Threat into Risk: A Challenge for Security Guidance AusRAIL 2006 Tony Beard Office of Transport Security Department of Transport and Regional Services

OTS - Security Analysis  Facilitates and coordinates the communication of transport security related information to industry  Provides assistance to industry / business by provision of a nationally consistent risk context statement  Analyses maritime and aviation security events reported by regulated industry participants to inform the development of threat and risk based policy  Places specialist officers in each state capital city to enhance the flow of transport security risk context information between industry and government and implement a continuous program of security awareness raising

Current Security Environment Threats:  Al-Qa’ida and associated trans-national terrorism remains as principle global threat  Recent experience indicates rail systems are an attractive target.  Continued interest in IEDs  National CT Alert level remains at MEDIUM Current Issues:  “Home grown terrorism” a term that does nothing to define or assist in understanding the terrorist threat  Radicalisation processes are poorly understood  Racial profiling is problematic and not the answer  Extremist religious identity transcends national, social and family identity  Extremists can be known and tolerated within their local community

Nature of the Threat  Trans-national terrorism leads to traumatic, catastrophic consequences  Focus is on mass casualties  Terrorists have demonstrated intent and capability – coordinated attacks  There is constant heightened level of threat  Nature and level of threat means we Must Expect the Unexpected  There is likely to be no prior warning of attack  Criminal activity highlights vulnerabilities

The Threat to Rail and Mass Gatherings  The transport sector is a target for terrorists because it concentrates people: –in large numbers; –at high density; –in accessible places; and –at regular, predictable times  Forms of attack against the transport sector have included: –Attacks on mass transit; –Improvised explosive devices; –Assaults by commando-style teams; –The use of “stand-off” weapons (eg mortars and missiles) to attack infrastructure

Criminality and Transport Security  Terrorism is a crime – not all crime is terrorism  Professional organised criminals utilise vulnerabilities in aviation security regimes  Their actions highlight vulnerabilities that may facilitate terrorism  Criminals want to preserve the transport system for their own ends  Terrorists want to destroy the transport system for their own ends

RISK: Frames of Reference  AS/NZS 4360 Risk Management  Corporate Risk  Regulatory Risk  Security Risk

A Security Risk Doctrine as the basis for Mitigation Planning  Government policy – prevention is a business cost.  Security risk management by industry –1. Non proscriptive regulation –2. Provides flexibility to owner/operators –3. It s not possible to eliminate all threats  Highly professional attackers – no prior warning  Probability of coordinated IED attacks on mass gathering  Traumatic and catastrophic consequences are untenable  Governments have NO RISK APPETITE  Focus on Vulnerabilities and Suspicious Activity

Security Planning Requirements  In this threat environment, effective mitigation requires: ­ Planning be based on a security risk assessment ­ Consultation with internal & external stakeholders ­ The identification of vulnerabilities ­ Provision for reporting, logging and assessing security incidents ­ Provision for security awareness and training to ensure identification and resolution of suspicious activity  This can only be achieved through: ­ Having clearly identified roles and responsibilities across all partners.

“ Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always.” - from a statement by the IRA addressed to Margaret Thatcher

Building Key Partnerships  Partnerships harness and focus capacity  Physical security measures must be supported by a security risk doctrine that utilises key partnerships  Risk Action Plans will exhaust available resources, especially available police: –Need to augment available resources –harness business and general community –utilise technology – CCTV  Discussion Exercises (Desk-Top) ­ harness government and business ­ against a common mental model ­ routinely and regularly clarify: - roles and responsibilities - policy and planning short falls

Partnership Objectives To ensure:  Government agencies; Businesses and Communities are together creating an environment hostile to terrorist planning and preparation by: –Identifying and mitigating vulnerabilities; and –actively disrupting and resolving suspicious activity.

Security Awareness Raising  A common language is necessary  Security awareness training for staff, contractors and regular customers is essential  Security plans must include provisions for the reporting, logging and assessing of security incidents  Identification and resolution of suspicious activity is essential

Vulnerabilities  Vulnerabilities potentially amplify terrorist capabilities and therefore increases the chance of a risk eventuating  Vulnerabilities must be prioritised to focus and ensure proportional targeting of risk mitigation strategies there by best utilising resources  Vulnerabilities should be prioritised through an intelligence led assessment of likelihood and an understanding of the local security context.

The Challenge Ensuring that even if the bomb doesn’t go off this week:  Government remain focussed  Industry remain vigilant and prepared  Public interest and awareness is sustained

Summary  Our response to terrorism must be focussed and proportional and consider the following factors: –Constant heightened level of threat –Terrorists display significant personal and professional capability –No prior warning of attack  A risk based approach provides common language, ideas and focus  Our operating environment is complex and sound partnerships are essential to achieving an effective response  Government, industry and the public must remain focussed and alert to security issues