CB Protective Measures in the Commercial Environment

Although intelligence sources in the West have long been concerned over the proliferation of chemical and biological weapons in the military arena, the perceived risk of attacks on a civilian population by terrorists using such weapons was considered a low risk. This was despite the history of small-scale attacks perpetrated by various groups including:

• The Japanese sect Aum Shinrikyo released sarin nerve gas in a residential building in Matsumoto, a small town, killing seven people and injuring over 300.
• Aum Shinrikyo, released nerve gas on the Tokyo subway in 1995, killing twelve and injuring thousands.
• The militant leftist German group the Red Army Faction is believed to have tried to develop botulism toxin, with some success, in the 1980s.
• A raid on a Red Army Faction safe house in Paris in 1984 uncovered a makeshift laboratory containing toxins.
• Members of a religious cult in the US State of Oregon succeeded in poisoning local restaurant salad bars with salmonella in 1994, injuring more than 700 people. No one is believed to have died as a result of the attack.

The generally accepted view was that despite the readiness of these disparate groups to use CB agents, most terrorist groups recognized the political dangers of using weapons of mass destruction. However the events of 11 September indicated a shift away from the objectives, methods and strategies of the 'classic' or 'political' terrorist. The Al Qa'ida terrorists responsible for the attacks on 9/11 showed that, lacking the desire to seek political compromises or concessions, they were willing to cause mass civilian casualties. The fear now is that such groups may choose to not only unleash chemical or biological attacks for nebulous reasons but also without advance warning. Therefore, after the events of 9/11 and the willingness of the terrorists involved to cause mass civilian casualties, it is feared that only the technical barriers (in terms of obtaining agents), producing adequate quantities of agent and finding effective means of dispersal remain.

Terrorist groups would encounter significant difficulties if they wanted to use many of the chemical or biological agents covered by weapons conventions, since developing and storing them would require sophisticated facilities. Specialized knowledge would be needed to acquire the right biological agent or precursor chemicals, process the chemical or biological agent, improvise a weapon or device, and effectively disseminate the agent to cause mass casualties. Throughout the different stages of the process, terrorists would run the risk of contaminating themselves and of being detected and would have to overcome technical and operational challenges. Some virulent biological agents and precursor chemicals are difficult to obtain, and others are difficult to process or produce, especially in the quantities needed to cause mass casualties. Given the high costs involved and the complexity of the technology, terrorist groups are unlikely to have the required financial resources and industrial infrastructure for widespread attacks without the support of state sponsors. However, there are concerns that they could be stolen or acquired from countries that have CB agents. The continued ability of states to acquire chemical and biological material and weapons exposes a weakness in the Chemical Weapons Convention (CWC) and the Biological and Toxin Weapons Convention (BWC).

The ease or difficulty for terrorists to cause mass casualties depends on the chemical or biological agent selected and the means of delivery. Terrorists would not need sophisticated knowledge or dissemination methods to use toxic industrial chemicals such as chlorine. In contrast, terrorists would need a relatively high degree of sophistication to successfully cause mass casualties with some other chemical and most biological agents. Terrorists with less sophistication could make an improvised weapon to disseminate agents, but these would be less likely to cause mass casualties. However, even relatively inefficient improvised dissemination methods could result in significant deaths and casualties as was demonstrated by the sarin attack in the Tokyo subway in 1995. Similarly, although ultimately proved to be not linked to Al Qa'ida, the incidents in the US immediately following the attacks on 9/11 involved the delivery of weapons-grade anthrax via the postal system and proved the potential for small scale, unsophisticated attacks to cause deaths and to paralyze business and services. Furthermore, as was demonstrated by the recent discovery of a terrorist cell producing ricin in a North London suburb, the raw materials required to produce some agents are relatively inexpensive.

Business concerns are fuelled by a number of elements. Although the current risk from chemical and biological attack is perceived to be low, the incidents in the USA and Japan show the credibility of the threat. An extrapolation of current trends and emerging technologies leads to the conclusion that such an attack is a realistic possibility in the future. Therefore, although it is still more likely that current terrorist capabilities are more suited to conventional tactics such as vehicle bombs, the potential for CB attacks means that protective measures should be incorporated into buildings and that operational procedures should plan for such eventualities. This is particularly true in the case of new buildings where the likelihood of an attack in the lifetime of the building, thirty to sixty years, is high. Business is also directed by the concerns of their staff. Stories in the media and the imminent war in Iraq and the potential for it to fuel future terrorist attacks add to staff concerns. Similarly, many multinational companies with staff in London and New York are affected by the heightened perception of threat in the US and the recent advice on protective measures issued by the US government.

When considering the risks associated with a CB attack on a commercial building, it is useful to consider the differences between a military scenario and a terrorist incident involving a civilian population. In a military situation the source of threat and likely method of attack is well known and predictable. In addition, battlefield detection technology is available and well tested. Battlefield protection can be provided by means of prophylactics, often administered as a preventative measure and by means of protective clothing. Troops are also rigorously trained to not only respond to a CB attack but also to continue operating in as normal a manner as possible. An attack on a civilian population by a terrorist group is likely to have a number of major differences. The source and likely types of agent are less well known. Unlike a military attack, a terrorist attack is likely to use improvised means of delivery. Taken as a whole the threat is much less predictable. Unlike in a military environment, the options for protection in the form of pre administered medication and personal protective clothing are either undesirable, in the case of mass inoculation of a large civilian population or are impracticable. Detection in a commercial situation is also impracticable given the state of current technology. Although work has been carried out in the development of commercial detectors, reliable, cost effective detectors with the sort of low false alarm rate that would be vital in a commercial environment are some way off in the future. Similarly, although the emergency services have trained for a response to a terrorist CB incident, the civilian population and, to a large extent, security and facilities staff of most commercial organisations are untrained in response measures against a real or suspected CB attack.

The advantage of a CB attack against a building from a terrorist viewpoint is that an attack does not have to be an overt, large-scale incident (such as the use of a crop spraying plane or 'dirty' vehicle bomb) to cause casualties. There are many methods of attacking a building and it is important to note that a CB attack does not have to be against a specific building for it to have an impact on the building and occupants. An attack on a city area or a particular building could have serious consequences for adjacent buildings.

Although water supplies and openable windows would provide a route for agents into buildings, the vulnerability of modern commercial buildings to CB attack lies in their accessibility and the relative ease of disseminating agents via the ventilation systems. Inserting agents in a ventilation system in an enclosed building would be a simple yet effective method of attack. Air exchange rates in modern buildings would dilute the CB agent but this method of attack has the potential to produce contamination of large areas of the building as well as wide exposure of the building occupants to the agent. Similarly natural ventilation pathways, fortuitous air pathways such as lift and riser shafts, could effectively disseminate agents that were brought into the building by intruders. The ideal "internal" terrorist device would be small, resemble a familiar object and contain a highly toxic CB agent. Such devices need not necessarily resemble typical 'suspicious' items such as unattended bags or briefcases. A CB device could be constructed to resemble a piece of equipment that belongs in the building. The risk of an attack emanating from a source within the building is therefore of equal concern to one that originates from outside the building. Similarly the risk of attack by means of a delivered item, e.g. letter or parcel, which enables a CB agent to be delivered inside a building, also needs to be considered.

In order to protect a building and its occupants against a chemical or biological attacks that a 'whole building' approach is required, i.e. one that looks at all aspects of the building design and operation. These potential attacks may be effected through simple, 'passive' hand delivered devices outside a building or inside a building in vulnerable areas such as reception areas, goods delivery yards and mail rooms plus more sophisticated, active devices involving aerosol or vapour generation delivered by means of bombs, projectiles or airborne systems. In addition, any commercial measures to protect against CB attack must be risk-led and be practicable in the commercial environment. Although as indicated earlier, the threat from a terrorist source is unpredictable, an assessment of the likelihood and credibility of the various potential methods of attack can be made. Appropriate mitigation measures can also be introduced that not only include conventional security measures such as manned guarding, CCTV, access control and physical security but also encompass measures affecting building planning, ventilation systems and operational procedures. These measures can be categorized in terms of the method of attack, i.e. simplistic or determined, against which they are targeted and include some of the following measures as shown in the following tables.

Finally, in considering a 'whole building' approach to commercial CB protective measures, the response of staff and building management staff to a CB attack, be it real or false, should be considered. Chemical and biological agents pose different sets of problems for emergency planning and preparedness. For example, most chemicals quickly affect individuals directly exposed to the agent. In contrast, the release of a biological agent may not be known for several days, and both perpetrators and victims may be miles away from the point of release when an incident is identified. Also, some biological agents produce symptoms that can be easily confused with influenza or other less virulent illnesses. If communicable, the biological agent can spread throughout the population. Questions that building owners and operators should ask themselves include the following:

Response to a local external attack

• Should staff be kept in building?

• Do you stop entry to the building?

• Should staff be kept in building?

• Do you stop staff entering the building?

• How do you communicate with staff outside the building?

• Is your back up site sufficiently remote?

• Chemical - Probably evacuation?

• Biological - Contain incident, therefore no evacuation?

John Haddon is the leader of Arup Security Consulting