Study into measures to prevent terrorist attacks with vehicles and mitigate the impacts thereof

The European Commission’s Directorate-General for Migration and Home Affairs (DG HOME) commissioned RAND Europe to prepare this study into ‘Measures to prevent terrorist attacks with vehicles and mitigate the impact thereof’ to improve the evidence base on vehicular terrorist attacks that have occurred since 2013 in the EU, Israel, United States and United Kingdom and understand what measures could be employed to prevent or mitigate such attacks in the future. The full report is confidential, but the executive summary is freely accessible.

The six main objectives of the study are to:

• enhance understanding of the use of rented vehicles in terrorist attacks
• improve understanding of measures to counter vehicle-related attacks
• identify legal, practical and technological challenges and implications
• examine information-sharing in the rental sector
• offer an assessment of future threats and vulnerabilities
• provide concrete recommendations for further work.

The study used a mixed-method approach which involved desk research, a survey, key informant interviews and internal analysis workshops with a Senior Expert Advisory Board.

Key findings

Overall, the study found that while the threat of attacks that use vehicles as weapons remains comparatively low relative to attacks that use other readily available weapons such as knives, blades, firearms and homemade explosives, there has been an increase in the frequency of attacks using vehicles – including the use of rented and shared vehicles – in recent years to conduct such attacks.

Figure 1 Number of vehicle attacks and attempts according to region. Source: RAND Europe analysis based on START (2020) Terrorism Database

This data was gathered from across academic research, grey literature, news and media reporting, as well as the START (2020) terrorism database. In addition, interviews and workshop discussions provided insight to events and attacks. In this graph, the EU data also includes one attack in Norway that took place in 2019.

• Various elements of the business models within the vehicle rental and sharing industry may both enable and constrain terrorist attacks, for example ability to rent a vehicle, rental logistics, level of background checks, level of involvement from law enforcement.
• The analysis has identified certain aspects of the business models that constitute gaps within the system that could be exploited by those wishing to use vehicles in attacks. Such gaps include the limited regulatory oversight over P2P vehicle sharing; bookings made via brokers, which do not provide the corporate businesses sufficient details on clients; and the lack of information sharing between franchises and the corporate businesses.
• A wide range of prevention and mitigation measures have been put in place by public authorities at national, EU and international levels, within private companies, and via public-private sector collaboration. These broadly include:
  • The provision of guidelines, training, awareness campaigns and targeted funding;
  • The use of technological solutions (e.g. geofencing, autonomous emergency braking); and
  • The implementation of networks for collaboration and information sharing
• There are a number of legal, practical and technological challenges that exist with regard to the current measures and their impact on future measures.
  • Legal challenges include data protection issues, fundamental rights and discrimination concerns.
  • Practical challenges are wide-ranging but can broadly be categorised as an issue of striking the right balance between business needs, security measures, and a positive customer experience; costs and financial constraints linked to resources, training and the implementation of new systems or measures; and the limited and/or unknown effectiveness of these measures.
  • Technological challenges are often linked to the development of new technologies, including the growing automation of security measures in vehicles and the increasing autonomy of vehicles; the digitalising of security measures; the implementation of technological measures to protect public and private spaces.
• Prevention and mitigation of terrorist attacks using rented and shared vehicles should also be understood in the context of upcoming changes in the mobility industries as well as current and future threats and vulnerabilities. Future changes and trends in the mobility industry – such as increased vehicle autonomy, changes in overall mobility patterns and the increased use of artificial intelligence – may lead to a number of vulnerabilities, particularly with regard to cyberattacks and hacking of rented and shared vehicles. Mitigation of these risks could be done by developing robust IT systems to prevent fleet and vehicle hacking and leveraging the emergence of new mobility systems and of single centralised systems for payment to strengthen customers background and identity checks.

Key issues identified and options for future action

Over the course of the study, the following ten issues and gaps were identified as areas that could be addressed by action from the Commission, Member States and other relevant stakeholders.

1. There is no standardised regulatory framework at EU-level for vehicle rental or sharing processes.
2. Vehicle rental companies may have limited time to analyse customer data prior to a rental.
3. Smaller, local and seasonal vehicle rental, sharing and P2P businesses may operate on a less formal basis than larger, multinational companies.
4. Where there is limited physical interactions with customers, there is a potential vulnerability.
5. The security procedures for the online booking of rental and shared vehicles may not be secure enough to prevent identity fraud and/or hinder known terrorists or criminals from accessing a vehicle.
6. There is a lack of or 'case-by-case' information sharing by vehicle rental and sharing companies with law enforcement authorities.
7. There are no industry-wide guidelines or training for vehicle rental staff on how to notice and report suspicious behaviour and there is an overall difficulty in identifying suspicious rentals.
8. Not all countries have a vehicle rental and sharing association that plays a key role in helping prevent the use of rented or shared vehicles in terrorist attacks.
9. Prevention methods may not be sufficient to identify would-be terrorists before they commit an attack using rental or shared vehicles.
10. Successful attacks are usually conducted using larger, heavier vehicles. While there are stricter requirements for renting trucks, there are no similar requirements for renting vans or large cars.