Security has been a big issue for civil aviation for decades. Airports and aircraft have proved to be a susceptible target for terrorist attacks as the list of incidents is extensive and gets longer every year despite strict security measures. Since the end of the Cold War new threats have also emerged. This includes the risk of terrorists using Chemical, Biological, Radiological and Nuclear (CBRN) means. It is therefore of great relevance to have insight in these threats to civil aviation. However, this is easier said than done: CBRN is not simple. For each of the four letters of the acronym, there are multiple sub categories of agents. The large number of CBRN agents in combination with a hard to estimate number of potential terrorists, results into a wide-ranging threat spectrum that does not allow for easy targeted countermeasures. This article presents an overview of the threat of CBRNe terrorism against civil aviation based on the IB Consultancy Risk Assessment Methodology. This method was also used to develop the lists of agents used within the European Union to monitor for CBRNe threats.

What is CBRN?
Attacks with CBRN agents have a low probability but potentially an enormous impact. When a terrorist uses an automatic weapon or an explosive device, he creates a hazard with a bang and a clear immediate danger. For CBRN this is different, the real danger comes only after the bang; if there is a bang at all. Releasing a chemical or biological agent can easily go unnoticed. However, the consequences of such a release will not go unnoticed and the agent can show its lethality in days or weeks.
The initial attack may be small, in terms of low quantity and quality of the agents used and a limited number of casualties. However, the societal impact could be huge, not only just after the attack but also in the longer run. Whereas terrorism is in essence political violence, CBRN is the ultimate political weapon. The fear and societal impact of merely the threat of a CBRN agent can have a larger impact than an actual attack with explosives. Besides the societal impact, the practical consequences of an attack can also be long-lasting. Contamination with CBRN agents can make an area unusable and uninhabitable for years. This is what we have seen with the buildings, postal office and senate, in the USA that were contaminated with Anthrax in the aftermath of the 9/11 attacks. It took more years and cost over one billion dollars to decontaminate the sites.
Now, what does CBRN look like? That is the million dollar question without an answer. CBRN agents can come in any form. Sarin is often transported as a liquid and vaporises quickly at room temperature. If it would reach a concentration of 70mg per m3, a male adult could die after being in such a room for only five minutes. You can kill a man with a tiny droplet of Sarin. Toxins such as Ricin are much more lethal, and the amount needed to be lethal is hardly visible. For Bio agents, there is no ‘quantity’ of an agent. For bacteria, it is the number of colony-forming units that is used to determine dosage. However, these numbers are not simple math. For Anthrax for example, a lethal dose is considered to be 10.000 spores. For each gram of Anthrax, one would get 100 lethal doses of Anthrax (through inhalation). However, three of the casualties of the 2011 Anthrax attacks in the USA were old ladies who were most likely infected as a result of receiving a letter that was contaminated in the mail sorting centre. None of these women is estimated to have even inhaled a thousand spores each. Mortality rates resulting from biological agents are not a given, a lot depends on the health of the victim and its sensitivity to the agent.

 

The threat of CBRN terrorism

The threat of CBRNe terrorism has two main components: the capability of terrorists to use CBRN agents and their motivation to do so. Let’s start looking at the first of these vectors, the terrorist capability. In order to execute a successful CBRN attack, the perpetrator needs to have a) a CBRN agent, b) a dispersal device which together form the CBRN weapons and c) a tactical plan on how to use that weapon. Getting access to CBRN agents is not so easy. The more dangerous the agent, the more difficult it is to get access. So, if a terrorist would like to use Smallpox in an attack, it means he first will need to steal the agent from one of the two places on earth where Smallpox is stored: the Center for Disease Control and Prevention (CDC) in the United States or the State Research Center of Virology and Biotechnology VECTOR in Koltsovo, Russia. Not an easy task. However, not all agents are difficult to obtain. To stay with biological agents, the best example is of course Anthrax. This agent is a normal bacteria species in most of the world: digging up some dead sheep often does the job. However, Anthrax dub up from the English country side is not the same as Soviet weapon grade Anthrax: it is just not as potent, and strong.

For chemicals digging is not a bad option either. World War I battlefields are a gold mine for unexploded ordnance, including munitions with a chemical payload. In Belgium, around one thousand pieces of munitions with a chemical payload are found each year. During the insurgency in Iraq, it is claimed that the insurgents (unknowingly) have used Mustard against Coalition forces when they exploded old munitions as road side bombs. This means that one can sometimes find chemical weapons on the side of the road: either as a failed roadside bomb or as a shell dug up by a Belgian farmer. Some chemical agents also have a ‘normal’ use such as Chlorine and Ammonia. The concentration and quantity of the agent will determine if it is usable as a weapon.
However, a terrorist does not need to steal, buy or find a CBRN agent; he can also produce an agent himself. The internet is full of websites and forums on which recipes for the production of agents are exchanged. Jihadi websites are used to exchange often very dangerous recipes. That making a CBRN agent is not impossible was shown in 1995 with the most (in)famous CBRN terrorist attack, when the Aum Shinrikyo group attack the Tokyo subway on 20 March 1995 with Sarin. The terrorists used a low quality agent and used to most simple and crude (and ineffective) dispersal device: plastic bags punctured with holes. This brings us to the second part of a CBRN weapon: the dispersal device. The simplest device would be a bowl with Sarin placed in a HVAC system: the Sarin slowly vaporises and is dispersed through a building, vessel or plane. However, devices that are a little smarter can still be fairly effective. Most agents needs to be dispersed as small particles or in a mist of droplets, other agents need to be dispersed as a gas. For all these agents, a simple deodorant spray canister will suffice: one removes the contents of an innocent looking deodorant spray and fills it with a CBRN agent and some pressure gas. The knowledge for making such simple devices and even basic agents is limited. Cooking Sarin is a different story. However, if we match the required knowledge, experience and lab equipment to those of an average chemistry student, we seem to have a perfect match. Samir Azzouz was a home grown terrorist who was arrested in The Netherlands in 2004. During the search of his house, plans of Schiphol airport were seized. In 2005, he was arrested again, now at the Chemistry College in Leiden, where Samir studied to be a chemist: a perfect study for a CBRN terrorist.
We can therefore conclude that it is not that difficult for a terrorist to obtain a CBRN capability. Although it may be somewhat difficult to gain entrance to the CDC to steal a sample of Smallpox, it will most likely not be so difficult to dig up some Anthrax, or to buy it from a research institute as a biochemistry student. The same is true for chemicals: cooking Sarin might stretch the terrorist capabilities somewhat, but picking up some roadside munitions from WWI is not that hard.
When it comes to motivation of terrorists, it is more difficult to make a proper assessment. Unfortunately, we have limited access to research on the motivation of terrorists on the use of CBRN. However, what we do know is that some terrorist groups have used CBRN agents, or have tried to use them. Islamist groups such as Hamas, Lashkar-e-Taiba (LeT), Riyad us-Saliheyn Martyrs’ Brigade and the East Turkistan Liberation Organization (ETLO) have attempted to use CBRN weapons. Al Qaeda’s wish to use CBRN has never been a secret when Osama Bin Laden stated “Acquiring [chemical and nuclear] weapons for the defence of Muslims is a religious duty. (…)” and “It is the duty of Muslims to prepare as much force as possible to terrorise the enemies of God”. Suleiman Abu Gheith (Al-Qaeda Spokesman) stated that “We have the right to kill four million Americans, two million of them children…and cripple them in the hundreds of thousands… Furthermore, it is our obligation to fight them with chemical and biological weapons, to afflict them with the fatal woes that have afflicted Muslims because of their chemical and biological weapons”. However, whether these Islamist groups were really motivated to use CBRN agents or were just bragging themselves into a NATO target folder will probably never be known. However, none of these individuals or groups has successfully executed an attack.

CBRN Impact
Some actually refer to CBRN weapons as Weapons of Mass Disruption. The reason for this is the psycho-social impact of CBRN. Even the threat of a small quantity of an agent to be used against a certain target will have a significant impact. Although the Sarin Tokyo Subway attacks resulted in only eight casualties, 5510 people reported to hospitals with various complaints. Most of them could be considered “worried well”: people who were impacted by the Sarin attack, but not physically injured. This is a typical example of when the use of a CBRN agent did not result in mass destruction, but in mass disruption.
Although we often like to think so, terrorists are not psychopaths: they don’t kill for the sake of it; violence is a means to an end. Opinions may differ on whether or not it is justified violence; the violence is meant to accomplish political change. Although this article is not the place for the “one man’s terrorist, other man’s freedom fighter discussion”, the political component of terrorism is crucial in understanding the value and danger of CBRN terrorism. A terrorist does not kill to kill, but to achieve an effect on a society: terror. When society has reached its threshold, it will initiate political change, such as the new government in Spain after the Madrid bombings in 2004. It seems that a terrorist needs less physical impact (casualties) with a CBRN attack to achieve a certain political effect than he would need with conventional means. This means that a CBRN scenario may need less of an agent, and needs to be less lethal to have a societal and therefore political impact, and therefore, a CBRN attack could be more feasible for more groups than most of us have always thought. A terrorist does not have to kill thousands of people, he wants to scare them.

Countering the threat: Detection, Protection and Training
Airports have a number of standard countermeasures in place to increase security. The aviation security rules inside the EU are based on standards contained in International Civil Aviation Organisation (ICAO) rules and on the security measures laid down by the European Civil Aviation Conference (ECAC). In order to face possible terrorist attacks, EU security rules for instance establish a list of prohibited articles to be carried into the security restricted area and the cabin of an aircraft. However, most airports pay only limited attention to CBRN in terms of training and planning. Security staff is not trained in CBRN awareness and detection of CBRN means proves to be hard.
Despite these limitations, the most important countermeasure when it comes to CBRN is still detection. Explosives and automatic gunfire are hard to miss, but a terrorist releasing Anthrax in your HVAC system is more difficult to notice. Without detection equipment, you will not know you are under attack until it is too late. For both chemical and radiological agents there is plenty of equipment available on the market that can detect the vast majority of CBRN agents.
Detection is also the starting point for staff to start using personal protective equipment (PPE). Airport and airline staff does not need the Level A space suits some first responders wear. It would be good though to have at least escape hoods and facemasks with the right canisters or pressured air for staff members. Most of the danger of CBRN agents comes from inhaling or ingesting these agents. Concentrations must be really high before people are incapacitated by skin contamination or by radiation. For 95% of all relevant scenarios, respiratory protection is the most important protection and often the only protection people need.
Using protective equipment requires training. Not just training on how to don a mask, but more importantly on what to do when you are protected. Staff with PPE can actually help passengers and guests in the terminal building in evacuating the premises. However, those staff members should have confidence in their equipment, and should understand what they can do, and what they cannot do. For flight crews, CBRN training should not only be about using PPE, but should be a CBRN awareness training in which they learn how to recognise a CBRN incident, even when they lack CBRN detection equipment.
Finally, detection, protection and training need to be part of an airport/airline CBRN doctrine. This doctrine should include choices on what to do for different scenarios. For example, if a CBRN agent is released in the departure hall, should we turn off the HVAC system, or turn it to maximum? Most guidelines suggest (or instruct) to turn the HVAC off, however simulating a CBRN attack on your airport may show that you actually need different countermeasures which are more appropriate for your circumstances.
The most important thing you need when dealing with the threat of CBRN terrorism is knowledge. Without understanding what the threat is, how it can manifest itself, what the impact may be and how to deal with it, it is difficult to act in an effective way. Buying detectors, masks and training is nice, but if airport or airline security management does not know what CBRN means, it will be difficult to use the resources at hand in the right way. Knowledge also means having a concept or methodology of addressing the CBRN threat. The presented risk assessment methodology based on the terrorist’s CBRN capabilities and intent is a helpful tool in accurately assessing the CBRN threat to civil aviation.[author] [author_image timthumb=’on’][/author_image] [author_info]Ilja M. Bonsen is founder and Managing Director of IB Consultancy, an independent defence and security firm specialising in non-conventional threats. Elsa Schrier works as a consultant at IB Consultancy in Brussels. In her work she focuses on CBRNe and European Security and Defence Policies. The authors can be contacted at: information@ib-g.com or ask them a question in the CBRNe Group on LinkedIn.[/author_info] [/author]