Korean National Police University May 2016 Paul Ekblom The Conjunction of Terrorist Opportunity: A Framework to understand and prevent terrorist attacks Korean National Police University May 2016 Paul Ekblom Visiting Professor Applied Criminology Centre University of Huddersfield p.ekblom2@hud.ac.uk

Counter-terrorism strategy in UK CONTEST – UK Government approach to addressing the threat of terrorism – operates on a number of levels: Prevent – stop people from becoming radicalised Protect – stop attacks from happening Prepare – once an attack has started, stop the attack and limit the harm to people, society and assets Pursue – investigate the crime, and arrest, incapacitate, bring to justice the perpetrators These different approaches operate by influencing a range of different causes of terrorism

Need for an adaptive approach The nature of the terrorist threat is highly dependent on the local context, and successful security solutions or responses have likewise to be customised to suit the context Terrorists are highly motivated, persistent, adaptable and innovative The Technological, Social and Business environment is changing rapidly, which creates new opportunities that terrorists can exploit, ranging from vulnerabilities to weapons We must be adaptable too, so we must make it easy for security practitioners to adapt to context, and to innovate faster than the perpetrators Otherwise we will continue to win individual battles, but we may go on to lose the war in the longer term

Need for an integrated understanding of causes of terrorist attacks In order to help security practitioners to be adaptable, they must Think clearly Communicate using consistent, well-defined terms Store and retrieve knowledge of good (and bad) practice in a well-organised way that can help them to Formulate the problem If they discover successful exemplars of good practice, to replicate them in a way that is intelligently customised to problem and context If they cannot find such good practices to replicate, then to generate a variety of plausible innovations that are based on tested theoretical principles Security practitioners therefore need a knowledge base that is Clearly-structured, Integrated, and With well-defined terminology

Unfortunately… Different policymakers and different police practitioners focus on different levels under the CONTEST schema, and different types of causation of terrorist events, but an integrated approach is needed But the language that different agencies and academics use is extremely diverse For example, terms like ‘risk, threat and vulnerability’ are often given different meanings in different professions, or not defined at all Criminologists have diverse terminologies too, and choose to focus on different sets of causes In particular, there is a big divide between 1) those who focus on the perpetrator or offender, and 2) those who focus on opportunities and vulnerabilities in our target assets, and our environments and services

What we need is… So we need An integrated framework With a common, well-defined language That brings together all these types of causation of terrorist attacks, and different levels and types of response

One such approach was developed to meet these requirements The Conjunction of Criminal Opportunity (CCO) was developed from a study of several hundred different crime reduction projects implemented in the UK’s Safer Cities programme It brings together a range of theories covering the causation of crime from both the perpetrator or offender side (capability and intent), and the environmental or situational side (especially opportunity) It is a ‘one-stop-shop’ for supporting two related tasks: Understanding the immediate causes of criminal events, that reside in the crime situation, and what the perpetrator brings to that situation Envisaging the range of interventions to block those causes, and so reduce the likelihood of the crimes from happening

One such approach was developed to meet these requirements Now, the immediate causes of terrorist events are rather similar to those of ‘ordinary’ crime So, several years ago I and two colleagues from the worlds of crime prevention training, and counter-terrorism, adapted CCO to the Conjunction of Terrorist Opportunity (CTO) CTO has 2 perspectives: On the causes of terrorist attacks or events On the interventions we can make to block, weaken or divert these causes, and thereby frustrate terrorists from achieving their goals

Target Vehicles & Audiences Conjunction of Criminal Opportunity 09/29/99 Conjunction of Terrorist Opportunity Target Vehicles & Audiences Ideology, goals

Ideological predisposition Diagnosis – the immediate causes of terrorist events – the terrorist side Ideological predisposition Lack of skills and other personal resources to avoid terrorism Readiness to act Resources for committing terrorism Decision to commit act of terrorism Terrorist’s (tele)presence in situation I’ll focus on the immediate causes for this presentation, don’t think CCTV has had a significant role on historical timescale yet….

Target of terror – vectors, audiences and military opponents Diagnosis – the immediate causes of terrorist events – situational side Target of terror – vectors, audiences and military opponents Enclosures – for targets and for terrorists Wider environment Absence/incapacity of terrorism preventers Presence/capacity of terrorism promoters Tora Bora

A crime prevention intervention Intervention in cause Disruption of Conjunction of Terrorist Opportunity Decreased risk of terrorist events Reduced number of events A crime prevention intervention Wider benefits

Map of basic intervention principles 09/29/99 Likewise for intervention principles Map of basic intervention principles

Intervention – the terrorist side Ideological predisposition Deradicalisation Lack of skills and other personal resources to avoid terrorism Increasing resistance to radicalisation Readiness to act Addressing short-term motivational pressures Resources for committing terrorism Denial of weapons, tools, info, funds Decision to commit act of terrorism Deterrence (risk) and Discouragement (low reward, high effort) Terrorist’s (tele)presence in situation Approach and access control I’ll focus on the immediate causes for this presentation, don’t think CCTV has had a significant role on historical timescale yet….

Intervention – the situational side Target of terror – vectors, audiences and military opponents Target hardening, making it less vulnerable or attractive; making target audiences more resistant to influence Enclosures – for targets and for terrorists Hardening the enclosure, adding stand-off etc Wider environment Making reconnaissance difficult, making Vehicle-Borne attacks hard to approach the target or enclosure at speed Absence/incapacity of terrorism preventers Mobilising public, organisations, families to influence potential perpetrators or report suspicious activity Presence/capacity of terrorism promoters E.g. mobilising people who sell fertiliser, not to sell, or to tell police Tora Bora

Preparation for attack Complex attacks – multiple steps Preparation for attack Execution of attack Consummation of attack The same diagnostic map of causes can be applied to the event which completes each scene. #Here’s the main scene, as before, the execution of the crime. #Here’s the preparation - showing several components# and 2 stages. #And here’s the consummation. We can target our interventions at any stage - perhaps several. We can use scene diagrams like flowcharts, to help us think strategically how criminals, particularly well-resourced organised criminals, could bypass blockages by seeking alternative routes to their goal. &

Summary CTO aims to provide an integrated model of causes of terrorist events to aid understanding, investigation, risk and threat assessment, and prevention Identifies full range of preventive responses which could be implemented by different agencies acting at different levels and over different timescales Acknowledges evolutionary nature of the problem We can use CTO to Think strategically, or tactically, and always holistically about problems and solutions Help to capture, store, retrieve and share knowledge of practice and policy Communicate efficiently across professional disciplines, and internationally

Where to find CTO https://5isframework.wordpress.com/conjunction-of-criminal-opportunity/ https://5isframework.files.wordpress.com/2013/12/cto-security-journal-july05.pdf