01
Where once most UK terror attacks were planned and executed by organised groups with central chains of command, today, attacks are more commonly organised and carried out by lone assailants.
Under the new1 Protect Duty – legislation expected to become law in 2022 that requires venue operators including retailers to protect the public in light of terror threats – it’s likely many retail businesses will need to carry out regular risk assessments specifically focusing on terror and security threats to the public.
This means retailers will need to consider the threat from each type of attack method, so threats such as a marauding knife attack on your shop floor, for example, or where a vehicle is used as a weapon in an outdoor space you are responsible for.
Retailers may also need to assess the vulnerabilities in their publicly accessible properties' physical security and review their security procedures, considering what actions would be taken if the threat level went up in their area.
Their purpose is to help build this awareness and also provide security guidance and practical improvements on protecting people in crowded spaces and the like.
Retail organisations can develop an understanding of UK threat levels and the changing terror landscape using Counter Terrorism Security Advisors (CTSAs)2. Their purpose is to help build this awareness and also provide security guidance and practical improvements on protecting people in crowded spaces and the like.
02
Working alone means prospective lone terrorists are solely responsible for gathering the information they need to plan their attacks, meaning they might visit your supermarket or shopping centre, for example, many times.
Unlike regular repeated customers, would-be solo terrorists can appear nervous, anxious or paranoid should they encounter your staff. This vulnerability creates an opportunity for retail workers to stop attacks before they happen.
If your customer-facing staff know how to identify and challenge suspicious behaviour, they can potentially show an assailant your business is no soft target and also prevent the prospective attacker from getting the information they need to launch their attack.
Where possible, a simple ‘Hello’ and polite questioning about why they are in your premises may be enough to disrupt a terrorist’s plans.
The Centre for the Protection of National Infrastructure (CPNI) offers training to help staff learn how to spot suspicious behaviour and how to report and act on it. Called See, Check and Notify (SCaN), it is free of charge to all businesses and organisations in the UK, including retailers, and offers tailored sessions for different types of roles including customer-facing staff.
03
Terrorists don’t look at your site as one entity in isolation, so retailers should not fall into the trap of limiting their security outlook to the boundaries of their premises. By identifying and jointly ‘owning’ the grey areas in between shops and other businesses in a public space, you limit the areas where hostile players feel comfortable.
You might consider building partnerships with surrounding businesses to jointly fund CCTV or security patrols to more effectively dominate those ambiguous in-between areas that might otherwise be seen as safe spaces for reconnaissance or regrouping in the event of an attack.
04
The Protect Duty will require larger retail organisations to have a well-established crisis management plans. Generally speaking, such plans cover the three phases of a crisis: response, crisis management and recovery.
The response phase is focused on protecting people and limiting damage in the event of an attack, the crisis management phase is centred on reassuring staff and customers and managing media and other stakeholders, while recovery is about restoring normality as far as possible for employees and customers.
Your plan should have clear triggers and escalation criteria and provide clarity around what procedures kick in when and who needs to act and how.
Your plan should have clear triggers and escalation criteria and provide clarity around what procedures kick in when and who needs to act and how. Plans also need to define roles and responsibilities and provide clarity around which communications are allowed in and out of the site in question during an incident. This in turn should also link up with the communications team to manage relations with key stakeholders such as media, customers and insurers. Plans should also specify the measures to deliver business continuity and how the incident is both closed and learnt from.
It may be useful to put the plan into a quick reference guide that staff on the ground can keep handy and refer to.
05
Retailers should consider carrying out an exercise to test their crisis management approach at least once a year. The type of exercise will depend on the type and size of your organisation and could be as simple as a walk-through discussion for smaller retailers, to scenario-based approaches for medium-sized organisations, through to full-scale simulations-based exercises for the very largest spaces and/or retail organisations.
If your retail business needs support preparing for the new Protect Duty or expert help on assessing your current readiness to comply, get in touch.
