physical security threat landscape - lookingglass cyber · landscape: recent trends and 2016...

A LOOKINGGLASS CYBER SOLUTIONS™ WHITE PAPER | FEBRUARY 2016

Physical Security Threat Landscape:

Recent Trends and 2016 Outlook

2

Physical Security Threat Landscape: Recent Trends and 2016 Outlook© 2016 LookingGlass Cyber Solutions™

Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2015: Year In Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

The 2016 Threat Landscape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Table of Contents

Physical Security Threat Landscape: Recent Trends and 2016 Outlook | © 2016 LookingGlass Cyber Solutions™ 3

In this white paper, we take a look back at notable trends and

events in physical security from 2015 and assess what security

professionals should expect in 2016, primarily in North America and

Europe . If not detected and responded to, physical threats such as

protests, labor strikes, boycotts, social unrest, terrorism, and natural

disasters can have a significant impact on business operations .

This can include delayed delivery of goods and services, shutdowns

of offices and facilities, traffic disruptions, and threats to the safety

and security of employees, customers, and executives .

Physical threats can also lead to financial losses, brand damage,

and legal proceedings . Therefore, it is critical to maintain situational

awareness of physical incidents that may affect your organization .

Executive Summary

Duty of Care“Duty of Care” refers to an organization’s corporate

duty or legal responsibility to ensure a safe work

environment for their employees. The responsibility

also demands that company executives exercise

good business judgment and use care in the

operation of the business. If duty of care is not

demonstrated – a threat exists that was foreseeable

and endangers the wellbeing of employees

or business assets – the result could be legal

proceedings, brand damage, and financial losses.

In the United States, these obligations fall under the

Occupational Safety & Health Administration, and the

Corporate Manslaughter & Corporate Homicide Act

in the United Kingdom.

Top 20 Cities with the Highest Percent of Physical Incidents1. New York City Area 22.0%

2. Chicago, IL 13.0%

3. Washington, DC 8.0%

4. San Francisco, CA 5.0%

5. Seattle, WA 5.0%

6. Los Angeles, CA 5.0%

7. Philadelphia, PA 4.0%

8. Baltimore, MD 2.5%

9. Boston, MA 2.5%

10. Portland, OR 2.0%

11. Oakland, CA 2.0%

12. Detroit, MI 1.8%

13. Austin, TX 1.6%

14. Phoenix, AZ 1.5%

15. San Diego, CA 1.4%

16. Atlanta, GA 1.3%

17. Houston, TX 0.9%

18. St. Louis, MO 0.9%

19. Charlotte, NC 0.8%

20. Dallas, TX 0.7%

In 2015, we observed more than 1,000 reports or indications of disruptive events in U.S. cities and commercial areas that had the

potential to impact local operations. This included crime, large demonstrations, and significant safety hazards.

“ This data is based on physical events observed in 2015 across 130 monitored U.S. cities.”

Physical Security Threat Landscape: Recent Trends and 2016 Outlook | © 2016 LookingGlass Cyber Solutions™ 4

5


With global monitoring, we observed the following physical security trends in 2015:

1. Movements for social change spurred by social media

2. Increase in U.S. mass shooting incidents

3. U.S. workplace violence: Homicide on the decline but shootings on the rise

4. Success of European far right political parties and extremist groups in the wake

of a migrant crisis and terrorism

Movements for Social Change Spurred by Social MediaSocial media’s rapid growth within the last few years continues to open doors for activists to plan,

coordinate, mobilize, and discover physical action events in a variety of new ways. As we predicted

in previous whitepapers, social media played an integral role in activist movements across the world,

and in 2015 we saw it used to advance the agendas of popular civil and human rights movements.

In past years, economic and environmental issues were seen as the top motivations for activist

movements. While those issues persist, civil human rights-related issues fueled by national incidents

2015: Year In Review

01SECTION

6Physical Security Threat Landscape: Recent Trends and 2016 Outlook | © 2016 LookingGlass Cyber Solutions™

involving allegations of racial discrimination and police brutality were at

the forefront of activists’ minds in 2015. Our research indicates that social

movements related to civil and human rights increased by approximately

90 percent over 2014. This is likely a result of increased media coverage

and response to events involving police brutality and racial discrimination.

With the help of social media, events and issues that were traditionally

considered local matters gained national attention.

Social media allows activists to work together to gain widespread support,

participation, and awareness of their causes. Activists post calls to action,

dubbed “hashtag activism,” by turning an issue into a Twitter hashtag and

using that in tweets about the topic. Many activists aim for their hashtag to

begin “trending” nationally, worldwide, or in a certain geographic region to

spark interest in their cause. One notable example was the case of Sandra

Bland; a prominent hacktivist group used ‘#SandraBland’ to organize

a nationwide “Day of Rage” after Bland was found hanged of apparent

suicide after being incarcerated for three days over a controversial traffic

stop. Demonstrations against police brutality and candlelight vigils under

the Sandra Bland hashtag continued across the U.S. through December 31,

2015 and were mainly organized through Facebook.

Aside from live-tweeting protest events, a tactic that has recently become

popular not only with activists but also with technology conference

attendees is “livestreaming.” Activists bring a recording device (most often

found on a mobile device) to record actions, garner support, and draw

in more participants at protest events. Livestreaming aims to provide a

firsthand experience from an event and bring awareness to a cause. The

6


most recent livestream feed was the “Unicorn Riot” stream at the Black

Lives Matter occupation of the Minneapolis, MN police department’s

4th Precinct in November 2015 following the shooting death of

Jamar Clark. Some livestreamers also attended the August 2015

protests in Ferguson, MO commemorating the one-year anniversary

of the death of Michael Brown.

Livestreamers often attempt to capture anything notable or controversial,

such as fights or alleged police brutality. If a livestream captures something

significant, the livestreamer or their affiliated group will spread the clip via

social media and attempt to make it go viral. Since these clips are often part

of a larger livestream, some critics have accused livestreamers of editing

their clips to create narratives favorable to them and their cause, or to

unfairly demonize police officers or their opposition. Similarly, activists have

accused the media of shaping their narrative through sound bite seeking

and politicizing their causes.

Social media’s global popularity has allowed movements to grow beyond

local and statewide levels and gain nationwide attention. This was the case

with the death of Freddie Gray, Jr in April 2015. Gray’s arrest, hospitalization,

and subsequent death, combined with an ever-growing police brutality

movement spurred by the events in Ferguson in 2014, resulted in an

ongoing series of protests organized through social media platforms.

Several of the protests turned violent, intensified by civil disorders and

looting of local stores in Baltimore, MD. Demonstrations continued after the

recent announcement of a mistrial in the case connected to the death of

Gray, and we will likely see additional activity in 2016.


In 2015, hometown groups successfully used social media to form national alliances and civil rights groups used social media to link

themselves with preexisting groups. The resulting alliances allowed both preexisting groups and budding activist movements to maximize

impact and outreach beyond their original potential. Emerging leaders in new civil rights movements network, promote, and add legitimacy

to their causes by leveraging the resources of preexisting movements, some of which have been active for decades. Any association with,

and endorsement by, more established activist movements is a win for these new groups.

Towards the end of 2015, inspired by the ongoing civil rights movements, student activists at colleges across the U.S. began staging protests

and occupations regarding various civil grievances. Many of these protests are still ongoing and represent a potential second wave of

the movements they support. The first wave of protests occurred in 2014 regarding the Michael Brown and Eric Garner cases. Due to the

success of these student demonstrations, most notably at the University of Missouri, such actions are likely to continue provided that school

administrators comply with the student organizers’ demands. One prominent anti-police brutality civil rights movement has praised and

encouraged these protests, which will most likely provide inspiration to current and potential activists in future planning and demonstrations.

Although some activists have started locking their social media accounts to retain the element of surprise and escape detection from law

enforcement, it is unlikely that most activists will privatize their social media accounts as they need and desire a large amount of participants

for their causes and are looking for an audience. In fact, the success of hashtag activism means it will likely be used more frequently in 2016

due to its ability to “trend” on social media and reach a global audience. Livestreaming is likely to increase in popularity as more people gain

access to mobile/recording devices and storage issues are solved. Additionally, livestreaming apps such as Periscope, Meerkat, and the

newly released Facebook “Live” streaming feature will make it all the more easier for activists to broadcast their actions.

The success of hashtag activism means it will likely be used more frequently in 2016.


Increase in U.S. Mass Shooting IncidentsThe number of mass shootings can at times be difficult to quantify due to the

fact that there is no universal definition for what constitutes a mass shooting.

While the Congressional Research Service defines mass shooting as an

event in which “four or more people are killed with firearms,” the popular

crowd-sourced website used by many academia, journalists, and advocacy

groups, Mass Shooting Tracker, defines a mass shooting as one with “four or

more people shot in one event,” and includes those wounded in the count

as well.1 Complicating matters even more, the FBI does not have an official

definition of mass shooting, though they have defined “mass killing” as one

with three or more fatalities.2

Going by each of their definitions, Mass Shooting Tracker recorded 331

mass shootings in 2015, a seventeen percent increase over 2014. The

FBI recorded 45 mass shooting events in 2015. This averages to 0.86

mass shooting events per week, and represents a seven percent increase

in mass shootings over 2014.3

These numbers indicate that mass shooting events are also occurring at a

greater frequency, specifically with mass public events – where the victims

do not know the shooter and the attack is pre-meditated with the purpose

of retribution, mass-murder, terrorism, or mass-hysteria. Regardless of how

you choose to define “mass shooting,” it’s clear that this type of incident has

trended up and to the right throughout 2015.

It is important to note that these numbers do not tell

the whole story, as there have been other shooting

events that many may not categorize as mass public

shootings or killings. This includes gang-related

shootings and ones that involve unsuccessful

robberies and drug sales, as well as unsolved mass

shooting events that are often attributed to drug- or

gang-related activities. Killings involving multiple

shooters and mass killings by other means are

also included, such as the May 2015 killing of nine

people outside of the Twin Peaks restaurant by

rival motorcycle clubs and the October 23 incident

in which a woman drove her car into a crowd at an

Oklahoma State University Homecoming event,

killing four and injuring dozens, respectively. If these

types of incidents were included, the number of

mass casualty events would likely be higher.

1 http://fas.org/sgp/crs/misc/R44126.pdf 2 https://www.fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter-incidents/pdfs/a-study-of-active-shooter-incidents-in-the-u.s.-between-2000-and-2013 3 https://www.massshootingtracker.org/data/2015


We also observed a trend where perpetrators of these mass shooting events are active

online and on social media. For example, the Emanuel African Methodist Episcopal church

shooter in Charleston, SC who killed nine, maintained a website where he published a

manifesto found after the shooting. The shooter in the Lafayette, LA mass shooting had

hundreds of online postings sharing his anti-government and anti-media views.4

In the Umpqua Community College shooting, the suspect in the killing of 10 people

maintained several social media profiles hinting at his future actions. His activities on

these sites suggested he was fascinated by the Irish Republican Army (IRA) and frustrated

by traditional organized religion. He also posted on the image-sharing site 4chan the night

before the shooting, implying something was going to happen at the college the next

day.5 He even tracked other mass shootings and expressed admiration for the actions of

the suspect in the shooting of two Virginia news channel hosts on live television. Although

the Virginia shooting does not fit the label of a mass public killing event, the shooter took

to social media in the months and weeks leading up to the killings, airing his frustrations

with his former employer. He also uploaded a first-person view of the killing, taken on his

cell phone, to social media immediately following the killing.

While not all perpetrators of mass killing events are taking to social media to air their

grievances or publicize their actions, the Internet and accessibility to it through mobile

devices has made it easier for threat actors to accomplish their goals, a trend that is very

likely to continue in 2016. Whereas shooters in the past wrote manifestos that were sent to

the print media or law enforcement, the prevalence and ease of social media has allowed

killers to bypass this step and release their intentions and threats directly to the public.

4 http://www.cnn.com/2015/07/24/us/louisiana-theater-shooter/ 5 http://pix11.com/2015/10/01/disturbing-message-appears-on-social-media-day-before-mass-shooting-at-oregon-community-college/

Business Impacts of Physical ThreatsViolent protests, civil unrest, and collective violence have been identified as the most significant risks to governments and businesses .6 With that in mind, businesses need to be aware of how physical threats can cause supply chain disruptions, operational risks, and serious threats to employees, executives, and clients .

In extreme cases, terrorism threats can cause significant disruptions as law enforcement and security forces may close down important road arteries, public transportation networks, set up check points, and evacuate entire business districts .

Supply Chain Disruptions: In an interconnected and globalized marketplace, protests, riots, strikes, terrorism, and severe weather in one part of the world can disrupt links in a business’ supply chain network . Supply chain disruption can cause economic losses as businesses rely on suppliers and transportation vendors to deliver products and goods on time . Businesses that fail to deliver services and products to customers on time may face reputational risks and economic losses .

Operational Disruptions: Physical protests, labor strikes, and social unrest can bring work to a halt and prevent employees, customers, and vendors from accessing stores, office space, and other facilities . Corporate facilities may be damaged via looting and vandalism, which can cause temporary shutdowns and outages . Large-scale physical protests and strikes in nearby areas can cause closures of roads and public transportation, which may impact travel and commute plans . Demonstrations can occur in close proximity to offices and public transportation hubs, elevating incidental risks and causing localized travel disruption .

Threats to Employees, Executives, and Clients: Employees, the most valuable asset in maintaining business activities, are at risk whenever peaceful protests escalate to unrest, and clashes erupt between police and protesters, or among protesters themselves . Activists can target offices with direct actions by blocking entrances, raiding/occupying offices, staging sit-ins in building lobbies, or trying to bypass security guards to enter the office space .

Physical actors often target business executives and board members to intimidate and influence a business policy or decision . There may be repeated protests outside private residences, distribution of leaflets to neighbors to cause embarrassment, and interruption of annual shareholder meetings . In the most extreme cases, business executives may experience death threats and assaults .

6 http://www.weforum.org/events/world-economic-forum-annual-meeting-2014


U.S. Workplace Violence: Homicides on the Decline but Shootings on the RiseEach year, nearly two million American workers report having been victims of

workplace violence. Many more cases go unreported.7 While the overall number

of workplace homicides declined in 2015, workplace shootings made up a larger

percentage of these violent incidents.

Workplace violence is defined as “any act or threat of physical violence, harassment,

intimidation, or other threatening disruptive behavior that occurs at the work site.

It ranges from threats and verbal abuse to physical assaults and even homicide.”8

These acts can affect employees, clients, customers, and visitors at corporate facilities.

Violence can take many forms, including homicide, assaults, domestic violence,

stalking, threats, emotional abuse, and any form of harassment. The most common

types of violence are often psychological in nature, such as bullying, intimidation, and

threats, yet those incidents are rarely reported.9 In two-thirds of workplace homicide

incidents, the assailant has no known personal relationship with the victim(s);

however, that number may be skewed by homicides involving late-night retail

stores such as convenience stores and gas stations.10

Homicide – shootings, stabbings, poisonings, etc. – is currently the fourth-leading

cause of fatal occupational injuries in the United States, making up eight percent

of fatal workplace injuries in 2014, the latest year for which figures are available.11

7 https://www.osha.gov/SLTC/workplaceviolence/ 8 https://www.osha.gov/SLTC/workplaceviolence/ 9 http://money.cnn.com/2015/08/26/news/workplace-violence-virginia-shooting/ 10 http://money.cnn.com/2015/08/26/news/workplace-violence-virginia-shooting/ 11 http://www.bls.gov/news.release/cfoi.t01.htm


However, according to the Bureau of Labor Statistics Census of Fatal Occupational Injuries (CFOI), there has been a steady decline of workplace

homicides since 1992 – 1,074 in 1992, 645 in 1999, and 634 in 2003.12 In contrast, the number of workplace shootings has steadily increased in

the past few years. In 2014, shootings made up 76 percent of workplace homicides, whereas that number was 67 percent in 1992.13

There are many reasons why workplace violence occurs, such as disgruntled current or former employees, customers who feel wronged, stressed

out employees, or as the result of a conflict between co-workers that elevates into a physical altercation in the office. This was the case of Vester

Flanagan, also known by his TV name Bryce Williams, who shot and killed news reporter Alison Parker and cameraman Adam Ward on live television.

Flanagan lashed out after he was fired from his job at the Roanoke-based TV station WDBJ and claimed on social media that he was repeatedly the

victim of racial discrimination while employed at the television station, specifically naming victims Parker and Ward on several occasions.

Workplace violence can also occur when personal life issues spill over into the workplace and manifest themselves at the office. In February

2015, a man walked into his job in Moorestown, New Jersey and shot his coworker and himself due to an “ongoing domestic situation.” 14

Research indicates several factors may increase the risk of violence for workers, including working with volatile, unstable people; working

alone or in isolated areas; providing services and care, especially health and elder care; and working where alcohol is served. Additionally,

time of day and location of work, such as working late at night or in areas with high crime rates, are also risk factors that should be considered

when addressing issues of workplace violence.15

Workplace shootings have steadily increased in the past few years. In 2014, shootings made up 76 percent of workplace homicides.

12 https://www.irmi.com/articles/expert-commentary/workplace-violence-in-the-21st-century-emerging-trends 13 http://www.npr.org/2015/09/08/438547063/the-challenges-of-identifying-potential-workplace-violence 14 http://www.nydailynews.com/news/crime/1-dead-attempted-murder-suicide-n-security-company-article-1.2126291 15 https://www.osha.gov/SLTC/workplaceviolence/


Under a recent Occupational Safety and Health Administration (OSHA) directive on workplace violence, employers can be cited if they do not

take precautionary steps to protect their employees from the potential harm of workplace violence.

As such, all employers should evaluate their own potential for workplace violence and consider the following preventive steps:

• Developnewemployeeorientationandtrainingonworkplaceviolenceprevention,

• Createandcommunicateawrittenpolicyonworkplaceviolence,includingwhatconstitutesworkplaceviolence

and how to report incidents,

• Monitoropensourceintelligencesourcesthatimpactexecutives,employees,andfacilities,

• Completeaworkplacehazardassessmentandsecurityanalysis,and

• Developappropriateengineeringcontrols,administrativecontrols,andregulartrainingateveryorganizationallevel.

Success of European Far Right Political Parties and Extremist Groups in the Wake of a Migrant Crisis and TerrorismIn 2015, political upheaval and terrorist attacks led to a large influx of refugees from the Middle East and sub Saharan Africa into the European

Union (EU). As more refugees flee their homelands looking for asylum, increased pressure against individual EU member states that are

resisting a migrant quota system could serve as a catalyst for further anti-immigration and anti-EU sentiments.

Far right political parties and extremist groups, such as the counter-jihad movement, have found support because of their anti-immigration,

nationalism, and anti-Islamic sentiments, as well as their responses to recent terrorist attacks. Far right European political parties tend to

be nationalistic, socially conservative, push for a strict limitation on immigration, and favor Christian values. These parties have also heavily

opposed the EU because they see the Union as eroding the nation-state, as well as national sovereignty.

Additionally, the large influx of migrants into the EU, and the pressure on the EU’s external borders in Greece, have increased pressure

on individual EU Member States to agree on a migrant quota system. The EU increasing the number of migrants allowed into its borders


could serve as a catalyst for further anti-immigration and anti-

EU sentiments. Furthermore, supporters of the EU Schengen

Agreement – the agreement that allows EU citizens to move

across the EU’s internal borders without a passport – may find it

difficult to advocate the principles of open borders in 2016. The

absence of internal borders makes it easier to freely move goods,

capital, and people across Europe, and it is likely that terrorists

could take advantage of this to move operatives and weapons.

European far right wing parties have been able to gain ground

because some voters feel that the mainstream parties have not

properly addressed issues such as immigration and integration.

This has created a void that has been filled by the far right

parties calling for tougher stances on these issues. Many far

right parties have been able to win over voters by portraying

themselves as the only opposition to immigration, as mainstream

parties have converged and agreed on more liberal immigration

policies. As a result, parties in France (Front National), Sweden

(Swedish Democrats), Germany (Alternative for Germany), and the

Netherlands (Party for Freedom) have already gained ground in

the aftermath of the recent Paris attack and the current refugee

crisis by capitalizing on the absence of reactive and proactive

measures.16 They have proposed tougher measures that appeal to

voters who fear future terrorist attacks in their home countries.

16 http://www.businessinsider.com/europes-hard-right-parties-making-gains-in-polls-2015-11?r=UK&IR=T


Mainstream anti-Islamism and anti-immigration social movements led by Patriotic Europeans Against the Islamization of the Occident (Pegida)

continue to gain support, and Pegida has even started to run in political elections, such as Dresden, Germany’s 2015 mayoral election.17 The

group shows no signs of slowing their actions down, and held their inaugural UK rally in Birmingham on February 6, 2016.18 Along with anti-

Islamism and anti-immigration movements is the extremist counter-jihad movement, which favors provocative street protests targeting Islam

and direct actions against mosques. Support for these actions continues to grow in the UK, with the far right nationalist party, Britain First,

replacing the far-right street protest movement, the English Defence League (EDL), as the largest counter-Jihad group.

As these extremist groups, social movements, and far right political parties becoming more vocal and gain widespread support, feelings of

alienation, social estrangement, and disenfranchisement among immigrant communities around Europe will likely increase. Immigrants could

begin to resent their host countries, particularly within France, Germany, Belgium, the Netherlands, Sweden, Denmark, and the UK, which are

already experiencing the implications of failed integration policies. International terrorist networks will likely take advantage of these increased

feelings of hostility and use these grievances as a basis for recruitment.

The Paris attacks, and any future European attacks, can be viewed as a form of provocation, aimed at driving a wedge between immigrants

and their Western host countries. Exacerbating anger and suspicions against the Muslim communities in Europe could create a breeding

ground for Muslim moderates to become more susceptible to extremist ideas and join ranks with organizations like ISIL and al-Qaeda.

As discontent among immigrant communities and anti-immigration sentiments increase, extremist groups, political parties, and terrorist

organizations will continue to find success, resulting in a fragile political and social environment in the EU.

17 http://www.theguardian.com/world/2015/jun/08/germanys-anti-islam-pegida-makes-surprise-gains-in-first-election-bid 18 http://www.theguardian.com/uk-news/2016/feb/06/pegida-uk-supporters-stage-anti-islam-silent-march-birmingham

Far-right parties in France, Sweden, Germany, and the Netherlands have already gained ground in the aftermath of the Paris attacks.

17


IncreasedFocusonFightingInternationalTerrorismandRadicalizationThe recent terrorist attacks in the United States and Paris, France, as well as numerous terrorist arrests

across the European Union (EU) in 2015 have once again pushed international and homegrown terrorism

to the top of the global security agenda.

The December 2 homegrown terrorist attack in San Bernardino, California shows that the U.S. is not

immune to homegrown terrorism from individuals and smaller cells acting in support of international

terrorist networks such as the Islamic State (IS) and al-Qaeda (AQ). In this case, all of those involved had

the intentions and capabilities to plan and launch attacks below the radar of U.S. law enforcement and U.S.

intelligence agencies. It is still unclear if the intended target was actually the holiday party or someone/

something with higher symbolic value that could maximize media exposure.

Similarly, the 2015 Paris attacks show IS’s intentions and capabilities to conduct successful indiscriminate

attacks inside the EU. The success rate of terrorism attacks within the EU is potentially increasing due to a

combination of ineffective inter-regional cooperation and a new generation of young and computer savvy

terrorists with the ability to circumvent electronic surveillance. Individuals traveling from Syria, Iraq, and

Yemen will continue to be a challenge as they can return equipped with lethal skillsets, such as combat

and operational experience from being in these conflict zones.

The 2016 Threat Landscape

02SECTION


The EU’s core objective of economic integration (supporting a single market) provides a fertile environment for international terrorism. The

reduction of borders, which now allows for the free movement of people, goods, technology, and financial transactions can mask terrorist

activities, making it easier for terrorists to operate and hide in plain sight. They can cross borders more easily, move weapons, and plan

attacks in one EU Member State but carry it out in another. A few Member States – France, the UK, the Netherlands, Belgium, Spain, and

Germany – are all attractive targets for homegrown terrorists and returning jihadists with connections to the Islamic State of Iraq and the

Levant (ISIL) and AQ franchises across the Middle East and Africa.

A review of IS literature available in the open source indicates that the terrorist network seeks to punish and retaliate countries that are part

of a coalition to destroy the terrorist network’s base in Syria. France, Russia, and the UK have been singled out as targets. At least one aim of

such retaliatory attacks is for the IS to demonstrate to their constituency and potential supporters that they have not been weakened and are

still committed to their cause.

European states are also vulnerable to attacks because they represent the ‘far enemy’ or the West in the eyes of religious political terrorist

networks such as IS and AQ. In their view, the West and Western practices (materialism, capitalism, modernism, etc.) is the direct source of

Islam and the Islamic government’s corruption in the Middle East. The Paris attacks as well as a terrorist attack on the London Tube show that

IS and AQ are not only waging a jihad (holy war) against the ‘near enemy’ – corrupt Islamic governments in the Middle East – but also against

anyone they deem a threat to their views.

Despite intelligence sharing attempts between countries within the EU through the European Justice and Home Affairs (JHA) agencies Europol and

Eurojust, individual Member States tend to be reluctant to share information due to national security interests. Bilateral cooperation is common, but

the lack of intelligence sharing between these states increases the risk of intelligence failure and the inability to thwart terrorist attacks.

The EU’s core objective of economic integration (supporting a single market) provides a fertile environment for international terrorism.


Terrorist organizations will likely continue to find recruits within Member States for

the foreseeable future because countries such as France, Germany, Italy, Spain,

Belgium, the Netherlands, and Sweden have been experiencing high rates of

unemployment and segregation. Immigrant and Muslim communities have also

experienced backlash, seen through the rise of attacks against Muslims and the

growth of far right parties. The result is a growing feeling of resentment, alienation,

and hostility of people towards their host countries, which may intensify in the wake

of the ongoing European migration crisis. IS has proven to be effective in capitalizing

on these feelings and manipulating disenfranchised individuals into their ranks and

turning them against their host societies.

Outcome of the Presidential Election on U.S. Social MovementsThe upcoming U.S. presidential election in 2016 will likely invigorate many social

movements across the country. There are a number of highly contested policy issues

by the U.S. public, which, depending on the outcome of the election, could spark

increased activism based on historic and more recent domestic social movements.

In addition, given increased media coverage of the election, commercial entities can

become particularly susceptible to public focus and ire based on lobbying efforts

and political contributions of well-known executives. Below are some of the key

policy issues that, regardless of the election’s outcome, could influence future social

movements and activity within the U.S.

Approval of the Keystone Pipeline and Stance on Arctic Drilling: Prior to

President Obama’s rejection of the Keystone XL project, there were extensive

campaigns targeting stakeholders and financiers of the pipeline. Issues like Keystone

and fracking (particularly related to Arctic drilling) have been highly contested issues


resulting in wide-scale demonstrations against public and private sector entities. There are clear divisions in support for the Keystone Pipeline

and fracking between Democratic and Republican front-runners. Democratic candidates Hillary Clinton and Bernie Sanders have officially

announced opposition to the pipeline and Arctic drilling, while Republican candidates Jeb Bush, Ben Carson, Marco Rubio, and Donald

Trump have openly endorsed and supported these energy initiatives. EPA regulations, specifically the Clean Power Plan represent another

clear division between the parties on these issues. All Republicans seek to curb or limit EPA regulations upon election, and if a Republican

candidate wins the election, it will likely reinvigorate environmental activism.

Legislative Reform and Healthcare: We saw a wide array of activism leading up to the ACA’s passage, as well as various legislative

challenges and arguments concerning the funding of Planned Parenthood. Corporate sponsors and opponents of Planned Parenthood have

been the primary targets of demonstrations and activism throughout 2015. Similar to the Keystone and fracking issues, there is a stark contrast

between Democratic and Republican opinions on the ACA and funding for Planned Parenthood. In terms of the ACA, Democratic candidates

have voiced their support (in varying degrees), while Republican candidates seek a range of alternatives and repeals. Attempts to repeal or

offer substantial reform will likely occur under a Republican president, which could spark civil mobilizations similar to those leading up to the

ACA’s passage. On the issue of Planned Parenthood funding, there is an even clearer divide, with Democrats supporting funding as opposed

to the unanimous calls for defunding from Republicans. Regardless of the outcome of the 2016 presidential election, Planned Parenthood

funding is a hot topic with supporters from both sides willing to conduct activism in support of their views.

Proposed Controls Concerning Second Amendment Rights: 2015 saw large demonstrations following mass shootings and violent events

from all sides of the debate. While interpretation of the Second Amendment has been a long ongoing debate and activist issue, recent

developments and media coverage concerning mass shootings and police brutality have further added to the debate’s momentum. The

Second Amendment has already appeared as a platform issue in social movements and campaigns, and given the stark contrast in the

candidates’ positions on the issue, any outcome will likely evoke responses from proponents and critics.

Syrian Refugee Conflict Stance and Broader Immigration Policies: Candidates from both sides of the aisle have issued statements

concerning future policy for Syrian refugees ranging from ‘open arms’ and increased screening, to religious restrictions and complete

cessation. There has also been steady momentum behind pro and anti-immigration movements throughout 2015 over policy debates


concerning undocumented immigrants. Contention and

potential social unrest over refugee and immigration policy will

likely be further enhanced by the ongoing debates and media

coverage of the Syrian refugee situation.

Response to Ongoing Middle Eastern Conflicts: Decisions

concerning the future and level of U.S. involvement in regional

conflicts, and the fight against Jihadists, has been seen to spark

responses from groups primarily opposed to an increased

presence in the Middle East. However, there has also been an

observed smaller uptick in movements calling for increased

U.S. actions. The U.S. government has been the main focal point

of these activities, though we have seen some targeting cross

over to the private sector when organizations hold regional

interests stemming from either operations or philanthropic and

political activities of senior executives.

Violent confrontations between rival demonstration groups

and demonstrators and police have resulted in instability

in a few European countries. Inflammatory issues such as

anti-immigration, anti-Islamization, and anti-Semitism have

sometimes turned protests into emotionally charged events

that escalate into violence. To provide situational awareness

for business travelers, we have identified countries to keep

an eye on while traveling to Europe in 2016.

Traveling to Higher-Risk Countries

While businesses are usually not the primary targets of terrorism, business travelers and businesses with fixed locations in Europe could become victims of incidental violence and localized travel disruptions in the event of an incident. If you’re in any of the below areas, be on the alert for indirect consequences of terrorism and homegrown terrorism in 2016.

• London,UK • Paris,France • Berlin,Germany • Brussels,Belgium • Copenhagen,Denmark

Though no specific location or target in Europe can be singled out as a prime terrorist target, the above cities remain vulnerable to terrorism. This is due to their active participation in airstrikes against IS in Syria and Iraq, as well as the high number of IS recruits who can return from conflict zones to their host countries with lethal skill sets.

22


As physical and cyber security continue to converge, physical security professionals need to continuously

monitor open source communications, especially social media, for any mention of threat to their

organization, executives, employees, and facilities. This means being prepared for all physical threats,

including mass shootings and workplace violence, as well as fallout from other issues that may not seem

like direct threats, such as the current turmoil in Europe and the rise of local social movements.

In 2016, organizations and physical security professionals should be vigilant around the lead up and

outcome of the U.S. Presidential election. Regardless of who wins, there will likely be demonstrations

and other acts of social unrest from both sides leading up to the elections, and possibly beyond. Globally,

the increased focus on fighting terrorism and radicalization will make it even more important than ever

for physical security professionals to maintain situational awareness and prepare their organizations for

potential threats. We recommend using caution when traveling to the United Kingdom, France, Germany,

Belgium, and Denmark.

02SECTION

Conclusions

While your network may be secure, do you have visibility beyond the perimeter? Security is no longer about what you can see. What you can’t see is where the true threats hide.

Cyveillance, a LookingGlass Cyber Solutions company, offers an easy-to-use platform that enables security professionals the ability to see beyond the perimeter. Our solutions identify cyber and physical threats and risks across the globe, allowing you to mitigate and eliminate them before they disrupt your business.

We go beyond data to provide the threat intelligence that you need to achieve your organization’s business goals. Contact us today to learn more and get a free trial.

Using security intelligence technology can save companies up to $2.6 million when compared to companies not using security intelligence technologies. “2014 Global Report on the Cost of Cyber Crime.” Ponemon Institute; HP. 3 Dec. 2014. http://www8.hp.com/us/en/software-solutions/ponemon-cyber-security-report

Cyber Threat Center

www.cyveillance.com/cyberthreatcenter

11091 Sunset Hills Road, Suite 210 Reston, Virginia 20190 Toll-Free: 888.243.0097 | Headquarters: 703.351.1000www.cyveillance.com [email protected]

© 2016 LookingGlass Cyber Solutions. All rights reserved. Cyveillance is a registered trademark of Cyveillance, Inc.

All other names are trademarks or registered trademarks of their respective owners

LookingGlass Cyber Solutions delivers advanced, comprehensive threat intelligence-driven solutions in four categories: machine readable threat intelligence (MRTI), threat intelligence management (TIM) with over 140 data sources transformed into threat intelligence, threat intelligence services, and threat mitigation. LookingGlass enables security teams to efficiently, effectively address threats at every stage of their lifecycle. For more information, visit www.lgscout.com.

Cyveillance, a LookingGlass Cyber Solutions company, is the leading provider of cyber threat intelligence, enabling organizations to protect their information, infrastructure, and employees from physical and online threats found outside the network perimeter. Founded in 1997, Cyveillance delivers an intelligence-led approach to security through continuous, comprehensive monitoring of millions of online data sources, along with sophisticated technical and human analysis. The Cyveillance Cyber Threat Center, a cloud-based platform, combines web search, social media monitoring, underground channel information, and global intelligence with investigative tools and databases of threat actors, domain names and IP data, phishing activity, and malware. Cyveillance serves the Global 2000 and the majority of the Fortune 50 – as well as global leaders in finance, technology, and energy – along with data partners and resellers. For more information, visit www.cyveillance.com.

physical security threat landscape - lookingglass cyber · landscape: recent trends and 2016...

Documents