Security Threat Analysis: Passenger Rail Networks
An overview of terrorist attacks on passenger rail networks in Europe and North America focused on current and emerging tactical and targeting trends.
It is now over 13 years since the 7/7 bombings inflicted mass casualties across the London transport network on the morning of 7 July 2005. In the interim period, railway networks and subway systems in Europe and North America have remained the target of a large number of terrorist plots and attacks featuring a number of attack methodologies.
The Current Security Threat Analysis
On the morning of 22 March 2016, Islamic State (IS) carried out the bombing of the Maalbeek Metro Station in Brussels as part of a coordinated improvised explosive device (IED) attack on rail and aviation targets in the Belgian capital. Twenty people were killed and over 100 others injured in the attack. The cell responsible for the attacks was part comprised of the wider network that carried out the 13 November 2015 marauding assault on multiple locations in Paris.
Since the Brussels bombing, there have been additional successful or attempted attacks on rail networks in several major cities including London, St Petersburg, Brussels and New York. Whilst only the St Petersburg attack on 3 April 2017 resulted in any fatalities, the terrorist threat to rail passenger networks across the Western world remains high and will continue to pose a major threat to public safety and business operations for the foreseeable future.
Why Rail Networks?
Rail passenger facilities typically rely on open architecture and are designed to facilitate the free flow of large numbers of passengers across the network. This increases the vulnerability of the network to attack by placing limitations on the viability of increased security measures which do not result in unreasonable delay and inconvenience to commuters. The fact that rail networks naturally extend over a large area also provides terrorist operatives with multiple points of entry into and exit from the facilities. In addition, the existence of vast rural stretches are inevitably highly challenging to effectively patrol and secure.
Security Threat Analysis: Attack Methodologies
There are a number of frequently used methods of attack against rail networks, including bladed weapons and IEDs. Less frequently, attacks have also involved the use of firearms; for example, the 21 August 2015 failed IS-inspired attack on a Paris-bound train in Thalys, which was thwarted by the intervention of three American tourists who wrestled the gunman to the ground.
Less orthodox attack methodologies include the 20 March 1995 sarin gas attack on the Tokyo subway system by the Japanese religious cult Aum Shinrikyo. The liquid sarin was deployed in plastic bags which were punctured by the terrorist operatives in multiple train carriages. The attack killed 12 people and injured over 1,000 others. Whilst a range of terrorist groups have continued to demonstrate interest in attacks using chemical or biological weapons, the resources and technical capability required to manufacture a chemical or biological agent are prohibitively high for many aspiring hostile actors, rendering it an unfeasible methodology.
A further possible method is deploying a train derailment device for use against passenger trains travelling at high speed, a tactic which has been promoted in several high-profile jihadist magazines. The first documented reporting of such a device being used for this purpose was of an attack in early October 2018 against an inter-city passenger train travelling between Nuremberg and Munich. Although the device failed to derail the train, its impact upon the vehicle was felt by the driver. Threatening letters in Arabic and Arabic graffiti indicating an Islamist extremist motive were subsequently recovered at the scene of the attack.
IED Attack Trends
The vast majority of IED attacks on passenger rail networks in Europe and North America in recent years have featured the use of devices initiated by a timer or a suicide operative. Examples include the 15 September 2017 Parsons Green bombing and the 11 December 2017 failed suicide attack in a tunnel adjoining the New York Subway. Suicide IEDs give a number of tactical advantages to the operative, including the ability to make last-moment alterations to the location in which the device is functioned. Suicide attacks also eliminate the possibility that a suspicious package would be identified and the area evacuated before the device is functioned.
Radio-controlled devices have also been used on a number of occasions in this period, most notably in Al-Qaeda’s 11 March 2004 coordinated attacks on multiple train carriages in Madrid which killed 192 people and injured over 2,000 others. The attack remains the most lethal single terrorist incident to have taken place in Europe this century.
A large percentage of the IED attacks identified in this period were carried out during the morning rush hour (defined as 0700hrs to 1000hrs) on weekdays, almost certainly also due to a desire to maximise the number of casualties in the attack.
In recent years, a large number of terrorist IEDs in Europe and North America have failed to function as intended, or at all, due to technical or material deficiencies in the device. Examples of this include the 15 September 2017 Parsons Green attack and the 11 December 2017 New York Subway bombing. Although a fireball was caused by the initiation of the detonator in the Parsons Green incident, the TATP main charge did not explode, reducing the effectiveness and lethality of the device. Notably, in the context of recent attacks in Europe and North America, the majority of perpetrators whose devices successfully functioned appear to have spent time fighting alongside jihadist terrorist organisations in foreign conflict theatres. These include members of the extended terror cell who perpetrated the 13 November 2015 Paris attacks and the 22 March 2016 Brussels attacks, Salman Abedi, who carried out the 22 May 2017 suicide attack on the Manchester Arena, and Ahmad Khan Rahimi, the individual behind the 17-19 September 2016 New York and New Jersey IED attacks. The trend suggests that, despite the proliferation of online materials regarding IED construction, many would-be terrorists rely on real-world training in order to successfully carry out an IED attack. .
Source of the Threat
Based on current activity levels and targeting trends, terrorism associated with Islamist-extremist organisations such as Al-Qaeda and IS currently poses the greatest threat to European and North American passenger rail networks. Whilst in recent years there has been an increase in terrorist activity associated with the far-right, at present many of these emerging groups lack the operational capability of established terrorist networks such as IS. Moreover, the majority of far-right plots and attacks in recent years have focused on ethnic, sexual or religious minorities, or political opponents.
At present, there are few indicators to suggest that such groups are likely to attempt to carry out mass casualty terrorist attacks on passenger rail networks in the immediate future. A number of anarchist and far-left militant groups across Europe and North America have demonstrated some interest in acts of vandalism and sabotage against rail networks in association with a broad range of political causes. This includes the US-based ‘Pudget Sound Anarchists’, who have shared videos online promoting industrial sabotage of rail networks in opposition to fracking. However, there is very little evidence at present to suggest that such groups possess a rising capacity and/or willingness to target rail commuters with lethal intent.
The highest volume of terrorist activity directed against the UK rail transport network in recent decades originated from the IRA. Between 1991 and 1997, there were a reported 41 IRA attacks on transport targets across England. These attacks featured a total of 81 separate IEDs and resulted in three deaths. During this period, there were also more than 6,500 telephoned bomb threats and a further 9,400 suspicious objects reported across the rail network. Whilst the IRA’s intention was not to carry out mass casualty attacks, the sheer volume of activity, in addition to the added challenges posed by copycats and malicious pranksters, placed significant financial pressure on UK transport networks and the resources of police and rail security services.
Rail Security Enhancements
Following the peak of the IRA campaign against the UK mainland, review of existing rail security weaknesses led to the implementation of a broader security strategy to target-harden the UK rail network and reduce the risks facing it. Security measures introduced in the intervening period include:
Installation of CCTV systems across the rail network to assist in counter-terrorism investigations and provide security personnel and stationmasters with greater visibility of the facilities.
Improved lighting to deter terrorists and improve site visibility.
Repairing gaps in perimeter fencing along the rail network to limit access to unauthorised persons.
Installation of transparent or blast-resistant bins to limit the effectiveness of IEDs placed inside them.
Encouraging staff and passengers to identify and report suspicious behaviour and unattended packages.
Future Trends
The terrorist threat to passenger rail networks is highly likely to persist for the foreseeable future. Despite the destruction of the IS ‘Caliphate’ in Iraq and Syria, the group continues to pose a major threat to the West in the form of a decentralised network.
Associated risks are likely to emerge from the return of foreign fighters previously aligned with jihadi terrorist groups in current conflict theatres. Such persons could potentially play a leading role in the formation of extremist hubs and the diffusion of terrorist skills and operational tradecraft throughout support groups in the West. In the face of these and other threats, the need for innovative, intelligence-led security solutions to the heightened threat has never been greater. By identifying and analysing trends from previous terrorist attacks, we increase our odds of stopping the next one.
Gareth Herbert
Intelligence Analyst, VSG www.vsg.co.uk
…………………………………………………………
If you see something suspicious: move away and call 999 or the police Anti-Terrorist Hotline on 0800 789 321.
Or, while travelling on the rail network, text 61016 or call 0800 40 50 40 to contact British Transport Police.
