Revisiting the Yemen bomb plot of 2010

blog_070316This CBRA blog revisits the Yemen bomb plot from 2010, the most decisive turning point in modern air cargo security. More than five years after the events, this blog discusses the plot’s implications to the contemporary air cargo security and outlines CBRA’s recommendations for future security work. Parts of this blog text have already been published in the doctoral thesis of CBRA researcher Toni Männistö.

Two explosive devices aboard passenger planes: The series of events, that we call the Yemen bomb plot, took place on 29 October in 2010. On that day, al-Qaeda terrorists almost destroyed two passenger airplanes with a pair of express courier parcels, each enclosing plastic explosives hidden inside a printer toner cartridge. The explosive parcels where sent to Chicago from the capital of Yemen, Sana’a, via two different express courier operators.

Both parcel bombs were eventually intercepted and defused, without fatalities or injuries. But before the interception, the bombs had already travelled onboard multiple air freighters and passenger planes. Many people flew that day with a fully functional explosive device under their seat! Though the parcels were addressed to Chicago, officials think that terrorists wanted to detonate the bombs mid-air, just before landing using cell phone timer alarms.

A Lockerbie-style mayhem was slightly avoided, largely thanks to a timely piece of intelligence. The bomb plot started to uncover when a suspected double agent tipped Saudi-Arabian intelligence that al-Qaeda terrorists had shipped two parcel bombs from Yemen to the US via the express courier service. The Saudi intelligence forwarded the tracking numbers of the suspected explosive devices to their US and German colleagues and told them to look for printer toner cartridges.

The first parcel was intercepted in Dubai, and the second one at the East Midlands airport, nearly 200 km to the northwest from London. In the UK, a bomb squad did not first recognize anything suspicious when they screened the suspected parcel. “It looked like a printer cartridge – there were no wires or anything,” one of CBRA’s contacts at World Customs Organization (WCO) recounts. “But of course, what the cartridge did contain was explosive that current technologies couldn’t detect.” Later laboratory tests revealed that each parcel contained 300 to 400 grams of PETN, military grade plastic explosive, wirings, and a detonator hidden inside a printer’s toner cartridge. The bombs were so meticulously concealed that they had not only passed the standard air cargo and safety screening but also the special screening of the bomb squad.

Aftermaths: The Yemen incident was rude reminder of the vulnerability of the air cargo logistics to terrorism. Sure, the day was saved by old-school, field intelligence work and prompt government response. But before interception, the first parcel travelled aboard three different flights: Sana’a – Dubai, Dubai – Cologne, and Cologne – East Midlands Airport. The second explosive parcel flew first from Sana’a to Doha and then to Dubai where it was intercepted.

In the immediate aftermaths of the events, aviation security authorities in the US and many European countries stopped accepting freight shipments from Yemen. Germany also cancelled all passenger flights from Yemen for more than two weeks. “As often happens in these situations,” the WCO’s air cargo specialist remarks, “the first reaction was stopping anything coming from this part of the world – any plane for any reason.” The new security rules changed the air cargo operations virtually overnight, seriously disrupting the air cargo and mail service. Delays were widespread and lengthy, but the worst aspect of the disruption was that no one knew when the new apparently transient security regime was to be revoked.

Eventually, once the precautionary stoppage was ended, new unprecedentedly stringent security requirements entered into force, disrupting the air cargo and mail service further. The US Transportation Security Administration, TSA, introduced the most stringent rules: any mail originating or transiting through Somalia or Yemen was banned, as well as printers or printer toner cartridges from high-risk locations. Moreover, parcels originating from any business partners had to be screened up to high-risk screening standards, piece by piece, if such shipment did not accompany a tendering statement, a document assuring that cargo comes from a known and trusted shipper. The new regime disrupted seriously international air cargo logistics, causing air cargo shippers worldwide to accumulate huge backlogs of US-bound shipments. Annoyed and surprised about the turn of events, the air cargo industry reacted to the US rules with a barrage of criticism, calling the measures superfluous and impractical. Over the following weeks, the reactive security rules were gradually relaxed to enable clearing of the backlog of US-bound air cargo.

In the long term, the Yemen events put air cargo security into a spotlight, securing political commitment and spurring further reforms for years to come. The International Civil Aviation Organization, ICAO, for example, included advanced security, concepts such as the “secure supply chain” principle, the concept of high-risk cargo and mail, and the consignment security declaration, CSD, into the new edition of the Annex 17 of the Chicago Convention. Also the European Union expanded the EU air cargo regime to cover airlines operating into the EU aviation security area – EU-28 plus Switzerland, Norway and Iceland – from third country airports. The amendment also specified criteria for identifying and screening high-risk cargo and mail, known as HRCM.

CBRA considerations for future air cargo security: The modern air cargo security has taken major leaps since the Yemen incident, but the work towards higher air cargo security still continues. The CBRA research team considers that, like in any other area of supply chains, it is crucial both to facilitate cross-border logistics and to ensure adequate security. This classic dilemma of striking the balance between trade facilitation and supply chain security is not easy to solve, but we believe that there are some promising ways to promote logistics-friendly air cargo security.

Governments should normally consult the air cargo industry before introducing new security rules. New security rules should avoid reducing speed, on-time reliability, or cost-efficiency of the air cargo service. There are often ways to integrate new security requirements seamlessly into the sequence of day-to-day logistics activities, but this requires close government-business coordination.

One promising way forward is to improve capabilities of pre-loading risk assessment, so that the riskiest air cargo shipments can be identified early on and subjected to a more stringent screening. Many projects on this matter are under way, most notably the Air Cargo Advance Screening (ACAS) in the US and Pre-loading Consignment Information for Secure Entry
 (PRECISE) in the European Union. The CBRA team applauds these efforts of advancing risk assessment and reminds of the importance of proactive updating of risk-scoring algorithms.

EU’s decision of forcing flights from third countries into EU to comply with EU’s air cargo security regime makes also good sense. It is reasonable to secure air cargo up to an adequate standard sooner rather than later, preferably before the first flight. More global capacity building – especially training and funds for modern screening equipment – are needed in developing countries. Also, auditing activities in third countries would benefit from further resources.

Harmonization and mutual recognition is another key theme for years to come. In the EU, civil aviation and customs authorities might find some synergies if they harmonized their respective Known Consignor (KC) and Authorized Economic Operator (AEO) programs. Air cargo companies would also benefit if types and performance requirements of screening methods would be uniform across the members of the European Union.

Bibliography:

BBC, Q&A: Air freight bomb plot, 2 November 2010

European Commission, Regulation 173/2012, amending 185/2010

International Civil Aviation Organization, Chicago convention, Annex 17, 9th edition

Koolloos M.F.J., Männistö T., van der Jagt O.C., Jezierska M.M., Hintsa J., Kähäri P. and Tsikolenko V. (2015), Security Screening for the Air Express Cargo Industry, Final Report, Brussels, Belgium.

Männistö, T., 2015. Mitigating Crime and Security Risks in the International Logistics Network: the Case of Swiss Post. Doctoral thesis, École Polytechnique Fédérale de Lausanne (EPFL).

CBRA Blog by Dr. Toni Männistö

CEN Supply Chain Security — Good Practice Guide for Small and Medium Sized Operators, 2012 (CORE1030)

Summary: This is a guidance document for small and medium sized enterprises, SMEs. on how to apply a supply chain security approach to their operations in order to mitigate the risk of criminal activities. It gives an overview of the main crime types occurring in the supply chain along with some countermeasures, as well as the supply chain security initiatives, and the compliance requirements thereof. The document is available for purchase e.g. at:   http://shop.bsigroup.com/ProductDetail/?pid=000000000030258778  (link tested on 3 March 2016)

[s2If is_user_logged_in()]

Full review: The recommended supply chain strategy rests on a six-step approach. The first step is to define a context for the supply chain, crime prevention and security management activities taking into consideration the security sensitiveness, the geography and transport modes, and the main stakeholders involved in the supply chain operation. The second step is to make a threat and vulnerability analysis with regard to terrorist and other criminal threats in the supply chain. The main criteria included are the gaps existing in enhanced security, the high-risk crime types, and the potential consequences of crime occurrences. The third step covers the regulatory framework, the major aspects being the regulations and programs required for successful business operations, expectations of customers and suppliers, requirements laid down by insurance providers, and relevant government authorities. The fourth step refers to an overall security plan, taking into account the physical security, data security, human resources security (including selection, training, and exit procedures), business partner security (including selection, and auditing), and process control and monitoring of deviations. The fifth step involves implementing into practice concrete security measures, investment in technologies, procurement of services, in-house solutions and so forth. The final step is to monitor and measure the security performance and take appropriate corrective actions.

Five supply chain crime types have been elucidated in this guide. These include:  Property theft (cargo theft, intellectual property breaches); targeted damage (terrorism, sabotage); cross-border duty and tax fraud; illegitimate transporting, exporting and/or importing (smuggling of prohibited and restricted goods, people smuggling); and crime facilitation (document forgery, bogus companies, cybercrime). For each crime type, the main focus should be on the issue (main features and typical sectors/products involved), scope of the problem and actions to mitigate risks.

This guidebook has chosen eight security initiatives for illustration purposes. It explains the context of each initiative, whom it is meant for, and some basic requirements and the implications. These are as follows:

  • Import Control System (ICS) in the EU (a systems tool meant for the lodging and processing of Entry Summary Declarations, and for the exchange of messages across national customs agencies, economic operators and the European Commission).
  • Export Control System (ECS) in the EU (introduces EU procedures to computerize and control indirect exports and to implement the EU safety and security regulations);
  • Maritime Security Legislation, International Ship and Port Facility Security (ISPS) Code in the EU (International regulations to ensure the security of maritime transportation are being issued by the International Maritime Organization, IMO, in the International Ship and Port Facility Security Code);
  • Aviation Security Legislation, Air Cargo Supply Chains in the EU (three categories of aviation security legislation exist in the EU- Framework regulation, supplementing regulations, and implementing regulations-all targeted towards civil aviation security).
  • European Union Authorized Economic Operator, EU AEO (operators involved in international trade of goods certified as complying with WCO or equivalent supply chain security standards);
  • Regulated agent, Known consignor and Account consignor in the EU (Specific “trusted trader” status existing in the European air cargo supply chains);
  • ISO 28000 Series of Standards on Supply Chain Security Management Systems (address potential security issues at all stages of the supply process, e.g. terrorism, fraud and piracy);
  • Transported Asset Protection Association (TAPA) in Europe (fighting cargo crime using real-time intelligence and the latest preventative measures).

CORE1030

[/s2If]