ISIS vs ISPS: The Limitations Ashore

Preamble: This article is particularly focused on the 2016 cruising season in the Mediterranean and Western Europe.

The USA has not always been in a rush to ratify international treaties, with MLC 2006 and the UN Convention on the Law of the Sea being outstanding examples. However, the USA pushed the ISPS Code (International Ship and Port Facility Security) through the IMO in 18 months.

Subsequent to the 9/11 attack by hijacked aircraft, the US objective was to protect themselves from a similar attack by sea. Germane to achieving this primary goal was securing individual ships and their crews against assault and/or seizure by terrorists who would use them to deliver an attack on a port city. An associated benefit of the ISPS procedures that guard against terrorists is that they also serve to guard against piracy and ransom hijackings.

Seafarers under ISPS

Note the above. If you are a seafarer you are in third place under the ISPS Code. Your personal security is embraced only to the extent that it serves a higher purpose, which is the protection of the asset (yacht) on which you serve, the security of which is in turn valued only against preventing its use in a mass casualty terrorist incident ashore. Are we clear so far?

There tends to be a disconnect between our awareness about old news and our focus on fresh news. 9/11 and introduction of the ISPS Code is old news. Fresh news is last week’s terrorist incidents in Istanbul and Jakarta. And it’s the fresh news which tends to dominate our perception that terrorism is something new. Not so.  

Even if you are new to yachting and in your early twenties, the 9/11 event of 2001 (2,996 dead, + 6,000 injured) happened in your lifetime, as did the London transport suicide bombings in 2005 (52 dead, 700+ injured), and the Madrid train bombing in 2004 (191 dead, c. 1800 injured). More mature readers who were around in 1979 lived through the peak year of a long period of terrorist attacks across Europe – 1,019 incidents in that year alone. In 1980, the Bologna train station bombing resulted in 85 dead and c. 200 injured.

A summary of terror in the post-WWII period to the year 2000 

In London alone there were over 130 IRA incidents including bombings, shootings, mortar attacks and assassinations. There were 32 attacks by various anarchist groups. Within that same overall time frame various Middle Eastern groups were concerned in terrorist operations over an 11 year period.

Many other parts of UK were also targeted. There were many plots which were foiled by the security services, or failed due to the would-be perpetrators’ own ineptitude.

Elsewhere in Europe, in Germany the Red Army Faction undertook bombings, assassinations, kidnappings, and bank robberies spanning three decades (34 dead, many injured). The Revolutionary Cells carried out 296 bomb, arson and other attacks in Germany between 1973 and 1995. In Italy, the Brigatti Rossi operated a similar regime of terror for two decades, including the murder of a former Prime Minister. Between 1969 and 1994 Middle East-based groups were responsible for attacks on aircraft which included 4 downings, 6 hijackings and 2 other attacks with weaponry.

The common theme in all these incidents was that even though there may have been specific targets such as significant buildings or individuals, there was a deliberate intent to kill or maim anybody else in the vicinity. That is the driving force behind terrorism, to instil fear in everybody who is not a member of the perpetrators’ group.

In sum, for several decades during the post-war period, terrorism was constantly in the news and a part of daily life.  Since 1990 there have been other episodes across Europe and the rest of the world, including 9/11 itself but, in comparison with pre-1990, it had until recently been relatively quiescent on the terrorist front.  

The above accounts all relate to attacks on land. In the post-WWII period it has proven to be piracy rather than terrorism that has been the main threat to ships at sea. There were incidents, mostly small scale and including an element of piracy. Apart from the Achille Lauro hijacking in 1985, it is unlikely that any reader can name any other terrorist attack at sea.  

Now ISIS has appeared on the scene, not so much as the elephant in the room as an octopus with many tentacles. Its declared objective is to wrap the entire world in its clutch.

To date, although ISIS has boasted about its intent to close the Mediterranean shipping lanes, it has demonstrated no capacity to convert this threat into action. Such being the case, what is the risk of ISIS wrapping one of its tentacles around your yacht, or you as an individual, this coming summer season in the Med? If you are at low risk level at sea, what level of risk do you face while in port or ashore?

The risk should be assessed in terms of:

(i) Likelihood of further outrages by ISIS or its followers, or copy-cat incidents by Al Qaeda
(ii) Likelihood of any single place, asset or individual being involved in a terrorist incident
(iii) Potential outcomes of such involvement

There is consensus among all Western governments’ security agencies that:

(i) Event probability is high. Sheer numbers mean that (ii) probability of involvement of any one person is low. The potential outcome (iii) of personal involvement is obviously totally unacceptable to any individual.

The combination of event probabilities and outcome tolerance needs to be balanced so that precautions do not freeze all normal activity.

Writing for the INYT on 6 January this year, one of its columnists coined the term “The age of small terror”. The phrase is intended to differentiate between local-impact incidents, including even 9/11, and mass impact terror such as the WW II London Blitz, the siege of Stalingrad, the final battle for Berlin, and so on.

The organized terror of war can be guarded against by warning systems, evacuations, hiding in bomb shelters and so on. Terrorism is sudden and unannounced, and pro-active options are limited to the work of intelligence organizations and public vigilance.

The age of small terror

The term “age of small terror” is intended to serve as a reminder that today we are living in a repeat of the 1970’s and 1980’s, when urban centres and transport systems were the scene of a steady stream of terrorist episodes.

Throughout that period of small terror, everybody carried on with life, because they had to. Reactive measures such as security guards at train stations, metal detectors at public events, airport security check-in lines and so on, have long since been factored into our daily lives.

This new age of small terror is born from the intent and proven capability of ISIS and its cohorts to stage a new wave of local episodes causing mass casualties, such as the Paris attacks of 13 November last year (130 dead, over 360 injured), and to encourage random single-perpetrator attacks such as the December 5th incident on the London Tube station at Leytonstone (3 injured).

This all raises the question of what means are available to mitigate risk in this new age of small terror? Which brings us back to ISPS. Despite the pre-Christmas Paris incidents, the near-lockdown of Brussels, and a high level of alert in France, Germany and Austria over the New Year, ports in the EU remained at MARSEC Level 1. The fact that we experienced no call to adopt a higher MARSEC Level should not be read as ports and ships being an afterthought when the balloon is expected to go up.

The good news is that at present it seems that only the major conurbations are viewed by security services as being at the higher risk level. The bad news is that if any port were to be raised even to MARSEC Level 2, then the probability-to-outcome risk ratio will have seriously shifted. We would need to be far more circumspect in the way we go about our business.

In these circumstances, would the typical security seen at the major yacht shows afford adequate or even any protection for you? 

A MARSEC Level 3 situation would be gravely serious. It should be associated with the bloody images we have all seen of the aftermath of terrorist shootings with assault weapons and detonations of suicide belts. It would mean that the authorities making the call have an informed fear of imminent carnage, possibly at several locales to complicate the efforts of first responders.

Consider what would probably be happening ashore. Security units and emergency services would be aware that “something’s up”. Hospital administrators will be ready to enact their plans to receive shattered bodies and torn limbs. Their phones will be ringing down to the blood bank and mortuary - “something’s up”.

Ambulance drivers will be hanging around their vehicles. In the fire brigade stations the crews will be waiting with dry mouths for the call to go out. Members of SWAT units will be rechecking their gear for the umpteenth time. The local Lifeboat Honorary Secretary will be ready to press the summon button on his pager. 

What does ISPS do for us?

And what will the yachties be doing? If we were in port under such circumstances, what does ISPS do for us? The SSP may include an option for immediate departure and clear up the breach of formalities later; to be at sea seems a safer bet than remaining in port. Or the yacht may remain in port and enter Level 3 lockdown mode, which includes a requirement for additional patrols.

The downside to this particular activity to protect the asset is that any actively patrolling crew are, by definition, exposed to the imminent risk of extreme violence from an unknown quarter. The crew role is primarily passive defence. Evacuation is a last option if the situation is further complicated by a bomb threat and passive defence is seen as no longer viable.

At this point ISPS ends, and it is doubtful that many yachts’ SSPs go further. Evacuation means exposure. Keeping in mind that in our ISIS scenario general mayhem, including shootings and explosions, is expectedly imminent, what guidance is available in the SSP for timing an evacuation, and what contingency plans exist to execute it?

So far we have been considering the situation of the yacht and crew on board. What about crew who may be ashore in this port which has just gone to MARSEC Level 3? What about crew who have been sent on ship’s business from a yacht in a Level 1 port some distance away to the Level 3 port?

Boundaries and limits

To address these situations, the first matter to clarify is the boundary of the MARSEC zone – what defines the port limits?

Within the EU the smaller ports have found it difficult to comply with EU dogma on this issue. Where a port facility is a near-autonomous fenced area such as an oil refinery or a container terminal, the port facility itself can denote the bounds of the port.

The case of a small port where the municipality wraps itself tightly around the waterfront, such as St. Tropez, is not so simple. What is an “adjacent area?” Would Pampelonne Beach count? It is in such cases that the difference between a central authority’s assessment of overall risk, and the maritime authority’s assessment of local MARSEC risk level, may lead to dangerous complacency or unnecessary alarm.

(It should be noted here that in the USA there is no automatic link between the Homeland Security Advisory System (HSAS) risk level and the United States Coast Guard’s (USCG) MARSEC level).

Duty of care

No matter what the boundaries, the case of crew ashore in a MARSEC Level 2 or 3 situation raises various considerations of “duty of care”. Crew members who are not signed off remain under contract to the yacht 24 hours a day. A Seafarer’s Employment Agreement (SEA), for instance, does not stop at the gangway. MLC 2006 is itself a particular example of embodiment of the principle of duty of care, as is the ISM Code.

The UK Corporate Manslaughter Act is just one example of an international trend to defining and expanding the responsibilities of organizations towards employees and others who may reasonably be assumed to be within an organization’s responsibility (e.g. day workers, contractors, shipyard workers on board).

Given an over-riding duty of care, there is clearly a practical need, and a generally overlooked legal obligation for a yacht to extend its ISPS preparedness. It should cover the eventuality of there being signed-on crew ashore but in the general vicinity in the event of a raised MARSEC level of risk, and possibly an actual terrorist incident.

There is an implied similar obligation towards non-crew members, who may be on board or ashore on occasions directly related to their requested attendance on the yacht. ISPS overlooks the need for this extended protective umbrella and its attendant demand for a response plan. Such a plan would need to cover a procedure for communication of warnings and information to crew and non-crew ashore.

Personnel safety ashore

A logical extension of consideration for crew ashore is a set of guidelines for crew travel. This would require due diligence in assessing destination intelligence, accommodation, ground transport, and even airline routeing choice.

To illustrate the significance of this last point, a corporate travel officer who put an employee on the Malaysian Airlines Flight 17 which was bound from West to East and was shot down over Ukraine, and did not check whether its planned route passed over a war zone being avoided by other airlines, would be a potential target for liability lawyers representing the victim’s family. Due diligence? Duty of care?

What if a warning to crew ashore comes too late, or they are caught out in a situation which develops without warning? In all catastrophic situations different people react in different ways. Some make right decisions and survive, others make wrong decisions and pay the price. In any case, making a decision at all puts you in a better position than someone who remains passive. Here again, basic non ISPS security principles and guidelines can make the decisive difference.

Where ISPS ends

ISPS was never designed to provide guidance for an active event: it was written only to provide guidance for preventing an event.

It can then be argued that in the age of small terror, just caring about people, never mind an actual duty of care towards them, would suggest that some kind of awareness and response training might be called for, to extend protection where ISPS leaves off.  

There are two other aspects of crew response to a MARSEC Level 3 alert which are not addressed by the ISPS Code, and are probably rarely included in any given SSP.

The first is that although training and a sense of duty will keep crew performing their allotted tasks if they are in a concerned port, they may well be uncertain as to the extent of the area under threat. If they have family or other dear ones in the vicinity, they will be under stress about their safety. The same will apply if they are safe in a MARSEC Level 1 port but their family is in a zone which has gone to MARSEC Level 3, or is in a non-port urban area which has been placed under a high or imminent risk alert.
In such circumstances some crew may endure much anxiety until the alert is over, even though MARSEC Level 3 is likely to be maintained only for a short period. Modern communications will mitigate but not remove such stress.

Anxiety and aftermath

The other aspect of crew reaction is the aftermath of an incident. The effects of Post Traumatic Stress Syndrome on any individual are unpredictable, as is their required period of recovery. In extreme cases there may never be full recovery, especially where psychological shock is combined with physical disablement. This is another instance in which ISPS more or less says “we know they are coming to get you”, but says nothing about when they do.

A final point about ISPS as a protective shield against ISIS (or any other terrorists) is that when it was written nobody ever considered that drones would be fairly ubiquitous by 2016. They present a new type and level of threat.

A forthcoming sequel to the OnboardOnline article about drone operations posted on 25th November 2015 will address the subject of defence against drones.

That we now live in a new age of small terror is beyond question. The ISIS terrorist attack in Jakarta occurred two days before this article was written and by the time it is posted it is likely that it will already be out of date: ISIS or one its imitators will have struck again, in Europe or elsewhere, claiming one more or several more or many more victims of modern terrorism. Our only choice is to keep calm and carry on.

This article raises many questions about security which are related to, but not addressed by, the ISPS Code.

It is apparent that ISPS is not going to protect us in all circumstances. The only comfort about small terror is the low probability factor for any one of us being affected. Further, it is possible to be pro-active in preparing for occasion when the risk level increases or a terrorist incident occurs. When the octopus strikes and a tentacle is lashing around in your vicinity, a little extra training may save lives.

Drawing from the points made above, as a ready-made template for training beyond compliance, an Aide-mémoire will follow, prepared in collaboration with security specialists Securewest International.

It is intended to provide guidelines for both crew and shore support personnel in and around yachts, going to and from yachts, or between other places of employment. It will also serve as a record of the intent to go beyond basic compliance with duty of care – the first line of defence against liability.

*Image credits: Commons Wikimedia Wikimedia Wikipedia Wikipedia Shutterstock Flickr/Pixabay