Protection against terrorist threats

The Conservatives committed to improving the safety and security of public venues in their 2019 manifesto. This has culminated in the publication of proposals on a new “protect duty”, which could affect a significant proportion of commercial property owners, operators and occupiers. The government’s aspiration is that the implementation of these proposals will create a legal framework to enhance the protection of “publicly accessible locations” in the UK from terrorist attack and ensure organisational preparedness.

Any party that falls within the ambit of the new duty could soon be required by law to consider the adequacy of security measures, systems and processes adopted at their sites and take steps to mitigate any perceived risks.

In a consultation (running until 2 July) which is open to the public but primarily aimed at organisations, businesses, local and public authorities and others who own or operate publicly accessible locations, the government is inviting responses and comment from those affected. Views are being sought on:

who the new duty should apply to
what measures will be required
how compliance should work.

What are publicly accessible locations?

A “publicly accessible location” is defined as any place to which the public or any section of the public has access as of right (on payment or otherwise) or under express or implied permissions. They would therefore extend to a wide variety of everyday locations, including:

retail stores and high streets
shopping centres and markets
pubs, bars and clubs
sports stadiums
festival sites and music venues
parks, beaches, public squares and other open spaces
schools and universities
medical centres and hospitals.

It is proposed the duty would apply to:

(i) owners or operators of publicly accessible venues with a capacity of 100 or more, or temporary event locations within defined boundaries

(ii) large organisations employing 250 staff or more that operate at publicly accessible locations, including organisations with a number of outlets, with a capacity of 100 or less, across a wide geographical footprint, where there is significant and/or regular public footfall on a routine or daily basis (eg shops, supermarkets and petrol stations)

(iii) public spaces where boundaries are undefined (eg public parks and squares).

What might the duty requirements be?

For public venues and large organisations, the government considers that owners and operators should be required to:

use available government information and guidance to consider terrorist threats to the public and staff at locations they own or operate
assess the potential impact of these risks across their functions and locations, and through their systems and processes
consider and take forward “reasonably practicable” protective security and organisational preparedness measures, which could involve , for example, staff training and planning for how to react in the event of an attack.

The consultation document helpfully includes some best practice examples of security considerations and mitigations at different types of organisations, to demonstrate that the threat and risk impacts have been considered and proportionate mitigations investigated and implemented, or at least plans put in place for implementation.

Since 2017, many organisations will already have undertaken a risk assessment and have procedures in place. Others may currently be undertaking significant work as a result of the pandemic and will be considering the adequacy of their existing systems, processes and measures in that context.

The government says it wants to ensure the duty does not impose unreasonable or disproportionate costs or burdens on staff resource or time. That said, cost implications will vary depending on factors such as the location and the nature of the venues affected. Proportionate security measures for some larger organisations or venues carrying greater or more complex risks may need to be more sophisticated. As those measures will entail financial cost to plan, design and implement, a reasonable time ought properly to be allowed to plan and progress such measures within a business.

How might compliance be evidenced?

The most efficient way of demonstrating compliance is through risk assessments, which would specify:

the range of threats considered
the steps taken to mitigate the threats
the steps taken to prepare for and/or respond in the event of attack
if steps have not been taken, why.

The assessments would need to be recorded and retained by venues and organisers and reviewed periodically to respond to changes.

An inspection regime (assessed remotely or by a third-party agency) would be required to oversee compliance, using evidence-based risk assessments. In practice, this could involve providing completion certificates for staff training courses or evidence of installation of physical security measures, such as door locks and roller shutters.

The government envisages that any inspection regime could also offer an opportunity to provide specific support to a duty holder and advice to help them improve protection and preparedness.

How might compliance be enforced?

The development of an enforcement model with penalties primarily based on civil rather than criminal sanctions (so fines versus imprisonment) is considered to be better suited, as the government’s stated aim is to foster and encourage a culture of effective organisational security. Any such enforcement regime should also give inspectors the capacity to provide advice and guidance and appropriate mitigation, as well as scope to request necessary improvements.

Will the proposals be well received?

Robert Gardener, Hogan Lovells’ director of government affairs, believes that on balance the proposals will be welcomed: “From a policy perspective, there is broad agreement for legislation in this area. There is little doubt that improved measures will help to keep the public safe, but there is also a strong political driver behind this move.

“Security experts have warned about the ‘siege mentality’ of responding to the threat of terrorism; the denying of liberty and the spreading of fear is actually doing the job of the terrorists for them. The government is alive to this and is keen to embed preventative measures in much more of a steady state and unnoticeable way: protection without detection. That is why venues need to be part of the approach, and that is why parliament is unlikely to resist the draft legislation.”

Anita Zacharias is counsel at Hogan Lovells LLP