CRITICAL SYSTEMS AND PROCESSES AFFECTING THE RESILIENCE OF SUBWAY SYSTEMS TO TERRORISM RISKS CRITICAL SYSTEMS AND PROCESSES AFFECTING THE RESILIENCE OF SUBWAY SYSTEMS TO TERRORISM RISKS

the high-impact types of attacks. Terrorist attack on the urban transport systems with high concentration of people (such as the subway), depending on its mode, can cause different levels of damage including the elimination of sub-components of fire safety equipment or destruction of passive fire protection. To mitigate the effects of an attack, the resilience of vehicles, as well as efficiency of evacuation of the survivors affected mainly by the availability of adequate emergency exits, the number of evacuees and the local conditions of the process are critical. Based on the experience of previous attacks on the metro systems (Tokyo, London and other incidents), this paper identifies critical systems and processes for management of the emergency situation following a potential terrorist attack, ensuring safe and rapid evacuation and rescue to passengers.


Introduction
The risk of a terrorist attack in the developed countries remains consistently high. Based on research of case studies of both succeeded and failed terrorist attacks, the subway systems seem to be a popular target for terrorism because of the specific features and consequences related to an attack in the subway system´s environment: potentially substantial material and human damage, high media visibility and coverage causing general panic and long-term negative effects on the capacity of the whole transport infrastructure at a given place.
The state authorities as well as defense and security agencies are aware of these risks and implement special technological and organizational measures to improve the safety of subway transport systems, such as passenger clearance screening, increased depot security, on-going detection of explosives or integrating the emergency preparedness plans and approaches.
There have also been a number of studies and research projects aiming to increase the resilience of metro vehicles, to improve the effectiveness of preventive measures and to mitigate the potentially devastating impact of a terrorist attack in the subway system, such as the European FP7 SecureMetro project, the SECUR-ED and Protectrail projects to name but a few. In this regard, it is also worth noting the current MODsafe project (Modular Urban Transport Safety and Security Analysis) that integrates approaches to the safety and security measures in order to reduce barriers within the European Union so that a common European strategy can be established.
All these different initiatives and strategies have one common objective: to reduce material damage as well as potential causalities and injuries caused by a potential terrorist attack, to increase resilience and ensure fast recovery so that the metro transport systems are a less attractive target for terrorism.

Specifics of the terrorist attacks in the subway system
The physical features of the subway transport systems (underground location, construction technologies, ventilation, egress routes, alternative accessibility, integration with other public transport systems etc.) are rather specific and therefore require special measures with respect to the protection of passengers, ability to resume normal operation in an emergency situation and the crisis management in general.
It is critical to define most probable scenarios of a terrorist attack, analyze related risks, evaluate the current infrastructure under these threats and design both technological and organizational solutions for the high-impact types of attacks. and emergency response is the lessons learned from the major incidents targeting the subway infrastructure. Due to limited size of this paper, it focuses on the key findings only [7].

Tokyo subway sarin attack
The Tokyo subway attack was carried out on March 20, 1995 by a coordinated group of members of the religious movement Aum Shinrikyo (called Aleph since 2000 onwards), killing 13 and injuring over 5,000 people. It was the most serious incident in Japan since the World War II and noteworthy also for the use of a chemical agent (liquid sarin) instead of conventional explosives.
Nerve gas sarin is odourless, colourless and highly toxic (lethal even at very low concentrations). It is manufactured by the reaction of methylphosphonyl difluoride with isopropyl alcohol: CH 3 POF 2 + (CH 3 ) 2 CHOH → [(CH 3 ) 2 CHO] CH 3 POF + HF Sarin affects the nervous system by interfering with the re-absorption of neurotransmitters. Death usually occurs as a result of asphyxia as the victim becomes comatose and suffocates due to the inability to control the muscles involved in breathing function.
The Tokyo subway, with its 9 lines, 179 stations and about the 195 km of route, is one of the busiest commuter transport systems in the world. The timing of the terrorist attack was not coincidental: around 8 a.m., at the peak of the morning rush hour when the concentration of commuters was the highest. Five men released liquid sarin from the plastic bags inside the trains at separate subway lines to maximize the impact and human damage. The trains continued on their routes with intoxicated passengers leaving the vehicles and others entering at each station. The gas further spread at each stop, either by vaporization or through contaminated passengers. Following emergency response to the Tokyo subway attack revealed serious gaps in the security system and planning [8] and [9]: § design of trains that did not allow to open the windows to support internal ventilation § inability to identity the chemical agent until several hours later, thus exposing the passengers, subway staff as well as rescuers and causing secondary contamination of the whole subway infrastructure (e.g. on the Chiyoda line, employees cleaned two packages of liquid sarin on the train's floor by mopping them up with newspaper and bare hands, two of them died later on); § more than an hour delay in problem recognition, not understanding that the emergency calls from different stations referred to the same mass incident, which led to the fact that the fire department sent all of their personnel to the first (Tsukiji) station, leaving minimal resources for other affected stations; Research of the terrorist attacks in the rail-based systems in the last 50 years concludes that the number and severity of the attacks has grown substantially [1]. To be more specific, 833 recorded attacks killed about 3,500 persons and wounded more than 15,000. The sharpest increase in both number of attacks and their fatalities was identified in 1990s and 2000s [2], [3] and [4].
The scope and character of damage caused by a terrorist attack is mainly affected by the mode of perpetration and the tactics used. In the period of 2000 -2010, bombing was used in 77% of the cases, followed by fire and firearms (both 4%) and firebomb and Molotov (3%). All other types of attacks are marginal (see Fig. 1). As the trends have the same characteristics over the period studied, it is reasonable to expect a continuing growth of attempted bomb attacks in the mid-term future [5]. The priority of security measures therefore needs to be given to the selection of vehicle materials and structural design that will increase the resilience of metro vehicles to the blast of explosives as well as measures increasing the security of passengers, staff and infrastructure through design of fire barriers and fire suppression technology that will reduce the impact of an attack. Special attention should be given to the situation when the metro train is blocked in a tunnel following a bomb blast as it represents the most challenging scenario for the survivability of the passengers, prevention of panic behavior and facilitation of rescue.

Case studies: major terrorist attacks on the subway systems
A mass-casualty terrorist attack at crowded, underground premises requires specialized response of the rescue agencies involved. The main inspiration for tailoring of the security plans nearest station. Walking evacuation in an unlit tunnel lasted approximately 15 minutes.
The main method of evacuation developed then by the London Underground was through the end door in the last train. The side doors were designed so that they cannot be opened by passengers, only by trained subway staff as there is not enough space between the wall of the tunnel and side door, exposing the passengers to the risk of electric shock caused by high-voltage infrastructure in the tunnel.
Based on the severity of the injuries caused by bomb blasts and delayed arrival of qualified medical staff, another inadequacy revealed was the fact that the metro trains were not equipped with the first aid kits (available only to the drivers and in the stations).
Another important issue related to the evacuation in the urban environment is identification of large number of people, collection of their personal data and contact information for further police investigation, identification and return of personal property and notification of next of kin, as well as the establishment of appropriate reception centers to ensure that the people who have suffered mental or lighter physical trauma will not gather at locations around the disaster, thus preventing adequate and easy access of the rescue teams.

Moscow metro bombing and failed attacks
Subway systems have been a favorite terrorist target also in other parts of the world, particularly the Russian capital Moscow. In August 2000, a strong explosion of homemade bomb equivalent to 800 g of TNT occurred at Pushkinskaya metro station in the center of Moscow, killing 12 and injuring over 150 people. In February 2004, a suicide bombing inside the train between two stations on the Zamoskvoretskaya Line killed 10 and injured more than 50 people. The most recent terrorist attack occurred in the morning rush hours (7:56 and 8:38) in March 2010 when two bombs exploded on the Sokolnicheskaya Line, killing 40 and injuring 102 others. The two suicide female bombers who carried out the attacks wore explosive belts with a force of 1.5 kg of TNT and 2 kg of TNT respectively. Both devices were enhanced with metal nuts, bolts and screws to increase the destructive impact of the blasts. It is unfortunate that the Moscow authorities tend to release only limited information related to the attacks and emergency response which does not allow for more detailed study and analysis.
It is worth mentioning that there have been a number of terrorist attacks that foiled or failed, either as a result of efficient prevention and security measures or for other reasons related to the nature of the plot: four attempted attacks in the London Underground on 21 July 2005 (the bombs' detonator fired but did not ignite the main explosive charge), suicide bombings on the New York City subway system planned by al-Qaeda in 2009 and § unclear competencies and responsibilities of different authorities and lack of willingness to prioritize cooperation over interagency competition; § serious failures in the organization of evacuation, data collection and transport of victims to the health facilities; § withholding of information and miscommunication to the passengers and the public following the attack, based on the reluctance to provide information that might be incomplete or uncertain.

7/7 London subway bombings
The London bombings of 7 July 2005 were a series of multiple coordinated suicide attacks targeting civilians who commuted on the subway transport system during the morning rush hour. Between 8:50 and 9:47, four British jihadists detonated homemade organic peroxide-based devices in the London Underground trains across the city and another exposive was detonated inside a double-decker bus in Tavistock Square later on. In this country's first ever suicide terrorist attack, 52 civilians were killed, more than 700 injured and over 4000 people affected. Traffic in the city was paralyzed for a few hours and thousands of people remained closed in the metro stations and tunnels up to several hours [10].
The aftermath of the attacks were characterized by chaos and panic [11]: the lighting of trains and their immediate surroundings in the tunnel was destroyed, it was not possible to open the door, communication sets between the driver and passenger did not work and drivers could not communicate with the dispatchers either. There were power failures in some parts of the subway system and reports of blasts and smoke in the tunnels. In the first phase, the control center (London Underground Network Control Centre) evaluated the situation as a train derailment after hitting the tunnel wall at Edgware Road station.
Emergency health service was called to seven metro stations although some of them did not experience any incident. Serious incidents cause a large number of calls to the emergency helplines and the control center is usually able to evaluate the situation relatively quickly. However, in the case of London subway attacks, the situation was different because the subway stations and tunnels did not have sufficient cellular coverage meaning that people could not call for help and the drivers could not report to responsible dispatchers due to the damage of the communication system kits.
The most challenging situation occurred in the train that was damaged and blocked in the tunnel between King's Cross and Russell Square stations. After about half an hour after the attack, the evacuation of passengers was organized by the London Underground Emergency Response Unit with assistance of two police officers who helped passengers disembark through the driver's cabin and helped transport the wounded to the The equipment and technical features of the subway trains need to be tested in realistic conditions simulating a bomb blast (currently the most usual mode of an attack), such as lack of lighting, smoke, secondary fire, panic and high concentration of people [12].
The designers and producers need to consider innovative approaches ensuring continuation of operation even in the most challenging conditions represented by the aftermath of a terrorist attack, e.g. self-powering of electrical equipment with internal ageing-prone batteries, protection of cables in shielded tubes, the closest possible location of antennae to the associated device while allowing easy operation and maintenance.
The overall crisis management is of utmost importance as the biggest challenges experienced after most of the attacks resulted from organizational and cultural, rather than technical deficiencies [13] and [14]. Following Table 1, Table 2 and Table  3 is an overview of the key criteria related to the subway resilience and security. a plot to bomb Washington Metro stations by another individual linked to the al-Qaeda ranks in 2010 to name but a few.

Key factors for the terrorism resilience and emergency response in the subway system
The above mentioned case studies, other incidents which could not be described here in detail as well as research projects focused on increased resilience and security of the subway systems identify a set of key survivability criteria based on the following functions: § fast and accurate recognition of the problem, i.e. location, scope, character and impact of the terrorist attack § minimization of the panic among survivors, allowing them to provide first aid to those wounded or suffering trauma and to understand their situation and possible next steps related to their rescue § accessibility of the rescue teams to the place of incident § organization of evacuation (if and when necessary) Key technical criteria for the subway trains Table 1 Trains -technical criteria Windows § Windows should be easily opened or closed manually as necessary for ventilation purposes. § Unbreakable material and blast-proof design of windows is desirable to prevent injuries from the flying gass debris following a bomb blast. § Use of windows as intuitive emergency exits needs to be considered (as seen in the 7/7 London bombings or the Kaprun funicular fire of 2000).
Door operating system § Side doors represent a good emergency exit in a situation when the attack occurs while the train is in or close to the station. § The door slides need to enable intuitive opening from the inside by passengers and the unlocking mechanism must be operational even without power. Luminiscent instructions next to the door are desirable. § Doors connecting the trains need to be unlocked at all times allowing for evacuation by the end door of the last train.
Lighting § Fire and blast-resistant lighting that secures visibility even in smoke, dust and soot conditions (e.g. LED-based lighting successfully tested under the SecureMetro project). § Availability of flash-lights for the case when emergency lighting fails.
Intercom system § Blast-proof device that allows mutual, both-direction communication between the driver and passengers should be installed in all trains, with special considerations for possible jamming with too many speakers on the same frequency. § Train-to-ground communication system that allows both the driver to provide information about the attack and situation underground and the dispatcher/ rescue manager to give instructions for evacuation.
First aid equipment § Easily accesible illuminated sets with the basic life-saving health supplies should be installed in every train.
Emergency instructions § Easy-to-understand, illuminated emergency instructions located in each train may prevent the panic and help facilitate fast and effective rescue.
Evacuation guidance signs § Luminescent exit and directional signs (similar to those used in airplanes and buildings) can help the passengers locate the exits. Considerations should be given to guidance for injured passengers crawling on the train ground. ensure increased security in emergency situations: slide doors need to enable opening by passengers inside the trains, windows should allow for ventilation while not posing additional risks when broken, whereas adequate communications, together with emergency lighting in the train or tunnel and clear instructions and guidance by evacuation signs may reduce the chaos and panic that are associated with any emergency. Professional crisis management system involving all stakeholders with well-established working relationships is just as important: it allows to recognize the problem without delays, deploy the rescue teams precisely when and where necessary and carry out effective recovery.
This paper presents a non-exhaustive checklist of key technical and organizational criteria against which any subway system can be assessed. More research and efforts are needed to implement the improved operating procedures and relevant safety standards of the subway systems into practice.

Conclusion
Specifics of the subway infrastructure make it a particularly attractive target for the terrorists: an attack at a crowded space under the ground with limited alternatives for exit may not only cause potentially very high material as well as human damage but also paralyze the whole urban transportation system. A terrorist attack has some specific consequences (spread of fear and panic in the general public, typical lack of information in the immediate aftermath etc.) that distinguish it from natural or other man-made disasters and therefore requires special emergency response.
The case studies of the previous attacks carried out in the subway systems of different cities around the world provide valuable insight into what needs to improve so that the subway is more resilient to the attacks and the passengers are protected from the most serious effects. The threat of terrorism requires innovative approaches to the crisis planning.
The designers and manufacturers of the subway systems need to give a priority to the materials and technologies that Key technical criteria for the subway system Table 2 Subway system -technical criteria Surveillance system § Fire and blast-resistant security cameras should be installed at all stations. Security can be further increased by regular parols, especially during moring and afternoon rush hours.
Lighting § Tunnels, as well as stations and exits leading to the ground should be equipped with alternative emergency lighting independent of electric power supply (e.g. luminescent coating).
Ventilation § Depending on the character of attack, ventilation shafts need to ensure fast supply of incontaminated air.
Design of rail track § The tracks should be designed so that the trains in transit between stations can continue on to the nearest station without a power supply (gravity-driven).
Enhanced telecom infrastructure § Full cellular coverage in the subway system, including the tunnels, can help facilitate communitation of passengers with the ground, thus allowing fast recognition of the incident, scope of the damage and efficient rescue of the survivors.
Key organizational criteria for the subway system Table 3 Subway system -operations Emergency response manual § Adjustments/special considerations are needed to prepare the subway staff as well as the rescue agencies to handle multiple simultaneous incidents/ attacks. § In case of a major incident/ mass-casualty attack, additional rescue teams should be allocated to both neigboring stations.
Evacuation centers § Based on agreements with local authorities and rescue agencies, identify at least two potential reception centers in the vicinity of the metro stations, negotiate with the owners / tenants of the premises and engage them in contingency planning and drills.
Division of responsibilities § Clear allocation of decision rights and responsibilities among different divisions (both operational and technical) should be set-up to ensure timely and efficient rescue operations.
Training and emergency preparedness § All subway staff should have professional training in the life-saving skills. § Regular drills involving subway staff and all rescue agencies need to be organized in order to identify and address potential inadequacies and areas for improvement.