Relevance of ‘EVIL DONE’ to the current UK threat landscape

Summary

Since the release of Clarke and Newman’s ‘EVIL DONE’ framework in 2006, there has been limited empirical research on its capacity to predict target attractiveness and vulnerability as intended. This study aimed to investigate the utility of the framework in the context of the current UK threat landscape, including additions from the TRACK framework (Marchment & Gill, 2020) using cases of terrorism in the UK from 2015 through 2021 (n=184). For the large proportion of Northern Ireland-related cases (88%) that are local and appear undirected or random in nature, ‘EVIL DONE’ may not be the best approach to predicting and mitigating the threat. Analysis of terrorist activity on a local scale may require examination of more local details including characteristics of the victims and perpetrators, as well as the types of residential areas and homes most at risk. However, analysis of cases from Great Britain only (excluding Northern Ireland) demonstrates greater usefulness of the framework in explaining the attractiveness of targets, particularly the components destructible, occupied, near, easy (DONE), and tolerable and relevant (from the TRACK framework). In the event of an attack in Great Britain, locations that are more exposed, occupied, and further from the offender tend to result in the greatest lethality.

Background

In 2006, Clarke and Newman¹ posited eight components to predict the vulnerability of locations to terrorism (i.e., how attractive they are as targets). The components comprise the ‘EVIL DONE’ framework: exposed, vital, iconic, legitimate, destructible, occupied, near, and easy. Exposed targets are those that stand out and attract attention (e.g., a high-rise building). Vital targets are necessary to the survival of daily life (e.g., water supplies and power plants). Iconic targets are symbolically significant to society (e.g., the White House and the Statute of Liberty in the United States or Buckingham Palace and Big Ben in the United Kingdom). Legitimate targets are deemed deserving of an attack (e.g., military personnel or government buildings). Destructible targets are those that are easily destroyed compared to other targets. Occupied targets are those with more potential victims. Near targets are those that are relatively close in proximity to where the terrorists are based. And finally, easy targets are those easily accessed or with little or no security measures in place.

Since 2006, very little empirical testing has been carried out to determine whether the ‘EVIL DONE’ framework is useful in understanding the attractiveness and vulnerability of targets. This study analyses cases of terrorism in the UK from 2015 through 2021 to investigate how well the components of the framework fit the current UK threat landscape. It also includes additional components of tolerable (related to risk of detection pre-attack) and relevant (target is symbolic of the ideology of the offender and selected to send a message; from Marchment & Gill, 2020)². 

Research questions

RQ1. Do the ‘EVIL DONE’ (+TR) components demonstrate strong relationships with lethality? This question explores, in the event of an attack, which of the components are associated with greater injury and fatality.

RQ2. Which of the components are consistently present or absent across cases (i.e., attractive to, or avoided by, offenders)?

Results

The study included 184 cases, 88% of which were Northern Ireland-related. Because most of the attacks were Northern Ireland-related, they didn’t reflect the types of terrorism we would typically be investigating.

Table 1: Distribution of offender ideology

Most cases were based on individuals attacking other individuals outdoors in residential areas or targeting private residences. For these cases, the framework didn’t fit very well as these offenders are not logically weighing up the costs and benefits of attacking particular locations as assumed by the ‘EVIL DONE’ framework. As the nature of terrorist activity in Northern Ireland is local and appears undirected³ or random, ‘EVIL DONE’ may not be the best approach to predicting and mitigating the threat. Analysis of terrorist activity on a local scale may require examination of more local details including characteristics of the victims and perpetrators, as well as the types of residential areas and homes most at risk.

A small number of cases in the dataset were not Northern Ireland-related (22 in total). Analysing cases from Great Britain only (excluding Northern Ireland), the framework appears to fit much better in explaining the attractiveness of targets. The component scores for Great Britain show that six of the ten variables tested (DONE +TR) align with what we would expect from the framework. That is, offenders tend to avoid locations that are relatively indestructible, unoccupied, far away, highly secure, likely to expose them pre-attack (tolerable), or irrelevant to their ideological motivation. The remaining four components (EVIL) demonstrate a greater spread of scores, suggesting less usefulness in understanding the characteristics of locations that are avoided by, or attract, offenders.

For Great Britain, we also look at the relationships between these components and lethality of cases. Three components help to predict lethality in the event of an attack – exposed, occupied, and near. Locations that are more exposed and occupied, and attacks that require the offender to travel further, are associated with greater lethality. Recognising that these results are based on only a small number of cases, we conclude that the DONE+TR components help us to predict attractiveness of targets in the first place (the EVIL components appear to be less helpful), and the components of exposed, occupied, and near help us to predict lethality in the event of an attack.

_{1 Clarke, R.V., & Newman, G.R. (2006). Outsmarting the Terrorists. Westport, CT: Praeger Security International.}

_{2 Marchment, Z., & Gill, P. (2020). ‘Spatial Decision Making of Terrorist Target Selection: Introducing the TRACK Framework’, Studies in Conflict & Terrorism, doi: 10.1080/1057610X.2020.1711588}

_{Table 1 Separatists/Nationalists, IRA, Continuity IRA, New IRA, Real IRA, Óglaigh na hÉireann (ONH), Ulster Defence Association (UDA), Ulster Volunteer Force (UVF)}

_{3 By undirected, we mean that the target is not clearly identified. Examples of undirected attacks include an IED (pipe bomb) left outside a residential property, or a paramilitary punishment attack where link between the offender and the victim is not known (or not included in the open-source data). However, it should be noted that for the communities in which these attacks occur, it is likely that the identification of the target is known by the offender.}