8 min read · Written by Grant Rayner on 03 Jul 2023
Share by emailThis essay was originally published in Dangerous Travels on 03 Jul 2023 and was updated on 28 Jan 2024
I’m currently finishing up the Quick Reference Guide to Planning for Higher-Risk Destinations. The guide is complete. I’m just waiting on an ISBN to be issued so I can formally publish.
Building on some of the material in this guide, I thought it might be useful to walk through a process of assessing risks at your destination.
Once of the challenges with assessing risks is that we tend to rely on government travel advisories. These advisories are necessarily conservative and generic, and can’t provide a granular assessment of the risks. More importantly, they don’t provide an accurate picture of the risks to you based on your specific travel plans. That said, government travel advisories have gotten better over the years and are a useful start point for planning travel and for gaining a high-level appreciation for risk. But they’re not enough.
If you’re a corporate traveller, your organisation might subscribe to risk information provided by a security company. As with government advisories, these are useful but tend to be generic. Most of these assessments are high level and they tend to focus on capital cities. That’s sufficient for most travellers, but it may not be sufficient for those of us looking to travel further afield. The truth is that it’s impossible for these assessments to consider every aspect of risk. As some of you reading this will know, there’s no guarantee the analysts writing the reports have even been to the country they’re writing about.
One of the challenges you’ll face reading these assessments is making practical use of risk ratings. If the risk from terrorism in a country is ‘high’, what does that mean for you as a traveller? What actions should you be doing differently in a country where the risk from crime is ‘high’ vs a country where the risk from crime is ‘medium’? Does a risk of ‘low’ for civil unrest mean that civil unrest won’t happen and you don’t need to take precautions?
As travellers, we need a pragmatic way to assess risk that allows us to review these assessments and other publicly available information, and then apply what we’ve learned to implement meaningful actions that enable us to mitigate those risks. The key to doing this successfully is to avoid abstractions such as risk ratings and analyse risks in a way that is relative to our travel plans.
So, let’s explore a more practical approach to assessing risk that not only informs our decision to travel, but also guides on other key travel decisions, such where we stay, the places we visit, and how we move around.
The first step in the process is to establish the existence of threat groups.
Are there terrorist groups? Are there criminal gangs? Et cetera.
The presence of threat groups is a strong indicator of a potential threat. If you identify threat groups, that’s a clear sign to dig a bit deeper and qualify the threat that these groups may pose to you as a traveller based on your intended travel plans.
For most countries, it’s relatively easy to determine whether threat groups exist. You can find this information in government travel advisories.
Of course, just because a threat group exists in a country, doesn’t mean it’s a threat to you.
Let’s go a level deeper.
One of the key aspects of rationalising threats is to realise that most countries are large, and threat groups don’t (and can’t) operate everywhere.
In your initial research, identify where these threat groups are based. These are probably areas that you should avoid. If you go there, you’d be asking for trouble. As I write this, I’m thinking of Jolo in the Philippines as one example.
Next, identify the reach of threat groups. Where have they been known to have conducted operations in the past? They may have operatives or informants in these locations. Past operational activity, including reconnaissance as part of operational preparation, will ensure they’re familiar with the environment, enabling them to strike again. You may be at risk in these locations, but it’s hard to tell. Of course, it’s also possible that a threat group may target a location where they’ve never conducted an attack before. It’s probably a good time to remind you that we’re using heuristics to pare away at risk, and we’re not going to be coming up with a 100% solution.
It will be relatively easy to answer these questions using open source information. The answer to these questions will let you know if you’re able to avoid the risk entirely based on the locations you plan to visit, or whether you are entering territory where the threat group is known to operate.
Let’s dig deeper again by focusing on the activities of threat groups.
Once you have a sense of where the threat group operates, analyse their current level of activity.
Threat groups change over time in relation to external pressures and internal changes. Good examples of internal changes are changes in leadership and group dynamics (e.g., splintering or aligning with other groups).
A threat group that is under pressure by security forces may have dispersed and may be minimising their movements. Their supply chain may be under pressure, preventing them from sourcing weapons or explosives. Intensive electronic surveillance may force them to operate more manually, which will increase friction and slow momentum. Similarly, they may be riddled with informants, enabling security forces to be one step ahead at every turn. Alternatively, they may be operating with the support of some elements of the security forces and may be able to operate in the open.
Also consider the length of time the threat group has been operating. A group in it’s nascent stage may be aggressive and daring, seeking to make their mark. Another group may be tired and mostly defeated, or perhaps dormant. You’ll get a sense of the state of a threat group by analysing their recent activities and the frequency of attacks.
A threat group’s recent history of activity provides several useful pieces of information. First, the frequency of activity is significant. In the case of a terrorist group, a high level of activity suggests that the group is highly motivated and willing to take risks. It also indicates that the group may be well resourced because they’re not trying to conserve scarce resources for a single ‘spectacular’ attack. Perhaps of most concern, frequent attacks may indicate that the security forces do not have the situation under control.
How frequent is too frequent? It depends on the targets and your exposure to those types of locations. If the threat group is targeting police posts in a particular province once a week, as long as you avoid police posts, you’ll be safe. If they’re targeting international hotels, that’s a different matter entirely.
If we look at Indonesia in the 2000s, we’d see on paper a series of relatively infrequent attacks:
(Note that these are just the attacks likely to impact foreign travellers. There were a multitude of attacks in other locations in Indonesia during this period, including multiple attacks in Sulawesi. The Bali bombing in 2002 was preceded by coordinated bombings on Christmas Eve of 2000, where churches in Jakarta, Pekanbaru, Medan, Bandung, Batam Island, Mojokerto, Mataram, and Sukabumi were targeted.)
So, focusing on the period between 2002 and 2005, we see there there was one attack per year. Is that a lot? Having supported clients in Indonesia during this period, I can tell you that it sure seemed like a lot at the time. We were expecting more attacks. Fortunately, the Indonesian security services (with the support of their allies) were able to mount a highly successfully campaign to neutralise terrorist cells. Are more attacks possible in the future? Probably. Threat groups still operate in the country and radicalisation is still a problem in some areas. However, these groups fall into the category of being under intense pressure, limiting their capacity to conduct effective operations.
As you’re reviewing the recent history of activity, also consider the severity of incidents. The severity of an incident can be a factor of the resources placed to bear, for example a massive explosion killing dozens in a local market or a group of gunmen rampaging through a hotel. Effective planning and execution can also increase the severity of an attack. The Bali bombing in 2002 was particularly impactful due to the use of two explosive devices.
Severity can also relate to the consequences of an action. For example, there’s a huge difference in severity between being kidnapped by local criminal gang who are looking for a quick cash payout and ISIS, who will probably cut off your head.
Analysing the activities of threat groups is a useful activity, as it may provide insights into patterns and perhaps future intentions. Just remember that you’ll only be seeing observable activity. You won’t learn about other activities, such as reconnaissance and surveillance, sourcing weapons and explosives, or building and maintaining networks.
Now you understand where the group operates and what kind of things they’re involved in, the next step is to work out what that means to you as a traveller.
So what?
It’s important to remember that many threats exist in locations independently of travellers that come and go. Insurgencies, for example, have nothing to do with travellers—they’re entirely domestic affairs. Of course, there are other threats, such as scammers, which may specifically focus on travellers.
How do you assess whether threat groups are actually a threat to you?
First, determine whether the threat group has expressed an intention to harm foreigners. A group who wants to harm foreigners will typically be vocal about their intentions. Then, determine whether they’ve actually followed through on this threat? It’s one thing to say stuff online. It’s another thing entirely to actually do it. If you’re familiar with the threat model, you’ll understand the importance of assessing capability and intent of a threat group.
A threat group may be against all foreigners. Alternatively, the group may be against a select type of foreigner from a specific country or group of countries. Of course, the challenge for you as a traveller is that it’s difficult to identify exactly where someone is from from across the street. Also, there’s still the risk of being in the wrong place at the wrong time.
Once you’ve established a threat group’s intent to harm foreigners, you’ll need to consider what locations might you go to, or activities you might conduct, that would place you in potential contact with threat groups. Consider the locations these groups have targeted in the past. Do they target locations where foreigners are likely to spend time? Do they target locations where you’re likely to spend time? Again, you should be weighing the frequency and recency of attacks in your decision making.
An example that comes to mind is the attack on the Holey Artisan Bakery in Dhaka, Bangladesh in 2016. This attack resulted in 29 people being killed, including 20 hostages (17 foreigners and 3 locals). When you think about travelling to locations like Bangladesh, there really are only a handful of places that foreigners (expats and travellers) hang out. It would be trivial to target these locations. Looking back to the attacks in Bali in 2005, some of the bombers carried explosive devices in their backpacks, enabling them to walk along the street and select restaurants where foreigners were congregated (the attacks occurred between 6:50pm and 7:00pm local time, when people would be heading out for dinner and drinks).Personally, I’m more concerned about these types of opportunistic attacks than large-scale ‘spectacular’ attacks targeting hotels and embassies.
Following the process above, your assessment of the threat should shape most of your travel decisions, for example:
The key is to use information you have at hand to rationalise the threat. Consider stated intent, previous attacks, and the recency of activity. Most importantly, focus on potential touch points and plan to avoid those locations. In doing so, you can make meaningful inroads to mitigating risk. You won’t be able to eliminate risk altogether, but you’ll have done all you can. That’s significantly better than doing nothing (or not travelling at all just because a report says the risk is ‘high’).
Thanks for reading.