Soft Targets Under Fire ON SEPTEMBER 21, 2013, A GROUP OF TERRORISTS ATTACKED THE WESTGATE SHOPPING MALL IN NAIROBI, KENYA. AFTER THE THREE-DAY SIEGE, MORE THAN 60 CIVILIANS HAD BEEN KILLED AND 175 WOUNDED. INSURANCE CLAIMS WERE ESTIMATED TO BE AS HIGH AS 10 BILLION KENYAN SHILLINGS (APPROXIMATELY $160 MILLION), REPRESENTING A THIRD OF ALL INSURANCE CLAIMS IN THE COUNTRY THAT YEAR, ACCORDING TO KENYAN REGULATORY AUTHORITIES.
The Westgate mall had private security guards, central monitoring, physical barriers and other security measures and was located in a relatively stable area. How could this kind of attack happen in such a relatively secure high-density urban area? The New York City Police Department (NYPD) was so concerned by the attack that it conducted its own investigation, which was released in mid-December 2013.
The NYPD's report characterized the local authorities' response as confused and delayed at best. Kenyan authorities initially claimed that the attack was carried out by 15 heavily armed assailants. The NYPD investigation, however, suggested that it could have been the work of only four lightly armed attackers, all of whom may have escaped after only 12 hours.
According to the NYPD, the Kenyan Army shot its own unmarked police officers entering the mall, and the heaviest damage may have been caused by the army's use of anti-tank missiles and rocket-propelled grenades. The lesson of the report is clear: the mall was on its own. These commercial urban targets must depend upon their own security and preparedness to avoid becoming the next terrorist battleground.
Despite the fact that the Westgate mall was in a crowded urban area, remote locations are no safer. In January 2013, a group of terrorists took more than 800 people hostage at a gas plant near In Amenas, Algeria. Algerian special forces eventually took back the plant, but not before up to 40 civilians were killed. Few details are known about the security force preparations and response, but there have been allegations in the press of lax plant security. The facility owner said that the Algerian government was responsible for securing the exterior and, since it depended upon those forces, it did not employ armed guards. According to reports, the security protocol for a terrorist attack was simply to "hide in offices or bedrooms, turn out all the lights, close all the windows and doors, get under the bed, stay hidden and wait." There were no indications that there was a rally point or secured area to which workers should retreat.
These types of attacks on private commercial targets are certainly a wakeup call for companies operating in foreign locations. To be ready, risk managers need to consider implementing effective physical security safeguards in these facilities. One way managers can protect both facilities and employees is by understanding formal security processes and strategies and incorporating these lessons in personal practice.
Assessing Security Risk
To develop an effective security plan, first assemble a planning team. Optimally, this includes a mix of risk managers and professional security personnel. It is their responsibility to evaluate existing physical security, conduct a threat assessment, implement the security plan, train personnel and continue to survey and inspect the facility to be sure the plan is implemented correctly and effectively. Once the physical security plan has been synthesized, outside consultants that were not part of the planning process should test assumptions, plans and responses in order to avoid "groupthink"--where participants all agree with the plan and overlook its weaknesses.
One of the most important steps in plan development is threat assessment. Risk managers do not always have access to enough information to develop an informed analysis. However, local law enforcement and governments are usually willing to share their threat assessments with responsible parties, especially for natural disaster risk and preparedness. …