the future.
Security
challenges
27
Sources
Ramelsberger, A. / Richter, N., Die Banalität des Hasses, Süddeutsche Zeitung,
Bayern, München, Die Seite Drei, 4.9.2008
http://en.wikipedia.org/wiki/2007_bomb_plot_in_Germany;
http://de.wikipedia.org/wiki/Sauerland-Gruppe;
http://www.spiegel.de/thema/sauerland_gruppe/;
http://www.sueddeutsche.de/thema/Sauerland-Gruppe;
http://www.focus.de/schlagwoerter/themen/s/sauerland-gruppe/.
Past Event G 7
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
“Operation Athena”
White-collar crime / terrorism
Tax evasion, funding of terrorist activities
10 – 17 September 2008
German-Swiss border, German-Liechtenstein border, 17 German
airports, trains travelling to Switzerland
People trying to get money out of the country without registration
From 10 - 17 September 13,000 persons and 22,000 pieces of luggage
were searched for hard cash. Customs officers searched passengers
on trains travelling to Switzerland, cars in the area near the border to
Switzerland and Liechtenstein and airline passengers on 17 airports
throughout the country. This was part of “Operation Athena” of the
European Union which all member states and Tunisia, Morocco,
Norway and Croatia participated in.
The goal of the operation was to strike a blow to tax evasion and
money laundering (e.g. profits from smuggling drugs, cigarettes and
weapons), but also to trail money flows to terrorist organisations.
800 customs officers registered 5.5m € over 181 cases (European
total: 11m € in 400 cases). It was the biggest hard cash investigation
ever conducted in the Federal Republic of Germany.
Sniffer dogs, road blocks, luggage inspections
http://www.focus.de/politik/deutschland/schmuggel-operationathena_aid_334680.html;
http://www.zoll.de/f0_veroeffentlichungen/e0_sonstiges/w0_2008/z
28_bargeldkontrolle/index.html.
28
Past Event G 8
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and impacts
SMT / CIT involved
“Saar-Terrorist”
Terrorism
Threats against the Federal Republic of Germany; attempts to recruit
Germans citizens for terrorist organisations and Islamist groups
fighting in Afghanistan
2008 – 2010
Neunkirchen, Saarbrücken, Afghanistan
Eric Breininger († at age 22), called “Saar-Terrorist” by the media
after his Saarland origin (the Saarland is a German state in the southwest of the country)
Breininger was an average German teenager, living with his older
sister and mother after his parents’ divorce. In early 2007, while
working for a transport company one of his colleagues introduced
him to Islam. A few moths later, Breininger converted and came into
contact with the “Sauerland group” (see above). In November of
2007 Breininger left Germany, travelling to Afghanistan via Iran and
Pakistan. There he graduated from a terrorist training camp run by
the Islamic Jihad Union.
From 2008 until 2010, Breininger recorded a number of video
messages in German. In these messages, he tried to inspire Germans
to come to Afghanistan and fight with the Taliban. He also implied
threats to the Federal Republic of Germany, stating that Germany
should withdraw its military presence from Afghanistan. His work as
a propagandist was considered very important by his sponsors, since
he gave them the means to address the German public directly in
German through the video messages.
On 30 April 2010 Breininger died during a fire-fight with Pakistani
soldiers.
Although Breininger stated in a video message that he himself was
not planning terrorist attacks in Germany, there were numerous
reports in the media over the years claiming he had returned to
Germany to perform terrorist attacks or at least that he was
orchestrating attacks from his hideout in Afghanistan.
The fact that he was of German descent played a big role in the
debates that followed his messages. Called “Saar-Terrorist” by the
media, his continuing presence as a propaganda mascot for the
Taliban, was a constant reminder of the fact that Germany was in
fact in the cross hairs of Islamist terrorist groups and that this threat
was not only a “foreign” one through persons with a migration
background, but that there was also a “home-grown“ threat through
converts.
Breininger’s messages resulted in a heightened state of alert,
especially at German airports and railway stations.
29
Other issues
involved
Security challenges
Sources
Past Event G 9
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and impacts
http://www.bild.de/news/vermischtes/pakistan/terrorist-breiningerin-deutschland-5935656.bild.html;
http://de.wikipedia.org/wiki/Eric_Breininger;
http://www.bild.de/news/vermischtes/deutschland/plante-zweites9-11-5664606.bild.html;
http://www.welt.de/politik/deutschland/article7484468/Das-kurzeLeben-des-Islamisten-Eric-Breininger.html;
http://www.spiegel.de/thema/eric_breininger/.
Cargo planes bomb plot of 2010
Terrorism
Bombing
29 October 2010
Yemen, Dubai, Köln/Bonn airport, East Midlands airport, Chicago;
several aircrafts, among them commercial passenger jets
Terrorist group “Al Qaeda in the Arabian Peninsula” (AQAP) claimed
to be responsible
Two packages were sent from Yemen to outdated addresses of Jewish
synagogues in Chicago containing odourless plastic explosives hidden
inside the printer cartridges of two printers. The Saudi Arabian secret
service had gained knowledge of the bomb plot and relayed that
knowledge to the German authorities among others.
The first package was processed in Dubai and at Köln/Bonn airport
without the bomb being detected and flown to East Midlands airport
near Nottingham/Leicester. From there it was supposed to travel to
Chicago via Philadelphia. The bomb was only detected and
(inadvertently) disarmed after US authorities provided Scotland Yard
with the tracking number of the package and even then only after the
US authorities put pressure on British officials to inspect the package
a second time.
The second package was discovered on a cargo plane at Dubai
airport.
The bombs would have destroyed two airplanes in mid-air,
presumably shortly before landing in the USA. The bombs would
probably have been transported by passenger planes during their
transatlantic voyage.
Restrictions for the import of cargo from Yemen were put in place.
For two weeks passenger flights from Yemen to Germany were
suspended. The Federal government recognised the need for a more
thorough inspection of transit and transfer cargo after being criticised
for the fact that the bomb reloaded at Köln/Bonn airport was not
30
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Past Event G 10
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
discovered by security.
Cargo screening; Qatar Airways and German Federal Criminal Police
officials stated that the bombs could not have been detected by
sniffer dogs, explosives detection equipment or X-ray screening due
to their sophisticated nature (plastic explosives hidden inside printer
cartridges).
In fact the first package cleared inspections in Dubai, Germany and
the United Kingdom. Only the intelligence gained through a defector
from the AQAP by the Saudi Arabian secret service made it possible
to prevent the attacks.
The terrorists had previously sent three dummy packages as a test
drive for their attacks.
The incident shows, that it is possible to outsmart current detection
mechanisms using sophisticated bomb designs.
Cargo screening needs to be improved.
http://www.spiegel.de/politik/ausland/0,1518,726310,00.html;
http://www.telegraph.co.uk/news/uknews/terrorism-in-theuk/8124226/Cargo-plane-bomb-plot-ink-cartridge-bomb-timed-toblow-up-over-US.html;
http://en.wikipedia.org/wiki/Cargo_planes_bomb_plot;
http://www.n-tv.de/politik/Bomben-Paket-fliegt-ueber-Koelnarticle1825561.html;
http://www.welt.de/print/die_welt/politik/article10680637/Paketbo
mbe-war-drei-Stunden-in-Deutschland.html.
Discovery of a dummy bomb in Windhoek
Terrorism
Bombing
17 November 2010
Hosea Kutako International Airport in Windhoek, Namibia
The local airport security chief was arrested on 20 November 2010
and confessed that he had placed the dummy.
During the loading of Air Berlin flight AB 7377 (an Airbus A330)
destined for Munich, a suitcase attracted attention. It had a sticker
saying “Test” on it, but otherwise no markings. Using an X-ray
machine, security noticed batteries connected to a detonator and a
running clock. Hours later, experts of the Federal Criminal Police
arrived in Windhoek and discovered that the suitcase was a dummy
bomb used to test airport security and did not contain any explosives
(bomb simulator made by US company Larry Copello Inc., “RealtestKoffer”). 27 hours after the dummy was found, German minister of
the interior, Thomas de Maizière, told the press that the suitcase did
not contain a real bomb.
31
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Past Event G 11
Name
Category of security
event
Type of event
Date
Where – Field /
Area
However, it remained unclear who had placed the dummy. Local
authorities denied any involvement. Soon speculations ran wild.
German authorities speculated that a foreign secret service might be
responsible, but failed to inform Namibian and German authorities
about the test. Others conjectured that a German agency was
responsible, but was now too embarrassed to admit its involvement.
It was finally discovered that the airport security chief at Windhoek
airport was the responsible party.
A few hours before the dummy was found, minister de Maizière had
issued an unusually explicit terror warning about an attack planned
for the end of November 2010 without giving any further details.
Together with the news of the bomb in Namibia, this attracted
significant media attention.
Even after the alleged bomb was revealed to be a dummy, Matthias
Seeger, head of the Federal Police, said in an interview with tabloid
newspaper BILD that the threat of a terrorist attack in Germany was
higher than ever: “On a scale from one – no threat – to ten –
immediate threat – we are at 9.0” (“Auf einer Skala von eins - keine
Gefahr - bis zehn – akute Anschlagsgefahr - liegen wir im Moment bei
9,0”).
The heightened state of alert in Germany which was instructed even
before the events in Windhoek was sustained until the end of 2010.
After the dummy was found, the Air Berlin aircraft was unloaded, the
passengers questioned and the crew replaced. After a delay of six
hours, the plane finally departed. Passengers and luggage were again
screened upon arrival at Munich’s Franz-Josef-Strauß-Airport.
X-ray, vigilance of local security personnel, sniffer dogs.
http://www.spiegel.de/politik/ausland/0,1518,730543,00.html#ref=rs
s;
http://www.spiegel.de/politik/deutschland/0,1518,729836,00.html;
http://www.stern.de/politik/deutschland/terrorverdacht-in-namibiakofferbombe-war-wohl-eine-attrappe-1625480.html;
http://www.reisenews-online.de/2010/11/18/namibia-kofferbombefuer-deutschen-flug-entdeckt/.
Frankfurt airport shooting
Terrorism
Shooting
2 March 2011
Frankfurt am Main airport, a US military bus in front of terminal 2
32
Who
Event Description
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Arid Uka (age 21), born in Kosovo, but raised in Germany, employed as a
substitute at the International post office near terminal 2 of Frankfurt
airport; radical Islamist with ties to radical groups, but presumably not
connected to any terrorist groups
The shooter approached the bus which had about a dozen soldiers aboard
and which was waiting at a bus stop in front of the terminal building. He
then shot a soldier standing in front of the bus. After that he shot the bus
driver who was sitting behind the wheel and went inside the bus where he
fired at two other soldiers. After having fired a total of nine shots, a
stoppage of gun prevented him from firing more shots and he tried to flee
the scene of the crime, but was overwhelmed and arrested almost
immediately by German police officers.
The American military busses at Frankfurt airport are used to transport
returning soldiers back to their bases.
2 American Air Force soldiers died, 2 were severely injured.
Police increased their presence at the airport; officers who patrol the area
now wear bullet proof vests and carry machine guns; use of more
undercover agents at the airport.
This event is the first Islamist terrorist attack on German soil that could not
be prevented and that resulted in casualties. It is therefore of great
significance.
The shooter stated that the motivation behind his actions was his hatred
towards US soldiers which he developed after seeing a video on the internet
allegedly showing US soldiers plundering a house in Afghanistan and raping
a girl. He also stated that he overheard US soldiers at the airport making
derogatory remarks about the people of Afghanistan. This triggered an urge
to kill US soldiers, especially those travelling to Afghanistan.
Obert, M., Der Rätselhafte, Frankfurter Rundschau, Panorama, 9.3.2011
http://en.wikipedia.org/wiki/2011_Frankfurt_Airport_shooting;
http://www.spiegel.de/thema/anschlag_frankfurter_flughafen_2011/;
http://www.sueddeutsche.de/politik/attentat-auf-frankfurter-flughafenallahu-akhbar-und-neun-schuesse-1.1067703;
http://www.focus.de/politik/weitere-meldungen/frankfurter-flughafenattentaeter-ist-erster-home-grown-terroristdeutschlands_aid_605302.html.
Past Event G 12
Name
Category of security
event
Type of event
Date
Where – Field /
Area
“Düsseldorf cell” (Düsseldorfer Zelle)
Terrorism
Bombing
29 April 2011 (date of arrest)
Düsseldorf
33
Who
Event Description
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Abdeladim el-K. (age 29, contacts to high-ranking al Qaeda members,
group leader), Jamil S. (age 31) and Amit C. (age 19, student, about
to get his A-levels); all members of al Qaeda; two originally from
Morocco, one from Iran, but they had lived in Germany for some
time; Abdeladim K.’s residence permit had expired in November
2010; el-K. was trained at a terror camp.
Police arrested the group members after overhearing through
listening devices that their search for bomb components and
building instructions was getting more and more concrete. This was
the moment, when evidence became sufficient to start a preliminary
investigation by public prosecution. The arrests took place in
Düsseldorf and Bochum. Before that they had bought chemicals that
can be used to construct bombs and were on the verge of building
and testing a bomb.
Three al Qaeda members were planning an attack on the public
transport system of a major German city, but had not yet decided on
a specific target. They discussed attacks on a bus stop or a bus
shortly before police intervened. They were seeking a high number
of fatalities.
During a press conference, Jörg Ziercke, head of the Federal Criminal
Police said: “We cannot give the all-clear!” (“Wir können keine
Entwarnung geben!”). Hans-Peter Friedrich, minister of the interior,
stated that Germany „is still in the cross hairs of international
terrorists“.
A special task force of the Federal Criminal Police (“Komet”) had
been tailing the members of the group for six months before the
arrest took place. CIA and Moroccan secret service were also
involved.
Online searching of computers / spyware, acoustic surveillance. For
the first time, the German Federal Police used the full force of all
available methods of investigation.
The scope of the case was smaller than that of the “Sauerland group”
case (see above), but there were many similarities (e.g. the use of
certain chemicals).
Interior minister Hans-Peter Friedrich stated that flight passenger
data that was transmitted from the U.S. was instrumental in this
case. U.S. authorities had alerted German police to suspicious travel
patterns of members of the Düsseldorf cell.
German magazine “Der Spiegel” claims that an average of five
Islamists leaves Germany every month to be trained at a terrorist
training camp. At least 220 persons from Germany were trained at a
terror camp in the last decade; half of them returned to Germany
afterwards.
http://www.spiegel.de/politik/deutschland/0,1518,759842,00.html;
http://www.tagesschau.de/inland/alkaidafestnahme102.html;
http://www.swr.de/blog/terrorismus/2011/04/30/ziercke-wir-
34
konnen-keine-entwarnung-geben/;
http://www.spiegel.de/politik/deutschland/0,1518,759741,00.html,
http://www.spiegel.de/politik/deutschland/0,1518,760983,00.html.
Rosenbach, M., Stark, H., Eine Bombe für Deutschland, Der Spiegel
19/2011, 7.5.2011., p. 28-33.
Past Event G13
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Arson attack on a cable bridge in Berlin
Terrorism
23 May 2011
A cable bridge leading hundreds of cables over Markgrafendamm
street at Berlin-Ostkreuz railway station. Ostkreuz station is a major
junction for railway traffic.
Unknown, but police assumes that there is a left-wing autonomous
background.
A cable bridge was set on fire on Monday morning using flammable
liquids. The fire destroyed most cables until it was finally extinguished
at 4:30am.
An anonymous claim of responsibility was distributed over the
internet, quoting “anti-nuclear”, “anti-militarism” and “anti-racism”
to justify the deed.
The attack shut down a significant part of railway traffic in Berlin for
hours and had a severe impact especially on commuter traffic.
The arson attack brought several railway control centres offline and
severed railway communication lines. Tens of thousands of railway
passengers and both intercity travel and mass transit were affected
by cancellations and severe delays that lasted until late Tuesday.
Additionally, the fire resulted in a massive disruption of the Vodafone
telephone network which affected tens of thousands of Vodafone
customers in Berlin and Brandenburg.
The economic damage due to the impact on commuter traffic is
unknown.
Over the years, the Deutsche Bahn (German railway company) has
been the target of a large number of attacks against railway overhead
contact lines and locomotives that occurred all over Germany.
A similar, but less severe arson attack (also attributed to far-left
radicals) occurred in Berlin on 1 November 2010.
Protection of peripheral infrastructure
http://www.spiegel.de/politik/deutschland/0,1518,764475,00.html;
http://www.rbb-
35
online.de/nachrichten/vermischtes/2011_05/bahnverkehr_nach_kab
elbrand.html;
http://www.morgenpost.de/berlinaktuell/article1648708/Zugverkehr-in-Berlin-bricht-nach-Brandzusammen.html.
Past Event G 14
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
Hijacking of Lufthansa Flight 649 in 1972
Terrorism
Hijacking
22 / 23 February 1972
Lufthansa Boeing 747 “Baden-Württemberg” (flight LH 649) travelling
from Tokyo to Frankfurt am Main via Delhi-Palam Airport is hijacked
in the skies over India and brought to Aden (South Yemen)
5 Palestinian hijackers of the “Popular Front for the Liberation of
Palestine” (PFLP), the same organisation as behind the “Landshut”
hijacking in 1977 and the hijacking of an Air France plane in 1976, led
by Wadi Haddad aka Abu Hani
On 22 February 1972, the hijackers seized control over the airplane
shortly after takeoff from Delhi-Palam airport (today: Indira Ghandi
International Airport) using firearms.
An unknown PFLP member had already sent a ransom note written in
English demanding an unknown sum of money and the release of
three Jordanians under arrest in West Germany. It arrived a few
hours after the hijacking at the Lufthansa offices in Köln bearing a
Köln postmark. The deadline given was 9 am of the following day (23
February).
In Yemen, the hijackers threatened to blow up the aircraft, killing all
hostages. The German authorities decided to comply with the
demands and to follow the terrorists’ demands to the letter in order
to save the lives of the hostages.
After successful negotiations with Nasser Muhammad, prime minister
of South Yemen, whose government was amongst the supporters of
terrorist groups, a Lufthansa security officer took $5m in cash to
Beirut in Lebanon. There he picked up a car whose keys had been
sent together with the ransom note. He was wearing identifiable
clothes and carried a copy of Newsweek magazine as instructed by
the kidnappers. In the car, PFLP members had left a note with further
instructions. The Lufthansa officer was told to drive a predetermined
route around Beirut until the car was finally stopped by PFLP
members. He handed over the money and was in turn given a code
word which was forwarded to the hijackers in Aden. This signalled the
delivery of the ransom money and that the hijacking had been a
success.
36
Effects and impacts
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Past Event G 15
Name
Category of
security event
Type of event
Date
Where – Field /
Area
Who
Event Description
In return, the hostages were released: first women and children, then
the other passengers, finally the crew and the aircraft itself.
Explosives experts disarmed the bombs that had been planted on the
aircraft.
The South Yemen government is said to have received $ 1m of the $
5m ransom as “landing fees” from the hijackers.
The hijackers took 186 hostages (172 passengers + 14 crew).
The fact that the German government was giving in to the demands
of the hijackers may have encouraged future hijackings.
Lack of proper passenger / luggage screening, no protection of the
cockpit from intrusion
At that time, $ 5m was the biggest sum ever paid as ransom for an
aircraft.
Originally, the hijackers had intended to take the aircraft to Amman in
Jordan, but abandoned that plan after the pilot told them that the
plane was too big to land there.
Among the passengers was 19 year-old Joseph Patrick Kennedy II.,
son of Robert Francis Kennedy.
Lufthansa paid the $ 5m ransom and was later compensated by the
German government.
Georg Leber, German minister of transportation, told the press that
the whole operation was so elaborate and well planned that the
hijackers themselves were most likely only subordinates in a large
terrorist network, taking orders from unknown wire pullers.
http://news.bbc.co.uk/onthisday/hi/dates/stories/february/23/newsi
d_2518000/2518731.stm;
http://www.guardian.co.uk/theguardian/2011/feb/26/bonn-paid5million-ransom.
Hijacking of a Slovair twin-engined aircraft
Illegal immigration / terrorism
Hijacking
8 June 1972
Slovair flight (a Let L-410A with 17 passenger seats) travelling from
Mariánské Lázně, Czechoslovakia (German: Marienbad) to Prague is
hijacked and taken to Weiden in der Oberpfalz, a town in Bavaria near
the German-Czechoslovakian border.
A group of ten Czechoslovakians (7 men and 3 women, one with an
infant): Lubomir Adamica (age 22, leader of the group), Milan Trcka (age
21), Jiri Vochomurka (age 21) and others between age 18 and 23; all
seeking refuge in West Germany
The hijackers entered the aircraft with the regular passengers. Two of
the women carried handguns in their underpants while the men carried
37
Effects and
impacts
SMT / CIT
involved
Other issues
involved
Security challenges
Sources
cola bottles. Shortly after takeoff Adamica signalled the others to begin
the attack by taking off his jacket. Two of the passengers were struck
down with the cola bottles. The other passengers were threatened with
one of the guns that had been snuck aboard. Then Vochomurka and
Adamica went to the cockpit to force the two pilots to change course.
The pilots resisted and in the following brawl Adamica shot pilot Ján
Micica in the throat. Co-pilot Dominik Chrobák then ceased his resistance
and flew the aircraft to Latsch airport near Weiden in der Oberpfalz, his
dying colleague in his lap.
The hijackers were taken into police custody without resistance as soon
as the plane landed.
4 passengers and 2 crew members were taken hostage; the pilot was
shot in a scuffle and died.
The large number of skyjackings in the early 1970s led to a change in the
treatment of air pirates that tried to escape the Eastern bloc. While in
the beginning, many received a hero’s welcome upon arrival on the
West, the criminal energy and brutality behind some of the following
skyjackings in conjunction with attempts to improve political
relationships with the Communist bloc changed that. § 316c was
installed into the German Criminal Code which made skyjacking a
distinguishable crime and the perpetrators were denied political asylum
(before that skyjackers were usually charged with illegal restraint and
duress, but granted asylum).
Adamica, the shooter, hanged himself in January 1973 while he was in
pre-trial custody. Trcka also attempted to commit suicide, but failed.
http://www.spiegel.de/spiegel/print/d-42602458.html;
http://www.spiegel.de/spiegel/print/d-41911334.html;
http://sk.wikipedia.org/wiki/Únos_lietadla_do_NSR_dňa_8._júna_1972.
Past Event G 16
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Hijacking of Lufthansa Flight 615, “Kiel Entführung” (Kiel hijacking,
after the name of the aircraft)
Terrorism
Hijacking
29 October 1972
Flight Lufthansa LH 615 (a Boeing 727) travelling from Beirut via
Ankara to Frankfurt am Main is hijacked north of Cyprus and taken to
Zagreb airport; after their demands are met, the hijackers take the
aircraft to Tripoli.
2 unknown members (one called himself “Abu Ali”) of the terrorist
group “Black September”, the same group responsible for the
“Munich massacre” a month earlier
38
Event Description
Effects and impacts
The two hijackers entered the aircraft in Beirut as passengers. North
of Cyprus they entered the cockpit, produced handguns and forced
the pilot, Walter Claussen, to take the plane to Zagreb after refuelling
in Cyprus.
The hijackers demanded the release of the three terrorists who had
survived the “Munich massacre” and who were at that time
incarcerated in Bavarian prisons (Sammar Abdullah, Abdul Kader
Dannawi and Ibrahim Badran) and safe passage to a friendly Arab
country.
In Zagreb, the aircraft was again refuelled and brought to Riem
Airport München where the three prisoners were to be exchanged
with the hostages. But the hijackers chose not to touch down on the
airport, which was surrounded by police. Instead they circled over
Nürnberg for a while until negotiations with the German authorities
ultimately failed and then ordered Claussen to take them back to
Zagreb where they again circled the airport without touching down.
The prisoners had in fact been released under unknown
circumstances and were taken to München, from where (after the
exchange had failed) they took off in a private aircraft led by
Lufthansa CEO Herbert Culmann. The plane was ordered not to leave
German airspace until an agreement had been reached with the
hijackers. When he heard that the “Kiel” circling Zagreb airport was
almost out of fuel and the hijackers were threatening to blow up the
aircraft, Culmann decided to take the prisoners to Zagreb without
consulting the crisis team in Bonn and to make an exchange on the
hijackers’ terms. Upon their last minute arrival in Zagreb (the “Kiel”
had only one minute of fuel remaining when Culmann’s plane
touched down and the hijackers gave the order to land), the prisoners
joined with the hijackers aboard the “Kiel”, but without fuel the
aircraft was unable to leave the airport.
In response, the hijackers threatened to detonate their explosives
once again, thus killing everybody aboard the plane, unless they were
provided with fuel. They had hidden explosives everywhere on the
aircraft. Kurt Laqueur, local German consul general, gave in to their
demands (despite being under orders not to do so) and the aircraft
went to Tripoli where all hostages and the aircraft were released.
Laqueur’s lone decision to fuel the aircraft against his orders is still
controversial. Lufthansa CEO Herbert Culmann called him a hero who
saved the lives of the hostages, while Bavarian minister of the interior
Bruno Merk stated that Laqueur gave way for the victory of brutal
extortion. During the re-election campaign of chancellor Willy Brandt,
the opposition called the events a “humiliation” for West Germany.
Ulrich Wegener, then aide of minister of the interior Hans-Dietrich
Genscher, later said in an interview: “At this time the German
government thought they could negotiate with terrorists … to get rid
of them”.
Some sources claim that the hijacking was staged as a cover story to
39
SMT / CIT involved
Other issues
involved
Security challenges
Sources
Past Event G 17
Name
Category of security
event
Type of event
Date
Where – Field /
Area
Who
Event Description
make it possible to release the three terrorists who survived the
“Munich massacre” only a few weeks earlier and who were at that
time jailed in Germany. Those three terrorists were in fact released
when the German government complied with the demands of the
hijackers (see above). It is alleged that German officials agreed to the
hijacking as a cover to get rid of the jailed terrorist because of their
fear of “real” retaliatory measures to free them. Chancellor Willy
Brandt denied that a secret deal was made with the terrorists.
Lack of proper screening at Beirut airport, no protection of the
cockpit from intrusion
The events put considerable pressure on the relationship between
West Germany and Israel.
http://www.time.com/time/magazine/article/0,9171,910445,00.html
;
http://de.wikipedia.org/wiki/Kurt_Laqueur;
http://www.spiegel.de/spiegel/print/d-41443421.html;
http://www.guardian.co.uk/world/2000/mar/26/jasonburke.theobse
rver1.
Hijacking of Lufthansa Flight 181, “Landshut Entführung” (Landshut
hijacking, after the name of the aircraft)
Terrorim
Hijacking
13 – 18 October 1977
Flight Lufthansa LH 181 (a Boeing 737) travelling from Palma de
Mallorca to Frankfurt am Main is hijacked as it passes over Marseille,
then taken to Mogadishu with stops in Rome, Cyprus, Bahrain, Dubai
and Aden.
4 members (two men, two women) of a terror commando called
“Martyr Halimeh” of the “Popular Front for the Liberation of
Palestine” with close ties to the German terrorist group “Rote Armee
Fraktion (RAF)”: Zohair Youssif Akache (age 23), Suheila Sayeh (age
24),Wabil Harb (age 23) and Hind Alameh (age 22)
The four terrorists managed to smuggle aboard two pistols, four hand
grenades and 500g of plastic explosives hidden in vanity cases and a
radio.
The aircraft was hijacked in French airspace over the Mediterranean
Sea. It was then that Akache burst into the cockpit with a handgun.
The aircraft was first lead to Rome, where it was refuelled. In Rome
the terrorists articulated their demands which were identical to those
of the kidnappers of Hanns Martin Schleyer (see below, “Other
issues”): the release of eleven RAF-terrorists incarcerated in
Germany. Additionally they demanded $ 15m and the release of two
40
Effects and impacts
SMT / CIT involved
Other issues
involved
persons from a Turkish prison.
During a stop in Aden pilot Jürgen Schumann was shot by the
terrorists after they had allowed him to leave the aircraft to inspect
the tires after the rough landing in Aden; the aircraft was then piloted
by co-pilot Jürgen Vietor.
The plane arrived in Mogadishu on 17 October at 4:34 am after
several countries had refused to open their airports to the terrorists.
Here the kidnappers issued an ultimatum to release the RAF-terrorists
from prison and are duped into believing that their demands were
being followed to gain time. The kidnappers poured alcohol over the
passengers and readied their explosives.
The government of Somalia which was friendly towards the
Palestinians was told that the kidnappers were Germans (a lie) and
promised weapons to help Somalia in its war with Ethiopia. In turn
the government of Somalia agreed to a rescue operation. Fake
update reports on the pretended release of the RAF-prisoners were
fed to the hijackers.
On 18 October at 0:05 am CET a team of the GSG-9 (an elite counterterrorism and special operations unit of the German Federal Police
established after the Munich massacre), which had been following
the Landshut on her journey, stormed the aircraft (“Operation
Feuerzauber” / operation fire magic). After seven minutes three of
the four hijackers were dead and the fourth apprehended without
casualties among the passengers and the crew. A GSG-9 officer, a
stewardess and three passengers were slightly injured, however.
The aircraft had 82 passengers and 5 crew members on board (not
including the hijackers); one hostage (the pilot) was shot by the
hijackers.
The GSG-9 achieved prominence after the successful rescue
operation. The German government stated that it would continue its
policy not to negotiate with terrorists. Chancellor Helmut Schmidt,
who later stated that he would have resigned if there had been
casualties among the hostages during the rescue operation, was
praised for his management of the crisis.
Lack of proper screening of luggage at Palma de Mallorca airport, no
protection of the cockpit from intrusion, counter-terrorism police unit
This terrorist attack was part of the so-called “Deutscher Herbst”
(German autumn) during which a series of terrorist activities struck
Germany. This in turn was part of the “Offensive 77” of the leftradical terrorist group “Rote Armee Fraktion” (Red Army Faction, RAF)
in which the so-called “Second Generation” of the group tried to
force the release of the imprisoned members of the “First
Generation”. The Landshut hijacking was closely tied to the
kidnapping of Hanns Martin Schleyer, industrialist and president of
the Confederation of German Employers’ Association (BDA) and of
the Federation of German Industries (BDI), on 5 September 1977.
Schleyer was killed by his captors on 18 October 1977, after the
41
Landshut hijacking had come to an end. In the night before, the
leaders of the “First Generation” (Baader, Ensslin, Raspe) had
committed suicide in the maximum security prison of StuttgartStammheim penitentiary which prompted the murder of Schleyer.
Security challenges
Sources
http://en.wikipedia.org/wiki/Lufthansa_Flight_181;
http://de.wikipedia.org/wiki/Entführung_des_Flugzeugs_Landshut
http://nachrichten.t-online.de/zeitgeschichte-die-landshutentfuehrung-108-stunden-in-der-hoelle/id_12999754/index;
http://www.welt.de/politik/article1259970/Der_Albtraum_der_Lands
hut_Entfuehrung.html;
http://einestages.spiegel.de/static/topicalbumbackground/2845/_wo
_sind_die_schweine.html.
.
42
Israel
Sixteen different recent security events related to the mass transportation infrastructures found in
Israel. All events are linked to one of the two largest and most important public transportation
systems in Israel: Ben-Gurion International Airport (BGIA) and the Israeli Railway. The events are
categorized as either related to terrorists' activities, Cyber events (e.g. radio / GPS interference),
criminal activity or illegal immigration.
Information about the events was obtained from interviews conducted with security personnel in
both BGIA and the Railway. Additional information was found in the printed and online media.
Past Event IL1
1
2
3
4
5
6
7
Name
Category of
security event*
Type of event*
Date
Where - Field /
Area
Who
Event Description
The Pretty Woman
Terrorism
Suicide bombing
January 1984
Ben Gurion International Airport (BGIA) and Athens international
airports
15 May terrorist organization
Operated by the 15 May terrorist organization, a female British citizen
messenger was sent to Israel with a sealed suitcase filled with
explosives, which was set to explode on air or in the airport. The
messenger wasn't aware of the explosive device and did not even carry
the key to the locked suitcase. Her good look and sense of fashion
combined with her ability to develop small talk with the controllers
probably helped her skip comprehensive checks and she boarded the
plane unchecked. She flew with El-Al from Athens to Tel-Aviv (BGIA)
Fortunately for her and for her fellow passengers, there was a failure
with the explosion mechanism and the suitcase did not explode. The
messenger, unaware of her good luck, stayed in a hotel in Israel with
the suitcase for a few days. After a while she went back abroad with the
suitcase, this time as an outgoing passenger from Ben-Gurion to
Athens. Still the booby trapped suitcase was not identified and
fortunately – did not explode as well.
The incident was only recognized three months after the actual
boarding, when some of the perpetrators involved were caught in the
UK for other reasons. They weren't aware of the failure of the explosive
device, so the law keepers who searched the messenger’s apartment in
Athens were surprised to find the sealed suitcase inside, still filled with
the explosives.
The suitcase was given to the woman by a Jordanian named Fouad
Abdallah. He was arrested in April 1984 by British and American agents
in a raid in his apartment in Athens. The Greek authorities released him
and provided him safe passage to Algeria. He was finally arrested in
1990 and taken to Israel, where he was sentenced to 25-years in prison.
43
.
8
Effects and impacts
9
SMT / CIT involved
10
Other issues
involved
11
Security Challenges
*
Practically there was no impact on the public which was not aware to
the event. The security forces in BGIA, however, changed the checking
process so that each passenger was questioned by two security men
not at the same time, The controllers met together immediately
afterwards to confirm they both received the same information.
Since the time of the incident, it was concluded that locked suitcases
without keys are a suspicious sign which should cause a special
treatment of the passenger.
Profiling method: relying on suspicious signals to determine which level
of potential security threat should be assigned to the passenger.
-
The questioning method proved inadequate in filtering potential
security threats. It was since combined with a luggage check for every
passenger.
http://www.crowell.com/PDF/UTA-Flight-772/20_Caprioli_Report.pdf
(p23)
Sources
http://fresnozionism.org/2010/01/the-greeks-had-a-word-for-ithypocrisy/
http://meria.idc.ac.il/journal/1999/issue2/jv3n2a4.html
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents
/ agriculture smuggling = white collar crime,3) radio and GPS interfering for mass
transportation systems,4)hacking of control systems = cyber crime
Past Event IL2
1
2
3
4
5
6
7
Name
Category of
security event*
Type of event*
Date
Where - Field /
Area
Who
Event
Description
Explosives on the Railways – 1
Terrorism
Failed attempt to blow up a train
17/5/2001
Near Binyamina – a small town in Israel. Despite its small size the station in
Binyamina serves practically all the trains between the northern and central
areas of Israel.
Unknown
A small explosive device was placed on the railway between Binyamina and
Zikhron-Ya’akov. The explosive was activated by contact with the train not
using remote-control elements. Traces of batteries and wires were found in
the area.
The explosion occurred exactly when a train carrying passengers went down
the railway, but caused no damage to the tracks, other than creating a
shallow hole between the tracks and causing very light damage to the
headlights of the locomotive.
44
Investigation of the scene revealed that the device was placed in a hurry
between the tracks and no attempt was made to destroy the tracks
themselves by planting the explosives under them.
8
Effects and
impacts
9
SMT / CIT
involved
10
Other issues
involved
11
Security
Challenges
sources
*
Further investigation revieled that the perpetrators apparently reached
and left the place using a quad (all-terrain vehicle).
Infrastructur Light, almost insignificant damage to the railway and the
e
locomotive. The railway traffic, however, was cut off for
most of the day.
Economy
This was the first terrorist attack against the train, and
caused much anxiety to people. Although exact financial
damages cannot be easily estimated, it is likely that many
potential passengers were discouraged from using the train
again
Political
The event was one of many terrorist attacks between the
years 2000 and 2003, most often initiated and perpetrated
by Palestinian organizations with a political agenda.
The free-range railways in Israel are generally protected at best with a fence
and at worst are exposed to the road. Therefore, no SMT was used to
prevent the incident.
The director of the train company mentioned that a much larger and
heavier explosive device is needed to blow up a train. This results in future
assessments of such events.
Developing ways to prevent explosive devices from being placed on the
railway.
http://www.ynet.co.il/articles/0,7340,L-742790,00.html
http://news.walla.co.il/?w=/21/62586
http://www.haaretz.co.il/hasite/pages/ShArt.jhtml?itemNo=35628&contrassID=0
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
Past Event IL3
1
2
3
Name
Category of
security event*
4
5
6
Type of event*
Date
Where-Field/Area
Who
7
Event Description
Piracy on the Air - 1
Radio and GPS Interference / Terrorism
Radio communication at frequencies used by BGIA caused a disturbance in
the proper order of work
18/6/2001
BGIA
Palestinian pirate radio stations
An IsraAir's airplane was forced to make an emergency landing in BGIA at
night due to unspecified circumstances. The communication between the
pilots and the control tower was heavily disrupted by radio transmissions
from a pirate radio station located in a village near Tul Karem, which is in
the territory of the Palestinian Authority. Luckily, the airplane still managed
to make the emergency landing safely.
Although BGIA's authorities informed the Ministry of Communication of the
incident, the disruptions in radio communication only worsened the next
45
8
Effects and
impacts
9
SMT/CIT involved
10
Other issues
involved
11
*
morning and caused delays in leaving and incoming flights. The flight
controllers were forced to constantly switch radio frequencies to bypass the
interferences.
A day later, the Palestinian Authority yielded to the demands of the Prime
Minister Office and shut down the station. Ironically, the station itself, Kol
Hashalom (Voice of Peace) belonged to a radical-left movement in Israel,
and most of its broadcasts consisted of peace songs.
People
Luckily, the airplane managed to land safely, with all 34
passengers unharmed.
Values
The incident served to bring to light the danger posed by
pirate radio stations both in Israel and in the Palestinian
Authority. It changed the attitude of the public towards
the pirate stations.
Political
The incident resulted in a political pressure on the
Palestinian Authority to shut down pirate stations.
Economy
There were claims that IsraAir, whose plane made the
emergency landing, tried to divert the attention from the
original failure of the airplane to the pirate radio
broadcasts, to minimize damages to its reputation.
The main issues here were solved outside the airport, by political pressure.
The media assisted in bringing the incident to the public attention, hence
encouraging the government to take care of it.
The same technology that was used by peace activists for peaceful
purposes could also be used more effectively by terrorists to prevent
landing and uptake of airplanes.
Security
Developing measures to withstand serious interferences in the radio
Challenges
communication between the control tower and airplanes.
http://news.walla.co.il/?w=/9/75800
sources
http://news.walla.co.il/?w=/21/76161
http://www.thevoiceofpeace.co.il/
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
Past Event IL4
1
2
3
4
5
6
7
Name
Category of
security event*
Type of event*
Date
WhereField/Area
Who
Event
Description
Suicide Bombing in Train Station – 1
Terrorism
Failed attempt to perform a suicide bombing attack in a train station
16/7/2001
Outside the train station in the city of Binyamina
Hamas and the Islamic JAyad terrorist organizations.
According to police reports, the terrorist arrived at Binyamina train station
at 19:35. Another driver brought him to the station, but left the perimeter
immediately. It is unknown whether or not the driver realized what his
46
Effects and
impacts
8
9
10
11
*
passenger had in mind.
He was a youngster at his early twenties, well-shaved and well-dressed, and
carrying an explosive device that contained nails and metal strips designed
to be ripped to shrapnel by the blast.
His plan was apparently to conduct the attack at the station platform, or go
into one of the trains and explode inside. Since the station had additional
security forces at that time, he did not go into the station but waited at the
nearby bus station from across the road. He waited for train passengers to
leave the train and reach the bus station before activating the explosive
device.
The police confirmed that there were warnings concerning a specific
terrorist attack in the train station in Binyamina, which is the reason the
security forces in the station were bolstered, including placing detectives
posing as civilians.
People
Two passengers were killed, and eleven injured were
evacuated to the hospital, three of them in a severe
state.
Economy
As in any terrorist attack, this one heightened the state
of fright which caused people to avoid the train.
Political
The event was one of many terrorist attacks between
the years 2000 and 2003, most often initiated and
perpetrated by Palestinian organizations with a
political agenda.
According to the Israeli cabinet’s policy at the time,
Israel decided to retaliate against every terrorist
attack.
The Palestinian Authority denunciated the attack.
Infrastructure
The explosion demolished the bus station, as well as
two cars that stopped by to pick-up passengers.
It is clear that the human-based measures at the entry point to the station
deterred the terrorist from making an attempt at the train station itself.
It is believed that the terrorist received aid by another person who drove
him to the spot, but did not necessarily know his intentions.
Possibly protecting both the train station area, and the area immediately
surrounding it.
SMT / CIT
involved
Other issues
involved
Security
Challenges
http://www.haaretz.co.il/hasite/pages/ShArt.jhtml?itemNo=52747&contrassID=0
sources
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
Past Event IL5
1
2
3
4
Name
Category of
security
event*
Type of
event*
Date
Suicide Bombing in Train Station – 2
Terrorism
Failed attempt to perform a suicide bombing attack in a train station
18/9/2001
47
5
6
Where - Field
/ Area
Who
7
Event
Description
8
Effects and
impacts
9
SMT / CIT
involved
10
Other issues
involved
11
Security
Challenges
sources
Near the train station in the city of Nahariya.
Hamas and the Islamic JAyad terrorist organizations.
A few days before the attack, the terrorist left his village of Abu-Snan, where
he was the head of the Islamic Movement and was a past-candidate to the
position of mayor. He spent a few days in the territory of the Palestinian
Authority, and infiltrated his way back into Israel a short time before the
incident. The ISA (Israel Security Agency, "Shabak") notified the Palestinian
Authority that the man made contact with the Hamas in the Strip, but the
Authority claimed that the terrorist was not in their territory at the time.
The attack happened twenty meters away from the train station in the center
of Nahariya. A policeman noticed the terrorist waiting for passenger coming
down from the train, and tried to apprehend the man. The terrorist fled and
eventually blew himself up, with an explosion so massive it was heard
throughout large parts of the city.
People
The hospital in Nahariya received seventy injured people,
eight of them carrying severe burns. The attack eventually
cost the lives of three people.
Economy
As in any terrorist attack, this one heightened the state of
fright which caused people to avoid the train.
Political
The event was one of many terrorist attacks between the
years 2000 and 2003, most often initiated and perpetrated
by Palestinian organizations with a political agenda.
The event triggered a clash between the citizens of AbuSnan, of which half are Muslims, a third Druze and the rest
are Christians. The Druze residents threatened to take
revenge on the Muslim residents after the incident.
Infrastructure The train infrastructure was not harmed. The train line to
Nahariya, however, was cut off for a few hours.
It would appear that the security forces at the entrance to the train station
deterred the terrorist from attempting to enter the station.
Although the deterrence can be counted as a success, this terrorist attack
caused a radical change in the profiling system, since the terrorist did not fit
the usual profiles of terrorists. He was 48 years old, a well-known and
respected religious person, and married with children.
His son, a devout Muslim and 20 years old, was arrested later by the police. It
was suspected that he assisted his father in the attack.
While demonstrating the incapability of the profiling system to detect all
threats, the fact that the terrorist could not (or would not) enter the station
proved the importance of the security forces at the entrance to the station.
Seeing as the policeman identified the terrorist, but could not stop him and
avoid the explosion, it is obvious that an SMT that will allow the security
guards to stop the terrorists at a distance from the station's entrance would
be very useful. This is one of the top priority security challenges today.
http://www.ynet.co.il/articles/0,7340,L-1098668,00.html
http://www.ynet.co.il/articles/1,7340,L-1099128,00.html
http://news.walla.co.il/?w=/9/113492
48
*
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents
/ agriculture smuggling = white collar crime,3) radio and GPS interfering for mass
transportation systems,4)hacking of control systems = cyber crime
Past Event IL6
1
2
3
4
5
6
Name
Category of
security event*
Type of event*
Date
Where - Field /
Area
Who
7
Event
Description
8
Effects and
impacts
9
SMT / CIT
involved
10
Other issues
involved
Explosives on the Railways – 2
Terrorism
Failed attempt to blow up a train
30/6/2002
On the railway near the city of Lod.
Unknown, but estimated to be a Palestinian terrorist organization.
An explosive device weighing 5 kgs was placed on the railway near the small
city of Lod. The device contained steel shrapnel as well as explosive material.
The device exploded at 7:20 in the morning when the train passed over it, two
kilometres from the nearby train station.
One of the indirect effects of the event was that during follow-up
investigation of the area, illegal immigrants were located nearby.
Infrastructur The explosion caused a hole in the ground, but the railway
e
itself was not damaged. The bottom of the first passenger
cabin was only slightly damaged.
Economy
As in any terrorist attack, this one heightened the state of
fright which caused people to avoid the train.
The travelling fees of the train were raised by 7% the
following day, partly because of the need to fund extrasecurity.
Political
The event was one of many terrorist attacks between the
years 2000 and 2003, most often initiated and perpetrated by
Palestinian organizations with a political agenda.
Thirty Palestinians illegal immigrants, who were found in the
neighbourhoods near the train station, were taken into arrest
and questioned.
Infrastructur The explosion caused a hole in the ground, but the railway
e
itself was not damaged.
Following the incident, the fire fighting services decided to
form a special committee that would look into methods to
rescue passengers trapped in a burning train that was
involved in a terrorist attack.
As a result of this event and the previous attempts at
sabotaging the railways, an option to separate the railways
from the roads by bridges was taken into consideration.
The free-range railways in Israel are generally protected at best with a fence,
and at worst are exposed to the road. No other SMT was used to prevent the
incident, beside patrols along the rails. Closed spaces (e.g. tunnels) are also
protected by cameras.
The railway traffic between Tel-Aviv and Lod was stopped for four hours
following the event.
49
11
*
Security
Challenges
Developing ways to prevent explosive devices from being places on the
railway.
http://www.ynet.co.il/articles/1,7340,L-1971034,00.html
sources
http://www.globes.co.il/news/article.aspx?did=598087
http://news.walla.co.il/?w=/9/247232
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
Past Event IL7
1
2
3
4
5
Name
Category of
security event*
Type of event*
Date
Where-Field/Area
6
Who
7
Event Description
8
Effects and
impacts
Explosives on the Railways – 3
Terrorism
Failed attempt to blow up a train
22/7/2002
Near the city of Rehovot.
Unknown. Possibly the same perpetrators of the previous terrorist attack
(Explosives on the Railways – 2), since the device was determined to be
identical to the one in the other attack.
An explosive device was activated, apparently by remote control, at 7:45 in
the morning, near a barrier separating the railway from the road.
According to police reports, the device weighed 5-6 kg. The targeted train had
two decks, and did not slip off the railway because of the explosion.
According to the Train’s director, no one saw the device before it exploded,
even though other trains passed on the same railway earlier. He also claimed
that the railways in the area are protected by a fence. It should be mentioned,
however, that the fence does not cover the intersection of the road with the
railways, and is thus useless at these locations.
People
Three passengers suffered from panic attack, and one
passenger was injured by the shockwave created by the
explosion.
Economy
As in any terrorist attack, this one heightened the state of fright
which caused people to avoid the train.
A week before the incident, the Minister of Transportation
ordered a special budget of 11 million NIS for the train, which
would be dedicated to the purchase and deployment of SMTs
around the railways.
Political
The event was one of many terrorist attacks between the years
2000 and 2003, most often initiated and perpetrated by
Palestinian organizations with a political agenda.
People
9
SMT / CIT
involved
The driver of the locomotive was injured in the explosion and
was moved to a nearby hospital. Another passenger suffered
from shock. The passengers were evacuated from the train.
The free-range railways in Israel are generally protected at best with a fence,
and at worst are exposed to the road. Even when protected with a fence, this
50
incident demonstrated that the fence cannot stretch across some points in the
railway, which therefore serve as the weak spots of the entire railway security
system.
Other issues
It is estimated that the terrorist/s waited in the vicinity for a certain train
involved
before choosing to explode the device with a remote control.
Security
Developing ways to prevent explosive devices from being places on the
Challenges
railway, and to be able to detect them on time.
http://www.inn.co.il/News/Flash.aspx/30497
sources
http://news.nana10.co.il/Article/?ArticleID=36305
http://news.walla.co.il/?w=/9/256753
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
1
0
1
1
*
Past Event IL8
1
3
4
5
6
Name
Category of
security event*
Type of event*
Date
Where-Field / Area
Who
7
Event Description
8
Effects and impacts
2
Suicide Bombing in Train Station – 3
Terrorism
Failed attempt to perform a suicide bombing attack in a train station
24/4/2003
The train station in the city of Kfar-Saba
Al-Aqsa Martyrs’ Brigades, the operational arm of the Fatah
The terrorist, an 18 years old youth from the refugee camp near Nablus,
reached the train station at 7:20 in the morning. He was stopped at the
entrance and was requested to present his identification card (ID) and to
be checked with a metal detector. Their suspicion was apparently raised
by the black sports jacket the terrorist was wearing, even though the day
was extremely hot. The terrorist pretended to look for his ID, patting his
jacket, and eventually activated the explosive belt that was hidden
underneath the jacket.
People
Sixteen people were injured in the attack, and the
security man who stopped the terrorist died from his
wounds.
Economy
As in any terrorist attack, this one heightened the state of
fright which caused people to avoid the train.
The station was also new, and only opened three weeks
before the incident, in a new building resembling a
shopping mall. Some economical damage was therefore
probably caused to the station and for the commercial
activity at the shopping center as well.
Political
The event was one of many terrorist attacks between the
years 2000 and 2003, most often initiated and
perpetrated by Palestinian organizations with a political
agenda.
Following the attack, Fatah and Al-Aqsa Martyrs’ Brigades
published a joint message accepting responsibility for the
attack. Later that day, another division in the Brigades
published a different message which denied any
involvement of the organization in the attack. The two
different messages served to highlight the division in the
51
Brigades, especially in regards to their policy on terrorist
attacks.
Infrastructure Some damage was caused to the entrance to the station.
9
10
11
*
As in previous cases of suicide attacks in the train station, the security
measures at the entrance prevented the terrorist from going inside.
SMT / CIT involved
The metal detector might have alerted the terrorist to the fact that he is
about to be exposed, and caused him to explode prematurely.
While the attack cost the life of the security man, this is largely
Other issues
considered a collateral damage and an unavoidable loss of life which
involved
prevented a much larger disaster.
There is a need to protect security forces as much as possible while still
Security Challenges
maintaining their efficiency and the normal services of the train station.
http://www.ynet.co.il/articles/0,7340,L-2583374,00.html
sources
http://www.ynet.co.il/articles/1,7340,L-2583734,00.html
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
Past Event IL9
1
2
3
Name
Category of
security event*
6
Type of event*
Date
Where - Field /
Area
Who
7
Event Description
8
Effects and
impacts
4
5
Pirates on the Air - 2
Radio and GPS Interference
Radio communication at frequencies used by BGIA caused a disturbance in
the proper order of work
13/5/2004
BGIA
Pirate radio stations from Israel
The communication between the control tower and airplanes in the air
around BGIA was increasingly disrupted by transmissions from pirate radio
stations.
The control tower switched to alternative frequencies at first, which
allowed some of the planes to land. When the disruptions continued and
increased, however, the decision was made to completely stop the landings
and take-offs. The airplanes received instructions to wait in the air, and the
take-offs were stopped completely.
As soon as the disruptions lessened, the take-offs were renewed, albeit at a
slower pace than usual. The landings continued as usual.
People
No person was injured, although there was a potential risk, if
the disruptions were to continue for a longer time.
Passengers were generally annoyed by the delay in both
landings and take-offs.
Values
The incident served to bring to light the danger posed by pirate
radio stations both in Israel and in the Palestinian Authority.
Political
It is also known that the Israeli government acts with a light
hand towards some of the pirate radio stations. Incidents like
this serve to deepen the mistrust between the people and the
government.
52
Economy
9
10
11
*
There were no long-term damages to the economy. Were the
disruptions to take longer, however, they would probably have
led to loss of working hours, fuel and other factors.
Means for detection of the pirate transmissions were used in order to
identify ASAP the source of the broadcasts. Once the sources were detected
SMT / CIT
and identified, rapid legal and practical steps were taken in order to locate
involved
and confiscate the radio equipment (although it has been proven that the
equipment can be replaced with new devices quite rapidly).
The same technology that was used for peaceful purposes, could also
Other issues
be used more decidedly and deviously by terrorists to prevent the
involved
landing and leaving of airplanes.
Security
Developing measures to withstand serious interferences in the radio
Challenges
communication between the control tower and airplanes.
sources
http://www.ynet.co.il/articles/0,7340,L-2916212,00.html
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
53
Past Event IL10
1
2
3
4
5
6
7
8
9
10
11
Name
Category of
security event*
Spy on the Train
Terrorism
Failed attempt to spy for the Hezbollah on sensitive infrastructures while riding
Type of event*
the train
Date
6/1/2005
Where-Field/Area
The train from Nahariya to Tel-Aviv
Who
Hezbollah
On December the 29th, 2004, a 38 years old Danish citizen of a Lebanese descent
called Ayad Al-Ashuah, entered Israel in a Turkish Airlines flight, by using a brand
new Danish passport. In the following days he has located two Israeli citizens of an
Arab descent, whom he planned to recruit to Hezbollah.
On the 6th of January, 2005, Al-Ashuah travelled on the train with one of his IsraeliArab friends. During the ride he was filming through the window with a video
camera. His behaviour caused suspicion on the part of the train's security officer.
Event
When the train reached Tel-Aviv, the officer upheld Al-Ashuah until the police
Description
arrived and took custody of him. Al-Ashuah was taken to questioning at the police
station, and it was revealed that while his Israeli-Arab friend was innocent, AlAshuah himself tied himself to the Hezbollah and admitted that he was sent to spy
on military sites in Israel for 2000 dollars. Capturing the spy was largely because of
the alertness of the security officer, who was utilizing human-based measures of
profiling and paying close attention to suspicious behaviour on the part of the
passengers.
Infrastructur The spy was taking pictures of military structures and sites along the
e
railway. It is likely that such images would have been used later to
bring harm to these sites.
Political
Israel received criticism from Denmark since no Danish
representatives were allowed to meet with the spy for two weeks
from the moment of his capture. Details of the affair were publicized
in Danish newspapers and other media. Experts on international law
Effects and
claimed that Israel was breaking the international law, as well as the
impacts
Vienna Treaty. While Danish representatives made clear that "the
friendship relations with Israel are very good", it seems that the
affair has left a smear on the relationship between the two states.
People
The other Israeli-Arab passenger was freed almost immediately,
when it was clear he was innocent. Two other Israeli-Arabs, relatives
of al-Ashuah were also taken into custody under suspicion that he
contacted them in order to recruit them to Hezbollah, but they were
released soon after due to lack of evidence.
The only SMT in use here was the security man himself, being alert and
SMT / CIT involved
adhering to the guidelines according which he was taught to recognize
suspicious behaviour.
Other issues involved The train should probably have some means for an arrest of suspicious
Security Challenges individuals, and for isolating and taking care of terrorists and other criminals
during the ride itself and until arriving at the station.
sources
http://www.ynet.co.il/articles/0,7340,L-2583374,00.html
http://www.ynet.co.il/articles/1,7340,L-2583734,00.html
54
*
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living ag
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transporta
systems,4)hacking of control systems = cyber crime
Past Event IL11
1
2
3
Name
Category of
security event*
4
5
6
Type of event*
Date
here- Field/Area
Who
7
Event Description
Pirates on the Air – 3
Radio and GPS Interference
Radio communication at frequencies used by BGIA caused a disturbance in the
proper order of work
6/6/2007
BGIA
A Israeli ultra-orthodox religious pirate radio station
Disruptions in communication between the control tower and the airplanes
caused a cessation of take-offs from BGIA for a short period of time in the middle
of the day, and at 23:00 in the night. As a result, seven take-offs were postponed,
and only resumed later at a slower pace of take-offs than usual.
The BGIA workers union declared its intention to strike and paralyze the airport.
Due to the rapid response of the Minister of Transportation and Minister of
Communication, who promised to come to the airport themselves to take care of
the problem, the union decided not to strike.
It is believed that the cause of disruptions was found in an apartment in the city
of Bnei-Brak, whose owner was using radio equipment to establish a pirate radio
station. The person was taken for questioning, and later released.
People
No person was injured, although there was a potential risk, if
the disruptions were to continue for a longer time.
Values
8
Effects and
impacts
Political
Economy
Passengers were generally annoyed by the delay in both
landings and take-offs.
The incident served to bring to light the danger posed by pirate
radio stations in Israel.
The fight against pirate radio stations became more
pronounced three days later, when the Israeli court made a
decision to keep the manager of a pirate radio station Kol
Haemet (Voice of Truth) in custody. The manager has instructed
his workers to buy a new transmitter for every one that was
confiscated by the police, and so there was a very real concern
that the radio station broadcasts would go on the air again.
The Ministers of Transportation and Communication received
requests to take care of the situation. A request was also
presented by parliament member Nissan Slomiansky to initiate
an urgent discussion in the economy committee of the
parliament regarding the pirate broadcasting.
There were no long-term damages to the economy.
Were the disruptions to take longer, however, they would
55
probably have led to loss of working hours, fuel and other
factors.
9
10
11
*
Foreign aircraft companies were furious over the delays in takeoffs and landings. The director of Swiss company in Israel
announced that the state must take care of the existing
infrastructures, and handle the pirate radio stations decisively.
Means for detection of the pirate transmissions were used in order to identify
ASAP the source of the broadcasts. Once the sources were detected and
SMT / CIT
identified, rapid legal and practical steps were taken in order to locate and
involved
confiscate the radio equipment (although it has been proven that the equipment
can be replaced with new devices quite rapidly).
The same technology that was used by ordinary citizens, could also be used more
Other issues
decidedly and deviously by terrorists to prevent the landing and leaving of
involved
airplanes.
Security
Developing measures to withstand serious interferences in the radio
Challenges
communication between the control tower and airplanes.
http://www.themarker.com/hitech/1.446282
sources
http://www.news1.co.il/Archive/001-D-132931-00.html
http://www.nrg.co.il/online/1/ART1/634/304.html
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
56
Past Event IL12
1
6
Name
Category of
security event*
Type of event*
Date
Where - Field /
Area
Who
7
Event Description
8
Effects and
impacts
9
SMT / CIT
involved
10
Other issues
involved
11
Security
Challenges
2
3
4
5
*
Gas near the Airport
White collar crime
A large and illegal stock of cooking gas was caught near BGIA
17/10/2007
In the city of Or Yehuda, near the runways of BGIA
A white collar criminal, selling and distributing gas without a permit
A large stock of cooking gas, which was stored and distributed without a
permit, was located in a warehouse extremely close to BGIA's runways, at a
distance of less than one kilometer away.
The warehouse contained twenty tones of illegal gas, contained in hundreds
of tanks. According to the Minister of Infrastructures, Binyamin Ben-Eliezer,
the presence of such large quantities of cooking gas in a proximity to BGIA is a
deadly hazard.
People
The criminal was apprehended for questioning, received
fines and will have a criminal record.
Infrastructure
No damage was caused during the arrest. If the
warehouse had caught fire, however, the resulting
explosion and fires could easily have threatened the
adjacent airport.
The police took care of the activity, following weeks of tracking the criminal
activities.
Despite the potential threat to BGIA's security, it is not clear whether the
police forces involved took care to alert BGIA's authorities regarding the
cooking gas warehouse 'under their noses'.
Monitoring the outer perimeter of BGIA, including neighbouring streets.
Achieving clear and efficient communication between the police forces and
BGIA authorities.
sources
http://www.news1.co.il/Archive/001-D-143132-00.html
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
57
Past Event IL13
1
2
3
Name
Category of
security event*
4
5
6
Type of event*
Date
Where-Field/Area
Who
7
Event Description
8
Effects and
impacts
9
10
11
*
SMT / CIT
involved
Other issues
involved
Security
Challenges
Sick Oligarch
White collar crime
Smuggling of a large amount of money through the airport, on the body of
a Russian businessman
21/10/2010
BGIA
Suliman Kraminov, a Russian oligarch
Suliman Kraminov, a Russian oligarch whose name can be found in the list
of 25 richest people in the world, landed in BGIA without notice, with his
assistants and security men. The customs people decided to check
Kraminov and his entourage, and uncovered a suitcase that one of his
personal security men carried, and in it a large number of bills amounting
to 100,000 Euro.
The oligarch and his entourage did not declare the large sum of money,
and the Israeli law requires the declaration of any tourist or passenger
who wants to transport into Israel more than 80,000 NIS (or the equivalent
sum in foreign coin) in cash.
When held for questioning by the customs people, the oligarch claimed
that he brought the money to donate to the court of Rabbi Ifragen, a wellknown mystic in Israel, whose fame has apparently travelled throughout
the world. In return for the money, the oligarch wanted to consult with
the rabbi regarding his unstable health.
The customs people decided to confiscate the suitcase with the cash in it,
and to determine its fate in later days.
Economy
While the smuggled amount of money is relatively
small, it is extremely important to enforce the laws in
all cases, even in the case of a philanthropic oligarch.
Political
No damage was done to the relations between Russia
and Israel.
Human-based measures, as well as a manual check of the suitcase in
question, and an investigation of the person's economical background.
-
Identifying the possibility of smuggling even when the party in question
does not fit the usual criteria of smugglers.
http://www.nrg.co.il/online/1/ART2/169/280.html?ap=1&from_art=1595
sources
416&to_art=2169280
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
58
Past Event IL14
1
3
4
5
6
Name
Category of security
event*
Type of event*
Date
Where - Field / Area
Who
7
Event Description
8
Effects and impacts
2
9
10
11
*
The Peruan Priest
Organized Crime
Drugs Smuggling
23/1/2011
BGIA
Drug currier from Peru, working for a network of drug dealers
A drug currier, working for an organized network of drug dealers and
smugglers (about which no information was uncovered), reached
BGIA via an identified "safe" route that began in Peru, through
Amsterdam, and ended with flying with KLM to Tel-Aviv.
It is unknown how he bypassed the security checks in Peru and
Amsterdam. When he reached BGIA, however, he was identified by
the front controller as soon as he went off the plane. He was
described as being frightened and having an odd behaviour. The
passenger was taken to a personal check, in which a heavy priest
mantle was found in his bag while checking it with an X-ray machine.
The imaging turned up that the bag had an internal lining with
unidentified organic chunk inside. The possibility that the material
was an explosive was discounted using sniffers.
Once it was clear that this was no terrorist attack, the Israeli police
became involved and identified the material as drugs. The currier was
transferred to a holding facility, where he excreted from his body
additional drug containers which he swallowed before the flight.
Obviously, if the drug load were not caught, it would have caused
trouble for society. Besides that, however, this incident did not seem
to have much of an impact.
A wide variety of SMTs was involved in this incident. Human
controllers noticed the currier’s anxiety and apprehended him for
questioning, where they noticed his strange luggage and opted to
SMT / CIT involved
check it using an X-ray machine. Sniffers were used to discount the
presence of explosives, police methods were utilized to identify the
drug load, and the confinement made sure that the rest of the drug
load left the body of the currier.
It is disturbing to realize that the drug currier managed to pass
Other issues involved
through two other airports – in Peru and in Amsterdam – without
raising the alarm.
Security Challenges
Sophisticated smuggling methods and means.
Source
Interview with one of the persons in charge of security in BGIA.
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living agents /
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transportation
systems,4)hacking of control systems = cyber crime
59
Past Event IL15
1
3
4
5
6
Name
Category of security
event*
Type of event*
Date
Where - Field / Area
Who
7
Event Description
2
The Oily Fuel
Suspected Terrorism
Contamination of airplane fuel supply
April 2011
BGIA / Fuel supply facility
Unknown
Suspicious oily material was found in the fuel filters in the reservoirs of the
airport. The fuel supply was stopped, and there was not enough safe clean
fuel available to let the airplanes take off. As a result outgoing flights
suffered very long delays (or were cancelled). All incoming flights were
instructed to carry with them a portion of fuel sufficient to enable them to
fly back to a nearby airport (Cyprus, Jordan) to refuel.
Samples of the suspicious material were taken to local laboratories, as well
laboratories abroad in order to try to identify this unknown material and it's
source. So far no clear conclusion has been reached and published.
Infrastructure
Re-evaluation of the fuel supply chain was needed.
Economy
8
9
10
11
The entire air service to and from Israel was
stopped with heavy economic impacts.
Political
According to the Minister of Transportation, this
Effects and
incident gave the ‘green light’ to promote and
impacts
advance the planning of a new airport in Timna,
which could be used as an alternative to BGIA
should the need arise.
Possible international assistance was needed to
overcome fuel shortage
Standard methods and protocols were used for checking and controlling the
supplied fuel.
Some time has passed between detection of the contamination the
evaluation ad and making the decisions how to handle the situation. Initially,
SMT / CIT involved it was assumed that no danger was expected from it. When the unknown
material was detected all over the supply chain and couldn’t be identified,
however, a decision was made that this unknown chemical might cause
aircraft malfunctions. All flights were put on hold and samples were sent to
specialized laboratories abroad.
The fuel is supplied by a private firm. A question of responsibility was raised.
International support was required.
Other issues
Questions were raised regarding the local capability to identify the material
involved
and locate its source. Another issue came up, as using wrong fuel might
damage the airplane engines, and the engine manufacturers and the
insurance companies were worried about that as well.
Security Challenges Securing the whole fuel supply chain.
This is a fresh event from the last days, so all the data was taken from the
publish media. Some internet sources include:
Sources
www.energianews.com/article.php?id=9425;
www.news-israel.net/Article.asp?Code=26053;
http://www.globes.co.il/news/article.aspx?did=1000644866;
60
*
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living ag
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transport
systems,4)hacking of control systems = cyber crime
61
Past Event IL16
1
2
3
4
5
6
7
Name
Category of security
event*
Type of event*
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues
involved
11
Security Challenges
sources
Human Flyover
Terrorism /order disturbance
Protests by illegal tourists with the intention to disturb order in BGIA , that
made it difficult to efficiently service passengers in the airport
8.7.2011
Airport - incoming passengers' hall.
"so called" peace activists
Demonstrators came to BGIA travelling in different air companies from
different countries and airports. They had a planned schedule according to
which they were trying to get into the country en-masse and later reach the
Palestinian territories. Including the Gaza Strip, "to protest and act against
the “blockade of Gaza” (quote). Some local citizens tried to join them in the
reception hall to disrupt order and attract media attention.
Israel made an effort to prevent the activists from boarding the planes in
the first place, by using diplomatic pressure and announcing that
participants in this venture will not be allowed to enter Israel. Known
participants were declared as not eligible to enter ISRAEL The laws of the
International Civil Aviation Organization state that in this case the air
companies should vdeny flight permission from such passenger and thus
would have to fly them back if they arrive in Israel The companies
themselves decided to prevent the boarding of these individuals
In BIGA, police forces were deployed in order to identify the relevant
individuals put them. in custody and send them back.. Some people
however succeeded to enter Israel.
People
The flyover didn't bring in as many people as expected
due to the successful measures applied. Some case of
order disruption took place with disturbance of
passengers' flux.
Economy
Although no economical impacts were discerned, it
seems likely that some passengers decided to avoid
BGIA at the day of the flyover. The security measures
caused extra budget need
Political
The event caused a small uproar in Israel and Europe;
The security measures applied were successful.
Increasing police activity, special instructions on sensitive human treatment,
arrangement of needed infrastructures (e.g. custody facility), enhanced
control measures.
Legal questions on who can be denied entrance into the country.
Dealing with massive demonstrations and order disruptions in BGIA in a
sensitive yet firm manner. Identification of potential order breakers.
Possible international cooperation in early prevention
All media cover – e.g.: http://www.ynet.co.il/articles/0,7340,L-4091551,00.html
http://www.israelhayom.com/site/newsletter_article.php?id=296
62
*
Events – samples of types and categories: 1)Drugs smuggling= organized crime 2) living a
agriculture smuggling = white collar crime,3) radio and GPS interfering for mass transpor
systems,4)hacking of control systems = cyber crime
We
have
presented a number of security events from the past thirty years. The events dealt mostly with the
security of either BGIA or the Train and railways system in Israel.
Several security needs were identified in this analysis:
-
Protection of the railway system - The railways in Israel are mainly protected with a fence
however, practically anyone can cut through it or make an attack on the tracks at places
where the railway meets the road and the fence's continuity is cut off (see Error!
Reference source not found., Error! Reference source not found., Error!
Reference source not found.). In addition, no alarming system exists to signal possible
threats. The only solutions currently available are manned reconnaissance.
-
Airport communication - Another problem is the treatment of pirate radio stations who can
interfere with the communications between the control tower and airplanes in the air and on
the ground, leading to a complete halt in landings and take-offs (see Error! Reference
source not found., Error! Reference source not found., Error! Reference source
not found.). A real threat is identified with risk of air accidents.
Attention should be given to the most basic SMTs – the human-based measures. Well-trained and reliable security men have proven again and again their capability at either deterring
terrorists from making an actual attack on a train station (see Error! Reference source
not found.,
- , Error! Reference source not found.), or identifying a drug carrier based on signs of
nervousness alone (see Error! Reference source not found.).
63
Italy
Terrorism
Past Event IT1
1
2
3
4
5
Name
Type - Threat topic
Threat
Date
Where - Field / Area
6
Who
7
Event Description
At 08:15 GMT, four gunmen walked to the shared ticket counter for
Israel's El Al Airlines and Trans World Airlines at Fiumicino Airport
outside Rome (Italy) firing assault rifles and threwing grenades.
8
Effects and impacts
The attackers killed 16 people and wounded 99 before three of them
killed by police. The remaining one was wounded and captured by
police.
9
SMT / CIT involved
10 Security Challenges
Terrorist attack on Rome Airport
Terrorism
Mass Murder / Harm
December 27th, 1985
Fiumicino Airport, Rome
The attack was first blamed on Palestine Liberation Organization (PLO),
but its leader, Yasser Arafat, denied the accusations and denounced the
strikes. The PLO asserted that the attacks were intended to force
Austria and Italy into severing ties with the Palestinians. Responsibility
for the attack was later claimed by the Abu Nidal Organization (ANO) in
retaliation for Operation Wooden Leg, the Israeli bombing of PLO
headquarters in Tunis on October 1, 1985. Libya was accused of funding
the terrorists who carried out the attack; although they denied the
charge, they did praise the assault. According to published reports,
sources close to Abu Nidal said Libyan intelligence supplied the
weapons and the ANO's head of the Intelligence Directorate's
Committee for Special Missions, Dr. Ghassan al-Ali, organized the
attacks. Libya denied these charges as well, notwithstanding that it
claimed they were "heroic operations carried out by the sons of the
martyrs of Sabra and Shatila."
Explosive detectors, Metal detectors, Weapon detectors
To increase the efficiency and the efficacy of explosive detection
devices and security protocols for the prevention/mitigation of
terrorists’ attacks to airports.
To install efficient behaviour recognition software in airports CCTV.
Source(s)
National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database
(http://www.start.umd.edu/gtd/)
http://en.wikipedia.org/wiki/Rome_and_Vienna_airport_attacks
64
Past Event IT2
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
Terrorist attack on Vienna Airport
Terrorism
Mass Murder / Harm
December 27th, 1985
Schwechat Airport, Vienna
Abu Nidal Organization
The morning of 27th of December 1985 at the Schwechat Airport (Vienna
International Airport, Austria), three terrorists carried out an attack. Hand
grenades were thrown into crowds of passengers queuing to check-in for a
flight to Tel Aviv.
8
Effects and impacts
Two people killed and 39 people wounded.
9
10
SMT / CIT involved
Security Challenges
Explosive detectors, Metal detectors, Weapon detectors
To increase the efficiency and the efficacy of explosive detection devices
and security protocols for the prevention/mitigation of terrorists’ attacks
to airports.
To install efficient behaviour recognition software in airports CCTV.
Source(s)
National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database
(http://www.start.umd.edu/gtd/)
http://en.wikipedia.org/wiki/Rome_and_Vienna_airport_attacks
Past Event IT3
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9
10
SMT / CIT involved
Security Challenges
Attack on Bologna Airport
Terrorism
Murder
February, 11th , 2010
Bologna Airport
“Conspiracy of Fire Nuclei” organization
On 11th of February 2010 an improvised explosive device (IED), hidden inside
a package on an airplane, was sent to Italian Prime Minister. The package
was in route from Athens to Paris, meant to travel through Belgium and
later to Rome, when it was discovered. The plane stopped and landed in
Bologna, Italy where authorities checked the package.
The IED caught fire while it was being checked. There were no casualties or
damaged and the Conspiracy of Fire Nuclei claimed responsibility for the
attempted bombing. Thirteen of the group's members were arrested in
connection with the attacks.
Explosive detectors, mail control procedures / systems
To increase the capability of early warning explosive hidden in mail
packages.
Source(s)
National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database
( http://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=201011020012 )
65
Past Event IT4
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9 SMT / CIT involved
10 Security Challenges
Attack on Milan Metro
Terrorism
Mass Murder / Harm
February 5th, 2002
Duomo Metro station, Milan
Unknown
05/11/2002: Unknown perpetrators attempted to bomb the Duomo Metro
station in Milan (Italy). The attackers set fire to a 66 pound gas canister
and left a note written in both Italian and Arabic stating that they were
fighting on behalf of Allah to convert all non-believers to Islam. No group
claimed responsibility for the attack.
Metro employees were able to put out the blaze before any damage
occurred to the facility.
CCTV, smoke detectors, gas detectors, behavior recognition software
To improve metro transportation control systems, in order to
automatically recongnize suspect behavior and early detect gas and
explosives.
Source(s)
National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism
Database
( http://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=200205110003 )
Past Event IT5
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
Attack on Rome Metro
Terrorism
Mass Murder / Harm
December 21st , 2010
An empty train coach in Rome subway
Unknown
Around 10.00 in the morning in Rome (Italy) an improvised explosive
device (IED), hidden in a bag inside a black shoebox, was found under
the seat in an empty train coach in the subway. The IED was made of
gunpowder and metal tubes but it did not explode since it did not have
a detonator.
8
Effects and impacts
There were no casualties or damages and no group has claimed
responsibility.
9
SMT / CIT involved
CCTV, smoke detectors, gas detectors, behavior recognition software,
biometrics
To improve metro transportation control systems, in order to
automatically recongnize suspect behavior and early detect gas and
explosives.
10 Security Challenges
66
Source(s)
National Consortium for the Study of Terrorism and Responses to Terrorism – Global terrorism Database
( http://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=201012210002 )
Cyber crime
Past Event IT6
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
Hacker attacks on Pisa Airport, Italy
Cyber crime
Reduction of airport systems functionality
December 19, 2010
Pisa Airport
Unknown
The morning of 20th of December a cyber attack to Pisa’s airport ICT
infrastructure was registered. The airport servers were affected by
“flooding” (contemporary access of a large quantity of fake users), and
the consulting services of flights departures and arrives were
interrupted for a short period of time.
8 Effects and impacts
The attack didn’t reach flight control systems but relevant economic
problems were caused to Airline Company due to the compromising of
on-line flights booking services. Airport Security Authorities activated an
external web link to provide flights information to passengers.
9 SMT / CIT involved
ICT security protocols, internet firewalls
10 Security Challenges
To increase ICT systems security and reliability of airport internet
services, without excessively slow information computing processes.
Source(s) Aeroporto di Pisa, sito web sotto attacco – Pubblicaamminstrazione.net 20.12.2010
Past Event IT7
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
Hacker attacks on Catania Airport, Italy
Cyber crime
Cyber Attack at Catania’s airport
March 5, 2011
Computer network of Catania Airport
Two boys
In the evening of 5 March 2011, Catania airport website was affected by
a cyber attack that interrupted secondary functionalities for some
hours. The cause was a cyber attack brought by two 22 years old boys.
8
Effects and impacts
The problem was solved in few hours and didn’t cause relevant
problems to Airline Companies or airport operators.
9 SMT / CIT involved
10 Security Challenges
ICT security protocols, internet firewalls
To increase ICT systems security and reliability of airport internet
services, without excessively slow information computing processes.
67
Source(s)
Catania: attacco siti web aeroporto – corriereborsa.it 05.03.2011
Past Event IT8
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9
SMT / CIT involved
10 Security Challenges
“Defacement” of Italian Postal Service
Cyber Crime
Compromising of mail services
October 10, 2009
Italian Postal Service official website
Two Hackers called “Mr.Hipo and StutM”
During the night of 10 October 2009 the security measures of Italian
Postal Service official website were violated. Two hackers attacked
the main server forcing the system to report the following message:
“You are lucky, we aren’t dangerous people”. This event, even if it
had no relevant consequences, allowed the hackers to access the
information contained in Postal Service database (users list, account
credential, passwords, etc.).
This event caused a lot of concerns in public opinion. Italian Post's
representative personnel said that the attack wasn’t dangerous for
post users data, but the event was strongly discussed by massmedia, influencing citizens opinion on the reliability and security of
postal services.
The technical name of attack type is “SQL injection”. This attack
affects web application based on SQL database, exploiting system
vulnerabilities to gain access to restricted data.
To increase security measures (mainly ICT protocols and
procedures) of web-based platforms.
Source(s)
Poste, un defacement annunciato - ZEUS news 15.10.2009
Past Event IT9
1
2
3
4
5
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Cyber attacks on Italian Universities
Cyber crime
Stealing and Counterfeiting of Universities data
July 7, 2011
Milano, Torino, Bologna, Cagliari, Bari, Foggia, Lecce, Messina,
Modena, Napoli, Pavia, Roma, Salerno, Siena, e Urbino.
6
7
Who
Event Description
LuzlStorm, cellular of anonymous hacker group
A wide-range cyber attack was performed to a number Italian
Universities: Bologna (Antoniano e Unibo), Cagliari, Milano
(Politecnico, Bocconi e Bicocca), Bari, Foggia, Lecce, Messina,
68
8
Effects and impacts
Modena, Napoli, Pavia, Roma, Salerno, Siena, Torino e Urbino.
A team of hacker called “LuzlStorm” gained access to users data
contained in Universities’ archives (telephone numbers, passwords,
generalities, etc.).
Representatives of the Italian Universities officially communicated
that the hackers stole only general data and not confidential
information. The objective of hackers seemed to simply be a
demonstration of the vulnerability of Universities’ ICT systems.
ICT security protocols
To increase the protection of on-line databases from cyber attacks.
9 SMT / CIT involved
10 Security Challenges
Source(s)
Le università svelate dagli hacker – LaStampa.it 07.07.2011
Gravissimo attacco hacker alle università – LaRepubblica.it 07.07.2011
Transnational organized crime
Past Event IT10
1
2
3
4
5
6
7
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9 SMT / CIT involved
10 Security Challenges
Honk Hong Drug Traffic
Transnational organized crime
Drugs diffusion
December 29, 2010
Kwai Chung Container Terminal
Drug traffickers organizations
Hong Kong Customs detected a transnational cocaine trafficking
case at Kwai Chung Container Terminal in 29 December 2010 and
seized about 290 kilogrammes of high-grade cocaine, with an
estimated value at about $260 million, in a container arriving
from South America and destined for the Mainland. Customs
officers intercepted two containers declared to contain "wood
working products" from a container vessel arriving from Chile
(South America) for examination. After an inspection using the Xray system and drug detector dogs, officers found a batch of
cocaine in one of the containers concealed inside 88 pieces of
hollowed-out wood planks.
To combat transnational cocaine trafficking activities, Hong Kong
Customs, through risk assessment, stepped up inspections
against suspicious consignments from South America for
examination at Kwai Chung Container Terminal. The Head of
Customs Drug Investigation Bureau, Mr John Lee, said today
(January 19) at a press briefing, "Hong Kong Customs will
continue to work closely with the Mainland and overseas drug
enforcement agencies to combat transnational drug trafficking
activities."
X-ray system and drug detector dogs
To increase the reliability and the efficacy of drug detectors at
Customs.
69
Source(s)
Government of Honk Hong, Custom and Excise Department – Press Release
http://www.customs.gov.hk/en/publication_press/press/index_id_787.html
70
Illegal immigration
Past Event IT11
1
2
3
4
5
6
Name
Type - Threat topic
Threat
Date
Where - Field / Area
Who
Karaburun tragedy
Illegal Immigration
Death of immigrants travelling in unsecured conditions
Jenuary 9th, 2004
Strait of Otranto towards Brindisi in the coasts of Puglia
Travel arrangers (2 drivers and 1 traffic leader) and 36 people from north
Albania.
Karaburun tragedy, also known as 9 January tragedy in 2004 was the fatal trip of
36 people from north Albania, 2 drivers and 1 traffic leaders, who were trying to
cross the Strait of Otranto towards Brindisi in the coasts of Puglia by means of an
inflatable boat. Karaburun tragedy is the Albanians emigrants' marine tragedy
with the 2nd highest mortality rate after the Otranto tragedy in March 1997,
when the Albanian ship with clandestine was hit by the Italian combat ship
Sibilla, causing the death of 84 people.
7
Event Description
8
Effects and impacts
28 people died or were declared lost. On November 8, 2010, Council of the
European Union approved visa-free travel to Schengen Area for Albanian citizens.
9
10
SMT / CIT involved
Security Challenges
Satellites, Radio Communications, Radar
To improve sea monitoring systems and to increase the rapidity/efficiency of
emergency response procedures to coastal accidents.
Source(s)
"Visa liberalisation for Albania and Bosnia and Herzegovina". Council Of The European Union. 2010-11-08.
http://www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/jha/117555.pdf.
Albanian news:
http://www.alsat.tv/eng/ALSAT_Lajme/Breaking_News/Otranto_Tragedy,_Session_in_the_Court_of_Lecce_P
ostponed/
71
White collar crime
Past Event IT12
1
2
3
4
5
Name
Type - Threat topic
Threat
Date
Where - Field / Area
6
7
Who
Event Description
8
Effects and impacts
9
SMT / CIT involved
10 Security Challenges
Olive Oil Relabeling Fraud
White collar Crime
Pathogens spreading from uncontrolled oil quality
March, 05th , 2008
Italy's thriving fake olive oil business involves importing oil from Tunisia,
Greece and Spain.
Italian Oil producers.
12:01AM GMT, 05 Mar 2008, more than 400 officers took part in
Operation Golden Oil after an investigation discovered as many as 91
people may have been involved in passing off low quality oil, made with
olives around the Mediterranean, for the finest Italian product. Italy's
thriving fake olive oil business involves importing oil from Tunisia,
Greece and Spain and re-labelling it as Italian oil. Other ploys include
labelling inferior oil as extra-virgin olive oil and claiming EU subsidies for
growing olives in Italy while actually importing them from elsewhere.
Police found invoices to the EU for €6.5 million of subsidies during the
raids, as well as receipts for €39 million of 'Italian' oil made with nonItalian olives. Coldiretti, the farmers' union, said the amount of foreign
oil being imported and re-labelled as Italian "rose by a quarter in 2007".
Police in Italy have arrested 23 people and confiscated 85 farms in an
operation that has exposed the scale of the country's fraudulent olive
oil trade.
Security of Commercial Transactions (with focus on food
importing/exporting), food quality control systems.
To increase the traceability of goods exported/imported in European
Union Countries.
Source http://www.telegraph.co.uk/news/worldnews/1580807/Italian-police-crack-down-on-olive-oilfraud.html
72
UK
This chapter provides an overview of security and public safety incidents that have directly targeted
or otherwise effects public transportation in London, particularly the Underground system, as
required by WP6. This report is not an exhaustive compilation of such events but a selective
presentation of the most significant mass emergencies or deliberate attacks that have occurred
during and since WWII. The information that follows has been gathered from media sources and
academic literature when available. The incidents outlined herein provide the backdrop for the
development of future scenarios in the later stages of WP6.
Past Event UK1
1
2
3
Name
Category of security event
4
5
6
Type of event
Date
Where - Field / Area
Who
7
Event Description
Bethnal Station Disaster
Mass public emergency
Numerous bombings and related mass emergencies affecting
London’s civilian transportation system during WWII.
March 3rd 1943
Bethnal Underground Station
Outcome of bombings during German blitz of London
The most intense period of the blitz was between the fall of
1940 and the spring of 1941 during which time London was
bombed for 76 consecutive nights by German air raids. The
raids directly and indirectly affected London’s transportation
system. The Underground was also used as a wartime shelter
for London residents. Though authorities were initially reluctant
to allow citizens to use Underground stations as bomb shelters
the regularity of night-time bombing raids during the height of
the Blitz prompted officials to reverse their position. At one
point during this time a full 4% of London’s population was
estimated to be residing primarily in the Underground. The
makeshift shelters were not entirely bombproof of course, and
bombs damaged Underground stations on a number of
occasions. Sheltering in the Underground also generated its
own problems such as malnutrition, and disease, and
psychological maladaptation. Indeed, one of the reasons
authorities were initially reluctant to allow sheltering in the
system was that they would be left with a quasi-feral population
of deep-level tube dwellers.
The deadliest event associated with the Underground during
this time was not due to the bombs but a human crush. In
evening of March 3rd 1943 the Bethnal station was opened for
sheltering in anticipation of a night raid. The sounding of the air
sirens combined with the firing of a nearby (and previously
secret) anti-aircraft weapon caused panic amongst the crowd
and a rush to descend the stairs to the shelter. An individual at
the bottom of the stairs tripped, causing many others to fall and
be crushed under the weight of those behind them.
73
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
173 people, the majority of which were women and children,
were killed in the disaster. This was the UK’s largest single loss
of civilian life during WWII and the single greatest loss of life in
the history of the Underground.
Authorities blamed the incident on the irrationality of the crowd
(‘mob mentality’) but inadequate attention to access and egress
in the station, as with most stations at the time, almost
certainly played a part in fomenting the conditions that lead to
the disaster.
The government’s inclination towards secrecy during wartime
prevented news of the incident from travelling widely; leading
some to accuse the government of censoring new of the
disaster and preventing a full investigation of what occurred.
The Bethnal disaster highlights the problem of crowd
management that public safety authorities continue to deal
with today. Though the direct legacy of the Bethnal incident
appears to be minimal, the broader problem of crowd
management – or more specifically, distinct failures of crowd
management – has driven innovations in the ‘science’ of crowd
control. This includes modifications to the built environment
(most evident in how sport stadium are construction, especially
after Hillsborough), the development of militarized police crowd
control tactics (most evident in the policing of mass protests at
the summits of the global political and economic elite), and
computer-based simulation of crowd dynamics.
Sources
www.dailymail.co.uk/news/article-521490/The-Bethnal-Green-Tube-tragedy-saw-173people-crushed-death--making-wars-worst-civilian-disaster-But-censored-history.html
http://www.bbc.co.uk/dna/h2g2/A17895702
http://www.bbc.co.uk/ww2peopleswar/stories/09/a795909.shtml
74
Past Event UK2
1
2
3
4
5
6
7
Name
Category of security event
Type of event
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
1973 IRA bomb attempts
Suspected terrorism
Attempted bombings (3)
1973
Baker Street Underground station; Sloan Square
Underground Station
Unknown. British authorities held the IRA responsible for
all three attempts.
In August 1973 two bombs were discovered in the Baker
Street tube station. Both bombs were defused. In
December 1973 a similar type of bomb was diffused in
Sloan Square station.
There were no direct material effects due to the fact that
the bombs were discovered before they could be
detonated. Nevertheless, they provided a reminder of the
ongoing IRA threat and the vulnerability of London’s rail
infrastructure.
Employees who discovered the bombs alerted the police,
who disarmed the unsophisticated devices.
These attempted bombings roughly mark the beginning of
a wave of attempted and successful bombings throughout
London and the UK that were part of the IRA’s ongoing
efforts to create an independent and unified Ireland free of
UK political control.
Though unsuccessful, the attempts were reminders of the
difficulties in securing open systems designed for efficient
movement and predicated on trust from unpredictable
methods that exploit the vulnerabilities afforded by such
systems.
http://www.bbc.co.uk/dna/h2g2/A17895702
75
Past Event UK3
1
2
3
4
5
6
7
8
9
10
11
Name
Category of security event*
Type of event
Date
Where - Field / Area
Hammersmith & City bomb
Terrorism
Bomb
March 15th 1976
West Ham Underground Station
Vincent Donnelly. The IRA did not claim responsibility for
the bomb but Donnelly was a known member of the IRA.
British authorities presumed the bombing was politically
Who
motivated.
At approximately 4:40pm a bomb detonated on an
Underground rail car minutes after it departed from West
Ham station. Donnelly may have boarded a train heading
away from central London, returned to West Ham after
realizing his mistake, and then boarded a train heading
Event Description
for the City and King’s Cross. Still in possession of the
bomb as it was about to detonate, Donnelly threw the
bag containing the bomb down the length of the car
before escaping through the driver’s cab window into the
tunnel after the explosion.
The bomb killed one person, destroyed the rail car, and
caused substantial damage to the rail car and
Metropolitan line tunnel. The train conductor and a
Effects and impacts
passenger pursued Donnelly in the tunnel, both of whom
he shot, killing the conductor. Donnelly tried to shoot
himself once cornered by police but was unable to do so.
He is currently serving five life sentences in prison.
Security on the Underground consistently primarily of
Metropolitan Police (if nearby) and local staff maintaining
watch over the facility while performing other duties. As
SMT / CIT involved
such, security was not particularly sophisticated, and
Donnelly was evidently able to board more than one train
while carrying a bomb unnoticed.
The attempted bombings were part of the IRA’s ongoing
Other issues involved
efforts to effect political change through force.
As with the three unsuccessful bomb attempts in 1973,
this event highlighted the difficulties of securing and
open designed for efficient movement and predicated on
trust from unpredictable methods that exploit the
vulnerabilities afforded by such systems. It also drew
Security Challenges
attention to the potential damage that could be caused if
the plan fully ‘succeeded’ and the bomb detonated as it
carried on through the populated City only minutes later.
As of yet, however, such ‘success’ remained only a
possibility.
http://news.bbc.co.uk/onthisday/hi/dates/stories/march/15/newsid_2543000/254360
5
76
Past Event UK4
1
2
3
4
5
6
7
Name
Category of security
event
Type of event
Date
Where - Field / Area
Who
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
Wood Green bombing
Suspected terrorism
Bombing
March 16th 1976
Wood Green Underground Station
No suspected identified; authorities assumed it was
connected to the IRA
The day after the bombing on the Hammersmith & City line
(Event Summary 5) a bomb exploded on an empty train car
as it pulled out of a siding at Wood Green station in central
London.
The station and the rail car were both empty at the time,
thus minimizing casualties. Flying glass injured one person
standing on the train platform. However, had the bomb
detonated 10 minutes later the train would have been full
with football supporters leaving an afternoon match.
As with the Hammersmith & City bombing, the
perpetrators were successful in circumventing existing
security measures in place at the time.
The attempted bombings were part of the IRA’s ongoing
efforts to effect political change through force.
As with the Hammersmith & City bombing, the human
casualties of this event could have been much worst had
the bomb detonated only minutes later, and both events
thus serve to underscore the vulnerability of public
transportation systems. One direct effect of this event is
that litter bins were removed from all Underground
platforms.
http://everything2.com/title/London+Underground
http://www.bbc.co.uk/dna/h2g2/A17895702
77
Past Event UK5
1
2
3
4
5
6
Name
Category of security event
Type of event
Date
Where - Field / Area
Who
King’s Cross fire
Mass public emergency
Fire
Nov. 18th 1987
King’s Cross Underground Station
Accidental fire
At approximately 7:30pm a small fire started underneath a
wooden escalator exiting the rail-level platform of King’s
Cross tube station. The initial response from authorities
was that the fire was the result of an IRA bomb but this was
quickly discounted when the fire was investigated. Judged
at the outset to be small and not requiring an evaluation of
the station, the fire smouldered for some time under the
escalator fed by grease and various bits of other material
inside the machinery’s enclosure. The subsequent arrival of
an incoming train forced a large amount of air through the
exit tunnel (the ‘piston effect’), which intensified the fire in
the tunnel, ignited gasses that had accumulated at the top
end of the tunnel, and caused an explosion in the ticketlevel platform of the station. It is believed that a discarded
match used to light a cigarette caused the fire.
Thirty-one people were killed and over 60 hospitalized
from burns or smoke inhalation. The fire eventually
destroyed both platforms of the Piccadilly line of King’s
Cross station. Though a smoking ban in the Underground
was already in place it was not strongly enforced until after
this accident. The fire also revealed a previously unknown
property of gas combustion in enclosed spaces now known
as the “trench effect,” and the King’s Cross fire is often
used an exemplary instance of this effect for fire
prevention training purposes. The direct legacy of this
event was the refinement of fire and building codes in the
Underground. With one exception, all wood escalators in
the system were replaced with metal escalators.
Regulations were also placed in the type of paint that could
be used in the Underground and requirements for fire
suppression sprinklers and heat detectors.
Fire fighters succeeded in fully extinguishing the fire by the
following morning.
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
*
http://www.firetactics.com/KINGSCROSS.htm
http://www.firetactics.com/service.htm
The incident was an early indication of the problems of
congestion and crowd control faced with the rise is
passengers in the aging Underground system..
Past Event UK6
78
1
2
3
4
5
Name
Category of security event
Type of event
Date
Where - Field / Area
6
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
Bishopsgate bombing
Suspected terrorism
Bombing
April 24th 1993
Bishopsgate, City of London
No individuals were apprehended for the bombing. The IRA
was widely blamed for the attack.
At 10:25am on April 24th a one-tonne fertilizer bomb was
detonated in the Bishopsgate district of the City of London.
The bomb was delivered in the bed of a dump truck that
had been stolen the previous month in northern England.
The truck was driven into the City and abandoned at
approximately 9:00am. Authorities received anonymous
information that a bomb was in the area, and police who
had already taken notice of the truck were in the process of
evacuating the area when it exploded.
One person was killed and 44 injured. The relatively low
casualty rate is due to the fact that the bombing occurred
on a Saturday morning when the district is only sparsely
populated. Material damage was extensive. Near 1 billion
GBP in damage was caused to buildings in the vicinity,
including serious damage to the Liverpool Underground
station.
The low human impact of the Bishopsgate bombing belied
the broader influence of the event on how terrorism in the
City would be responded to. The City had been targeted by
other bombs in the early 1990s, notably the St. Mary’s Axe
bombing of 1991 (not included in this summary), but while
response to the St. Mary’s Axe bombing was primarily
reactive in nature and focused on developing emergency
plans for managing the fallout of similar events in the
future, reaction to the Bishopsgate bombing focused on
preventing future incidents. The main thrust of this
preventative orientation was to dislocate the City from the
broader surroundings through physical and technological
means. Some called for the City to be turned into a
“medieval-style walled enclave to prevent further terrorist
attacks.” While extreme, this statement nonetheless
reflects the wider sentiment that the only manner to fully
protect the city was to barricade it from its surroundings.
This was realized (only in part, of course) by the rapid
development of the City’s “ring of steel. Modelled on the
counter-terrorism measures used to protect central Belfast
from similar attacks, the ring of steel involved establishing
a cordon around most of the City (it ‘faced’ mostly to the
north and east) and implementing stringent access controls
through checkpoints and other traffic management
measures. In addition to a highly visible police presence the
bombing also ushered in a rapid expansion of surveillance
79
10
Other issues involved
11
Security Challenges
cameras at checkpoints and throughout the City.
This event marked the last major incident before a yearlong ceasefire with the IRA would take effect.
Along with the 1991 St. Mary’s Axe bombing, the
Bishopsgate bomb confirmed the “worst fears of the
police” that determined perpetrators to deliver highimpact explosives into the heart of London. Nevertheless,
the human costs of both to these bombings remained
relatively low, which is the result of decisions of the
bombers (to warn authorities and choose to bomb on a
weekend) rather than existing security measures.
Coaffee, J. 2003. Terrorism, Risk and the City. Aldershot: Ashgate.
80
Past Event UK7
1
2
3
4
5
Name
Category of security event
Type of event
Date
Where - Field / Area
6
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
Canary Wharf Bombing
Suspected terrorism
Bombing
Feb. 9th 1996
Adjacent to the South Quay Station of the Docklands Light Railway in
London’s Canary Wharf district.
The IRA claimed responsibility for the bombing. James McArdle
was arrested and imprisoned for 25 years. He was released in 2000
under the provisions of the 2000 Good Friday Agreement.
At approximately 7:00pm a half-tonne ammonium fertilizer bomb
was detonated in the Canary Wharf financial district. The bomb did
not directly target the DLR but it was close enough to cause
substantial damage to South Quay station.
Police were warned of the bomb approximately 30 minutes prior to
the blast, and while they were able to evacuate most of the area two
newsstand agents were killed and 39 hospitalized. Three nearby
buildings were damaged beyond repair (two were subsequently
reconstructed). The rail station closed for a period of time but
reopened by the end of the month. 85 million GBP in direct damage
costs were sustained.
The “ring of steel” introduced after the St. Mary’s Axe and
Bishopsgate bombings was relaxed during the ceasefire of
1994/1995. This bombing marked the end of that ceasefire and the
return of the fortress mentality that characterized security in the
City. Security cordons and checkpoints were immediately reactivated
due to concerns that a bombing of the City would be targeted, and in
the following days proposals were brought forth to expand the
security zone westward, bringing over 75% of the City inside the
security cordon. The number of security cameras at checkpoints and
within the cordon increased as well, with every camera capable of
reading licence plate and accessing a national database to check for
suspect vehicles. The ring of steel remains the central element of
security in the City today and is a key part of maintaining the City’s
reputation as a safe and secure environment for global commerce.
There has never been another successful bombing in the City, which
may speak to the effectiveness of the initiative for protecting
London’s financial district. However, other bombings occurring
outside the security cordon demonstrates the problem of
displacement wherein making a target highly security may make
other targets vulnerable.
Coaffee, J. 2003. Terrorism, Risk and the City. Aldershot: Ashgate.
81
Past Event UK8
1
2
3
4
5
6
Name
Category of security event
Type of event
Date
Where - Field / Area
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
Aldwych Bus Bomb
Suspected terrorism
Bombing
Feb 18th 1996
Aldwych near the Strand
Edward O’Brian. The IRA did not claim responsibly for
the bomb but O’Brian was a known member of the IRA.
At approximately 10:40pm a bomb explored on a
London bus as it travelled west along the Strand
towards Westminster. The detonation is believed to be
accidental and may have occurred as the bomber was
transporting the bomb and bomb making material to
another location.
Six people sustained serious injury and three more
were treated at the hospital. The bomber was killed in
the explosion. Authorities were able to determine
O’Brian’s identity and a search of his apartment found
enough bombing making equipment for several more
similarly sized bombs.
The bomber was able to transport the bomb
undetected until they detonated.
Though the IRA did not claim responsibility for the
bombing it occurred just over a week after the Canary
Wharf bombing and thus firmed up expectations that
more bombings were to come.
This event demonstrates that while the “ring of steel”
security cordon may protect the City, it may serve at
most to displace the threat to other areas of London.
Furthermore, this event and others like it demonstrate
the difficulty of providing security for a system that by
its nature is open and accessible.
http://www.independent.co.uk/news/dead-ira-man-had-hitlist-of-bomb-targets1305236.html
http://news.bbc.co.uk/onthisday/hi/dates/stories/february/18/newsid_4165000/4165
719.stm
82
Past Event UK9
1
2
3
4
5
Name
Category of security
event
Type of event
Date
Where - Field / Area
6
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
7/7 Bombings
Terrorism
Bombing (4)
July 7th 2005
Multiple locations
Hasib Hussain, Mohammad Sidique Khan, Germaine
Lindsay, Shehzad Tanweer. The perpetrators claimed to be
inspired by al Qaeda.
At approximately 8:50am three bombs were detonated
inside three different trains in central London and a fourth
explosion an hour later in an above ground bus. The first
bomb exploded on a Circle line train as it approached
Liverpool Street. The second also exploded on the Circle
line as it travelled towards Paddington Station. The third
exploded on a Piccadilly train travelling to Russell Square.
All trains had left from King’s Cross St. Pancras Station. The
perpetrators were later tracked on surveillance camera as
they passed through King’s Cross St. Pancras. The fourth
bomb exploded an hour later on the top level of a bus on
Tavistock Square after leaving King’s Cross.
Fifty-six people were killed and over 700 injured in addition
to the four bombers. Estimates of the economic impact of
the bombing vary widely. The entire Underground system
was shut down for days and reopened in stages in the days
that followed.
The event(s) of July 7th 2005 had wide-ranging national and
international impacts. The bombings have been referred to
as a “game changer” in how terrorism is addressed in the
country. Security at perceived targets such as political
institutions, transportation hubs, and symbolic greatly
increased in the capital and other major centres
immediately after the bombing. London police use existing
stop-and-search powers much more freely to frisk transit
passengers and MI5 squads with shoot-to-kill orders
covertly tracked suspects for fear of follow-up bombings
(see Event Summary 11). A number of measures were
brought forth in the wake of the bombings intended to
enhance national counter-terrorism capabilities. The
centrepiece of these efforts was The Terrorism Act of 2006,
which extended the period that individuals could be
detained (to 28 from 14) if suspected of terrorism and
allowed Parliament to freeze the asset of suspected
terrorists. Though some of these measures have expired,
many remain in effect today. More broadly, it also brought
the UK and USA together as allies in the US-led ‘war on
terror.’
The timing and movements of the perpetrators from Luton
83
10
Other issues involved
11
Security Challenges
to King’s Cross were recreated using video surveillance
footage. The bombers were otherwise able to circumvent
existing security measures.
The perpetrators were British-born “cleanskins,” meaning
they were previously unknown to authorities. Of Pakistani
and Jamaican descent, all perpetrators were British born
and from well-to-do middle class families. The background
of the bombers thus challenged accepted conceptions of
terrorism and cemented fears about ‘home-grown’ Muslim
extremism. This had lead to widespread suspicion of
Muslims and leading to strained relationships with the
country’s large Muslim population.
The event confirmed the vulnerability of London’s mass
transit system as a target for unpredictable, asymmetrical
attacks due to the symbolic value of the system combined
with its lack of individualized security measures.
http://www.guardian.co.uk/uk/2010/jul/07/london-bombings-anti-terrorism
http://www.guardian.co.uk/politics/2009/may/13/terrorism-legislation-jack-straw
84
Past Event UK10
1
2
3
4
5
Name
Category of security event
Type of event
Date
Where - Field / Area
6
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
July 2005 attempted bombings
Terrorism
Attempted bombing
July 21st 2005
Multiple locations
Ibrahim Said, Yassin Hassan Omar, Hussain Osman, Ramzi
Mohamed. These individuals are currently serving 40 year
prison terms. As with the 7/7 bombings, these individuals
acted alone but claimed to be inspired by al Qaeda.
Exactly two weeks after the bombings of 7/7 four persons
again targeted London’s transportation system by attempting
to detonate four bombs on four different vehicles. Shortly
after noon an explosion occurred on the Hammersmith &
City line near Shepherd’s Bush Station. Minutes later another
explosion occurred on the Northern line near Oval Station,
followed shortly by an explosion on the Victoria Line near
Warren Street Station. A fourth explosion followed on a
Hackney Wick-bound bus in east London.
None of the bombs were successful as only the detonator
caps fired, not the main charges. There were no direct
casualties as a direct result of the attempted bombs, but one
person died as a result of an asthma attack at one of the
locations. Initial reports of a strange smell coming from some
of the stations raised concerns of a chemical attack but these
concerns were quickly dismissed. Though the direct material
impact of the attempted bombings was minimal, they
reinforced the heightened state of alarm felt after the 7/7 by
seemingly confirming fears that the 7/7 bombings might not
have been a one-off attack but the first of a coordinated
onslaught of similar attacks by al Qaeda-inspired and Britishborn attackers.
Again, the perpetrators were successful in delivering the
explosives to the intended targets. The only reasons greater
casualties were not incurred is because the explosives were
duds.
The background of the attackers – all British-born Muslims –
further entrenched fears of homegrown Islamic extremism,
thus reinforcing suspicion of Muslims and further straining
already tense relationships.
The event confirmed the vulnerability of London’s mass
transit system as a target for unpredictable, asymmetrical
attacks due to the symbolic value of the system combined
with its lack of individualized security measures.
http://news.bbc.co.uk/2/shared/spl/hi/uk/05/london_blasts/what_happened/html/21_07_0
5.stm#
http://www.guardian.co.uk/uk/2010/jul/07/london-bombings-anti-terrorism
85
Past Event UK11
1
2
3
4
5
6
Name
Category of security event
Type of event
Date
Where - Field / Area
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
Shooting of Jean Charles de Menezes
Murder
Wrongful shooting of suspect by police
July 22nd 2005
Stockton Station
Three Metropolitan Police officers
The shooting of de Menezes occurred the day after the four
attempted bombings of July 21st described in Event Summary 10. As
the suspect had not died in the previous day’s attempts a full-scale
hunt was launched for the suspects. de Menezes was mistakenly
identified as one of these suspects and was being followed by a
surveillance unit at his home. De Menezes left his apartment and
was followed by at least three members of the surveillance unit.
Police followed de Menezes to the Stockwell Underground Station
where he apparently acted ‘suspicious’ before boarding a train. A
three-man firearms unit confronted de Menezes there, and while
the details of what occurred in the following moments are disputed
the encounter ended with de Menezes shot seven times in the head
and once in the shoulder. Informed opinion suggests that the
shooting bears the hallmarks of a military operation designed to
‘neutralize’ suicide bombers rather than typical police work.
Police initially stated that the shooting was directly connected to the
previous day’s bombings. De Menezes was said to have wore a
heavy jacket unsuited for the weather, behaved erratically as he
approached the tube station, jumped the turnstile at the ticket level,
ran for the train as it as leaving the platform, and challenged officers
when the confronted him on the train. Almost all of these details
were disputed or contradicted by evidence collected after the fact.
Police changed their position the following day by stating that de
Menezes was not connected to the bombings in any way followd by
an official apology. De Menezes family received 585,000 GBP in
compensation. Subsequent investigation o the shooting raised raises
questions of whether the police tried to hide procedural mistakes
that occurred immediately prior to following de Menezes into the
Underground.
The shooting also brought widespread criticism of police ‘shoot to
kill’ procedures for dealing with suicide bombers. The codename
‘Operation Kratos,’ which authorized police to shoot suspected
suicide bombers in the head without warning, is no longer used in
official police vocabulary as a result of the de Menezes shooting
though similar tactics may remain in force.
The incident exemplifies the siege mentalities of authorities at the
time.
86
http://news.bbc.co.uk/2/hi/uk_news/7069796.stm
Past Event UK12
1
2
3
4
5
6
Name
Category of security event
Type of event
Date
Where - Field / Area
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
Haymarket attempted car bomb
Suspected terrorism
Attempted car bomb (multiple)
June 29th 2007
Haymarket, London
Unknown perpetrators
Suspects attempted to detonate two car bombs in central
London on evening of July 27. The bombs were crude but
capable of inflicting heavy damage and loss of life. The
bombs were discovered and disabled before they could be
detonated.
Though the bombs were not targeting the transportation
system, at least one tube station was closed during the
morning rush hour, leading to significant delays for trains
passing through the area.
The bombs were detected due to a combination of calls to
the police from the public reporting the suspicious vehicles
as well as attentive police officers in the area.
The attempted bombing may have been planned and
perpetrated by the same group as those responsible for
driving a vehicle loaded with propane canisters into the
arrivals level of Glasgow International Airport the previous
day. It was also suggested that the failed attempt may have
been connected a planned Gay Pride parade to be held in
the Haymarket district later in the week but that
connection was not substantiated.
The City’s “ring of steel” is intended to prevent attempts
such as this by searching all vehicles entering the district at
checkpoints. This event might be considered as indicative
of how the ring of steel displaces the threat to other areas
of the city. The widespread disruption to the transportation
system this event caused is also indicative of how relatively
small disturbances can cascade throughout complex
systems.
http://news.bbc.co.uk/2/hi/6252276.stm
http://news.bbc.co.uk/2/hi/uk_news/6255960.stm
87
Past Event UK13
1
2
3
4
5
Name
Category of security event
Type of event
Date
6
Where - Field / Area
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
London Riot
Large-scale riots
Public emergency
August 2011
Started in Tottenham and spread to other locations around
London
Large numbers of individuals
In the early hours of August 7th 2011 a march protesting the
police shooting of a 29 year old man in Tottenham, London
turned violent. Mass looting and vandalism of the
Tottenham retail district followed. Widespread violence
and looting in other areas of London occurred in the days
following that, which was met by a deployment of over
16,000 police officers and militarized tactics of crowd
control throughout London in the following nights.
Over 700 individuals were arrested during the riots and
damages of over 100 million GPB. The causes of the riots
are source of widespread debate.
Though the Underground system does not appear to be
targeted in any way, the closure of public transportation
systems has become one element in a repertoire of tactics
for dealing with mass unrest. Along with the use of lessthan-lethal weapons such as water cannons or rubbers
bullets, controlling the movement of protestors is a key
tactic of crowd control, and closing down public
transportation is one way of affecting this control.
Numerous Underground stations in London were closed
during the height of the August unrest to prevent the
movement of crowds to other districts of the city.
Many in the media have questioned whether the London
riots are a preview of policing issues that may arise during
the London 2012 Olympics.
http://www.globalsurance.com/blog/london-riots-cost-more-than-100m-404220.html
88
Past Event UK14
1
2
3
4
5
6
Name
Category of security event
Type of event
Date
Where - Field / Area
Who
7
Event Description
8
Effects and impacts
9
SMT / CIT involved
10
Other issues involved
11
Security Challenges
Crime and Disorder
Illegal/undesirable behaviour
Illegal/undesirable behaviour
Ongoing
London Underground
Crime and antisocial behaviour in general are ongoing
issues for Transport for London. These categories include
distinct crimes such as pickpocketing, muggings, and
assaults as well as public drunkenness, rowdiness, groups
of youths, and the verbal abuse of other passengers. While
terrorism often garners the greatest share of attention on
the topic of security, these issues occupy a far greater
prominence for day-to-day management of the
Underground.
Though crime on the London transportation system is
statistically rare, crime and antisocial behaviour is often
framed as a ‘quality of life’ issue that affects all persons
using the system.
Everyday policing on London’s transportation system is
guided by two principles: broken windows policing and
reassurance policing. The broken windows thesis asserts
that major crimes are precipitated by a proliferation of
small offences, and that being aggressive with these small
offences – graffiti, turnstile jumpers, panhandling, etc. –
will by extension provide a check on major crime.
Reassurance policing asserts that the perception of crime
and disorder is a problem in itself and that changing those
perceptions is also a policing objective. Both of these
theories place a strong emphasis on police visibility in order
to be deter and reassure. This is the current policy of
Transport for London’s Public Safety and Security
Directorate.
How can authorities not only reduce crime but reduce the
fear of crime?
89
Threat Scenarios
The scenarios outlined in this report are deliberately speculative and seemingly far-fetched, but they
are not removed from the realm of possibility. Each scenario reflects the incremental extension of
events that have occurred elsewhere combined with the realization of past near misses that would
have had far greater consequences if carried out to the full extent.
Terror Scenarios
1.
Toxic gas attack on a subway train1
Potential offender
Objective / intention
of offender
Tools
Use of tools
Approach of offender
Terrorists with political or religious motivation. They will most likely be
part of a big terrorist network and have numerous abettors in order to
successfully acquire the necessary chemical agents and process them. One
person is sufficient to ultimately carry out the attack (or more if the attack
is directed at several targets).
Economic damage
Human lives
Fear, demoralisation
Concealed pressurised canister containing a toxic chemical agent
(pulmonary / nerve / blood agent), but a low-tech alternative is also
thinkable (e.g. member of the Aum Shinrikyo used plastic bags wrapped in
newspapers containing liquid sarin and then poked holes into the bags
with umbrellas to release the toxin).
The main obstacle in this scenario is obtaining or producing the necessary
chemical agent(s).
Chemical toxins work best in enclosed environments. Most railway stations
or airport terminals are vast halls, which reduces effectiveness significantly
and makes the use of larger quantities of toxin necessary.
A subway train however provides an ideal environment for a gas attack,
since not even opening windows and doors will sufficiently reduce the gas
concentration and casualties.
A pressurised cylinder can be used to disperse the chemical agent
automatically or manually. Automatic release will require a much more
sophisticated container, but may also lead to the detection of the canister
since the attacker will leave the concealed canister behind. Manual release
minimises the chance of detection but will turn this scenario into a suicide
attack since the attacker will most likely be the first victim of the toxin. This
is due to the fact that the toxin needs to be dispersed ideally while the
train is travelling. That way the toxin can disperse in the train and then,
upon arrival at the next stop, spread out to the subway station. The
attacker could use a gas mask (when using a toxin that needs to be
inhaled), but putting on a gas mask before releasing the gas will most likely
be noticed by the other passengers who might interfere and thus prevent
the attack.
The attacker enters the subway train with the regular passengers.
1 Inspired by: Shahar, Y., Non-Conventional Terrorism: Challenge & Response, in: von Knop, K./Neisser, H./van
Creveld, M. (Ed.), Countering Modern Terrorism – Histroy, Current Issues and Future Threats (2nd International
Security Conference), Bielefeld, 2005, 361, 375; and the Sarin gas attack by Aum Shinrikyo on the Tokyo
subway, http://en.wikipedia.org/wiki/Sarin_gas_attack_on_the_Tokyo_subway.
90
/ access point
Insertion of tools
Target
Location of offender
Danger / threat
SMTs (preventive)
SMTs (emergency)
2.
The attacker will use a backpack or a bag to transport and to conceal the
canister. Since there are usually no bag checks at subway stations, this will
be no obstacle. Even if bags are checked (e.g. at major subway stations)
the attacker can enter the subway train at a remote station where there
are no bag checks.
Passengers travelling on a subway train. If the train is not stopped before
reaching a station (e.g. by engaging the emergency brakes) there will also
be casualties at the station.
The attack will most likely be carried out during rush hour for maximum
effectiveness.
In case the attacker uses an automated dispersion device, he will leave the
train after planting the device. If the toxin is dispersed manually (e.g. by
manually opening a valve), the attacker will have to remain with the
container and be killed by the toxin.
The attacker could also initiate dispersion while the train is at a station and
then quickly leave the train just before the doors close and the train
departs. There is however some risk that the attacker will be contaminated
despite these effort.
The number of casualties depends highly on the chemical agents used in
the attack. Extensive decontamination may be necessary after the attack,
leading to a complete closure of the contaminated facility.
Access control;
(random) luggage / bag inspections;
CBRNE sensors and measurement systems.
Complete evacuation of the contaminated area (and possibly the
surrounding area);
halt traffic;
EMTs / paramedics;
fire brigade;
protective suits and gear (NBC protection, respirators);
movable decontamination facilities.
Sniper attack on the front court of a central railway station2
Potential offender
Objective / intention
of offender
Tools
A terrorist with political or religious motivation and the determination to
die for his cause. The sniper will most likely have a military background or
have received training at a terrorist boot camp. The shooter will fire shots
until he is neutralised, making this a suicide attack. (A second or third
shooter might increase the number of casualties and delay neutralisation
by the police.)
Human lives
Fear, demoralisation
Sniper rifle (for military/law enforcement use, shooting sport or hunting;
some models available legally by gun licence holders, others through the
2
Inspired by the rampage of Charles Whitman, the “Austin Sniper”, on August 1, 1966. Whitman shot (among
others) 10 students of the University of Texas from the 28 th floor observation deck of the University’s
administrative building. http://en.wikipedia.org/wiki/Austin_sniper;
http://www.cbsnews.com/stories/2007/04/16/national/main2689785.shtml.
91
Use of tools
Approach of offender
/
access point
Insertion of tools
Target
Location of offender
Danger / threat
SMTs (preventive)
SMTs (emergency)
black market), ammunition, possibly lock picks, bag / suitcase etc. for
concealed transportation. Purchasing the (preferably state-of-the-art) rifle
or smuggling one into the country is the main obstacle to overcome in this
scenario.
The sniper takes position on the roof or in one of the upper floors of a
building that provides clear sight on the front court of a central railway
station. He then shoots random people on the plaza and the adjacent
streets, bus / taxi stations, etc.
Most buildings surrounding the front court of a central railway station are
usually owned by companies who rent out individual floors to other
companies, doctors, store owners, etc. (e.g. Mainz central station). Gaining
access to the building itself will therefore not require any special measures
by the shooter.
The shooter will have staked out the area beforehand to determine the
ideal position for his attack. Since the attack has to take place during office
hours for maximum impact, using a window in an occupied office as firing
position may require the murder of the people working there using a
second, smaller gun. The sniper may use lunch time for his intrusion to find
as little resistance as possible (and to ensure at the same time that the
plaza is crowded). Getting through restricted areas may require the use of
lock picks or force to open locked doors to gain access to certain floors or
the roof.
Another possibility to gain access to the firing position may be to seek
employment in the building, ideally as a caretaker.
The shooter can use a dismantled sniper rifle and transport it using an
unsuspicious bag, suitcase, backpack, etc. He then needs to assemble the
pieces upon arrival at the chosen firing position. He may also carry a small
handgun to deal with anyone who might pose an obstacle on his way to
the firing position.
Random people on the front court of a central railway station.
The roof or one of the upper floors of a building that provides clear sight
on the front court of a central railway station. The shooter may barricade
the door leading to the roof or the room he is in to delay police attempts
to neutralise him.
In 1966, Charles Whitman managed to kill ten people by shooting down
from the top level of an administrative building in Austin, Texas. He was an
ex-marine and hunted deer as a hobby. Since gun rampages were less
common back then, many pedestrians misinterpreted the shots at first and
went on with their business. This is when Whitman was able to kill most of
his victims. 66 minutes passed from the first shot fired until Whitman was
neutralised.
It is possible that a sniper with proper training could kill a dozen people or
more before being neutralised. Use of a state-of-the-art rifle and a silencer
might help to significantly increase the number of victims.
Potential problems for police forces dealing with this type of threat include
the localisation of the shooter and gaining access to his position.
Access control for buildings surrounding critical infrastructure
Evacuation;
halt traffic;
public announcements (radio, public address systems) to instruct people to
avoid the targeted area or to seek cover inside buildings and behind cars /
92
busses, etc.;
police special forces, possibly police snipers.
3.
Suitcase bombs on commuter trains3
Potential offender
Objective / intention
of offender
Tools
Use of tools
Approach of offender
/ access point
Insertion of tools
Terrorists with political or religious motivation (and possibly the
determination to die for their cause). Some knowledge of chemistry is
required to build a working bomb.
Human lives
Fear, demoralisation
(Economic damage)
Self-made explosives hidden inside suitcases, wheelie bags, backpacks,
etc.; possibly using substances like hydrogen peroxide that can be acquired
legally to build the bomb. Building the bombs and amassing the required
amount of explosive materials without alerting the authorities will be the
major objective in this scenario for the bombers.
The concealed bombs are placed on trains. They detonate ideally while the
train is travelling at top speed to ensure derailing it which will increase
casualties.
To ensure that the bombs are not discovered and disarmed, it may be
necessary for some of the bombers to stay with the bombs until the
detonation is triggered (either manually or remotely to ensure that the
suicide attacker does not get cold feet), making this scenario a suicide
bombing.
Multiple bombs can be placed on a single train for increased effect. Some
can be timed to explode after the primary bomb(s) have detonated to hit
rescue workers (EMTs, police officers, fire brigade) trying to recover
injured or dead people from the wreckage of the primary explosion.
The bombers could enter the trains at remote and small railway stations
which are usually not equipped with any type of security technology and
have neither personnel from the railway company nor police stationed
there. Then they could wait until the trains get more and more crowded as
they approach metropolitan areas and detonate the bombs. Since there
will be no surveillance footage from the railway station where the
bombers entered the trains, it will be harder for police to resolve the crime
afterwards.
The bombs will be concealed. Since bags are not checked before entering a
train, getting the bombs into the trains will not be an obstacle. This might
be different, if the bombers chose a central railway station as a point of
entrance since police officers (e.g. of the German Federal Police) and
security guards from the railway company are on patrol there. They might
be alerted by suspicious behaviour, clothing or luggage.
3
Inspired by the train bombings in Madrid 2004 and the attempted bombings in Germany 2006.
http://news.bbc.co.uk/2/hi/in_depth/europe/2004/madrid_train_attacks/;
http://www.spiegel.de/thema/kofferbomber/.
93
Target
Location of offender
Danger / threat
SMTs (preventive)
SMTs (emergency)
4.
The concealed bombs are placed on (multiple) commuter trains. This
promises a higher number of casualties than express trains which usually
have fewer passengers on board.
The bombs would ideally have to be planted during rush-hour traffic.
Another possible point of time for such an attack would be before or after
a major sports event (e.g. premier league football) when a large number of
fans travel to the venue using public transportation.
There are three options in this scenario. In case the bombers want to make
certain that the concealed bombs are not discovered, at least one of them
has to stay with every bomb and die in the explosion. Another option
would be to stay with the bombs as long as possible, but to depart the
train shortly before the explosion occurs. A third option would be to leave
the trains as soon as the bombs have been planted. This third option may
result in the discovery of the bombs by vigilant security personnel /
conductors / passengers spotting the abandoned pieces of luggage. In the
last two options, the explosion would have to be triggered either by a
countdown clock or manually through an improvised remote (e.g. a cell
phone).
During the Madrid train bombings in 2004, 191 people were killed and
about 2000 injured when ten bombs exploded inside four commuter
trains. This gives an indication on the amount of casualties that can be
expected from similar attacks.
Alertness of conductors towards unattended luggage;
(random) luggage / bag inspections.
EMTs / paramedics;
fire brigade;
halt traffic;
bomb squad / bomb disposal unit to defuse bombs that might not have
exploded due to malfunction or have been left to hit rescue workers.
Gun rampage at an airport terminal building
Potential offender
Objective / intention
of offender
Tools
Use of tools
Terrorists (small group) with political or religious motivation and the
determination to die for their cause. The shooters need to have some, but
not extensive shooting skills, probably acquired during military service or
training at a terrorist boot camp.
Human lives
Fear, demoralisation
An array of firearms (e.g. shotguns, submachine guns, assault rifles; ideally
(semi-)automatic weapons), large quantities of ammunition and a
container for concealed transportation (e.g. bag, suitcase, backpack).
Wearing bulletproof clothing (e.g. Kevlar vest) would be advantageous for
the shooters to delay neutralisation by the police.
Purchasing (preferably state-of-the-art) firearms or smuggling them into
the country are the main obstacles to overcome in this scenario.
The shooters suddenly remove their firearms from their containers (e.g.
suitcases, bags, or from under their coats) and start shooting at random
people. People will most likely flee after the first shots have been fired, so
the shooters will have to keep moving to find new targets. Ideally the first
94
Approach of offender
/
access point
Insertion of tools
Target
Location of offender
Danger / threat
SMTs (preventive)
SMTs (emergency)
targets would be police officers on patrol in the terminal building.
The shooters may also use the firearms to take hostages after the initial
killing spree.
The shooters enter the main terminal building just like regular flight
passengers, wearing casual outfits (possibly dressing in layers with
protective / bulletproof clothing underneath) and carrying bags or
suitcases containing the guns. Since there are no security checks before
check-in (at least in most countries, e.g. Germany4), gaining access will be
no obstacle for the shooters.
The loaded firearms and ammunition are carried in unsuspicious
containers like suitcases, bags or backpacks. Since luggage is only searched
during / after check-in, like gaining access, this will be no obstacle (cf.
footnote 5).
The targets are people visiting the terminal building of a major airport (e.g.
people waiting at the check-in counters). Daytime during holiday season
(especially summer holidays) would be an ideal point in time for such an
attack, since there is a significantly larger passenger volume.
The shooters will stand in a central spot in the main terminal building,
ideally in a crowd of other people. Since there will be a panic after the first
shots have been fired and people will flee from the source of danger, the
shooters will then have to move around in the building to find new targets.
After a significant amount of police officers and possibly special forces
have arrived at the scene, the shooters will most likely seek cover behind
check-in counters and seek a standoff with the police forces.
It is also possible that the shooters will take a number of hostages to delay
their neutralisation and to guarantee prolonged live media coverage of the
event.
If not stopped immediately, a small group of shooters could cause the
death of dozens of people. It is therefore of key importance that the
shooters are neutralised as soon as possible.
Use of a state-of-the-art rifle and a silencer might help to increase the
number of victims, since the shooters will be harder to locate by fleeing
persons.
One major problem for police forces dealing with this type of threat is the
fact that the shooters are heavily armed and could easily kill a number of
police officers before being neutralised (proper training and protection
provided). Localising the shooters however will not be a problem (e.g. by
using the CCTV cameras that are usually present at airports in large
numbers).
Another problem arises, if the shooters manage to take hostages after the
initial killing spree and manage to barricade themselves with the hostages
(e.g. behind check-in counters).
Access control for terminal buildings;
preliminary security checkpoints before entering the compound (this is
especially problematic for airports that are directly linked to train stations);
armed police patrols wearing protective gear.
Evacuation;
halt traffic (e.g. by blocking accommodation roads);
4
ICTAF states that there are security checks at Ben Gurion International Airport before entering the airport
compound. This scenario hence will not apply to airports with similar security measures in place.
95
public announcements (radio, public address systems) to instruct people to
avoid the targeted area, to flee or to seek cover;
police special forces, possibly police snipers.
5.
Dirty bomb in an airport terminal building
Potential offender
Objective / intention
of offender
Tools
Use of tools
Approach of offender
/ access point
Insertion of tools
Target
Location of offender
Danger / threat
5
Terrorists with political or religious motivation. They will most likely be
part of a big terrorist network and have numerous abettors in order to
successfully acquire the necessary materials and knowledge to build a dirty
bomb. One person is sufficient to ultimately plant the bomb. This is a
suicide mission for the bomb planter.
Economic damage
Human lives
Fear, demoralisation
Contamination
Small “dirty bomb” / radiological dispersion device (RDD), which is a
conventional explosive device that spreads radioactive materials (possibly
using Americium 241, Californium 252, Caesium 137, Cobalt 60, Iridium
192, Plutonium 238, Radium 226 or Strontium 90)5 upon explosion. The
RDD will be hidden inside a suitcase which is outfitted to prevent radiation
from leaking and thus being detected (e.g. by using lead plating).
The main obstacle in this scenario is obtaining the necessary radioactive
material and smuggling it into the country. An advantage is however the
fact, that only a relatively small amount of radioactive material is needed
since the target is an enclosed space.
The bomb planter will open the suitcase at a prominent location in the
foyer of the terminal building, revealing the bomb. He will then
immediately activate the detonator and die in the following explosion. It is
necessary that the bomb planter stays with the bomb until the explosion
since the container (the suitcase) needs to be opened to ensure maximum
dispersion of the radioactive material und thus maximum impact. This
requires almost immediate detonation after opening the suitcase to avoid
detection.
The bomb planter enters the main terminal building just like a regular
flight passenger, wearing casual outfits and carrying a suitcase containing
the RDD. Since there are no security checks before check-in, gaining access
will not be an obstacle (cf. footnote 5).
The RDD is hidden inside an unsuspicious suitcase. Since luggage is only
searched during / after check-in, this will be no obstacle (cf. footnote 5).
The targets are the people visiting the central terminal building of a major
airport, but also the building itself (see below under “Danger / threat”).
Daytime during holiday season (especially summer holidays) would be an
ideal point of time for such an attack, since there is a significantly larger
passenger volume.
The bomb planter will manually detonate the RDD and die in the
explosion.
Initially, a small RDD has the same potential effect as a bomb upon
explosion. Since most airport terminals are spacious halls, the number of
http://de.wikipedia.org/wiki/Schmutzige_Bombe; http://en.wikipedia.org/wiki/Radiological_weapon.
96
SMTs (preventive)
SMTs (emergency)
casualties from the explosion itself will be relatively small. However, the
radioactive fallout will result in additional casualties. There will also be
significant economic damage, since the building will be contaminated with
radiation. This will make extensive decontamination necessary and it may
take months until the area is safe again, meaning the complete closure of
the facility. The layer of radioactive dust would have to be completely and
thoroughly removed. The economic impact of closing a major airport (even
just partially) is potentially very high.
Even after the decontamination, passengers (and employees) may avoid
the area in fear of residual radiation. This may make it necessary to tear
down the contaminated building and rebuild it, thus deepening the
economic damage.
Access control for terminal buildings;
preliminary security checkpoints before entering the compound (this is
especially problematic for airports that are directly linked to train
stations);
CBRNE sensors and measurement systems (e.g. Geiger counters).
Complete evacuation of the contaminated area (and possibly the
surrounding area);
halt traffic;
EMTs / paramedics;
fire brigade;
protective suits and gear (NBC protection, respirators);
movable decontamination facilities.
6. Missile attack on a starting / landing passenger aircraft
Potential offender
Objective / intention
of offender
Tools
Use of tools
Approach of offender
/
access point
Insertion of tools
Target
Location of offender
Two terrorists with political or religious motivation (a driver and a
shooter). The shooter will most likely have a military background or have
received training at a terrorist boot camp.
Human lives
Fear, demoralisation
Man-portable air-defence system (MPADS) which is a shoulder-launched
surface-to-air missile launcher, preferably guided, ammunition. Purchasing
the MPADS or smuggling one into the country is the main obstacle to
overcome in this scenario.
The attacker simply aims and shoots. A guided system will lock on to the
aircraft (e.g. using infrared) and direct the missile towards its target.
The attacker will not have to enter the premises of the airport. Most
airports have motorways nearby (e.g. Frankfurt am Main airport) and
starting or landing aircrafts fly over them at very low altitude during takeoff or while landing.
An attacker could simply stop a small van on the motorway’s emergency
lane, jump out of the van as soon as an aircraft comes into range and fire,
all within seconds.
The attacker will have the missile launcher with him in the back of the van,
ready to fire.
A passenger aircraft during take-off or landing.
(Another possible target might be the air traffic control tower.)
The shooter will get out of the van in order to fire, then immediately get
back into the vehicle and drive away.
97
Danger / threat
SMTs (preventive)
SMTs (emergency)
The attacker can potentially destroy a larger passenger jet. There may be
additional casualties on the ground when the plane crashes.
Flares or other countermeasure system will not be effective against such a
short range attack. Also, most modern MPADS have the ability to recognise
flares and reject them as targets.
EMTs / paramedics;
fire brigade;
halt traffic.
98
7. The Junky’s Mummy 1
Short
description
Potential
offender
Objectives
Tools used
The scenario
Location of
offender
A coffin is sent abroad, with a corpse filled with explosives
A terrorist organization
Taking down an airplane mid-flight causing a large number of casualties.
A coffin is prepared with a real human corpse. The corpse is stuffed full with
explosive materials and a detonator.
A coffin is handmade, complete with a real human corpse and all the proper
authorizations about the death of a real person whose family wishes to bury in
another country. The body inside the coffin is filled with explosives, and the
coffin itself contains a detonator with a timer, set to explode midair. The coffin
is uploaded on an airplane and explodes midair, leading to a massive loss of
human lives.
No airplane is allowed to leave without having both the passenger and his or
her luggage on board. For that reason, one of the terrorists would probably
choose to get on the plane and commit suicide.
Any airplane crash, especially large airplanes, would carry
a horrendous price in human lives.
Should the targeted airplane happen to crash in an urban
Infrastructures
area, the damage to infrastructures would be
devastating.
There would be the economic consequences of fear from
Economy
other following terrorist attacks on airplanes, leading to
fewer passengers in the airport.
It is likely that some reduction in number of flights will
be noticed.
If the method for delivering explosives onto the airplane
Values
would be discovered, there would be a lessening of the
sensitivity of security forces towards cultural and
behavioral differences, including matters of privacy and
religion.
It is likely that the terrorist attack will be used for political
Political
leverage.
Sniffers for explosive materials would probably be able to detect traces of the
chemicals stuffing the body. The coffin could be carefully washed and cleansed
from the outside so that no trace of the explosive chemicals would be left,
however, and the security controllers are not likely to open the coffin and scan
the body with the sniffers.
People
Expected
impact
Preventive
SMTs
Responsive
SMTs
If the coffin can fit into a screening machine, it is possible that the unusual
filling of the corpse would be identified, especially if the controller is
suspecting foul play.
Another preventive SMT lies in the aforementioned fact that no airplane is
allowed to take off with the luggage of a passenger, without having that
passenger on board.
Once the coffin has been loaded on the airplane, and the plane has taken off,
there are no responsive SMTs that could prevent it from exploding.
99
100
8. The Deadly Porter
Short
description
Potential
offender
Objectives
Tools used
The scenario
Location of
offender
A porter in a hotel plants an explosive device in the suitcase of an innocent
resident who is about to leave to his flight
A terrorist organization, or an individual act
Blowing up an airplane, leading to a massive loss of human lives.
An explosive device to be planted in a suitcase
A porter with terroristic aspirations would infiltrate the hotel room where
suitcases are being stored before being sent to the airport with their owners.
He would hide an explosive device deep inside one of the suitcases, without
the owner being aware of it. The suitcase has a chance of escaping rigorous
inspection (especially in less protected airports) before being loaded on the
airplane. Once in the trunk of the airplane, it would explode at a pre-set time,
taking down the airplane and all its passengers.
The offender would only have to be present at the hotel where he will plant
the bomb in the suitcase. He would not come anywhere near the airport.
Any airplane crash, especially large airplanes, would carry a
horrendous price in human lives.
Should the targeted airplane happen to crash in an urban
area, the damage to infrastructures would be devastating.
The storage room in hotels would have to be securely
Infrastructures
redesigned so as to prevent infiltration by unauthorized
persons. Security checks would have to be conducted
among the porters and every other person allowed to
handle the luggage.
It is unknown whether such an attack would even be
interpreted as such and not as an aircraft malfunction,
unless a terrorist organization will take the blame for it.
Were it to be known, however, then there would be the
Economy
economic consequences of fear from other following
terrorist attacks on airplanes, leading to fewer future
passengers. Main result will be high investments in better
airport protection means.
It is likely that the terrorist attack will be used for political
Political
leverage.
Preventive SMTs for this case consist primarily of sniffers and screening
machines. One must also note that this is a case in which human-based
measures are actually detrimental. Only technological measures are reliable
here, and thus guidelines that state that the suitcase of every passenger must
be screened (regardless of his or her seemingly innocent status) should be
considered.
The passengers must be informed of the possibility that a terrorist planted an
explosive device in their belongings.
Preventive SMTs might be considered for deployment in the hotel itself, or at
the very least in its storage room.
Once the suitcase has been loaded on the airplane, and the passenger boarded
the aircraft, there is little to be done.
People
Expected
impact
Preventive
SMTs
Responsive
SMTs
101
9. The Leaky Passenger
Short
description
Potential
offender
Objectives
Tools used
The
scenario
Location of
offender
A terrorist pretending to be an innocent passenger would board a flight with a packet
of explosive material in his guts
A terrorist organization, or an individual act
Blowing up an airplane, leading to a massive loss of human lives.
A packet of explosive material wrapped and fit for swallowing. Also, a strong laxative.
A suicide bomber would swallow, through either end of the digestive system, a
tightly-wrapped packet containing explosive chemicals, possibly Semtex or another
plastic explosive. In the case of T-4, C-4, or other explosives that can only be
detonated using a special device, the terrorist might have to carry in his guts a small,
altered detonator as well, or even take it on board in his handbag, disguising it as an
electric transformer or a cellular phone recharger.
The terrorist would have to go past the existing SMTs designed to detect traces of
explosive material on the skin and clothes (sniffers). This could probably be arranged
by washing and scrubbing the skin carefully with soap after ingesting the packet, and
ditching the clothes used when working with the material. While certain screening xray machines might be powerful enough to image inner parts of the body, none of the
above can be found in regular use on human beings in most airports due to health and
privacy reasons. Therefore, as long as the terrorist does not pull attention to himself
by acting suspiciously, he should be able to board the airplane without trouble.
Once aboard the airplane, the terrorist would take a strong laxative. A few hours into
the flight he will go to the toilet, dispose of the explosive packet, fit it into a proper
shell and place the detonator inside. The contraption would be placed adjacent to the
wall (possibly inside the wall) and detonated in an attempt to create a hole in the side
of the plane which would lead to loss of pressure in the cabin and very possibly to a
plane crash.
Owing to the unusual method of delivering the explosives onto the airplane, this
would have to be a suicide bombing attempt.
Any airplane crash, especially large airplanes, would carry a
horrendous price in human lives.
Should the targeted airplane happen to crash in an urban area, the
Infrastructures
damage to infrastructures would be devastating.
It is unknown whether the attack would even be interpreted as
such and not as an aircraft malfunction, unless a terrorist
organization were to take the blame for it. Were it to be known,
Economy
however, then there would be the economic consequences of fear
from other following terrorist attacks on airplanes, leading to
fewer future passengers.
It is likely that the terrorist attack will be used for political
Political
leverage.
Sniffers might detect traces of explosive material on the skin and clothes of the
terrorist. Powerful screening machines might be able to look into his bowels, but such
are not ordinarily used in airports due to privacy and health reasons.
Human-based measures, such as keeping on the alert for signs of nervousness or
instability on the part of the terrorist, would probably work best in this scenario. The
security forces might decide to delay the terrorist until the packet has left his
digestion system in the ordinary way. The laxatives in his possession might give some
People
Expected
impact
Preventive
SMTs
102
Responsive
SMTs
small indication towards his course of action.
Some airplanes have security men on board, and they would have to keep a vigilant
eye on the passengers. The stewardesses must also be on constant alert for any
passenger that stays in the toilet for an overly long time.
10.Terror on the Railway
Short
description
Potential
offender
Objectives
Tools used
The scenario
Location of
offender
Expected
impact
Preventive
SMTs
Responsive
SMTs
An explosive device is placed on a railway
A terrorist organization
Derailing a train full of passengers
An explosive device, either remote controlled or activated by pressure. The
terrorists will probably refrain from using a timer, since a timer is unreliable if
the trains do not run on time.
A group of terrorists places an explosive device on a railway, with the intention
of derailing a passenger train. The device will be activated by remote control, or
by pressure sensors that cause it to explode at the moment the train passes over
it.
The terrorists might wait nearby. This is especially true if the device is operated
by remote control, they must stay near and give the cue. It is possible that they
will leave the place in order not to be caught.
People
Should the terrorists succeed in derailing the train, one
should expect hundreds of casualties.
Infrastructures
Effects on the train and the railway. In case the explosion is
near a station we can expect damages to it too
Economy
Terrorist attacks like this one usually bring a halt to the
trains traffic for a few hours, at least on the targeted
railway.
Political
It is likely that the terrorist attack will be used for political
leverage.
Having a fence around the railway might deter some of the less-prepared
terrorists, but has proven insufficient to keep terrorists out completely,
especially in places where the fence has to end – such as in the intersections
between a railway and a road. Cameras with movement detectors might prove
more effective in alerting at intruders’ presence especially in sensitive points
(e.g. tunnel entrance) Patrols moving along the railway might also identify the
terrorists.
As soon as the device explodes, police and train security forces would stop traffic
along the targeted railway until it had been examined thoroughly to make sure
no second device has been placed along it.
103
11. The Oily Fuel
Short
description
Potential
offender
Objectives
Tools used
The scenario
Terrorists inject contaminants into the fuel supply chain
A terrorist organization
Causing gradual degradation and malfunction of aircraft facilities, such as fuel
filters and others
A contaminant that will be injected into fuel supplies storage
A terrorist organization uses a contaminant which can be injected into fuel
supplies and remain mostly undetected. The contaminant causes degradation and
malfunctioning of airplanes’ engine parts, such as fuel filters and others. If it is not
discovered on time, it might bring about the failure of an engine midflight. If it is
discovered, the airport’s fuel supply will have to be put on hiatus until the
contaminant is either removed, or fresh fuel supply is provided.
Location of
offender
The terrorists only need to sabotage the fuel storage, which can be located inside
the airport’s perimeter or outside. The tank farms containing the fuel might be
outside the fence that surrounds the runways.
Expected
impact
People
Preventive
SMTs
Responsive
SMTs
An engine failure could cause an airplane crash costing the
lives of hundreds.
Infrastructures
Any airplane crash into an urban area would have a
horrendous cost. Moreover, if the contaminated fuel leaves
traces in the engine itself, there might be a need to replace
the engines of many of the airplanes.
Economy
As soon as the contamination is detected, planes will not be
allowed to refuel at the infected airport. This means less
traffic, and consequently less passengers. The airline
companies might also demand compensation from the
government for their damages.
Political
It is likely that the terrorist attack will be used for political
leverage.
Having a fence surround the tank farms as well as the railways could lead to
detection of the terrorists before they fulfill their purpose. Other SMTs for
detection of the intruders will consist of CCTV with motion detection algorithms,
radars and acoustic sensors. Patrols around the fence would serve as an extra
precaution.
Since the terrorists would probably need to buy a large amount of the
contaminant, the police should keep an eye for such a purchase of suspicious
materials.
Scheduled checks of the fuel supply and of airplanes’ engines should be conducted
to ensure that it had not been contaminated. If contamination had been
discovered, the contaminant should be analyzed in laboratories to determine its
nature. In the meantime, alternative fuel supply should be used. If no alternative
fuel is found, airplanes should be instructed to refuel in other airports.
104
12. Armed cell trained commandos
Short description
Potential offender
Objectives
An armed cell of military-trained commandos seizes control of a main
station.
A terrorist organization, trained native born
Cease all military engagement in Muslim countries.
Tools used
The scenario
Assault weapons and improvised explosives
‘Swarm’ attacks conducted by semi-militant groups targeting hospitality
facilities and transportation hubs have been a concern since the storming
of a hotel in Mumbai in 2008. In this scenario a dozen British-trained
persons storm Main station in central London during the morning rush.
Armed with assault rifles and a small to medium explosives, the group
takes the station in a time and coordinated assault. Numerous people in
the station are killed by gunfire. Being trained to a high level in British
SAS tactics, the perpetrators succeed in countering attempts by
authorities to retake the station by force and barricade themselves inside
the station for the following three days. The perpetrators demand cease
all military engagement in Muslim countries.
Location of offender
Main train station
Expected impact
People
Infrastructures
Economy
Political
Dozens of persons killed in initial assault on station
and more killed during following standoff
Station damaged from gunfire and small explosions
but most physical damage is superficial.
Majority of the Underground is closed for the
duration of the standoff, bringing to a halt. The cost
of the economic slow-down that results is estimated
to be in the billions.
1. Authorities state publicly that they do not
negotiate with terrorists but proceed with
backchannel negotiations with the group,
which highlights political divisions in
Parliament. Fractious political infighting
ensues, which further hinders response.
2. The military and secret services are deeply
demoralized by their lack of success in
retaking the station and because the
perpetrators are of their own.
Preventive SMTs
Responsive SMTs
An attempt to realize a plot similar to this was foiled by advance
intelligence that the attack was being planned followed by attempts to
disrupt the group through freezing assets and killing the leaders. British
Transport Police also has a unit of approximately 100 armed officers
trained to deal with incidents such as this.
As the Mumbai attack showed, a fast and coordinated response using
force if necessary is needed to prevent an initial assault from turning into
a drawn-out standoff.
105
Short
description
Potential
offender
Objectives
Tools used
The scenario
Detonating a massive bomb on a train in capital city during a crowded
international even, e.g. in central London during the 2012 Olympics.
Terror organization
Cease all military engagement in Muslim countries and releasing terror related
prisoners.
Ammonium nitrate fertilizer bomb
A group of individuals succeed in loading a large ammonium nitrate fertilizer bomb
on a train heading to the city. The bomb explodes as it prepares to arrive in to the
central station during the important international event, killing hundreds and
injuring thousands. Air and ground transportation across the capital is suspended,
leaving thousands of visitors without transportation. Numerous smaller explosions
occur in the following days. Government responds by declaring martial law and
deploying military resources to protect the city from further bombings.
13.
Fertilizer bomb
106
Location of
offender
At least one offender is killed on the train. Other suspects located in northe
where bomb is smuggled aboard train.
Expected
impact
People
Infrastructures
Preventive
SMTs
Responsive
SMTs
Hundreds killed and thousands injured.
Train station and buildings in immediate vicinity comp
destroyed.
Economy
Economic toll is in billions.
Political
Screening measures for cargo on trains are in place but authorities have
acknowledged that stopping such an attack from happening is virtually imp
if the perpetrator is determined enough to make it happen.
Responding to mass emergencies such as this requires investment in trainin
resources for first responders.
107
Cyber Scenarios
14.
Hacking an underground computer
Short
description
Potential
offender
Objectives
Tools used
The scenario
Unknown individuals hack the Underground’s computer system
Location of
offender
Location of offenders is unknown. They are likely to be physically dispersed around
the globe and known to one another only through online aliases.
Expected
impact
People
Expected impact
Infrastructures
Economy
Political
Greater investment in cyber security safeguards and compartmentalization of
system so that control cannot be gained from single command centre.
Responding to mass emergencies such as this requires investment in training and
resources for first responders.
Preventive
SMTs
Responsive
SMTs
A terrorist organization or a White Collar Criminal - A loose network of highly
skilled individuals. Eight or 10 persons are thought to be behind the attack.
Computers
The 2007 the cyber attacks on Estonia are widely regarded as the first instance of
contemporary ‘cyber warfare,’ and authorities in other countries are concerned
that similar methods could be used to inflict major physical and economic damage
to a country. In this scenario a coordinated network of hackers is able to defeat
existing network safeguards and take control of a number of trains in a big city.
The attacks are not malicious in nature but numerous accidents occur as trains
crash into one another or are derailed. First response capabilities are unable to
respond to all calls for service, leaving some accident sites unassisted for hours.
Some trains are derailed in deep-level tunnels between stations, making medical
treatment and evacuation extremely difficult. Dozens dies and hundreds require
hospitalization.
108
15.
Total Shutdown of Airport Radio Communication by Terrorists
Short
description
Potential
offender
Objectives
Tools used
Terrorists armed with high-power radio transmitters cause a total shutdown of radio
communications in an airport
A terrorist organization, probably a highly sophisticated one
Disruption of the airport operation trying to cause air accidents. All these in order to
cause casualties and stop the air transportation to and from the airport. This could
also result in a political crisis in regional or national level
High-power radio transmitters that can cover an area of a few dozen square
kilometers. Alternatively, the terrorists could use high-power radio jammers which
have a similar effect.
Terrorists will place a few remote-control transmitters around an airport at covert
locations. Due to the nature of the transmitters, they can be far enough from the
airport so as not to be detected by security forces patrolling around. As a matter of
fact, the transmitters could be hidden in urban areas near the airport and even in
citizens’ apartments.
The scenario
The transmitters can be scheduled to be activated in an irregular pattern, interfering
with radio transmissions in the area.
The radio interference caused by the transmitters on multiple channels and
frequencies would damage the ability of the control tower to communicate with
airplanes in the sky and on the field, and put a stop to take-offs and landings. In
extreme cases airplanes might collide into each other.
Location of
offender
The terrorists would stay away from the transmitters, and possibly leave them
altogether. The devices will be discovered and eliminated eventually, but this could
take a very long time especially if not all of them are activated at the same time.
People
Expected
impact
Preventive
SMTs
Responsive
SMTs
Crash of airplanes can cause huge numbers of casualties
Should airplanes crash into the airport, or into urban areas
Infrastructures
surrounding the airport, the infrastructural damage would be
vast.
Many flights will be postponed or possibly cancelled altogether.
Should the incidents repeat themselves, some aircraft
Economy
companies would decline landing their airplanes in the airport
altogether, or raise their prices.
In either scenario, citizens might come to regard the afflicted
Values
airport as unsafe, and it is likely that some reduction in flights
will be noticed.
It is likely that the terrorist attack will be used as a leverage to
Political
force certain political actions
There are currently no effective SMTs that can identify such devices remotely hidden
and prevent such an incident in advance.
Special police units equipped with detection systems to find the transmission sources
should be established.
109
16.Total Shutdown of Airport Radio Communication by Pirate Radio Stations
Short
description
Potential
offender
A pirate radio station near the airport causes a total shutdown of radio
communications in the facility
A pirate radio station
Objectives
The station's operators' objective is to remain on the air, possibly for monetary or
ideological purposes.
Tools used
High-power radio transmitters that can cover an area of a few dozen square
kilometers.
The scenario
A pirate radio station is being operated against the law without a license. Its
broadcasts are interfering with the airport communication systems affecting the ability
of the control tower to communicate with airplanes in the sky and on the field. Takingoffs and landings are completely stopped. In extreme cases accidents can happen.
Location of
offender
The radio station will probably be located in a nearby city or urban area. The operators
will be in the station.
People
Infrastructures
Expected
impact
Economy
Values
Political
Passengers will suffer heavy delays. In extreme cases accidents
can result in casualties and human lives. Any
Should airplanes crash into the airport, or into urban areas
surrounding the airport, the infrastructural damage would be
vast.
Many flights will be postponed or possibly cancelled altogether.
Should the incidents repeat themselves, some aircraft companies
would stop using the airport.
Heavy losses can be caused to the airport as well as related
companies
Airport will be considered by users as insafe.
Public might lose confidence in the authorities
Preventive
SMTs
There are currently not known SMTs that can prevent such an incident.
Responsive
SMTs
Special police forces equipped with special systems (e.g. sensitive electromagnetic
waves detectors). Could be established to cope with these risking stations
To the best of our knowledge, there is currently no such police force in existence.
110
Organized Crime
17.
The Junky’s Mummy 2
Short
description
Potential
offender
A coffin is sent abroad, containing a corpse filled with drugs
Any organization dealing with drugs
Objectives
Transporting drugs between countries.
Tools used
A coffin is prepared with a real human corpse. The corpse is stuffed with drugs
The scenario
A coffin is handmade, complete with a real human corpse and all the proper
authorizations about the death of a real person whose family wishes to bury in
another country. The body inside the coffin is packed with expensive drugs. The
customs services are incapable of detecting the drugs through the coffin, and
are reluctant to open it. The drugs are successfully transferred across countries.
Location of
offender
The currier in charge of the drug load will probably be a passenger on the
airplane carrying the coffin. He cans also wait in the final destination while the
accompanying person is full innocent with no knowledge of the real mission.
A large and illegal drug load would be transported to
another country, with all the obvious consequences for the
people and the economy of that country.
Expected
impact
Economy
Preventive
SMTs
If the coffin can fit into a screening machine, it is possible that the unusual filling
of the corpse would be identified.
Drug-sniffing dogs and sniffers might also be able to give alert, should they be
applied in the airport.
Responsive
SMTs
111
Disorders
18.The Human Flytilla
Short
description
Potential
offender
Objectives
Tools used
The scenario
A pressure group arranges a combined effort of hundreds, possibly thousands of
people to come to a single airport and demonstrate, disrupting order in the
facility
Pressure groups of all kinds. They could be peace activists, Muslim protestors,
PETA and many others
Drawing attention from the media and the crowd in the airport
The tools in this case are the activists themselves, who will buy flight tickets and
come to protest together
A pressure group organizes a combined effort of hundreds, possibly thousands of
people. They will all buy tickets to the same airport, arrive at the same day and
peacefully exercise their right to demonstrate (which might not be applicable in
the destination country).
Location of
offender
In the airport.
Expected
impact
People
Preventive
SMTs
Responsive
SMTs
While the demonstrators intend to avoid violence and
bloodshed, mass-demonstrations have a way of
occasionally becoming bloody, at least for a few in the
crowd. In addition, the ordinary passengers in the
airport might become agitated by the demonstrators'
activity, and brawls might arise.
Infrastructures
With the demonstrators clogging the airport, it is likely
that there would be a disruption of the proper order of
work.
Economy
The disruption in the order of work would encumber the
airport and delay taking-offs of flights.
Political
The demonstrations could easily be used to convey
political messages.
Initial handling of the demonstrators could begin by obtaining their details ahead
of time, and informing the airline companies that these people would not gain
entry to the airport – which means the companies would have to take them back
at their expense. This tactic worked very well for Israel during the Flytilla in 2011,
and resulted in the airline companies themselves turning away most
demonstrators and refusing them seats on the airplanes.
Police and airport's security forces would have to step in and confine the
demonstrators to the best of their abilities, possibly removing them entirely from
the airport and/or taking them into custody.
112
Findings & Conclusions
In this report we present a summary of the efforts done in task 1 of WP6. In this task we had to
describe past threat events which occurred in mass transportation systems such as air traffic systems
and train platforms. We covered the five threat categories our research deals with – terror (T), illegal
immigration (II), cyber (C), white collar (WC) and organized crime (OC). These listed events are
followed by a related offered threat scenarios.
We have covered some worldwide events, but focused on events collected by the partners, each
partner in its country, and specifically related to each of the four case studies we base our research
on: BGIA (Ben-Gurion International Airport), BER (the soon coming open new Berlin's Airport),
London's Underground and Torino's Train System. The below table summarizes the main collected
events:
Table No. 4: Past Events List
No.
Partner
Category
Event
1
LSTS, Be
T
Suicide attack – World trade center / Pentagon
2
LSTS, Be
T
"SuperFerry 14" bombing using booby trapped TV, filled with
TNT, in the lower decks
3
LSTS, Be
T
Madrid 4/11 – trapped backpack
4
LSTS, Be
OC / T
Operation "Ramp rats" (by an airplane employees) –
smuggling drugs, weapons etc.
5
LSTS, Be
II
Operation "Maxim" – smuggling humans
6
LSTS, Be
II
Illegal immigration – Air china
7
LSTS, Be
C / WC
Sasser - computer worms attacked Delta air lines computer
8
LSTS, Be
C / WC
Juvenile hacker attacked Worcester airport
9
LSTS, Be
WC / II
Corruption in SA
10
SITI, Italy
T
Terrorist attack on Rome airport – rifles and grenades
11
SITI, Italy
T
Terrorists attack in Vienna airport - grenades
12
SITI, Italy
T
Attack on Bologna airport – IED (improvised explosive
device)
13
SITI, Italy
T
Attack on Milan Metro – fire using 66 pound gas canister
14
SITI, Italy
T
Attack to Rome metro – IED, empty train
15
SITI, Italy
C/T
Hacker attack on Pisa airport
16
SITI, Italy
C / WC
Hacker attack on Catania airport
17
UK, Germany
T
Hijacking flights- KLM KL100/ Austrian commercial aircraft
18
UK, Germany
T
Bomb at Dresden central station
19
UK, Germany
II / T
Ennepetal hostage crisis
113
The following
table maps the
partners country's
collected events
divided by each of
the threats
categories - Past
events by
platform and
category:
Table
No. 1: Collected
Past Events
Categorization
20
UK, Germany
T
Sauerland group – self made car bombs Frankfurt a
21
UK, Germany
WC / T
22
UK, Germany
T
Operation Athena - money smuggling in order to fu
activities
Cargo planes - in the air bombing of packages sent
23
UK, Germany
Dummy bomb I Namibia airport
24
UK, Germany
Other –
criminal act
T
25
UK, Germany
T
Trying to plan an attack on a public transport system
26
UK, Germany
T
Arson attack on a cable bridge (railway traffic)
27
UK, Germany
T
Hijacking Lufthansa X 3 - flight 649, 615, 181
28
UK, Germany
II / T
Hijacking Slovair aircraft
29
ICTAF, Israel
T
Pretty woman
30
ICTAF, Israel
T
Explosive on the railways X3
31
ICTAF, Israel
C/T
Pirate on the air X 3
32
ICTAF, Israel
T
Suicide bombing in train station X 3
33
ICTAF, Israel
T
Spy on the train
34
ICTAF, Israel
WC
Gas container near the airport
35
ICTAF, Israel
WC / OC
Sick oligarch – smuggling money
36
ICTAF, Israel
OC
The Peruan priest - drugs currier
37
ICTAF, Israel
T (?)
The oily fuel
38
ICTAF, Israel
T / Other
Human flyover – order disturbance
T
T
Can be T
T
T
T
T
II /
ndesirable
behaviour
Bomb on subway car
Bomb at empty train
Fire in underground station
Fertilizer bomb at train station
Canary wharf bombing
Aldwych bus bomb
7/7 train bombing & July 25th attempt
Crime and disorder in London's underground / abov
/ DLR
39
NC, UK
40
NC, UK
41
NC, UK
42
NC, UK
43
NC, UK
NC, UK
The
scenarios 44
NC, UK
developed
and 45
presented in this 46
NC, UK
report are spinoffs
of
the
collected
past
events, and will serve the SIAM data base.
Frankfurt airport shooting at
As can be seen in table 1 – most of the collected past events are related to Terrorism. Beside Cyber
events, that are also part of terror acts, the rest of the threat challenges are less covered. This can be
explained by the fact that while Terror and Cyber issues are direct threats on mass transportation
systems, the other threats types might use transportation systems as platforms but not been
considered as a threat for them.
114
The following event's categorization issues required special attention:
-
Illegal immigration, specifically, suffered from an ambivalent attitude. A big question rose if
immigration at all, even being illegal at the time it happened, should be seen as a threat. This
question has been left open at this stage of the research.
While collecting the information required for this task, an interesting event of disorder happened at
BGIA. In this event, a group of protestors (so called, but with suspected relation to terror groups)
planed to gather inside the airport terminal, reaching it from abroad using a few close scheduled
flights. Part of them even could not expect getting a visa to enter the country and would not get an
entry approval. We couldn't categorize this situation as a terror attack or as any other type of crime,
and therefore decided to add a new category. At this stage of the research, as it is not one of the
original covered five categories, we have referred to it as "other". This event opened a discussion that
will be covered later in task 3 (country workshops), trying to identify related scenarios, their expected
impacts and suitable SMT's.
115
References
i
Organised and White Collar Crime Discussion White Paper, Department of Justice and Law Reform of Dublin, 2010.
ii http://en.wikipedia.org/wiki/Terrorism
iii
Bockstette, Carsten (2008). "Jihadist Terrorist Use of Strategic Communication Management Techniques" (PDF). George
C. Marshall Center Occasional Paper Series (20). ISSN 1863-6039.
http://www.marshallcenter.org/mcpublicweb/MCDocs/files/College/F_Publications/occPapers/occ-paper_20-en.pdf
iv
Bockstette, Carsten. "Jihadist Terrorist Use of Strategic Communication Management Techniques". George C. Marshall
Center Occasional Paper Series .
v
Disorders and Terrorism, National Advisory Committee on Criminal Justice Standards and Goals (Washington D.C.).
vi
European Commission (2007). Communication from the Commission to the European Parliament, the Council and the
Committee of the Regions of 22 May 2007 – Towards a general policy on the fight against cyber crime
vii
Identity theft occurs when someone appropriates another's personal information, such as name, PPS number or credit card
number without their knowledge in order to commit fraud or other crimes. The crime takes many forms. Identity thieves may
rent an apartment, obtain a credit card, or set up a telephone account in another person's name and the theft may take some
time to come to light through, for example, a credit report, a credit card statement or contact by a debt collector.
viii
A form of online fraud where fake emails or websites, supposedly from a legitimate company, seek to obtain confidential
account details with a view to conducting illegal transactions on the account.
ix Unsolicited commercial e-mails.
x
A broad category of software threats to network and systems which can exploit vulnerabilities in computer systems. Any
code which modifies or destroys data, steals data, allows unauthorized access, exploits or damages a system, and does
something the user did not intend to do is called malicious code. There are various types, including viruses, Trojan horses and
Worms.
xi
(The Parliamentary Office of Science and Technology (UK), 2006)
TE-SAT 2009 EU TERRORISM SITUATION AND TREND REPORT. Europol. 2009.
https://www.europol.europa.eu/sites/default/files/publications/tesat2009_0.pdf.
xiii Walsh, Marion (2009) Human Trafficking,
xiv
Sections 1, 2, 3 & 4 of the Criminal Law (Human Trafficking Act) 2008 and Article 3, United Nations Protocol to Prevent,
Suppress and Punish Trafficking in Persons, Especially Women and Children, Supplementing the United Nations Convention
against Transnational Organized Crime.
xv
White-Collar Crime and Criminal Careers, by David Weisburd, Elin Waring, with Ellen F. Chayet.
xii
xvi
http://www.focus.de/politik/deutschland/tid-19865/oktoberfest-attentat-als-der-terror-auf-die-wiesn-kam_aid_552841.html;
http://de.wikipedia.org/wiki/Oktoberfestattentat.
xvii
http://www.spiegel.de/panorama/zeitgeschichte/0,1518,504008,00.html; http://en.wikipedia.org/wiki/Munich_massacre.
xviii
http://en.wikipedia.org/wiki/German_autumn; http://news.bbc.co.uk/2/hi/europe/2340095.stm;
http://en.wikipedia.org/wiki/Red_Army_Faction.
xix
Kailitz, Politischer Extremismus in der Bundesrepublik Deutschland, 1st Ed. 2004, pp. 114-116.
xx
http://en.wikipedia.org/wiki/La_Belle_(discotheque); Kailitz, p. 97;
http://de.wikipedia.org/wiki/Sprengstoffanschlag_auf_die_Rhein-Main_Air_Base.
xxi
Kailitz, pp. 104-105.
xxii
Kailitz, pp. 97, 114.
xxiii
http://www.spiegel.de/panorama/a-48287.html.
xxiv
http://archiv.rhein-zeitung.de/on/01/03/16/topnews/tupochro.html.
116