Prepare for the Protect Duty

But member organisations can prepare for the new requirements now.

In response to terror attacks in public spaces, like those at Manchester Arena, London Bridge, and Liverpool Hospital, the Government is introducing new legislation, the Protect Duty, to improve safety and security in public spaces across the UK.

The legislation, which is also known as Martyn’s Law, will introduce a statutory duty for the owners and operators of publicly accessible locations (PALs) to take appropriate and proportionate measures to protect the public from terrorist attack.

A publicly accessible location is defined as: ‘any place to which the public or any section of the public has access, on payment or otherwise, as of right or by virtue of express or implied permission’.

Protect Duty consultation findings

In January, the Government published its response to the public consultation, which ran from February to July 2021. Overall, the majority of the 2,755 responses are supportive of the Government’s objectives.

Seven out of ten agree that those responsible for PALs should take appropriate and proportionate measures to protect the public from attacks, with a similar proportion saying they should prepare staff to respond in the event of a terrorist attack.

The Government also sought opinion on how the new requirements would be overseen. Just over half of respondents are in favour of an inspectorate to support improvements in security culture and practices within organisations. The same proportion also support the use of civil penalties to ensure compliance.

This implies the public supports the idea of the legislation and the creation of an independent body (or additional role for an existing body) to guide and review compliance with legislation, as well as punitive measures for those who do not fulfil their obligations.

The role of local authorities

The findings of the public consultation also indicate that local authorities are likely to have a significant part to play in the Protect Duty, in addition to being subject to the legislation as owner/operators of PALs. This includes councils and emergency services.

When asked which organisations should take a leading role in supporting the legislation, councils received three times as many nominations as the next most popular choice, emergency services.

This could see councils responsible for bringing together organisations and bodies operating public spaces to establish security partnerships, facilitate the sharing of best practice, and driving compliance. Potentially, this could include ensuring operators engage with appropriate training, risk management information and, where appropriate, invest in physical security.

Taking a co-ordinated, top-down approach makes sense. Doing so helps to ensure consistency between organisations and across public spaces and, through the sharing of best practice, prevent duplication and mistakes.

There are instances where responsibility for managing public safety may be far from clearcut. For example, an operator running a football match or a concert at an event space, or an owner of a marketplace renting out stalls to traders. These concentrate large numbers of people within their venue or space, but also lead to large groups of people gathering as they approach and depart. Determining which organisations are responsible for the security of these people and ensuring plans are co-ordinated, is essential.

Risk assessments

Councils and other organisations will already have undertaken risk assessments and drawn up critical incident response plans for terror attacks. While draft legislation for the Protect Duty has yet to be shared, it is prudent to review existing plans to ensure they are fit for purpose.

While it is unclear at this stage whether police would be come under the requirements of the Protect Duty, as owner/operators of a PAL, there is potential for an advisory or compliance role. Outside of the Protect Duty, there is potential for liability exposure that could impact casualty programmes through the unintended errors in implementing a managed response to an act of terrorism.

The higher education sector are already engaged on their campuses with the PREVENT agenda in order to identify and intervene with individuals who may be radicalised to conduct activities.

Organisations must ensure they understand the scope of the risk and the appropriate preparation and response management necessary to protect the public in the event of a terror attack.

Requirements will vary between venues and spaces. These may include training for staff to recognise and respond to a potential threat; first aid resources; shelter and evacuation plans; physical security to limit the freedom of movement of an attacker; or technology solutions that support the identification of potential threat, limit the opportunity for an attack and coordinate a response in the event of an attack. 

It can be helpful to consider that an organisation can be found to have failed, either by failing to recognise the potential for and preparing for an attack, or by responding inappropriately, where the response fails to contain the situation or makes it worse.

It’s important to note that between the start of an attack and the police arriving on site to neutralise the attacker, the response can only come from the owner-operator of a site. Therefore, ensuring adequate training and investment to deliver an appropriate response is essential.

Insurance response

Insurance is an important part of an organisation’s management of this risk. While the traditional focus for terrorism insurance is property damage and business interruption, in the case of the Protect Duty, the broader impact will fall on the casualty programme of those affected, including the markets’ interpretation of the potential for liability, post-attack.

There are limited examples of insurers attempting to restrict terrorism on public liability programmes. Those with larger venues may have already experienced more insurer scrutiny over their approaches to risk management. As the scope of legislation around the Protect Duty becomes clear, this may lead to more emphatic action by markets.

Demonstrating your organisation is taking appropriate steps to manage the risk of terror attacks and protect the public will become increasingly important when securing cover, especially for the most exposed occupancies.

There is no timetable for the introduction of the Protect Duty, but it should become law by 2023. Taking steps now to articulate the quality of your terrorism risk management – from risk assessment through to security investment and training and response implementation – will build resilience into your organisation in preparation.