The terrorism risk landscape is changing

High profile terrorist attacks and false alarm events are changing the way businesses respond to such incidents, and the insurance protections they are buying against evolving terror threats.

That was the message from two senior London market insurance brokers. Both are former British Army officers, before switching careers to work within the risk transfer sector, focused on crisis management and terrorism threats.

“Demand for standalone terrorism insurance is up,” said Justin Priestley, executive director, crisis management, at Gallagher.

“That is driven by a number of factors, firstly by a number of high-profile incidents, and not just in Central London,” Priestley said, speaking to StrategicRISK at the recent Airmic 2018 risk management conference in Liverpool.

The areas affected by such incidents have been large, and the effects prolonged, he continued. “Those effects have not necessarily been physical damage (PD),” he added.

Priestley referred to the Salisbury poisoning of Sergei and Yulia Skripal in March 2018, when a nerve agent was used to poison the former Russian intelligence officer and British double agent and his daughter.

The attack left them both hospitalised, in an incident blamed by the UK government on the Kremlin. It also left businesses on the wrong side of police tape and facing a sharp and prolonged drop in customers.

“Police have put cordons in place, for several months, resulting in denial of access for many businesses, for example,” said Priestley, who was a British Army officer before joining the insurance sector, working in bomb disposal and counter terrorism operations.

He described terrorism insurance pricing as static but competitive, leading to more businesses taking out standalone terrorism risk protection. “They don’t see this as prohibitively expensive insurance cover to have,” Priestley said.

He also stressed that insurers have demonstrated a good record in responding to claims from terror events. “The market has stood up well, paying those claims,” he added.

Several recent terror incidents in Europe have been classed as “active shooter events”, involving guns rather than bombs, leading to another shift in the perils covered by terrorism risk policies.

“Active shooter coverage can mean different things, for example business interruption (BI) cover, both for PD and non-PD, as well as specific advisory and response services both pre and post an event happening,” said Scott Bolton, director, Aon Risk Solutions, also speaking to StrategicRISK at the Airmic 2018 event.

Bolton also served in the British Army before joining the insurance sector, including providing counter-terrorism and bomb disposal guidance and support to the emergency services and government departments.

The number of insurers offering standalone protection for active shooter incidents has increased. In the London market, it includes insurers such as Aspen, Beazley, Hiscox and XL Catlin. “Some of them have the consulting element, others don’t,” said Priestley.

Priestley stressed the importance of response services for clients. “For our crisis resilience solutions, there is demand for that 24-hour support,” he said.

“It’s about reassurance for people to have someone to call. They want that expert advice, particularly when it comes to what communications message – internally and externally – to put out,” Priestley added.

NDBI & loss of attraction

Bolton pointed to two recent false alarm events in the UK, where there no actual terrorism took place, but many BI and loss of attraction consequences for the businesses involved.

The first was in May 2016. An imitation bomb – used as in trainings against terrorism scenarios – had been left within Old Trafford stadium, home of football club Manchester United.

As the team prepared to play a match against Bournemouth, the discovery of the suspicious package led to the Premier League game at the 74,994-capacity ground being abandoned and postponed.

That event occurred almost exactly a year before a real terrorist attack in May 2017, when an Islamist suicide bomber killed 23 and wounded 139 concertgoers at the nearby Manchester Arena, watching an indoor concert of US pop singer Ariana Grande.

The second false alarm event cited by Bolton was the false alarm in November 2017 at Oxford Circus London Underground station.

Black Friday Christmas shoppers fled in alarm, nine of them injured in the rush of people, after (false) reports of shots being fired. Police evacuated Oxford Circus and Bond Street stations, as well as setting up a cordon on Oxford Street – London’s busiest shopping thoroughfare.

The Oxford Circus scare occurred in the aftermath of the Westminster Bridge and London Bridge terrorism events, both of which involved vehicle ramming and knife attacks, in March and June 2017, respectively.

Eight people were killed and 48 were injured by the London Bridge attackers. Five people were killed and 49 wounded by the attackers at Westminster.

Unlike the Manchester Arena blast, the nature of these two London attacks – using knives and vehicles to maim pedestrians – caused minimal PD to businesses in the vicinity.

And for the Old Trafford and Oxford Circus false alarms, neither was a terrorism event, and therefore caused much disruption but little or no PD to businesses involved.

Bolton stressed the non-damage business interruption (NDBI) consequences for retailers caught on the wrong side of a police cordon – for a false alarm event and for a real attack – and likely facing a drop in footfall from spooked customers in the period afterwards – regardless of whether an attack took place.

This is translating into changes in demand for businesses buying terrorism insurance and related products, latterly for loss of attraction covers.

“NDBI has been a theme for the past two years, but loss of attraction has been a theme for the past six to 12 months,” said Bolton.

The insurance market offers more covers than previously. Pool Re, the UK’s public-private terrorism risk re/insurance backstop, has already extended its cover to include property damage caused by a cyber trigger, but is working with the government to change legislation to include NDBI. 

Events in Paris in November 2015 – when suicide bombers and assault-rifle armed terrorists killed 130 victims at multiple locations – were a precursor to the change in demand for insurance buyers, Bolton noted.

Lessons learned

Paris and later events provided lessons for risk managers and insurance buyers, such as gathering more data to understand the losses caused by such tragic events.

The “loss of attraction” fallout caused major revenues drops for Parisian hoteliers, restaurants and retailers, hit hard as millions of tourists were put off from vacationing in the French capital.

“The challenge is to get the information about the full scope of losses,” said Bolton.

Gallagher has been providing clients with detailed scenarios, to assess their exposures, in the wake of attacks in recent years.

“We’ve run more realistic disaster scenarios, to recreate the effects of attacks such as Paris or London Bridge,” said Priestley. “Are they in a target-dense area? What is the proximity of client assets to potential targets?”

Aon has also increased its investment in risk modelling techniques for assessing likely fatalities from mass shooting events as well as explosive attacks.

“For a shooter event, the thing which reduces impact is to restrict the freedom of movement of an attacker,” said Bolton.

“That can mean stopping them from getting around inside the building, because the armed police response is not going to be immediate in stopping them. For example, how do you lock down stairwell and elevator access from reception?” he said.

That has meant dusting off response procedures, including evacuation plans.

“You don’t want to evacuate staff towards a potential threat. And it is impossible to lock down all sites, so you need to tailor your procedures,” said Bolton.

He pointed to injuries caused to people trying to flee terrorism attacks and mass shootings, caught up in the crush – such as at the Manchester Arena blast, and also at the Las Vegas shooting in October 2017, at which a gunman opened fire on concertgoers at the Route 91 Harvest music festival.

In Las Vegas, the gunman killed 58 people and wounded 422 from his vantage point on the 32nd Floor of the Mandalay Bay Hotel. However, 851 people were injured in the attack – hundreds in the ensuing panic and crush to try to get out of harm’s way.

Such mass shooting events can involve the premises of multiple businesses – such as hotels, shops and stadia. Police are keen for businesses to work together, Bolton stressed, to share information about response plans.

“Even if you’ve got plans in place, there is still the potential for them to fail at the point of need,” said Bolton. “Information is often shared, such as by the security teams within companies, but cooperation could be improved in places,” he added.