Contingency plans for a terrorist CBR attack
As government and intelligence sources inform the public that a terrorist attack in the UK is inevitable, there is a renewed need to prepare to deal with the consequences. As well as a disaster recovery plan and an outline to maintain business continuity, a new set of contingencies must be prepared: the terrorist chemical, biological or radiological (CBR) contingency plan.
Most people still associate terrorist actions with explosive devices but this view must be expanded to include the risk of a CBR attack. For example, for terrorists intent on crippling an economy or destroying a central business district, the use of a CBR agent or even a toxic industrial chemical may be a very effective weapon. There is a risk that unconventional weapons, intended to maximise casualties, may be used against soft targets.
It is worth examining the ramifications of several terrorist scenarios to underline the need to develop proper CBR contingency plans. As yet, CBR contingency plans do not exist for the majority of businesses.
The explosive device
Terrorist bombings are usually a single event, although some groups also employ a secondary device to maximise casualties among first responders. Damage to, and destruction of, buildings is determined by the size and location of the explosive charges used. The possibility of immediate death and injury is generally over within several minutes. Casualties are usually limited to a several hundred-metre radius, depending on the size and type of the explosive device.
Following an attack, most businesses will activate their continuity and disaster recovery plans and begin the process of duplicating or replacing lost facilities and equipment. This tends to be followed by the activation of a ‘hot site’ provider, which may have access to several local facilities. Then the businesses would inform their insurers and work with adjusters to mitigate claims. Most significantly, replacement staff would be recruited where necessary.
Most buildings in the central business district of London have already been hardened against the threat from explosive devices and casualties are likely to be limited. National resources and opportunities of contracts will see a flood of suppliers converge on the area to assist. Insurance is readily available and a company affected by a terrorist attack should survive, subject to competent business continuity and disaster recovery planning. Such a plan will have identified the effects of losing the building, data, personnel, function and information, regardless of the cause.
Toxic/industrial/chemical
In this scenario, a truck en-route to a water treatment plant or swimming pool is hijacked, and additional chemicals are added to the vehicle’s load. The truck and its toxic cargo are then detonated. The mix of chemicals makes a cloud, similar to that produced by mustard gas, which moves downwind. The US National Institute of Occupational Safety and Health identifies a maximum downwind plume spread of 6.9km. The toxic cloud generally requires a wind speed of more than 20km/h before a plume develops, but as the wind hits edifices in the central business district it continuously bounces off buildings and laminar flow is replaced by turbulence. The swirling toxic gas may now extend over several square kilometers.
It has been estimated that in a city such as London up to 300,000 people could work in an area of 1,000m2. All would be at risk from gas released by terrorists entering their buildings; in such an event, the UK government’s advice of "go in, stay in and tune in" should be followed quickly. This advice has its limitations, however, and important decisions would need to be made — for example, whether to turn the ventilation on or off; go up or go down; or run or stay put.
Urgent decontamination and medical treatment will be required for those affected; perhaps for hundreds of thousands of people. But if the first responders set up their base for operations upwind, they could be as far away as several miles from the affected area.
No contingency plans exist for this type of event. Members of the workforce may be unwilling or unable to return to work due to their perception that their safety had been ignored. The good news is that the contamination caused by a toxic gas cloud may dissipate.
Radiological dispersal device: the ‘dirty bomb’
A third scenario is a source of alpha or beta radiation, stolen from a medical or food preparation facility and exploded in the central business district. A radioactive cloud develops and flows initially downwind towards the central business district. The expected swirl develops and people run into their buildings.
Some people may try to evacuate the area but they are unable to do this due to gridlock, so they return to their buildings; bringing contaminants with them. Lifts are used and contamination is sucked into buildings and moved around inside them. Air-handling units, although turned off, quickly spread the contamination around buildings via the air ducts.
First responders set up their decontamination units in an area described as upwind but the changing wind direction may engulf several of the units. The decontamination capacity is equally effected and decontamination of those within the ‘hot’ zone is now expected to take several days. The first responders will of course wear a suitable level of personal protection, but the fleeing casualties will need to move unprotected from their buildings to the decontamination unit. There they will remove clothing, estimated to hold 80% of contamination, before washing their hair and body, which may remove the remaining contaminants.
The journey to the decontamination unit was totally unprotected, however, and inhalation of contaminants may prove fatal. The whole central business district may become uninhabitable for years, as perhaps 200 contractors struggle to clean both the buildings and the environment. Contingency plans will be swamped and resources or alternative accommodation will be scarce as major concerns will swallow all available resources.
The biological event (anthrax release)
Two unopened anthrax letters passed through the Brentwood mail-handling facility on their way for delivery to the Hart Senate Office Building on Capitol Hill, in Washington, DC. Two workers died at Brentwood and it took over two years and cost US$130 million to decontaminate the building. All this was caused by just two unopened letters. Those fleeing from a building where an anthrax incident occurs will probably spread the contamination.
The US government recently withdrew its support for the Terrorism Risk Insurance Act agreement, which provided insurers with re-insurance similar to Pool Re in the UK. Building owners must now pay full premiums. Recent analysis in the US has assessed that a major anthrax event would cost US$54 billion in workers’ compensation alone, let alone decontamination or business claims. The cost of decontamination of any building — on either side of the Atlantic — is unlikely to be economical, and demolition would not be a viable option due to the inherent risk of residual contamination. Freehold values, leasehold liabilities and pension fund investments must be viewed as a possible problem. Employees would all probably be placed under prophylactic care for months: however, there exists the likelihood that some employees would not return to work in a building that had been contaminated by anthrax.
The prevailing philosophy of planning for effect and reaction must be replaced with planning for cause and defence where CBR risk is concerned —the defence of buildings and the protection of people must be prioritised. Almost all buildings can be turned into virtual citadels by utilising existing engineering controls such as heating; cooling; ventilation and air conditioning systems; and fire suppression systems. However, plans must also be made prior to an event to establish the various reactions required from particular locations in response to the type of agent(s) used. The typical response for a low-level external chemical release would be different from one at high level, and would vary significantly from the response to an internal release of any other agent.
Planning for these events is essential. Hoax and real events vary little in their ramifications. The only difference is in the level of danger faced by employees. Proper defence need not be expensive because employees themselves are capable of assessing if they are safe in the workplace.
Jeff Charlton is a visiting lecturer in terrorism and contingency planning at the Royal Military College