Over the past 40 years there have been numerous attacks carried out against cultural and hospitality venues in the furtherance of religious, ideological, criminal or political beliefs. By default, cultural and hospitality venues are attractive targets for terrorists due to their public accessibility, the volumes of visitors and guests or because of what the venue represents; in short because they are ‘soft targets’.

Examples of such attacks include the destruction of the Buddha’s of Bamiyan in Afghanistan by Mullah Omar, the 2015 attack on the Bardo museum in Tunis, the coordinated attacks in Mumbai through to the recent attack on a Berlin Christmas market where an articulated lorry was used as a weapon.

So how can we protect these venues from terrorist attacks without making them a fortress or detracting from their main functionality?

Understanding terrorist threats

When implementing protective strategies, the first thing I need to understand is what threats exist and what risks they pose to the organisation or individual being protected. In this case the threat source is terrorism. What is terrorism? There are many different definitions of terrorism but the one that I have used for over 30 years is: “The unlawful use, or threat of violence to achieve political or ideological aims.” This differs from organised crime which may use terror but is concerned with financial reward and gain. I define a terrorist as “Somebody who knowingly takes part in, supports or assists an act of terrorism.When implementing protective strategies, the first thing I need to understand is what threats exist and what risks they pose to the organisation"

The next stage is understanding the ways in which the threats can impact the organisation and the risks that exist from known, or anticipated attack methodologies. Whilst the threat from traditional attack methods continue; car bombs, grenades, firearms etc., these are by no means the only threats that should be considered. The 9/11 attacks used aeroplanes, a boat was used against the US Cole and in 2016 a lorry was used to devastating effect to kill 86 and physically injure over 400 civilians during the Bastille Day celebrations in Nice, France.

Introducing protective security measures

Once understood, the risks and vulnerabilities that exist for each attack method can be assessed and categorised. This allows protective security measures to be introduced that reduce the likelihood or impact of any attack that takes place. For ease, I categorise the protective security measures in one of four ways:

  • Physical measures
  • Operational (procedural) measures
  • Technical measures
  • Educational measures

These measures should be overarching and work collaboratively with each other to create defence in depth and increasing resilience and robustness. The idea being to provide a means of protecting assets and deterring, detecting and delaying attackers, whilst increasing response capabilities.

CPTED methodologies and design practises are a great means of preventing certain attack types and creating better response capabilities
Once understood, the risks and vulnerabilities that exist for each attack method can be assessed and categorised


Museums, hotels, bars and restaurants are places where people go to for relaxation and pleasure. Therefore, the implementation of security measures must be carefully considered so that the organisation is still able to function without destroying or negatively impacting the customer experience. Understanding an organisation’s risk appetite and tolerance levels are almost as important as the security measures that are introduced to protect them.

Physical security options

Physical security measures include barriers, fences, secure doors and windows. They can also include security personnel and the creation of stand-off and vehicle mitigation measures. CPTED methodologies and design practices are a great means of preventing certain attack types and creating better response capabilities. In some countries, security personnel can be armed, but not in all. During the 2017 New Year celebration attack at the Reina nightclub in Istanbul an armed police officer and 35,000 on duty police could not prevent the attack that resulted in 39 deaths.

Although technical security measures may not deter or really delay terrorist attacks (unless used as part of a physical security measure) CCTV, search equipment and access control systems do provide an ability to identify pre-attack activity including surveillance and penetrative testing.

Security education for staff

An organisation’s operational practices and procedures are a great protective security resource. Levels of alertness, introduction of surveillance detection programmes involvement of all staff in the security programme, correct search procedures and robust access control to reduce the target attractiveness of the venue.Security education can enable 100 people to be involved in a surveillance detection programme instead of just the security team

Security education is often either forgotten or not considered by many as a fundamental security measure. Security education allows staff to understand the security measures that exist, why they exist, the actions they are to take and the part that they can play in protecting themselves, visitors and venues from attack. Security education can enable 100 people to be involved in a surveillance detection programme instead of just the security team and help staff understand suspicious activities and reporting practices. Security education helps deliver and maximise the effectiveness of each of the other security measures that are introduced.


Proactive planning

An organisation has to be realistic in its approach to protection from acts of terrorism. The likelihood of preventing a terrorist attack is low, fact. Unless intelligence was available or surveillance detected the first a venue would know about it would be the attack itself. However, there is still an ability to make a significant impact in protecting visitors, staff, physical assets and reputation. These include:

  • Proactive immediate response planning
  • Establishing a recovery plan
  • Providing welfare and medical support to victims.
Welfare and medical support is not just about those directly impacted by the terrorist attack it also includes the indirect victims
Indirect victims may include first responders, crisis and emergency management teams and families of direct and indirect victims

I still find organisations and venues that do not have emergency or crisis management plans that are specific and fit for purpose. Not only is it critical that a plan exists but also that senior management know and understand the actions that they need to take. Plans should be exercised so that the operational, tactical and strategic elements are being tested and where vulnerabilities are identified steps are taken to reduce or mitigate them.

Recovery planning is a vital part of your crisis management practices. Is there a fall-back location, can there be partial opening, what systems are operable and will they function off-site? The sooner an organisation or venue can normalise operations the speedier the recovery will be. The longer it takes to recover, the increased risks to an organisation’s operations, finance and reputation.

Welfare and medical support is not just about those directly impacted by the terrorist attack it also includes the indirect victims; first responders, crisis and emergency management teams, families of direct and indirect victims. Consider counselling, establishing outreach programmes, town hall meetings and lessons learnt. Consider the welfare benefits of senior management visiting the scene, speaking with victims and being there to reopen the venue. Often it is not the physical effects that impact an organisation but the psychological effects and trauma suffered, often over many months or years by staff.It has to be remembered that governments spend billions of dollars on counter terrorist programs but they are not able to thwart all attacks

Creating a security culture

To conclude, the chances that your organisation or venue will become the victim of a terrorist attack are very slim and will normally depend on two factors; what you are doing and where you are doing it. It has to be remembered that governments spend billions of dollars on counter terrorist programmes but they are not able to thwart all attacks; neither can you.

Implementing sensible, risk based security measures means that resources are not being wasted unnecessarily. Including as many members of staff as possible in educational and detection programmes helps create a ‘security culture’ that everybody buys into.

“Failure to plan, is planning to fail!” Is a saying that has stuck with me since the early 1980’s. Whilst you may not be able to prevent terrorist attacks, by ensuring your venue has appropriate plans to respond in a proactive manner the greater the opportunity to reduce the risks and resuming activities in a timely manner.

Download PDF version

Author profile

In case you missed it

What is the changing role of training in the security industry?
What is the changing role of training in the security industry?

Even the most advanced and sophisticated security systems are limited in their effectiveness by a factor that is common to all systems – the human factor. How effectively integrators install systems and how productively users interface with their systems both depend largely on how well individual people are trained. We asked this week’s Expert Panel Roundtable: What is the changing role of training in the security and video surveillance market?

What is AI Face Search? Benefits over facial recognition systems
What is AI Face Search? Benefits over facial recognition systems

When a child goes missing in a large, crowded mall, we have a panicking mom asking for help from the staff, at least a dozen cameras in the area, and assuming the child has gone missing for only 15 minutes, about 3 hours’ worth of video to look through to find the child. Typical security staff response would be to monitor the video wall while reviewing the footage and making a verbal announcement throughout the mall so the staff can keep an eye out for her. There is no telling how long it will take, while every second feels like hours under pressure. As more time passes, the possible areas where the child can be will widen, it becomes more time-consuming to search manually, and the likelihood of finding the child decreases. What if we can avoid all of that and directly search for that particular girl in less than 1 second? Artificial neural networks are improving every day and now enable us to search for a person across all selected camera streamsWith Artificial Intelligence, we can. Artificial neural networks are improving every day and now enable us to search for a person across all selected camera streams in a fraction of a second, using only one photo of that person. The photo does not even have to be a full frontal, passport-type mugshot; it can be a selfie image of the person at a party, as long as the face is there, the AI can find her and match her face with the hundreds or thousands of faces in the locations of interest. The search result is obtained in nearly real time as she passes by a certain camera. Distinguishing humans from animals and statues The AI system continuously analyses video streams from the surveillance cameras in its network, distinguishes human faces from non-human objects such as statues and animals, and much like a human brain, stores information about those faces in its memory, a mental image of the facial features so to speak. When we, the system user, upload an image of the person of interest to the AI system, the AI detects the face(s) in that image along with their particular features, search its memory for similar faces, and shows us where and when the person has appeared. We are in control of selecting the time period (up to days) and place (cameras) to search, and we can adjust the similarity level, i.e., how much a face matches the uploaded photo, to expand or fine-tune the search result according to our need. Furthermore, because the camera names and time stamps are available, the system can be linked with maps to track and predict the path of the person of interest. AI Face Search is not Face Recognition for two reasons: it protects people’s privacy, and it is lightweight Protecting people’s privacy with AI Face Search  All features of face recognition can be enabled by the system user, such as to notify staff members when a person of interest is approaching the store AI Face Search is not Face Recognition for two reasons: it protects people’s privacy, and it is lightweight. First, with AI Face Search, no names, ID, personal information, or lists of any type are required to be saved in the system. The uploaded image can be erased from the system after use, there is no face database, and all faces in the camera live view can be blurred out post-processing to guarantee GDPR compliance. Second, the lack of a required face database, a live view with frames drawn around the detected faces and constant face matching in the background also significantly reduces the amount of computing resource to process the video stream, hence the lightweight. Face Search versus Face Recognition AI Face Search Face Recognition Quick search for a particular person in video footage Identify everyone in video footage Match detected face(s) in video stream to target face(s) in an uploaded image Match detected face(s) in video stream to a database Do not store faces and names in a database Must have a database with ID info Automatically protect privacy for GDPR compliance in public places May require additional paperwork to comply with privacy regulations Lightweight solution Complex solution for large-scale deployment Main use: locate persons of interest in a large area Main use: identify a person who passes through a checkpoint Of course, all features of face recognition can be enabled by the system user if necessary, such as to notify staff members when a person of interest is approaching the store, but the flexibility to not have such features and to use the search tool as a simple Google-like device particularly for people and images is the advantage of AI Face Search.Because Face Search is not based on face recognition, no faces and name identifications are stored Advantages of AI Face Search Artificial Intelligence has advanced so far in the past few years that its facial understanding capability is equivalent to that of a human. The AI will recognise the person of interest whether he has glasses, wears a hat, is drinking water, or is at an angle away from the camera. In summary, the advantages of Face Search: High efficiency: a target person can be located within a few seconds, which enables fast response time. High performance: high accuracy in a large database and stable performance, much like Google search for text-based queries. Easy setup and usage: AI appliance with the built-in face search engine can be customised to integrate to any existing NVR/VMS/camera system or as a standalone unit depending on the customer’s needs. The simple-to-use interface requires minimal training and no special programming skills. High-cost saving: the time saving and ease of use translate to orders of magnitude less manual effort than traditionally required, which means money saving. Scalability: AI can scale much faster and at a wider scope than human effort. AI performance simply relies on computing resource, and each Face Search appliance typically comes with the optimal hardware for any system size depending on the customer need, which can go up to thousands of cameras. Privacy: AI Face Search is not face recognition. For face recognition, there are privacy laws that limits the usage. Because Face Search is not based on face recognition, no faces and name identifications are stored, so Face Search can be used in many public environments to identify faces against past and real-time video recordings. AI Face Search match detected face(s) in video stream to target face(s) in an uploaded image Common use cases of AI Face Search In addition to the scenario of missing child in a shopping mall, other common use cases for the AI Face Search technology include: Retail management: Search, detect and locate VIP guests in hotels, shopping centres, resorts, etc. to promptly attend to their needs, track their behaviour pattern, and predict locations that they tend to visit. Crime suspect: Quickly search for and prove/disprove the presence of suspects (thief, robber, terrorist, etc.) in an incident at certain locations and time. School campus protection: With the recent increase in number of mass shootings in school campuses, there is a need to identify, locate and stop a weapon carrier on campus as soon as possible before he can start shooting. Face Search will enable the authorities to locate the suspect and trace his movements within seconds using multiple camera feeds from different areas on campus. Only one clear image of the suspect’s face is sufficient. In the race of technology development in response to business needs and security concerns, AI Face Search is a simple, lightweight solution for airports, shopping centres, schools, resorts, etc. to increase our efficiency, minimise manual effort in searching for people when incidents occur on site, and actively prevent potential incidents from occurring. By Paul Sun, CEO of IronYun, and Mai Truong, Marketing Manager of IronYun

What technology will impact security most in the rest of 2018?
What technology will impact security most in the rest of 2018?

Where does the time go? Before you know it, here we are at mid-year reflecting on an eventful first half of 2018 in the physical security market. It’s also a good time for our Expert Panel Roundtable to pause and look ahead at what we might expect in the second half of the year. We asked this week’s Expert Panel Roundtable: What technology development will have the greatest impact in the second half of 2018?