The targeting of hotels by terrorist organizations is not a new phenomenon but certainly a growing one. Hotels are often seen as soft targets, having wide-open environments with multiple entrances and a constant flow of guests, visitors, staff and delivery people. Hotels are also easily subject to pre-attack reconnaissance, with floor plans, photos and panoramic video clips of public areas often available over the Internet as part of marketing efforts and with co-located restaurants and shops open to the general public. In addition, hotels that are associated with western countries and that host foreign dignitaries and western guests are most at risk to be targeted by terrorist organizations throughout the world. Between 1970 and January 2016, more than 160 terrorist attacks have taken place at hotels around the world. Of these, approximately 80 percent involved explosive devices only (e.g., bombs, including car bombs and suicide bombers) and 16 percent involved attacks by gunmen (whether or not their attack also involved explosive devices). In the last five years alone, more than 40 hotel terrorist attacks have occurred.
Over time the motivation behind hotel attacks has changed. In the 1970s and 1980s, leftist and ethnic-separatist terrorist groups were prevalent, while today's threats arise from a more complex organization of sub-national groups driven by ideological, religious, political and economic motivations. The attack strategies have evolved not only to meet the new goals but also to address the defenses that have been incorporated by the industry.
The leftist and separatist terrorist groups in the 1970s and 1980s typically sought to minimize civilian casualties. For instance, it was common for terrorists to provide advance notification before an attack so that innocent bystanders could be evacuated. Today, no such advance notifications are provided as maximum civilian and law enforcement casualties are sought, along with economic disruption, to create as much chaos as possible. Additionally, the terrorist attacks at hotels now generally do not involve attempts by the terrorists to participate in negotiations or discussions relating to a peaceful resolution of the attack but instead often involve suicide missions by the terrorists.
1 Stephen Tibbles is a former police officer with the London Metropolitan Police Counter Terrorism Command and has extensive experience providing counterterrorism physical security advice and delivering counterterrorism awareness training to internationally renowned hotels in the United Kingdom and other regions of the world and to other high-profile sites.
The number of major terrorist attacks against hotels around the world more than doubled in the eight years following September 11, 2001, as compared to the eight years before--from 30 attacks to 62--while the number of countries affected jumped from 15 to 20. Meanwhile, the toll of persons killed and injured in such attacks increased roughly six-fold during this period. Certain western hotel chains have been targeted numerous times since September 11, 2001. Additionally, as hotels worldwide hardened their perimeter defenses with armed guards, check points, vehicle barricades, x-ray machines, magnetometers and similar security devices, terrorists have adapted their attacks to account for and bypass these security measures.
Potential litigation related to terrorist or other "mass" attacks will generally take the form of a negligence suit. Plaintiff victims generally allege: first, that the defendant owed a duty to the victims to have adequate security measures; second, that the defendant Hotel owner/operator breached that duty; and finally, that this breach is what allowed the attack to take place and caused the resulting harm. Other cases have alleged negligence based on a failure to warn potential victims once an attack has commenced, as opposed to a failure to have adequate security measures.
The Hotel Owner/Operator Defence
Defendants in these cases have generally asked for the lawsuits to be dismissed, arguing:
1. They did not owe a duty to the victims to either provide security or warn potential victims;
2. The duty to provide security did not reach so far as to include a duty to guard against these sorts of unforeseeable attacks; and
3. That any action or lack of action on the defendants' part did not cause the resulting harm.
The third argument, related to causation, has been the most successful for facility owners in recent litigation related to mass shooting attacks.
Facts of the Matter
Negligent security cases that advance past the summary judgment stage typically involve special facts indicating that the defendant could or did reasonably foresee the attack. For example, in a lawsuit related to the 1993 World Trade Center bombing, the court denied summary judgment to the Port Authority of New York and New Jersey in large part because the Port Authority had previously conducted security threat assessments that specifically identified the risk of a vehicle bomb placed in the underground parking garage (which is precisely what happened) and had received an intelligence report from the FBI one month before the bombing indicating that there had been a threat to blow up a major office building in New York.2 The court found that, unlike other cases in which the attacks were found unforeseeable, in this instance, the Port Authority had "disregard[ed] its own knowledge about the likelihood of criminal activity and the warnings of its own security experts."3 At trial, the Port Authority was ultimately held liable for 68 percent of the damages.4
Failure to Warn
Other similar cases have alleged liability based on a negligent failure to warn potential victims, as opposed to a failure to provide adequate security. Following a 2007 shooting at Virginia Tech, families of two victims sued the university for wrongful death, alleging that it had negligently failed to warn students of the danger on campus after the shooting commenced.5 Following a jury verdict in favor of the plaintiff families, the Virginia Supreme Court reversed this decision, holding that the university had no duty to warn students in this instance because, at the time they became aware of the shooting, university officials believed that the shooting was merely a "domestic incident" and so believed that the shooter "posed no danger to others."6
Accordingly, the terrorism risk to the hotel industry is ever increasing. As it continues to increase, it creates more difficulty for the industry to argue that such attacks are not foreseeable nor, should such attacks occur, that additional preemptive defensive actions weren't necessary, reasonable or appropriate under the circumstances.
The battle lines are blurry, which makes the task ever more challenging. What are the risks that should be addressed in your hotel in your location?