Page 1 of 6 ICAO AVIATION SECURITY GLOBAL RISK CONTEXT STATEMENT (Extract) INTRODUCTION The continuing threat of terrorism is most effectively managed by identifying, understanding and addressing the potential risks both to and from civil aviation and the transportation of passengers and goods (baggage, cargo, and mail) by air. Standard 3.1.3 of Annex 17 requires that: Each Contracting State shall keep under constant review the level of threat to civil aviation within its territory, and establish and implement policies and procedures to adjust relevant elements of its national civil aviation security programme accordingly, based upon a security risk assessment carried out by the relevant national authorities. The identification of risks permits States to determine and implement proportionate measures and controls to mitigate against each risk type. Therefore, the ICAO Aviation Security Global Risk Context Statement (RCS) has been developed and will be updated regularly. It aims to: a) provide a description of the current global risk picture; b) assist States in their efforts to protect air transportation and prevent its use for unlawful acts; c) present high-level statements to inform an improved approach in creating and maintaining States national civil aviation security programmes; d) assist ICAO in improving Standards and Recommended Practices (SARPs) and guidance material; and e) offer States information and a framework to conduct risk assessments at the national level. The RCS reinforces the importance of a risk-based approach, provides a risk assessment method and process map (see Annex B), and explains the method developed and used by the ICAO Aviation Security (AVSEC) Panel Working Group on Threat and Risk (WGTR), whose terms of reference are provided in Annex A. The RCS emphasises the importance of States reporting and sharing of information if they and ICAO are to apply the risk management process effectively. Finally, based on risk assessments carried out using the suggested method, the RCS provides a relative ranking of specific risks. A table summarising the currently assessed terrorist risks to aviation is presented in Section 4. The WGTR regularly provides analysis and advice on risk to the AVSEC Panel, maintains the RCS, and updates the statement as needed, but at least annually, to reflect recent events and its own updated risk assessments. ICAO draws on the advice of the WGTR on evolving threats and incidents when special security precautions may be advised and also when they may be dispensed with.
Page 2 of 6 The RCS is aimed primarily at aviation security decision makers among Member States and the Secretariat. Member States should take note of the document s classification and should distribute and protect it accordingly. Role of Member States in national and local risk management Assessment of national or even local risks, in conjunction with the overall risk factors, provides important and useful information on potential terrorist methods and types of attack. While the RCS aims to provide a global high-level view of terrorist risks, it does not attempt to create a detailed view of national or local risks or to suggest that one State has higher levels of risk associated with it than another State. It is therefore the duty of each Member State to make its own assessment of the risk applying to its territory and assets, and to establish risk mitigating measures, taking into account the high-level view presented in the global RCS. Each Member State should document and review its risk assessment periodically, or when significant new developments arise, in order to maintain an accurate, complete, and up-to-date picture of the risk environment. According to Standard 5.3.1 of Annex 17, each Member State has the obligation to exchange information and report to ICAO all pertinent information concerning the security aspects of an act of unlawful interference. Section 2 of the RCS assists Member States in determining the issues to be reported. The sharing of information with all Member States allows for a broader understanding of the global threat to aviation. ESTABLISHING THE THREAT PICTURE The nature of the threat As it has for many years, international civil aviation remains a terrorist target for a variety of motives. Terrorists continue to exploit real or perceived vulnerabilities in the international civil aviation system. Despite enhancements to the security system, terrorists continue to develop new techniques and weapons in hopes of circumventing security measures. In general, it is assessed that in selecting a target for attack, terrorists, whether from an organized group or a radicalized individual, aim to achieve any of the following objectives: a) inflicting mass casualties; b) causing economic disruption; c) making a symbolic statement; and d) generating public anxiety. These objectives may lead to a variety of forms of attack on the aviation system. Terrorists have shown themselves to be innovative, and may seek out a wider range of modus operandi and targets, influenced by the availability and vulnerability of such targets and dependent upon capability, and the opportunity for success in the terms set out above. The possible types of attack are considered in Annex C.
Page 3 of 6 Global threat All national aviation systems are linked to global aviation networks, and terrorists may attack from anywhere within the international civil aviation system by identifying vulnerabilities to gain access to their intended target. Decision makers must therefore take into account how the threat to civil aviation is developing globally. This does not mean that threat levels are identical around the world: there are regional, national, and even local variations. However, it does mean that many threats have the potential very quickly to jump national borders and change regions. All States should be aware of the vulnerabilities and consequences associated with such threats. Terrorists are constantly seeking to identify the perceived limitations of aviation security measures and to identify and exploit remaining vulnerabilities and weak points within the global system. Ten acts of unlawful interference were reported by States to the ICAO Database of Acts of Unlawful Interference in 2015, as compared to twenty in 2014. These reported acts covered a range of geographical regions, and consisted of attempted sabotage, attempted seizures, attempted and successful facility attacks, and other acts of unlawful interference. Sixty-seven other occurrences or incidents, identified through media reports but not officially categorized as acts of unlawful interference, were also recorded in the database in 2015, spanning a variety of security areas. Beyond these reported incidents, there is further evidence of continued planning by terrorists to commit acts of unlawful interference against aviation targets. Global consequences Given the global character of the terrorist threat to the aviation system (and the global nature of the aviation system generally), it follows that terrorist attacks upon the aviation system have global consequences. Public anxiety and economic disruption caused by a terrorist attack two of the key terrorist objectives will manifest themselves well beyond the borders of States that are the locations of or direct targets for terrorist attacks. Even terrorist attacks failing to have direct consequences have the demonstrated ability to achieve terrorist objectives, because the fear and uncertainty that they generate are often no less than that arising from a successful attack. Further, the global span of the media and the internet specifically exploited by terrorist groups grants terrorists the ability to reach audiences worldwide, via news reporting or their own propaganda, virtually instantaneously. Previous attacks attempted or successful clearly illustrate the global consequences on the aviation system. For example, the thwarted Liquid, Aerosols, and Gels (LAGs) plot (2006), the Underwear Bomber plots (2009, 2012), the Cargo/Printer Incident (2010), and more significantly, the 11 September 2001 attack all resulted in disruption to aviation operations across the globe, which led to the introduction of new security measures and a reduction in aviation traffic because of public fear and anxiety that more such attacks would follow elsewhere and/or in the near future. The increasing globalization of travel and of the airline industry means that a successful attack on any aircraft is likely to involve the citizens of many different countries. And beyond that, the economic consequences of terrorist attacks on the global aviation system mean that an attack upon the aviation interests of even one State is effectively an attack upon the aviation interests of all. This further reinforces the need for all States and aviation organisations to pay close attention to threats to aviation, even if they do not consider themselves to be directly threatened by terrorist attack.
Page 4 of 6 Potential perpetrators of terrorism Terrorists have varied cultural and social background, live in differing social circumstances and act from a number of different extreme motivations and intentions in committing or planning acts of terrorism. They may act for political, religious, social, environmental and/or personal (e.g. economic or mental health) reasons. Types of terrorists may include: a) members of established and organized international terrorist groups; b) members of regional affiliates and allies of such groups; c) so called home-grown terrorists, who have limited or no links to such groups; and d) radicalized individuals who travel to areas of conflict and undergo training and militarization to then plan and execute an attack outside of the conflict zone. Terrorists may act on their own initiative the self-radicalized and self-organized or as a part of wider groups and support structures. In both cases, they may be employed in the aviation industry. Terrorists continue to view insiders as a useful resource to facilitate attack planning, either knowingly or unknowingly, because of their specialized knowledge of security measures and potential access to security restricted areas and aircraft. Guidance on a possible method for assessing the threat from insiders has been produced by the WGTR and is available on the ICAO Secure Portal. Terrorism and criminality Attention must be given to the possibility of connections between criminality and terrorism. Criminal activity in the aviation and transportation arenas, when recognized, may point out vulnerabilities in security practices and expose weaknesses in security posture. Where weaknesses are exploited for criminal purposes, they may also be exploited for terrorist purposes. Criminals and terrorists use all modes of transport, including commercial aviation, to travel across nations and internationally, to carry out their missions. Criminal activity may provide funding and/or facilitation for terrorist groups and activities. As States continue to seize terrorist assets worldwide, extremist groups resort to criminal activities to fund their operations of violence and terror. The following criminal activity can sometimes be linked to the funding or facilitation of terrorist groups and activity: a) smuggling of humans, drugs, cash and/or contraband; b) drug trafficking; c) kidnapping; d) provision of weapons; and e) use of fraudulent documentation or identity. Criminal activity may also be used by terrorists in attempts to test specific security measures and learn how to overcome them. In addition, surveillance can be carried out by terrorists in order to check security systems, processes, and habitual activity in any setting, either covert or overt.
Page 5 of 6 Identifying criminal activity in the aviation security environment may lead to identifying terrorist activities or evidence of support of terrorist missions. Any unusual or increased incidence of criminal activity in transportation sectors should be noted, and where practicable, shared amongst relevant State agencies and jurisdictions, such as law enforcement, and between Member States. Arguably, criminal and terrorist groups might share similar mission goals. However, to date there have been no cases where organised crime groups and terrorist groups have collaborated, due in part to their fundamental differences in purpose and operations. Sharing of threat information Types of information In conducting a risk assessment, it is necessary to assemble information about the threat, particularly possible targets and modus operandi. Such information may come from a variety of sources, including: a) actual incidents, including successful or thwarted attacks on aviation, which provide information on terrorist objectives and methodologies; b) closed sources, primarily counter-terrorist intelligence and assessments, which may be gathered or generated by intelligence, law enforcement and other agencies of States; and c) open sources, which may include publicly-available information on unusual or suspicious occurrences, and the availability of items that could be used for terrorist purposes, and any other information that may contribute to the threat picture. Bilateral, multilateral, and global information sharing Lines of communication, both formal and informal, between the aviation security officials of States assist in the rapid exchange of information, including any change in the threat level or the nature of the threat. The exchange of information on techniques used to try to breach security, experience with security equipment, and operational practices are also extremely advantageous. States are reminded that Section 2.4 of Annex 17 places obligations on them to cooperate in such exchanges of information. States should develop procedures for the analysis and dissemination of threat information in order to ensure that appropriate actions are taken by aircraft and airport operators to counter the identified threat. Information should be disseminated to individuals with appropriate security clearances on a need-to-know basis, in order for them to carry out their duties effectively and develop a better understanding of their State s threat/risk environment. States with limited resources for dealing with imminent threats should consider negotiating legal and procedural assistance with adjacent States that are better equipped to collect and disseminate threat information. Details of important developments, such as new or unusual methods of operation and techniques used by perpetrators, should be promptly disseminated to other States and ICAO. The WGTR will seek to assist in providing advice and relevant guidance in such cases. While public knowledge of such matters is undesirable, officials responsible for airport and aviation security should be informed as soon as possible to facilitate the early development and implementation of effective countermeasures and procedures.
Page 6 of 6 Urgent communications may be facilitated through use of the ICAO Aviation Security Point of Contact (PoC) Network, established for the communication of imminent threats to civil air transport operations. Pursuant to Assembly Resolution A38-15: Consolidated statement of continuing ICAO policies related to security, States who have not done so are urged to participate in the ICAO PoC Network. If a State has specific information about a possible occurrence involving an aircraft operator or airport, it should immediately and concurrently inform the State(s) where the occurrence may take place, directly through the ICAO PoC Network or through the local diplomatic mission. 2.6.2.7. If a State is unable to communicate urgent information to another State, it should immediately request the assistance of a third State or ICAO. As soon as circumstances indicate that special security precautions may be dispensed with, such information should immediately be transmitted by the appropriate authority to the affected State(s). As soon as possible after a security incident, a review and analysis of all that transpired should be conducted by the appropriate authority. The results of this review and analysis should be made available to all participants, along with the recommendations of the appropriate authority for civil aviation security for general improvement and for the correction of any deficiencies identified. ICAO should be notified, at the earliest opportunity, of any action undertaken by a State to correct a deficiency. States concerned with an act of unlawful interference should provide ICAO with all pertinent information concerning the security aspects of the occurrence as soon as practicable after the act is resolved. States should, whenever appropriate, furnish copies of reports prepared for ICAO to other States that may have an interest. The categories of incidents that should be reported include: a) unlawful seizure of an aircraft; b) attempted unlawful seizure of an aircraft; c) destruction of an aircraft in service; d) unlawful act against the safety of civil aviation, including acts of sabotage and malicious damage, and the placing of bombs and other explosive devices or substances in airports, aircraft, air navigation facilities, baggage, cargo or mail; e) attempted unlawful act against the safety of civil aviation; and f) any other act of unlawful interference, including armed attacks at airports, acts directed toward off-airport personnel, facilities or vehicles, and acts that have the potential to develop into a threat to international civil aviation. States are asked to consider ways in which they can improve their existing systems of sharing information. For example, some States have established a system of occasional issuance of information bulletins on matters that may be relevant to the threat and risk to aviation, which are circulated at an unclassified or official-use-only level through the ICAO Secure Portal. Others have taken the approach of reviewing their own classified information and, if deemed useful to the wider aviation security community, reissuing the information at a lower level of classification to enable its wider dissemination.