To many, the threat of a chemical, biological, radiological or nuclear (CBRN) attack is informed by Hollywood movies and the occasional news report from Ukraine or Iran. Actual incidents, thankfully, remain few and far between, and in many cases are a result of direct state involvement. For example, the poisoning attempt in Salisbury or the successful assassination of Kim Jong-Un’s half-brother in Kuala Lumpur.
That said, our research shows broad terrorist intent to use CBRN material. And while such plots are infrequent, they do garner press interest because of the very mystery and intrigue they trigger within the general public. Much of the reporting can be unhelpful, with descriptors of a certain quantity of material commonly measured in “teaspoons” or “having the ability to kill X% of a population,” with little nuance on how that might be practically achieved.
This type of reporting presents a challenge for the insurance industry. How to sensibly communicate CBRN risks and support clients in their risk management solutions?
Access to the facts from credible, well researched sources is the first step.
See also: Growing Number of Uninsurable Risks
CBRN incidents January to June 2023
As malicious risk advisers, the team at CHC Global undertake a six-monthly CBRN Risk Report. The latest edition, covering January to June 2023, identified two late-stage plots that were foiled in Europe and one high-profile death threat reported in the U.S. During this period, CBRN concerns driven by geopolitical maneuvering continued to feature in mainstream media, primarily due to Russian and North Korean activity. But the tangible use of CBRN appeared to be more likely at a sub-state, decentralized level.
This trend is aligned with the broader commentary around terrorism threats in the advanced economies, where risk of detection and interception by intelligence and security forces has very much reduced the possibility of larger groups organizing and initiating attacks. Key terror risks are now really confined to lone actors, many of them self-radicalized, seeking to conduct low-level attacks using whatever means are readily available to them.
In the same period in Germany, police arrested an Iranian man in the city of Castrop-Rauxel for allegedly plotting an “Islamist-motivated” attack using cyanide and ricin. The man’s brother was also arrested in connection with the plot. It transpired that no poison was discovered at the man’s residence, and reports made no mention of any viable method for producing or acquiring cyanide or ricin. It is unclear how far the alleged plot had developed, but police did seize electronic devices while searching the suspect’s residence. Following this, authorities stated they believed action needed to be taken as soon as possible. Ricin is a highly potent toxin that can be lethal if injected into a person’s bloodstream, inhaled or ingested. According to the U.S. Centers for Disease Control and Prevention (CDC), testing indicates that a dose as small as three milligrams of inhaled ricin can kill an adult.
Athens police, with assistance from Israeli national intelligence agency Mossad, arrested two Pakistani nationals, reportedly foiling a plot to conduct a mass-casualty attack on Israeli and Jewish targets in the city. Police stated that a planned attack was imminent, and an unnamed Greek official revealed that one target of the plot is believed to have been a chabad house (Jewish community center). Israeli National News reported that the individual who led the planning of the plot, based in Iran, had attempted to source “poison gas” that was intended to flood the target site with noxious fumes and harm as many people as possible.
Insurance considerations and CBRN Risk
Balanced reporting of the facts will support the insurance industry to sensibly communicate CBRN risks to their clients. But how to support clients in their risk management solutions?
The inclusion of CBRN cover in terrorism insurance policies can vary, depending on the insurer and the specific policy wording. In the U.K., terrorism insurance typically covers damage or losses resulting from acts of terrorism as defined in the Terrorism Act 2000. Given that the consequences of a large event could result in the loss of many billions, the majority of cover in the U.K. is reinsured through Pool Re, though CBRN policies are offered outside this state-backed scheme.
While the CBRN perils tend to be grouped for convenience, the specific nature of the materials, their damaging effects and the potential longer-term consequences on people, property and business operations vary significantly. A hazardous chemical gas, such as chlorine, can disperse in a few hours and is unlikely to require any active decontamination. Conversely, a dispersed radionuclide, such as caesium-137, can continue to pose a health hazard for decades, with costs accumulating rapidly – for decontamination, building demolition, hazardous waste removal and rebuilding.
A further complication in these highly technical risk management processes is the impact on both public perception and political leadership. While response to an event will be initially governed by operational scientific and medical advice, progress of the hazard and risk management processes will inevitably be influenced by how the wider public reacts to the reported news – and how political decision makers choose to resolve the situation.
The consequence is that the ability of an insured party and their underwriters to influence the timings and nature of issue resolution and return to normality is somewhat out of their hands. In spite of a whole range of decontamination activities, one of the commercial properties affected by anthrax after the 2001 "Amerithrax" attack remain unoccupied for years. This was not because of any detected residual hazard but simply that no insurer would offer employee liability cover. And as we saw in the Salisbury Novichok event, some properties were cordoned off for over a year.
See also: How to Plan for Armed Intruders
Low-probability, high-impact events
The insurance industry must put into context that the likelihood of a CBRN attack might be low, but the impact is high and potentially catastrophic for organizations and people. We only have to look to COVID-19 to see how quickly a biological attack could affect organizations and individuals worldwide.
In this context, insurers should ensure they have access to credible information sources about the realistic threats a CBRN attack might present. And then highlight to their clients the potential threats and impact these types of attacks could have on operations, employees and claims – so organizations can take the necessary steps to manage their risk.
