Terrorist Use of Drones in the United Kingdom

Executive Summary

With the proliferation of the small drones market globally, and the increasing attention drawn to the disruption they can cause when used inappropriately, there is widely held concern that terrorists will seek to use a drone in an attack in the UK. A terrorist could use a drone as an air-borne improvised explosive device (IED) or as a delivery mechanism for an IED, and an airborne capability would circumvent traditional on-the-ground protective security measures. However, the payload capability of small drones in the UK is currently relatively small and any device attached to a drone is unlikely to cause significant property damage or harm to life. Such an attack would, however, have a psychological impact on the public and likely cause disruption to, and around, the target which may include businesses. The use of a drone to disperse CBR material could have catastrophic consequences.

Purpose
This paper assesses how drones could be used as an attack methodology by terrorists in the UK and examines what the impact would be on Pool Re and its Members.

Key findings

1. 1. There is a strong possibility there will be at attempt to use a drone in a terrorist attack in the UK within the next two years.
   2. A drone could be used as an air-borne IED or as a delivery mechanism for an IED, but the methodology to have greatest impact on Pool Re and its Members would involve the dissemination of CBR materials.
   3. The most effective mitigation measure for the majority of businesses in the UK is being aware of all potential security threats, including the malicious use of drones, and having effective business continuity and contingency plans which can respond appropriately. For larger businesses, counter-drone technology may not be totally effective and may be better considered as part of a comprehensive mitigation plan.
   4. Given the small payload capabilities and the likelihood of a low sophistication attack over a more complex drone attack, terrorists using drones are not currently assessed to have a significant impact on Pool Re or its Members.
   5. Increased payloads and range of drones may increase this threat in the future.

Background
In the next decade, there are expected to be 76,000 drones in use across the United Kingdom. The drone market could add £42 billion to the UK’s GDP, and 628,000 jobs will involve working with the technology. The technology is transforming and evolving every six months at the same rate as the most popular mobile phones. Whilst much of the market is focused in the defence space, the commercial drones market is expected to triple between now and 2023 and the consumer market will occupy almost a quarter of the $100 billion market opportunity globally.

Drones can be bought with relative ease online or on the high street at little cost to the consumer. The cost continues to fall rapidly and the most popular drone on the market at the time of writing costs between £600 and £700. Small drones weigh less than 20kg and can fly for around 8km with a flight duration of 30 minutes, a maximum altitude of over 5000m above sea level and carry a payload of 2-4kg.

The use of drones in attacks by terrorist groups in Iraq and Syria since 2016 has been well documented and videos have emerged on their capabilities in theatre. Groups such as Daesh have been using drones for surveillance operations, battlefield damage assessment and dropping explosive devices in the Middle East over the last couple of years and have shown innovation in deploying, adapting existing or building their own drones. Islamist extremists are not the only actors to use drones and they are being used in a range of scenarios with a range of motivations; a drone has disrupted a football match by flying a controversial flag whilst hovering above the pitch, environmental activists have crashed a superman-shaped drone into a nuclear power plant, a drone has exploded over a military parade and contraband is frequently flown over fences and perimeters in prisons in the UK.

The proliferation of small drones globally, the development in technology and the decline in pricing is being met with both opportunity for growth and development, particularly in the construction, agriculture and insurance industries, but is also presenting as an emerging safety and security threat. With a range of actors taking advantage of the benefits of drone technology, it is notable that a terrorist actor has not yet used a drone in an attack in the UK or in the West. A drawing or sketch involving the use of a drone was reportedly found during an investigation into an attack plot, but there appears to be currently less intent and capability to use a drone over low sophistication attack Methodology such as bladed weapons and vehicles. This perceived lack of intent or capability has meant that the majority of drone incidents in the UK have fallen into the nuisance category.

Despite this, recent intelligence suggests it is a case of when, not if, a drone attack will take place in the UK and it is almost certain that we will see terrorists attempt an attack using drones in the West within the next two years. The technology is developing and there has been more interest in drones as an attack methodology since they have been used on the battlefield – the return of foreign fighters from the so-called Caliphate to the UK could result in a knowledge transfer of the technology to an urban environment. Drone disruption that has already taken place in the UK, such as at Gatwick Airport in December 2018, may also encourage attacks, particularly to cause economic disruption and damage (the economic cost was £50 million and flights were suspended for 30 hours).

However, the technology currently on the market and the small payloads that the most popular drones can hold would mean that any IED or blast associated with a drone attack would not cause significant damage to property. The associated BI loss could be higher than the property loss but is unlikely to have a great impact on Pool Re and its Members. The exception would be if the drone were carrying chemical or biological material.

Scale of Threat

Disruptive
On the battlefield in Iraq and Syria, drones are being used by Islamist groups in surveillance, reconnaissance, attack planning and battle damage assessment. Videos have been uploaded online showing the capability the terrorist group Daesh has in carrying out reconnaissance before an attack including tracking and targeting Western forces and their military vehicles. Drones have therefore enabled terrorist groups in the Middle East by giving them an airborne capability which prevents them from being disrupted before their attack.

However, the threat to the UK of a drone used in this way to enable an attack is not assessed to have any impact on the (re)insurance market. Although an airborne surveillance capability would allow a potential terrorist to access areas outside of standard physical security measures on the ground, it is unlikely to provide any further information to the imagery already available online by, for example, a satellite map provider such as Google Maps. Additionally, legislation is currently in place in the UK to prevent drones flying over towns and cities and therefore a drone is unlikely to be able to carry out surveillance for a long period of time before being disrupted by police, military or security capabilities.

It became evident in December 2018 that drones can cause severe disruption to the aviation industry due to safety regulations preventing an aircraft from flying if a drone has been sighted in the vicinity. There is a potential for non-damage business interruption claims in a similar scenario if certified as a terrorist attack, however the perpetrator would have to be identified and subsequently investigated for terrorist motivations. The intention of terrorist groups to cause mass casualty attacks still outweighs the desire to cause economic damage to the UK and it is therefore unlikely this would currently be used as an attack methodology.

It is unlikely a drone will be used to disrupt any other target type outside of the aviation industry as there would be limited damage to property or harm to life. The sighting or hovering of a drone in a crowded place is unlikely to result in a police cordon around an area; instead the police will seek to find the pilot whilst instructing the public to move away from the area directly underneath the drone. Businesses are only likely to be affected in the immediate term if a disruptive drone causes significant panic and consequent casualties. The advice and reaction would be the same for any drone sighting regardless of the motivation of the pilot.

Destructive
Using a drone as an air-borne IED (ABIED) or as a delivery mechanism for an IED has not only been seen in the Middle East but also in countries outside of theatre, including Saudi Arabia and Venezuela. A recent reported assassination attempt on President Maduro by two exploding drones has raised questions on the possibility of a similar attack happening in the UK.

Drones which are currently sold in the UK can carry a payload of 2-4kg on average and travel a distance of 8km. The most popular drones on the market carry less than 2kg (see Appendix A). Attaching an IED to a drone is effectively an alternative method of delivery to the more conventional backpack or suicide device and the incident in Venezuela appears to prove it within the capabilities of nefarious actors. It greatly expands the target selection for a terrorist group beyond traditional on-the-ground locations and while protective security is improving at ground level, the vulnerability of the skies above presents an alternative method of delivering an IED attack.

The trend in IED size in the UK has been between 400g and 10kg of explosives with Triacetone Triperoxide (TATP) being the most popular precursor due to the ease with which it can be made using commercially available chemicals and instructions available online. Military-grade explosives such as C4 or plastic explosives are very difficult to obtain in the UK and are normally protected by explosive restrictions and regulations on their purchase and use. An IED attached to the most popular drone with the heaviest payload in the UK (DJI Inspire 2) could therefore weigh up to 1.5kg. In context, the Manchester Arena device weighed ‘tens of kilograms’, the Parsons Green device was made with 400g of TATP and packed with over 2kg of shrapnel and each rucksack in the 2005 London tube bombings was made of 2-5kg of high explosives.

Whilst it is within the conventional capability of a terrorist actor in the UK to construct an IED (Manchester Arena and Parsons Green as recent examples), it remains difficult and the likelihood of being detected by police and MI5 is high, regardless of the method of delivery. On building a successful IED it is more likely a terrorist will seek to get as close to the target as possible rather than attach the IED to a drone, where accurately and successfully reaching the target location is more difficult. A device weighing 1.5kg would have less damaging effects if detonated in the air where the blast risks being fragmented. The incident in Venezuela shows that there was little damage caused by 1kg of military grade explosive C4 on a drone and in comparison, TATP is a particularly unstable and flammable explosive, as seen in the premature explosion in Barcelona. It is unlikely to cause significant property damage in the UK due to the small size of the IED, although a police cordon would likely be set up to clear any debris and preserve and secure evidence of the device, potentially causing short term denial of access to businesses.

Additional technical skills would be required to build in a delivery mechanism to programme the drone to drop an IED at the intended target at a specific moment in time, although returning fighters from the so-called Caliphate who have had experience using drones in this way could potentially bring back the necessary knowledge learned on the battlefield.

The complications and difficulties in building and then flying an IED on a drone means that it is currently assessed to be unlikely this methodology will replace less sophisticated methods of attack, or more conventional delivery mechanisms of an IED, in the near future.

Chemical, Biological, Radiological (CBR)

The most destructive methodology in the UK would be if a terrorist actor used a drone to disseminate chemical, biological or radiological material. The use of CBR material in any circumstance could cause a significant amount of damage within a very short period of time. This is assessed to be of low probability but with high impact against all target types.

Increasingly larger models of agricultural drones are coming to market which can now carry liquid payloads of up to 50kg.  The DJI AGRAS MG-1, for example, can carry up to 10kg of liquid and can cover an area of 4,000-6,000 metres squared in 10 minutes. DJI advertises the drone’s ease of use, whether manually by the pilot or automatically along a pre-planned route. The technical abilities of this drone, when it is released, have caused concern amongst security professionals.

If the primary aim of a terrorist actor was to inflict maximum casualties, then chemical and radiological agents are unlikely to be their first choice. Large-scale casualties require significant quantities of a lethal agent which remain a significant challenge to acquire and deploy. Similarly, radiological material, even if dispersed with explosives, is unlikely to have a mass-fatality effect. The toxicity, transmissibility and latency of biological agents make them the only significant mass-effect agent, but there are significant barriers to the acquisition and weaponisation of the material. If the aim was to cause shock, fear and panic and to demonstrate a capability, then a low latency chemical agent would be more attractive. In this respect, any material or liquid dropped from above would have the result of causing fear and panic, including a hoax.

A chemical attack in the UK is considered to be inevitable, although manufacturing a CBR device is complex and risky. Such an incident would cause considerable business interruption and there would likely be an extended police cordon erected in all areas deemed to have been affected by the attack. The material or substance would need to be determined and depending on its nature the decontamination could take an extended period of time. The small, localised event in Salisbury left some businesses closed for months, and one for over a year.

Increase in threat

The current capabilities of popular drones in the market have been considered in this analysis, although if drone technology advances to be able to carry significantly larger payloads in the future and the barrier to entry for terrorists was lower, the threat could increase.

Mitigation Measures

As the threat of drones emerges and further incidents occur around the world, security professionals and businesses are looking into mitigation measures they can employ to protect themselves. Mitigation measures on the market currently include technology which can either detect a drone or affect a drone, although the latter is only available to the authorities.

However, counter-drone technology at the time of writing is considered to be only 50% effective at best and recommended as a last resort when considering the protective security of a business. Instead, businesses should look at raising awareness of the threat and response structures. Making your staff aware of how to identify, report and react to a drone sighting and having business continuity and crisis management procedures in place to support them is the best form of mitigation. 99% of businesses in the United Kingdom are small and medium enterprises, employing fewer than 250 people, many with single office locations. It is not expected that, when conducting risk assessments, businesses are looking at the threat of drones or looking to install counter-drone mitigation measures which may be both costly and disproportionate. Security budgets have rightly focused on measures to mitigate against the most likely current methodology (knives, vehicles and small IEDs).

For large businesses, critical national infrastructure, or industries where drones pose a threat to safety and security, counter drone technology is an option and is a market that has expanded rapidly over recent years. Counter-drone technology was deployed at Gatwick Airport in December 2018 and is reported to have cost the airport £5 million. However, it is important to be aware that there is not one system that meets all requirements and organisations are advised to contact CPNI before purchasing any systems (See Table 1 for current counter-drone technology abilities and shortfalls). It can be ineffective in urban environments and operator intensive. There are other ways of mitigating against drones which do not require expensive technological solutions; some critical national infrastructure buildings, such as power stations, are secure by design and built to withstand the impact of light aircraft, so the impact of a drone would be limited. The retail sector uses awareness as mitigation and more conventional measures such as secure glass and glazing to withstand any blast.

Table 1 – Counter Drone Technology abilities and shortfalls

There are ongoing Government initiatives to publish both a national drone strategy and a counter-drone technology standard, and work is being carried out in conjunction with industry to develop counter-drone technology for use both overseas in a military capability but also within the UK.

Legislation

Whilst in the United States the Federal Aviation Administration (FAA) mandates the registration of drones weighing more than 250g flown for any purpose, there is currently no legislation in the UK to enforce the registration of drones or drone users.