AUSTRALIA-NEW ZEALAND COUNTER-TERRORISM COMMITTEE
AUSTRALIA’S
STRATEGY FOR
PROTECTING CROWDED
PLACES FROM TERRORISM
AUSTRALIA’S
STRATEGY FOR
PROTECTING
CROWDED PLACES
FROM TERRORISM
2023
ISBN: 978-1-925593-95-2 (Online)
© Commonwealth of Australia 2023
.
With the e
xception of the Coat of Arms and where otherwise
stated, all material presented in this publication is provided
under a Creative Commons Attribution 4.0 International
licence (www.creativecommons.org/licenses).
For the avoidance of doubt, thismeans this licence
only applies to material as set out in this document.
The details of the relevant licence conditions are available on
the Creative Commons website as is the full legal code for
the CC BY 4.0 licence (www.creativecommons.org/licenses).
Use of the Coat of Arms
The terms under which the Coat of Arms can be used are
detailed on the Department of the Prime Minister and
Cabinet website.
1
Table of Contents
Summary
What is a Crowded Place?
Crowded Places and Terrorism
Who Has a Role in Protecting Crowded Places?
Owners and Operators of Crowded Places
Local Governments
State and Territory Governments
The Australia-New Zealand Counter-Terrorism Committee
Crowded Places Sub Committee and the Business Advisory Group
Commonwealth Government
Private Security Providers
The Community
Australia’s Strategy for Protecting Crowded Places from Terrorism
Building Stronger Partnerships
Enabling Better Information Sharing and Guidance
Implementing Effective Protective Security
Guidance
Layered Security
Cost and Proportionality
Reputation
Recovery
Increasing Resilience
Governance and Accountability
2
4
4
7
7
8
8
9
9
9
9
10
10
10
12
14
15
15
16
16
16
17
18
2
Summary
Crowded places such as stadiums, shopping
centres, pedestrian malls, and major events will
continue to be attractive targets for terrorists.
The current National Terrorism Threat Level is
outlined at www.nationalsecurity.gov.au, with
the levels depicted below in Figure 1.
The current environment reflects advice of the
Australian Security Intelligence Organisation
(ASIO) that individuals and groups continue to
possess the intent and capability to conduct a
terrorist attack in Australia.
Australia is not immune to the threat of
terrorism and contemporary information
regarding the current environment is detailed
at www.nationalsecurity.gov.au. Australian
governments work with the private sector to
protect crowded places. Our law enforcement
and intelligence agencies are well-equipped to
detect and disrupt plots, and they have a strong
history of stopping terrorist attacks.
But the reality is it will not always be possible
to prevent all terrorist attacks from occurring,
so we need to strengthen our national
arrangements in order to help owners and
operators better protect crowded places from
terrorism.
Owners and operators of crowded places have
the primary responsibility for protecting their
sites, including a duty of care to take steps to
protect people that work, use, or visit their site
from a range of foreseeable threats, including
terrorism.
The objective of this Strategy is to protect the
lives of people working in, using, and visiting
crowded places by making these places more
resilient (Figure 2).
The approach taken to protect crowded places
should be nationally consistent, proportionate
and, to every extent possible, preserve the
public’s use and enjoyment of these places. It
is not possible to protect everything, so owners
and operators must prioritise the highest risk
areas of a crowded place.
AUSTRALIA-NEW ZEALAND COUNTER-TERRORISM COMMITTEE
This Strategy also ensures there is a clear and
consistent understanding of what constitutes a
crowded place, the roles and responsibilities of
all those involved in protecting these places, and
the threat environment in which they operate.
The success of this Strategy rests on strong
and sustainable partnerships across Australia
between governments and the private sector to
better protect crowded places. To this end, the
Strategy sets out a national framework, known
as the ‘Crowded Places Partnership.’ This
Partnership provides a consistent approach in
each state and territory for trusted engagement
between all levels of government, state and
territory police, and owners and operators
across the country.
Membership of the Crowded Places Partnership
gives owners and operators access to better
threat and protective security information. This
comes from a variety of sources, including
Commonwealth law enforcement and
intelligence agencies, state and territory police,
other owners and operators, and international
partners. In each state and territory, police have
‘Crowded Places Forums’, through which they
can share information and advice with owners
and operators.
Figure 1 – National Terrorism Threat Level
CERTAIN
EXPECTED
PROBABLE
POSSIBLE
NOT EXPECTED
3
Figure 2 – Framework for protecting crowded places from terrorism
By accessing this information, owners and
operators will be in a better position to protect
their crowded places against terrorism.
Protective security measures can be used to
deter, detect, delay, respond to, and recover
from a terrorist attack. Implementing them can
be a complex process which, if done incorrectly,
can be costly and ineffective. This Strategy
includes a suite of supplementary materials
that will assist owners and operators to
understand and implement protective
security measures. These materials also
contain modules on specific weapons and
tactics used by terrorists.
These supplementary materials can
be found at www.nationalsecurity.gov.au
and include:
• Crowded Places Self-Assessment Tool;
• Crowded Places Security Audit;
• Hostile Vehicle Mitigation Guidelines;
• Chemical Weapon Guidelines;
• Active Armed Offender Guidelines;
• Improvised Explosive Device Guidelines;
and
• Disrupting Hostile Reconnaissance
Guidelines.
The Guidelines are designed to increase
understanding of the threat posed by
particular weapons and tactics (e.g. vehicles,
improvised explosive devices) to crowded
places. The Guidelines, and complementary
publications such as ‘escape, hide tell,’ also
provide guidance on the issues and options
that owners and operators may consider
during risk mitigation and contingency planning
activities.
Even the most robust and thorough protective
security plan may not stop a terrorist attack on
a crowded place from occurring or succeeding.
But what well-considered and tested protective
security does is reduce both the likelihood of a
terrorist attack occurring and the consequences
of such an attack.
Page 1 of 8
Crowded Places Self-Assessment Tool
This self-assessment tool helps owners and operators of crowded places to understand how
attractive their location may be for a terrorist to attack. It then provides guidance on what steps to
take next.
Experience has shown that the issues listed in this self-assessment are amongst those that
terrorists consider when identifying a target for attack.
In order to complete the self-assessment, it is essential that you read the accompanying
explanatory notes for each of the following statements. This will provide you with a better
understanding of some of the terms and concepts that are used in the assessment.
It is important to remember that this self-assessment needs to be conducted from the perspective
of a would-be attacker; not from your perspective as to the current level of security you have at
your location.
Please note that the descriptive words around the numerical scale often differ from statement to
statement. The factors that are most likely to influence terrorist target selection are rated on a scale
of 1 to 7; other factors are rated on a scale of 1 to 5.
AUSTRALIA-NEW ZEALAND COUNTER-TERRORISM COMMITTEE
ACTIVE ARMED
OFFENDER
GUIDELINES
FOR CROWDED
PLACE S
3635
DISRUPTING HOSTILE
RECONNAISSANCE
GUIDELINES
FOR CROWDED PLACES
AUSTRALIA-NEW ZEALAND COUNTER-TERRORISM COMMITTEE
4
The reputation of owners and operators
of crowded places is prone to serious and
permanent damage if a less than robust,
responsible, and professional priority is given to
protecting people against attack. Reputational
damage can have a significant impact on a
business’ finances. Being security minded and
better prepared could not only deter an attack,
it can reassure customers and staff that those
responsible for crowded places are taking
security seriously.
The tools and information provided within
this Strategy are intended to give readers
a general understanding. In many cases,
owners and operators will be required to seek
further specific advice from private security
professionals. The Strategy contains guidance
on how to select a private security consultant.
Hardening and improving the resilience of
crowded places relies on all stakeholders
taking action to apply this Strategy. Owners
and operators, and governments at all levels,
will need to use the guidance in this Strategy
to make decisions and implement protective
security measures in accordance with the
existing conditions and arrangements in each
jurisdiction.
This Strategy will be reviewed on a regular
basis by the Australia-New Zealand Counter-
Terrorism Committee (ANZCTC), the national
body responsible for coordinating an effective
counter-terrorism capability across Australia
and maintaining arrangements for intelligence
and information sharing between all
jurisdictions and relevant agencies.
What is a
Crowded Place?
Crowded places are locations which are easily
accessible by large numbers of people on a
predictable basis.
Crowded places include, but are not limited
to, sports stadia, transport infrastructure,
shopping centres, pubs, clubs, hotels, places of
worship, tourist attractions, movie theatres, and
civic spaces. Crowded places do not have to be
buildings and can include open spaces such as
parks and pedestrian malls.
A crowded place will not necessarily be crowded
at all times: crowd densities may vary between
day and night, by season, and may be temporary,
as in the case of sporting events, festivals, or
one-off events.
Crowded Places
and Terrorism
Australia’s current National Terrorism Threat
Level is outlined at www.nationalsecurity.gov.au.
It is important for owners and operators of
crowded places to understand the current
National Terrorism Threat Level and
accompanying information on the national
security context.
A range of factors can shape terrorist target
selection. In most cases, the location itself
is not the target—it is the high volume and
concentration of people that makes a crowded
place attractive to attack. While some crowded
places have other attractive features, any
location that concentrates large crowds could
be an attractive target.
5
The circumstances of would-be attackers—
including specific grievances, the weapons and
equipment they can access, and their location—
are likely to influence any potential attack
planning, including target selection.
According to ASIO, terrorist attack planning
in Australia will probably continue to involve
weapons and tactics that are low-cost and
low-capability. This methodology has been used
by terrorists for attacks on crowded places
overseas to devastating effect. Basic weapons
(including knives and vehicles), firearms, and
explosives could all be used in any attack. That
said, the possibility of more complex attacks
cannot be ruled out.
Many factors influence the selection of weapons
and tactics by terrorists, such as resource
availability, skills, knowledge, opportunities,
motivation, group makeup, as well as strategic,
ideological, and tactical objectives. The
interplay of these factors shapes the size, style,
sophistication and location of an attack, as well
the likelihood of success.
OFFICIAL
OFFICIAL
Crowded places
22-13213
Assessment: Crowded places remain the most likely target for any terrorist attack in Australia. Australia-based violent extremists require limited capability to
attack people in crowded places.
We consider the concentration—or potential concentration—of people to be the key factor in determining the attractiveness
of a crowded place to an attacker. We expect terrorist plans targeting crowded places will likely be timed to coincide
with significant and/or holiday events where crowds are likely to gather.
Places of worship or religious symbolism
e.g. churches, mosques, synagogues
Sports and music events
e.g. sports matches, concerts
Dining and social gathering hubs
e.g. pubs, clubs, restaurants
Transport hubs and modes of public transport
e.g. train stations, bus depots, airports
Community markets and events
e.g. outdoor markets, festivals, carnivals
Shopping centres and attractions
e.g. malls, supermarkets, theme parks
The presence or absence of protective security measures
may be considered when terrorists are planning attacks. Measures are
implemented to deter (e.g. CCTV cameras), detect (e.g. baggage searches),
delay (e.g. bollards) and respond (e.g. response from security forces).
Readily available
and accessible
Simple weapons and
tactics are eective
Generates media attention
and instils fear
Promoted in propaganda
Most have limited
security measures
DETER
Why are crowded places chosen?
DETECT RESPOND
DELAY
Current as of 18 November 2021
Box 1: Why do terrorists attack crowded places?
6
Individuals preparing for, planning to undertake,
or in the process of committing a terrorist
attack, tend to display certain behaviours. These
can be specific behaviours they may exhibit
in order to make and execute their plans (for
example, conducting reconnaissance) or more
general behaviours of intent or support for
terrorist activity (such as repeatedly expressing
ideologically extreme sentiments).
A number of terrorists worldwide have been
detected by bystanders who acted on their initial
suspicion that something was ‘not quite right’
about an individual’s activity by reporting this
to authorities. Employees working in crowded
places and members of the public are often
best placed to detect suspicious behaviour. It is
important that owners and operators of crowded
places do everything they can to raise awareness
of possible suspicious behaviour among those
using their sites. For further information, please
see ‘Implementing Effective Protective Security’
(page 14).
Who Has a Role
in Protecting
Crowded Places?
Owners and Operators of
Crowded Places
Owners and operators of crowded places can
include businesses, major event organisers,
sporting clubs, charities, community groups,
religious groups, and local, state and territory
and Commonwealth governments.
All owners and operators of crowded places
have the primary responsibility for protecting
their sites, including a duty of care to take steps
to protect people that work, use or visit their site
from a range of foreseeable threats, including
the threat of terrorist attack.
Owners and operators have a responsibility to
understand what the current terrorist threat
environment means for the security of their
site. This includes understanding the main
factors that influence terrorist target selection.
The Crowded Places Self-Assessment Tool
found at www.nationalsecurity.gov.au offers
information and guidance on how to assess
such factors for a crowded place. Advice on the
threat environment can be found on the national
security website, the ASIO Outreach subscription
website, or through local police contacts.
The Self-Assessment Tool itself should not be
considered a risk or vulnerability assessment.
Rather, it helps owner/operator understand
the relative attractiveness of their site which
can then inform these assessments and help
guide further security planning. Depending
on the outcome of this assessment, owners
and operators may need to take further action
including, but not limited to, engaging directly
with state and territory police, undertaking a
formal risk assessment of their site, engaging
with private security contractors, and, based
on expert advice, implementing effective and
proportionate protective security measures.
Owners and operators have a responsibility
to undertake a risk assessment and/or
vulnerability analysis of their crowded place.
They may need to do so by engaging a private
security provider. Once this assessment is
completed, owners and operators have a
responsibility to implement the appropriate
7
mitigations, monitor them for effectiveness
(including through audits), and review them at
appropriate junctures. Personal liability can
attach to some of these obligations if breached.
Developing, implementing, and regularly testing
a comprehensive security plan is a matter of
good business and corporate responsibility.
The plan should prioritise saving lives and
minimising harm while aiming to protect
physical assets, information, reputation and
other elements that could affect business
continuity.
Owners and operators have a responsibility to
consider how security arrangements and plans
may need to change if the national threat level
is raised or lowered, and how long it would take
to implement these changes. This should be
achieved by accessing information and guidance
provided by governments, both online and
through state and territory networks. It helps
owners/operators also have a responsibility to
raise awareness of possible security threats
among their staff and patrons.
Box 2:
Responsibilities
of Owners and
Operators of
Crowded Places
• Primary responsibility for
protecting their sites;
• Understand the threat of
terrorism;
• Undertake risk assessment and/
or vulnerability analysis;
• Develop, implement and regularly
test security plans;
• Raise awareness of security
threats with staff and patrons
• Timely reporting of security
incidents and suspicious
behaviours.
Owners and operators are also expected to
report any security incidents or suspicious
activity to law enforcement at the earliest
opportunity.
In life threatening situations, everyone should
phone 000. Suspicious or unusual behaviour,
that is not time critical, should be reported to
Crime Stoppers on 1800 333 000 or the National
Security Hotline on 1800 123 400.
Figure 3 – Who To Contact
8
State and Territory Governments
State and territory governments have the
primary responsibility for preventing, preparing
for, responding to, and recovering from terrorist
attacks in their jurisdiction.
While the owners and operators of crowded
places remain responsible for implementing
protective security measures, state and territory
governments acknowledge that responsibility for
building and sustaining resilience to terrorism
is shared between government, owners and
operators, and communities.
State and territory police are responsible for
providing threat information to owners and
operators of crowded places. This includes
material developed by the states and territories,
Commonwealth agencies, and overseas
partners. Police provide specific information
on the local threat context to help owners and
operators develop protective security measures.
State and territory police may also provide
protective security guidance in some instances.
Crowded Places Forums are a shared
responsibility between government and industry
stakeholders. These Forums are the primary
means of collective engagement between police
and local owners and operators of crowded
places, including businesses and local councils.
Members of the Crowded Places Forum can
share information, guidance, and lessons
learned relevant to their local circumstances.
These Forums also provide an opportunity for
Commonwealth agencies, particularly ASIO and
the AFP, to brief owners and operators in each
state and territory as a collective.
Local Governments
Local governments are often responsible for,
among other things, managing civic spaces,
public activities, celebrations, agricultural
shows, and community days. This means they
have the same role and responsibilities as
other owners and operators of crowded places,
including a duty of care to develop, implement,
and regularly test protective security measures.
Local governments also play an important role
in designing and approving public spaces—
including a unique opportunity to consider and
creatively apply protective security during the
early stages of crowded place design. Doing
so helps to minimise the disruptive effect of
protective security on the public’s enjoyment
of public spaces.
9
The Australia-New Zealand
Counter-Terrorism Committee
The ANZCTC is comprised of representatives
from the Australian government, Australian
state and territory governments and the New
Zealand Government. The ANZCTC coordinates
an effective counter-terrorism capability across
Australia and maintains arrangements for
intelligence and information sharing between
all jurisdictions and relevant agencies. The
ANZCTC also provides strategic and policy
advice to heads of government and other
relevant ministers.
All jurisdictions and New Zealand are members
of the ANZCTC. Each Australian jurisdiction
has its own comprehensive counter-terrorism
governance arrangements.
Crowded Places Sub Committee
and the Business Advisory Group
The CPSC is the body that reports to and advises
the ANZCTC on protecting crowded places from
terrorism. It is also a forum through which
all jurisdictions can identify and share best
practice, develop capabilities, and oversee
activities related to protecting crowded places.
The CPSC is responsible for developing and
maintaining a nationally consistent crowded
places protective security capability across state
and territory police forces.
CPSC membership has been expanded and now
consists of senior representatives from state
and territory police services, the chair of the
Business Advisory Group (BAG), the Australian
Defence Force (ADF), the Australian Federal
Police (AFP), and ASIO.
The CPSC works with, and is advised by,
the BAG. The BAG’s membership consists
of representatives of crowded places with a
national presence. It operates a national forum
through which crowded place owners and
operators, peak industry bodies, government
representatives, and international partners
share information and advice. The outcome of
this engagement directly informs the work of
the CPSC. The BAG also facilitates exercises and
training for its members.
Information and guidance developed by the
CPSC is shared, where appropriate, with owners
and operators in all jurisdictions through the
BAG and state and territory Crowded Places
Forums.
Commonwealth Government
The Commonwealth has a number of key
responsibilities related to protecting crowded
places from terrorism. It maintains national
counter-terrorism related policies, legislation,
and plans; maintains a broad range of counter-
terrorism intelligence, investigative and
operational capabilities within Commonwealth
agencies; and supports intelligence and
information sharing between the jurisdictions.
Commonwealth agencies also directly support
the states and territories to prevent, investigate,
disrupt, respond to, and recover from terrorist
incidents across the country. This is done
primarily through ASIO and AFP involvement
in each jurisdiction’s Joint Counter-Terrorism
Team.
ASIO is the authoritative source of security
threat information in Australia and is
responsible for determining the National
Terrorism Threat Level. ASIO assesses security
intelligence and provides protective security
advice to governments, the police, and other
agencies. ASIO also provides threat information
and protective security guidance to owners and
operators of crowded places through various
means. For further information see ‘Enabling
Better Information Sharing and Guidance’
(page 12).
Private Security Providers
Private security providers and professionals
play a central role in protecting crowded places.
In many cases, private security personnel—
including security contractors, risk analysis
experts, and private security officers—are
directly responsible for strengthening the
security of crowded places. Security guard
force or frontline officers are often the first
responders to a terrorist incident. Consequently,
they must be well-trained and professional.
Governments have a role in supporting the
private security sector to achieve this, including
by maintaining a robust regulatory regime
around employment, training, and registration.
10
The Community
All communities and individuals have a
responsibility to help detect and prevent possible
terrorist attacks in crowded places. Everyone
working in or using a crowded place should
be aware of their surroundings and report
suspicious or unusual behaviour to authorities.
In life threatening situations, everyone should
phone 000. Suspicious or unusual behaviour,
that is not time critical, should be reported to
Crime Stoppers on 1800 333 000 or the
National Security Hotline on 1800 1234 00
use and enjoyment of these places. A nationally
consistent approach will help achieve this
objective in an effective and efficient manner.
The Strategy involves four core elements which
provide a structure for building a consistent
national approach to protecting crowded places
that can be applied flexibly throughout Australia
(Figure 2, page 3).
Improving the resilience of crowded places
relies on all stakeholders taking action to
apply this Strategy. Owners and operators, and
governments at all levels, will need to use this
Strategy to make decisions and implement
protective security measures in accordance with
the existing arrangements in each jurisdiction.
Building Stronger Partnerships
Protecting crowded places from terrorism is not
just a job for governments, it is a responsibility
shared by the private sector and the community.
The success of this Strategy rests on sustainable
and strong partnerships across Australia
between all governments and owners and
operators of crowded places, including
businesses and local governments.
In Australia, the national framework for
cooperation is known as the ‘Crowded Places
Partnership’ (Figure 4). The Partnership
supports a nationally consistent and coordinated
approach for trusted engagement between
police, owners and operators of crowded places,
and Commonwealth agencies in every state
and territory.
Trusted relationships between governments and
owners and operators of crowded places are
fundamental to the effective implementation of
this Strategy. The Crowded Places Partnership
sets out a range of mechanisms to support this
engagement, but none of these replace the
ability for all police and intelligence agencies to
engage directly with owners and operators when
required.
Figure 3 – Who To Contact
Australia’s Strategy
for Protecting
Crowded Places
from Terrorism
Australia’s Strategy for Protecting Crowded Places
from Terrorism is based on strong, trusted
partnerships between all levels of government
and those responsible for crowded places. It
aims to make crowded places as resilient as
possible to terrorist attacks while preserving our
11
Figure 4 – Crowed Places Partnership
Box 3: Crowded
Places Forums
For further information on
Crowded Places Forum in your
state or territory, please visit
the Crowded Places Page at
www.nationalsecurity.gov.au/protect-
your-business/crowded-places.
CROWDED PLACES PARTNERSHIP
INTERNATIONAL
PARTNERS
AUSTRALIA-NEW ZEALAND
COUNTER-TERRORISM COMMITTEE
(ANZCTC)
Crowded Places Sub
Committee (CPSC)
CHAIR: Police
MEMBERS:
State and territory police
Business Advisory Group (BAG)
ASIO/AFP/Defence
BUSINESS
ADVISORY GROUP
(BAG)
CHAIR: Business
MEMBERS:
Nationally represented
owners and operators
ASIO/AFP, as required
STATE AND TERRITORY
CROWDED PLACES FORUMS
CHAIR: Police/Government
MEMBERS:
Owners and operators
(business, local councils)
Police
State/territory officials
ASIO/AFP, as required
CPSC provides
guidance to
Forums
BAG advises CPSC
CPSC provides guidance to BAG
Exchange of
information
and advice
Reports to
Speak at BAG Forums
Forums
report to
CPSC
The primary vehicle for police to engage
collectively with owners and operators of
crowded places in each jurisdiction is known as
‘Crowded Places Forums’ (Box 3). The Forums
comprise owners and operators (including
business and local councils), state or territory
officials, and police. The state and territory
Crowded Places Forums are a vehicle for
fostering local networks and partnerships to
ensure all stakeholders are as well connected
as possible. The Forums are also responsible
for reporting to the CPSC on a regular basis,
to ensure local information is considered and
12
Forums.
ASIO is the authoritative source of security
threat information in Australia. The threat
information and intelligence it generates is
provided to owners and operators of crowded
places through a range of different mechanisms.
ASIO is responsible for the National
Terrorism Threat Advisory System found
on www.nationalsecurity.gov.au. It provides
public advice on a scale of five levels about
the likelihood of an act of terrorism occurring
in Australia. If the threat level changes, the
Commonwealth provides advice on what the
threat level means, where the threat is coming
from, potential targets, and the most likely
weapons and tactics used by terrorists.
ASIO also issues threat assessments to inform
the actions of police and other agencies
responsible for protecting Australians from
terrorism. Police in all jurisdictions consider
this intelligence and translate it into threat
information and guidance that is relevant to local
circumstances. This information and guidance is
shared with owners and operators both directly
and through state and territory Crowded
Places Forums.
In circumstances where credible intelligence
points to a specific and immediate threat to a
crowded place, ASIO works proactively with
local police and impacted parties to share threat
information so an appropriate response can be
developed and deployed. This engagement is
initiated by ASIO as required.
ASIO Outreach is the principal interface between
ASIO and industry. The ASIO Outreach provides
information to business and government
via a subscription-based website, ASIO-
hosted briefings, face-to-face engagement,
and participation in forums such as the BAG
Forum and the Trusted Information Sharing
Network (TISN) led by the Department of
Home Affairs. The Trusted Information Sharing
Network (TISN) is the Australian Government’s
primary industry engagement mechanism to
enhance the security and resilience of critical
infrastructure. The TISN brings together in
partnership critical infrastructure owners and
operators, supply chain entities, peak bodies,
and all levels of government. Several crowded
place owners and operators are TISN members.
The TISN is supported by the Department of
captured at a national level.
We have much to learn from our international
counterparts. Having the right mechanisms in
place to build and sustain the trusted exchange
of ideas and advice with international partners
allows us to identify, refine, and share the most
effective measures for protecting crowded
places. International engagement must continue
to inform and guide Australia’s approach to
protecting crowded places from terrorism.
This engagement should occur at all levels of
government, between owners and operators
of crowded places, and should include regular
consultation with private sector experts.
The Commonwealth and many states and
territories already have broad networks of
international contacts through which they
exchange expertise on protecting crowded
places. These efforts require robust coordination
to avoid unnecessary duplication of effort and to
ensure outcomes are shared across the country
with those who would benefit from them.
The CPSC plays a role in strengthening these
arrangements. With members from the
Commonwealth, state and territories, local
government, and the business community,
the CPSC acts as a central repository for
documenting and coordinating our international
engagement on protecting crowded places,
including advice, lessons learned, information
about equipment and technology, and training
we receive from our overseas partners.
Enabling Better Information
Sharing and Guidance
Protecting crowded places from terrorism in an
evolving threat environment requires trusted and
routine information sharing and guidance across
Australia between all governments, industry
sectors, business, and communities. The strong
partnerships developed and sustained through
the Crowded Places Partnership will help to
achieve this goal (Figure 5).
It is a key responsibility of government to ensure
those who own and operate crowded places
have access to high quality threat information.
This information, intelligence, and guidance is
generated by ASIO and police across the country,
and shared, primarily, through the Crowded
Places Partnership and Crowded Places
13
Home Affairs together with the Australian
Government and state and territory agencies.
All these mechanisms are aimed at providing
risk management decision makers with the
most current security intelligence and protective
security advice to assist them in their duties.
The ASIO Outreach secure website hosts
intelligence-backed reporting drawn from the
full range of ASIO’s information holdings and
expertise. ASIO Outreach has a dedicated page
for grouping together reporting and Security
Guides relevant to Owners and operators of
crowded places. Eligible owners and operators
of crowded places can subscribe to the ASIO
outreach at www.outreach.asio.gov.au, a website
that constitutes a valuable resource to help
security managers address protective security
requirements.
Figure 5 – Information Sharing
INFORMATION SHARING
POLICEASIO
STATE AND
TERRITORY
CROWDED
PLACES
FORUMS
BUSINESS
ADVISORY
GROUP
CROWDED PLACES
SUB-COMMITTEE
Lessons
learned
Information
and advice
Information
Sharing and
Guidance
Provide
information
and protective
security
guidance
Share lessons
learned
and report
suspicious
behaviour
Report
suspicious
behaviour
Information
Sharing and
Guidance
Information
Sharing and
Advice
Present to
Forums
Provide threat
information directly,
via ASIO Outreach and on
nationalsecurity.gov.au
website
OWNERS AND OPERATORS OF CROWDED PLACES
The flow of information between governments
and those responsible for crowded places is
not one-way. Owners and operators should be
willing to share information, advice, and lessons
they have learned with governments and their
peers. Building a strong and inclusive security
culture is a responsibility shared by all.
14
In addition, everyone has a responsibility to
report suspicious behaviour to the authorities.
In life threatening situations, everyone should
phone 000. Suspicious or unusual behaviour,
that is not time critical, should be reported to
Crime Stoppers on 1800 333 000 or the
National Security Hotline on 1800 1234 00
Figure 3 – Who To Contact
Implementing Effective
Protective Security
Implementing protective security measures can
be a complex process which, if done incorrectly,
can be costly and ineffective. Owners and
operators have a responsibility to undertake a
risk assessment and/or vulnerability analysis of
their crowded place, implement the appropriate
mitigations, monitor them for effectiveness
(including through audits), and review them at
appropriate junctures.
This section is designed to provide owners and
operators of crowded places with a baseline of
knowledge to improve their understanding of
protective security.
The tools and information provided with this
Strategy are a starting point. In many cases,
owners and operators will be required to
seek further advice from private security
professionals. Professional and qualified
security consultants play an important role in
undertaking full security risk assessments of
crowded places and recommending appropriate
protective security measures.
Box 4: How Should
I Assess Security
Consultants?
The following are factors that owners
and operators of crowded places
should consider when selecting a
security consultant:
• Security licence;
• Education, qualifications,
skills, and experience;
• Referee reports;
• Security clearance
(where required);
• Professional association
and affiliations;
• Previous experience
conducting security reviews;
• Ability to effectively
undertake the security review
(subject matter knowledge);
• Impartiality of advice (consider
any commercial affiliations); and
• Published professional work.
15
Guidance
Before owners and operators make decisions
about protective security measures they must
first understand how attractive their location
may be for a terrorist to attack. To determine
this, all owners and operators should complete
the Crowded Places Self-Assessment Tool found
at www.nationalsecurity.gov.au/CrowdedPlaces.
Based on the outcome of the Self-Assessment,
the document provides guidance on what
owners and operators should do next. This could
include:
• Refer to information on the general
threat environment and specific terrorist
weapons and tactics found at
www.nationalsecurity.gov.au
• Complete the Crowded Places Security Audit
found at www.nationalsecurity.gov.au
• Contact the relevant area within your state
or territory police for further information,
including about joining a Crowded Place
Forum.
Crowded places encompass a significant range
of different locations, venues and businesses.
They differ substantially in size and have
different levels of risk to manage. For example,
the security requirements for a large shopping
centre will be different from those of a small
street market or a large music concert.
For this reason, the Crowded Places Security
Audit does not provide a definitive list of all
security matters that must be addressed
for a particular location. Instead, it provides
a checklist of the most common security
considerations faced by crowded places in order
to highlight gaps in security. It is important to
remember that protective security measures
should be proportionate to the level and type of
threat. The Audit should only be consulted after
the Crowded Places Self-Assessment Tool has
been completed.
Layered Security
Layered security describes the practice of
securing a site by applying multiple layers of
complementary protective security measures
(Figure 6). The goal of layered security is to
reduce the likelihood of a successful terrorist
attack on a crowded place by building multiple
layers of redundancy into a site’s security
architecture. If implemented correctly, layered
security ensures that the failure of any single
layer—which may consist of different security
measures (people, information, and physical
assets) - will not significantly compromise the
overall security of the place being protected.
This concept is also known as ‘security in depth’.
Applying the model better equips those
responsible for, working in, and using a crowded
place to deter, detect, delay, and respond to a
terrorist attack.
Figure 6 – Layered Security
Obvious physical and electronic
target hardening measures e.g.
• Security signage
• Clear perimeter
(fencing, signage)
• Visible security patrols
• CCTV
• Security lighting
Visual detection and
alert systems, e.g.
• Security patrols;
• Security awareness and
vigilance
• White level inspections
• Identity cards/accreditation
• CCTV
• Suspicious behaviour
reporting
Timely and coordinated reaction
by security forces, e.g.
• Trained security
• Emergency communication
procedures to quickly notify
staff
• Practiced emergency plans
• Compatible with emergency
services response
Physical counter-measures and
processes, e.g.
• Trained security
• Security fencing
• Entry gates
• Vehicle access controls
(e.g. car park shutters,
bollards)
DETER
DELAY
DETECT
RESPOND
16
The actual measures owners and operators can
use within each of these layers will differ from
location to location. Decisions about protective
security will be informed by a variety of factors,
including:
• The prevailing threat advice;
• The type of purpose of the site (people,
information and physical assets), including
the presence of high-profile individuals;
• The history of security incidents at the site;
• The presence of high-risk facilities in close
proximity to the site;
• Existing security measures that are in place.
Cost and Proportionality
Security measures can be resource intensive,
costly and, if not correctly managed and
communicated, can alienate staff and the
public and significantly disrupt the day-to-day
operations of a crowded place. This is why
expert specialist advice is essential and why
careful consideration and planning is required
before implementing any protective security
measures. The following principles should
underpin all decision-making:
• All protective security measures should be
proportionate to the level and type of threat;
• It may not possible to protect everything, so
owners and operators must prioritise the
highest risk areas of a crowded place;
• Physical security is more cost effective when
incorporated into the design phase of a
crowded place.
Reputation
The success of governments and businesses
rests on building and maintaining a good
professional reputation. Reputation is prone to
serious and permanent damage if owners and
operators of crowded places give a less than
robust, responsible professional priority to
protecting people against attack. Being security
minded and better prepared could not only deter
an attack, it reassures customers and staff that
those responsible for crowded places are taking
security issues seriously.
Recovery
Recovery from a terrorist attack is the process of
rebuilding, restoring and rehabilitating affected
individuals, communities, and physical assets.
This process usually begins once an incident
has been resolved, continues until disruptions
have been rectified, demands on services have
returned to normal levels, and the needs of
those affected have been met.
A business continuity plan is central to the
recovery process. This plan is activated during
the ‘response’ phase of an incident and is
designed to return a business, activity, or
location to normal as quickly as possible after
an incident. The plan requires owners and
operators to make important decisions about
which assets or activities are most important
and the timeframes within which certain
operations must be resumed. A business
continuity plan should not just cover terrorist
attacks and must be designed so it can be
activated during any major disruption.
A robust business continuity plan will often
include:
• Cross training of skills among the paid and
volunteer workforce;
• Documented procedures to allow staff to
quickly perform unfamiliar tasks;
• Agreed relocation operations both within
and outside the location;
• Remote access to IT systems in nominated
backup locations;
• Alternative sources of essential equipment;
• Secure offsite storage of data backups and
valuable documentation;
• Agreed methods for out-of-hours contact for
staff, clients, and other critical personnel.
It is important to note that, in the event of a
terrorist attack, arrangements outlined in a
business continuity plan may be overridden by
police or a coroner, who may control a location
for a significant period of time, preventing the
resumption of normal business operations. This
may be necessary to secure a site and facilitate
forensic examination. Police will attempt to
minimise the duration of this period to the
extent possible.
Governments will work with affected owners
and operators of crowded places to re-establish
essential services and restore public confidence
as quickly as possible.
17
Insurance can be a useful tool to manage losses
or damage caused by an act of terrorism. The
Australian Government ensures that insurers
cannot exclude liability for major acts of
terrorism from eligible insurance contracts
through the Terrorism Insurance Act 2003.
Increasing Resilience
Even the most robust and thorough protective
security plan may not stop a terrorist attack on
a crowded place from occurring or succeeding.
But what well-considered and tested protective
security does is reduce both the likelihood of a
terrorist attack occurring and the consequences
of such an attack.
Resilient crowded places can do more to prevent
a terrorist attack, can reduce the damage
caused by an attack, and can recover more
quickly after an attack has occurred. Building a
strong security culture is central to developing
resilience to terrorism and other types of
criminal activity.
Other elements of building an effective security
culture can include:
• Ensuring that security is a permanent
feature of executive decision making and
agendas;
• Requiring senior management to
demonstrate personal commitment to
and compliance with security values and
standards;
• Understanding commercial, reputational and
legal risk that could result from inadequate
protective security measures being in place
to prevent or mitigate a terrorist attack;
• Providing staff with clear, succinct and
jargon-free guidance about security
standards and procedures;
• Promoting good security practice to both
staff and visitors by making use of internal
communication systems, posters, message
boards and newsletters;
• Adopting effective and lawful staff screening
processes during recruitment;
• Providing staff training in security practices;
• Exercising all staff in security scenarios;
• Self-initiated security penetration and
breach testing;
• Sharing information with staff about security
breaches;
• Encouraging and rewarding staff for
identifying and reporting security
vulnerabilities and incidents.
Communication runs through the full length
and breadth of every organisation and
communication regarding counter-terrorism
security should be no different. Protecting
a crowded place from terrorism rests on
building and sustaining a culture of security
from management level through to staff on the
ground. Those responsible for managing the
security of a crowded place should regularly
meet with staff to discuss security issues and
encourage staff to raise their concerns about
security.
Security managers should also consider a
communication strategy for raising awareness
among staff and others who need to know about
a security plan and its operation.
A resilient crowded place has trusted
relationships with government, other crowded
places, and the public. It has access to accurate,
contemporary threat information and has a
means of translating this threat information
into effective, proportionate protective security
measures commensurate with the level of risk
they face.
While resilience is difficult to measure in the
absence of an attack—you cannot evaluate what
has not occurred—it can be assessed through
regular testing and evaluation of policies and
procedures, exercising security arrangements
and responses, and regular and ongoing training
of staff.
It is natural that owners and operators
of crowded places will examine terrorist
attacks that occur elsewhere and seek to
understand what it means for them. The more
comprehensive they have been at addressing
activities around prevention, preparedness and
response, the more confident the owners and
operators can be that their level of resilience
will reduce, as far as possible, the impact of a
terrorist attack.
This will include the ability of owners and
operators to resume business-as-usual
activities as soon as possible.
18
Governance and
Accountability
Countering terrorism is a responsibility shared
by all Australian governments, the community,
and the private sector.
Australia’s national counter-terrorism
coordinating body, the ANZCTC, meets regularly
to coordinate and maintain effective counter-
terrorism arrangements across Australia. This
Strategy will be reviewed on a regular basis by
the CPSC and the ANZCTC.
