Vulnerability assessment of the EU PRoTECT project - Revision history

Dolinda at 14:26, 23 November 2020

2020-11-23T14:26:36Z

Puck at 09:35, 20 November 2020

2020-11-20T09:35:02Z

Puck at 09:28, 20 November 2020

2020-11-20T09:28:16Z

Puck at 13:45, 19 November 2020

2020-11-19T13:45:23Z

Puck: Created page with "Within the EU PRoTECT project municipalities have performed vulnerability assessments on specific public spaces in their region that can be considered soft targets for Terro..."

2020-11-12T10:01:11Z

Created page with "Within the EU PRoTECT project municipalities have performed vulnerability assessments on specific public spaces in their region that can be considered soft targets for Terro..."

New page

Within the EU PRoTECT project municipalities have performed vulnerability assessments on specific public spaces in their region that can be considered soft targets for [[Terrorism|terrorist attacks]]. For this purpose, the EU Vulnerability Assessment Tool developed by DG Home was used and a specific manual for municipalities or other local law enforcement agencies was developed. This EU VAT is an example of how to identify and analyze vulnerabilities that can be used to focus on determining what kind of measures are needed to mitigate these vulnerabilities. There are multiple other processes and analysis tools for vulnerability assessment and for identifying risks.

== The EU Vulnerability Assessment Tool manual ==
DG HOME has developed the EU Vulnerability Assessment Tool (VAT) (2019) which main objective is to provide practical support to Member States’ to enhance the protection of [[Public space|public spaces]] by facilitating the conduction of an on-site vulnerability assessment. Within the PRoTECT project, a manual for this EU VAT was developed to specifically aid municipalities and their stakeholders in identifying vulnerabilities of their [[Public space|public spaces of interest]] ([[soft targets]]) in order to strengthen their protection against terrorism.

The EU VAT Manual describes (1) who should perform such an assessment and why, the steps that are needed (2) before using the tool, (3) what different steps are involved in the assessment and how to record te results of the assessment, and (4)what can be done with the results and what next steps can be taken.

== Security management and assessing vulnerabilities ==
It is important to mention that the vulnerability assessment was organized by a managing body, in the case of the PRoTECT project the five municipalities and their related supporting PRoTECT partner. It is essential to involve relevant stakeholders for the security of the site to be assessed and that for the purposes of the PRoTECT project the managing body is responsible for identifying what public space to asses. Having a managing body is necessary because some organization needs to take the lead responsibility in developing a security plan. Generally, developing a security plan is an ongoing process – threats and other circumstances change, requiring the security plan to be continually adapted as well. In the case of protecting a PSOI against terrorist attacks, it is assumed that even though a certain activity may be unique, there are some common aspects related to the PSOI: the method of planning, managing the activity and other security related aspects.

Developing and maintaining a security plan is a cyclic process, generally involving the following steps:

1. Security audit/inspection (policy, constraints, site and activity characteristics, threats, security measures, vulnerabilities, risks, etc.);

2. Decision making (budgets, priorities, schedules, risk acceptance, go/no-go by the management body, etc.);

3. Security plan (development/adjustment, and ratification by the management body);

4. Implementation and (periodic) verification of security measures (in accordance with the security plan).

The aspect of risk assessment involves three consecutive processes<ref>Systematic techniques for risk assessment are described in the IEC 31010:2009 standard.</ref>:

1. Risk identification (identifying threats and threat scenarios)

2. Risk analysis (determining consequences, probabilities, risk levels and vulnerabilities)

3. Risk evaluation (determining priorities, risk treatment actions, risk acceptance)

The vulnerabilities of a PSOI and the possible risks of an attack can be identified by examining the PSOI (geographical layout, accessibility for vehicles, natural or emplaced security measures, etc) and devising viable attack scenarios. Scenarios should at least mention the threat type (e.g. shooter), the aim of the attack, with what means and how the terrorist carries out the attack. Conceiving scenarios can be an activity carried out by a team of experts from all the relevant stakeholders that is put together by the managing body. This means that to be able to carry out the assessment, different experts need to be present and gathered to go through all steps. In the risk analysis process, the consequences (i.e. impact, severity) and probability (i.e. likelihood, chance) of each attack scenario are determined by the team of experts, considering all factors of influence.

== Before using the tool: getting started ==
Before using the EU VAT, it is important to determine a managing body. The managing body is an individual, organization or group of organizations that takes up the responsibility to identify and work on counter terrorism regarding PSOIs. This can be a law enforcement agency, a municipality or possibly also the owner of the public space. The management will most likely involve various stakeholders in decisions concerning site security, such as local government, emergency services, retailers, etc. In the case of the PRoTECT project, the managing bodies are the municipalities involved that will identify their vulnerabilities against various terrorist attacks and identify their soft targets. This managing body needs to take the following actions:

1. Create clear understanding of the organization of the PSOI (who is involved (stakeholders) and their roles and responsibilities, geographical boundaries of the site, the plans for the events and risk evaluation criteria) and gather all relevant information.

2. Create a team of experts that will perform the vulnerability assessment together (include stakeholders that have detailed knowledge of the PSOI, security policies and expertise on counter-terrorism).

3. Create and decide on a work method with the team of experts, on how to perform the vulnerability assessment. In the case of PRoTECT this was done by workshop sessions with all relevant stakeholders.

== Assessing the Public Space of Interest: 5 steps ==
It is recommended to kick-off by displaying a topographical map to the team, detailing the boundaries of the main site and surrounding sites, and describing the general function of each surrounding site in relation to the activity on the main site. When possible, organize a visit to the PSOI.

=== Step 1: Characteristics of the site ===
Write the necessary details like the main site's name, if there are specific activities happening (like a festival, market or something else) and when this activity occurs. The dates and times are important to be aware if an activity is occurring regularly or is incidental. Second, write down the details of the site, the name and address, in which phase of the EU VAT the site fits and what the expected crowd density is. It is possible that the crowd density differs on specific times, please add this if relevant. Finally, it is useful to fill in the team members and the date of assessment.

=== Step 2: Existing security measures ===
Gather together with the team of experts, the existing security measures you are aware of regarding the specific site. This can be a natural measure, for instance a wall that can create a blockage or to hide behind, or emplaced measures, for instance surveillance police teams or road blocks. Within the PRoTECT project the measures [BP(vd1] were categorized by the use of technology solutions.

=== Step 3: Scenario per threat type ===
Use each other’s creativity and expertise to assess scenario’s according to ten potential '''''terrorist threat types''''' mentioned by the EU VAT. The ten potential threat [BP(vd2] types used are:

1. Fire arms attack - small calibre pistol or semi/full-automatic rifle;

2. Sharp object attack - knifes, machete, other sharp and blunt objects;

3. Vehicle attack - use of vehicle as a weapon by ramming large crowds;

4. IED (explosives) - left/concealed in objects or goods (based on home-made or commercial explosives);

5. PBIED (explosives) - explosives concealed on a person (suicide or carrier);

6. UAVIED (explosives) - explosives delivered by a remote-controlled airborne device;

7. VBIED (explosives) - explosives concealed inside a vehicle (or its cargo);

8. Chemical attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed);

9. Biological attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed);

10. Radiological attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed).

=== Step 4: Consequence and probability ===
For each scenario, one should assess with the team of experts what the consequence and probability are for each scenario. For each site (area) of the PSOI and considering existing measures, each scenario should be followed trough to identify the lack of measures that could create a vulnerability if either or both consequence and probability are high.

=== Step 5: Analysis and results ===
Finally, when all consequences and probabilities have been determined for a site, check for any inconsistencies or dependencies among the scenarios, consequences and probabilities, and make adjustments where necessary. Possibly repeat this activity once all record templates for all sites have been completed. Determine level of risk for each scenario, for instance by using a risk matrix (risk low, medium and high) and record this.

== What’s next ==
Once an overall insight into the vulnerabilities of the PSOI is available, follow-up actions can be taken. The security experts’ team can suggest mitigation options for some or all of the attack scenarios to the management body. Also, using the results from using the EU VAT, the managing body can evaluate the risks, deciding which risks to mitigate and how (in part based on the options provided by the security team) and which risks to accept. Furthermore, informing and involving the stakeholders. Finally, '''''gathering information''''' on [[Measures|solutions]] and getting the measures implemented to mitigate '''''vulnerabilities'''''.

@@ Line 47: / Line 47: @@
 ===Step 2: Existing security measures===
-Gather together with the team of experts, the existing security measures you are aware of regarding the specific site. This can be a natural measure, for instance a wall that can create a blockage or to hide behind, or emplaced measures, for instance surveillance police teams or road blocks. Within the PRoTECT project the measures [BP(vd1] were categorized by the use of technology solutions.
+Gather together with the team of experts, the existing security measures you are aware of regarding the specific site. This can be a natural measure, for instance a wall that can create a blockage or to hide behind, or emplaced measures, for instance surveillance police teams or road blocks. Within the PRoTECT project the measures were categorized by the use of technology solutions.
 ===Step 3: Scenario per threat type===
-Use each other’s creativity and expertise to assess scenario’s according to ten potential '''''terrorist threat types''''' mentioned by the EU VAT. The ten potential threat [BP(vd2] types used are:
+Use each other’s creativity and expertise to assess scenario’s according to ten potential '''''terrorist threat types''''' mentioned by the EU VAT. The ten potential threat types used are:
 #''Fire arms'' attack - small calibre pistol or semi/full-automatic rifle;
@@ Line 74: / Line 74: @@
 <br />
-== Footnotes and references ==
+==Footnotes and references==
 <references />

@@ Line 71: / Line 71: @@
 ==What’s next==
 Once an overall insight into the vulnerabilities of the PSOI is available, follow-up actions can be taken. The security experts’ team can suggest mitigation options for some or all of the attack scenarios to the management body. Also, using the results from using the EU VAT, the managing body can evaluate the risks, deciding which risks to mitigate and how (in part based on the options provided by the security team) and which risks to accept. Furthermore, informing and involving the stakeholders. Finally, '''''gathering information''''' on [[Measures|solutions]] and getting the measures implemented to mitigate '''''vulnerabilities'''''.
+<br />
+== Footnotes and references ==
 <references />

@@ Line 52: / Line 52: @@
 Use each other’s creativity and expertise to assess scenario’s according to ten potential '''''terrorist threat types''''' mentioned by the EU VAT. The ten potential threat [BP(vd2] types used are:
-.       Fire arms attack - small calibre pistol or semi/full-automatic rifle;
+#''Fire arms'' attack - small calibre pistol or semi/full-automatic rifle;
+#''Sharp object'' attack - knifes, machete, other sharp and blunt objects;
+#''Vehicle'' attack - use of vehicle as a weapon by ramming large crowds;
-.       Sharp object attack - knifes, machete, other sharp and blunt objects;
+#''Improvised Explosive Device (IED)'' - left/concealed in objects or goods (based on home-made or commercial explosives);
+#''Person-Born Improvised Explosive Device'' (PBIED) - explosives concealed on a person (suicide or carrier);
-.       Vehicle attack - use of vehicle as a weapon by ramming large crowds;
+#''Unmanned Aerial Vehicle Improvised Explosive Device (UAVIED)'' - explosives delivered by a remote-controlled airborne device;
+#''Vehicle-Borne Improvised Explosive Devise (VBIED)'' - explosives concealed inside a vehicle (or its cargo);
-.       IED (explosives) - left/concealed in objects or goods (based on home-made or commercial explosives);
+#''Chemical'' attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed);
+#''Biological'' attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed);
-.       PBIED (explosives) - explosives concealed on a person (suicide or carrier);
+#''Radiological'' attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed).
-.       UAVIED (explosives) - explosives delivered by a remote-controlled airborne device;
-.       VBIED (explosives) - explosives concealed inside a vehicle (or its cargo);
-.       Chemical attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed);
-.       Biological attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed);
-.   Radiological attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed).
 ===Step 4: Consequence and probability===

@@ Line 1: / Line 1: @@
-Within the EU PRoTECT project municipalities have performed vulnerability assessments on specific public spaces in their region that can be considered soft targets for [[Terrorism|terrorist attacks]]. For this purpose, the EU Vulnerability Assessment Tool developed by DG Home was used and a specific manual for municipalities or other local law enforcement agencies was developed. This EU VAT is an example of how to identify and analyze vulnerabilities that can be used to focus on determining what kind of measures are needed to mitigate these vulnerabilities. There are multiple other processes and analysis tools for vulnerability assessment and for identifying risks.
+Within the EU PRoTECT project municipalities have performed vulnerability assessments on specific public spaces in their region that can be considered soft targets for [[Terrorism|terrorist attacks]]. For this purpose, the EU Vulnerability Assessment Tool developed by DG Home was used and a specific manual for municipalities and local law enforcement agencies was developed. This EU VAT is an example of how to identify and analyze vulnerabilities that can be used to focus on determining what kind of measures are needed to mitigate these vulnerabilities.
-== The EU Vulnerability Assessment Tool manual ==
+==The EU Vulnerability Assessment Tool manual==
-DG HOME has developed the EU Vulnerability Assessment Tool (VAT) (2019) which main objective is to provide practical support to Member States’ to enhance the protection of [[Public space|public spaces]] by facilitating the conduction of an on-site vulnerability assessment. Within the PRoTECT project, a manual for this EU VAT was developed to specifically aid municipalities and their stakeholders in identifying vulnerabilities of their [[Public space|public spaces of interest]] ([[soft targets]]) in order to strengthen their protection against terrorism.
+DG HOME has developed the EU Vulnerability Assessment Tool (VAT) (2019) with the main objective of providing practical support to Member States to enhance the protection of public spaces by facilitating on-site vulnerability assessments. Within the PRoTECT project, a manual for this EU VAT was developed to specifically aid municipalities and their stakeholders in identifying vulnerabilities of their public spaces of interest (soft targets) in order to strengthen their protection against terrorism.
-The EU VAT Manual describes (1) who should perform such an assessment and why, the steps that are needed (2) before using the tool, (3) what different steps are involved in the assessment and how to record te results of the assessment, and (4)what can be done with the results and what next steps can be taken.
+The EU VAT Manual describes (1) who should perform such an assessment and why, (2) the steps that are needed before using the tool, (3) what different steps are involved in the assessment and how to record te results of the assessment, and (4) what can be done with the results and what next steps can be taken.
-== Security management and assessing vulnerabilities ==
+==Security management and assessing vulnerabilities==
-It is important to mention that the vulnerability assessment was organized by a managing body, in the case of the PRoTECT project the five municipalities and their related supporting PRoTECT partner. It is essential to involve relevant stakeholders for the security of the site to be assessed and that for the purposes of the PRoTECT project the managing body is responsible for identifying what public space to asses. Having a managing body is necessary because some organization needs to take the lead responsibility in developing a security plan. Generally, developing a security plan is an ongoing process – threats and other circumstances change, requiring the security plan to be continually adapted as well. In the case of protecting a PSOI against terrorist attacks, it is assumed that even though a certain activity may be unique, there are some common aspects related to the PSOI: the method of planning, managing the activity and other security related aspects.
+It is important to mention that the vulnerability assessment was organized by a managing body, in the case of the PRoTECT project the five municipalities[VG(v1] . It is essential to involve relevant stakeholders such as the local law enforcement agency. The managing has the lead in developing a security plan for the PSOI. Generally, developing a security plan is an ongoing process – threats and other circumstances change, requiring the security plan to be continually adapted as well. In the case of protecting a PSOI against terrorist attacks, it is assumed that even though a certain activity at the PSOI may be unique, there are some common aspects related to the PSOI: the method of planning, managing the activity and other security related aspects.
@@ Line 31: / Line 31: @@
 The vulnerabilities of a PSOI and the possible risks of an attack can be identified by examining the PSOI (geographical layout, accessibility for vehicles, natural or emplaced security measures, etc) and devising viable attack scenarios. Scenarios should at least mention the threat type (e.g. shooter), the aim of the attack, with what means and how the terrorist carries out the attack. Conceiving scenarios can be an activity carried out by a team of experts from all the relevant stakeholders that is put together by the managing body. This means that to be able to carry out the assessment, different experts need to be present and gathered to go through all steps. In the risk analysis process, the consequences (i.e. impact, severity) and probability (i.e. likelihood, chance) of each attack scenario are determined by the team of experts, considering all factors of influence.
-== Before using the tool: getting started ==
+==Before using the tool: getting started==
 Before using the EU VAT, it is important to determine a managing body. The managing body is an individual, organization or group of organizations that takes up the responsibility to identify and work on counter terrorism regarding PSOIs. This can be a law enforcement agency, a municipality or possibly also the owner of the public space. The management will most likely involve various stakeholders in decisions concerning site security, such as local government, emergency services, retailers, etc. In the case of the PRoTECT project, the managing bodies are the municipalities involved that will identify their vulnerabilities against various terrorist attacks and identify their soft targets. This managing body needs to take the following actions:
@@ Line 40: / Line 40: @@
 .       Create and decide on a work method with the team of experts, on how to perform the vulnerability assessment. In the case of PRoTECT this was done by workshop sessions with all relevant stakeholders.
-== Assessing the Public Space of Interest: 5 steps ==
+==Assessing the Public Space of Interest: 5 steps==
 It is recommended to kick-off by displaying a topographical map to the team, detailing the boundaries of the main site and surrounding sites, and describing the general function of each surrounding site in relation to the activity on the main site. When possible, organize a visit to the PSOI.
-=== Step 1: Characteristics of the site ===
+===Step 1: Characteristics of the site===
 Write the necessary details like the main site's name, if there are specific activities happening (like a festival, market or something else) and when this activity occurs. The dates and times are important to be aware if an activity is occurring regularly or is incidental. Second, write down the details of the site, the name and address, in which phase of the EU VAT the site fits and what the expected crowd density is. It is possible that the crowd density differs on specific times, please add this if relevant. Finally, it is useful to fill in the team members and the date of assessment.
-=== Step 2: Existing security measures ===
+===Step 2: Existing security measures===
 Gather together with the team of experts, the existing security measures you are aware of regarding the specific site. This can be a natural measure, for instance a wall that can create a blockage or to hide behind, or emplaced measures, for instance surveillance police teams or road blocks. Within the PRoTECT project the measures [BP(vd1] were categorized by the use of technology solutions.
-=== Step 3: Scenario per threat type ===
+===Step 3: Scenario per threat type===
 Use each other’s creativity and expertise to assess scenario’s according to ten potential '''''terrorist threat types''''' mentioned by the EU VAT. The ten potential threat [BP(vd2] types used are:
@@ Line 72: / Line 72: @@
 .   Radiological attack - threat object concealed in goods or carried items (e.g. canister or UAV dispensed).
-=== Step 4: Consequence and probability ===
+===Step 4: Consequence and probability===
 For each scenario, one should assess with the team of experts what the consequence and probability are for each scenario. For each site (area) of the PSOI and considering existing measures, each scenario should be followed trough to identify the lack of measures that could create a vulnerability if either or both consequence and probability are high.
-=== Step 5: Analysis and results ===
+===Step 5: Analysis and results===
 Finally, when all consequences and probabilities have been determined for a site, check for any inconsistencies or dependencies among the scenarios, consequences and probabilities, and make adjustments where necessary. Possibly repeat this activity once all record templates for all sites have been completed. Determine level of risk for each scenario, for instance by using a risk matrix (risk low, medium and high) and record this.
-== What’s next ==
+==What’s next==
 Once an overall insight into the vulnerabilities of the PSOI is available, follow-up actions can be taken. The security experts’ team can suggest mitigation options for some or all of the attack scenarios to the management body. Also, using the results from using the EU VAT, the managing body can evaluate the risks, deciding which risks to mitigate and how (in part based on the options provided by the security team) and which risks to accept. Furthermore, informing and involving the stakeholders. Finally, '''''gathering information''''' on [[Measures|solutions]] and getting the measures implemented to mitigate '''''vulnerabilities'''''.
+<references />