The Terrorism (Protection of Premises) Bill, commonly known as ‘Martyn’s Law’ (named after Martyn Hett a victim of the 2017 Manchester Arena bomb attack), was introduced to Parliament on 12th September 2024 and is currently undergoing Parliamentary scrutiny. The Bill intends to make it a legal requirement for those who are responsible for publicly accessible venues (the ‘duty holder’), to assess the risk of a potential terrorist attack, and if necessary, to put in place measures to address it.
Under the scope of the Bill, a venue (the ‘qualifying premises’), is a building (including part of a building, or a group of buildings) which is wholly or mainly used for one or more ‘qualifying event’. A ‘qualifying event’ includes retail, sale of food or drink, nightclub and entertainment venues, hotels, visitor attractions, healthcare, education, and places of worship. The Bill has a tiered approach based on the capacity of the ‘qualifying premises’. A ‘standard tier’ has capacity to host between 200 and 799 persons at the same time, and an ‘enhanced tier’ has capacity to host 800 or more persons at the same time.
For education premises (which includes childcare, primary, secondary, and further education) and places of worship, even where these have a capacity of 800 persons or over, it is proposed that these will fall under the standard tier.
For the purposes of this article we will be considering only standard tier premises.
The standard tier will hold no legal requirement for a qualifying premises to consider costly physical security measures, but instead will focus on procedures which will define the actions the workers should take in response to a terrorist attack. The standard tier will measure all premises in scope against the same standard, that of ‘reasonably practicable’. This means that duty holders will be expected to assess and implement procedures that are suitable for their individual circumstances. The ‘reasonably practicable’ test includes what is financially realistic for a premises.
The Bill will establish a regulator to oversee compliance through a new function of the Security Industry Authority (SIA). Persons responsible for a standard tier premises will be required to notify the regulator of their premises.
The government have stated that ‘dedicated guidance and support will be provided for duty holders’ and that [this guidance] ‘will be easy to follow, needing no particular expertise’[1], the latter point to which I will return. The government has indicated that the guidance will include procedures for evacuation, invacuation, lockdown, and communication arrangements.
It is anticipated that risk assessment will be the key to establishing the potential threat of a terrorist attack, the level of risk it presents, and (in the case of a standard tier premises) what procedural control measures will be required to mitigate it. The term ‘risk assessment’ is broadly associated with health and safety and there is an expectation that the health and safety role will be central to the development of these risk assessments, due to familiarity with the concept of risk assessment and of its practical delivery – albeit for the purposes of evaluating familiar, and foreseeable, ‘workplace hazards’.
As a health and safety professional, I am acutely aware of the need for competence in the activity or hazard being assessed, when developing a risk assessment. The accepted definition of competent person (in relation to health and safety) is someone with the necessary skills and experience or knowledge. It would therefore be professionally and ethically wrong for me to develop a risk assessment for an activity or hazard for which I had little knowledge or experience of. This is where I have concerns with how the risk assessment will be implemented by the duty holder.
The government’s wording of ‘no particular expertise’ is at the other end of the scale from ‘competence’. If I have no experience or knowledge of how to assess the threat of a terrorist act occurring, what form that act might take and of the procedures required to eliminate or minimise it, how then could I be considered ‘competent’ to undertake such a risk assessment?
In addition to knowledge and experience another element in demonstrating competency is training. The government have stated ‘we have moved away from a prescribed training requirement (i.e. a one size fits all package for all relevant staff)[2], meaning that the duty holder will be responsible for deciding what training will be appropriate for their individual circumstances (again using the principle of reasonably practicable).
Currently there are various counter terrorism awareness and Martyn’s Law e-learning training courses available, these courses vary in duration between 30 mins and 90 mins. In 2006, changes were made to UK fire safety legislation, where it became an employer’s duty to undertake fire risk assessments for the buildings they were responsible for, where previously a Fire Certificate had been issued by the fire brigade. In order to be considered competent to undertake these assessments, I had to attend a five-day training course which included a written exam. Is a brief e-learning course going to make someone sufficiently competent to understand terrorism and develop a risk assessment and protocols which will meet the aims of the Bill, and stand up to the scrutiny of the regulator? Is ‘no particular expertise’ going to be enough to produce a risk assessment and mitigation plan which (in health and safety terms anyway) would be considered ‘suitable and sufficient’?
The other aspect of training is what will be provided to employees. Remembering that the standard tier places emphasis on procedures and the actions which workers should take in response to a potential terrorist attack. Some employers find it problematic to get their workers to do what they are supposed to do during, well established, well thought through, and routinely tested, fire evacuation scenarios. Under the requirements of the Bill, duty holders will have to consider not only evacuation procedures but also, if appropriate, invacuation procedures (moving individuals to a place where there is less risk of physical harm, e.g. away from windows) and lockdown procedures (preventing individuals leaving or entering the premises). Training workers will involve not only instructing them on how to recognise which scenario is unfolding, but also how they should respond to it. This could prove challenging. Fire evacuation is a familiar and generally understood process but it can still go wrong in an actual emergency. How realistic is it to expect people to correctly, and quickly, identify the scenario and the appropriate action they must take (get out / stay in / move to a safer area), in the face of terrorist action. How these procedures are communicated to workers (and visitors), and tested, will need to be fundamental components of them.
There are over 10,000 workplace fires per year attended by the fire and rescue services. It is a valid concern that well established fire evacuation procedures could be eroded at the expense of introducing invacuation and lockdown procedures for a scenario that is statistically far less likely (although the consequences could be equally as severe).
The content of the proposed guidance will be absolutely crucial otherwise there could be a lot of inadequate risk assessments and/or the subsequent control measures put forward to be wildly inappropriate for the premises concerned.
At present there is no indicated timescale for when the Bill might receive Parliamentary approval and Royal Assent. The government have stated that, following Royal Assent, there will be a period of time prior to implementation of the legislation and that they expect this to be ‘at least 24 months’, this is to allow for the set-up of the regulator and to ensure sufficient time for duty holders to understand their new obligations, and to plan and prepare for them.
While duty holders will be able to use the test of reasonably practicable when deciding the measures they will take (to comply with the Bill when it is enacted), given the emotive nature of the issue how then will they convince their workers, visitors, etc. (society in general) that their business is doing enough to protect them from a risk that is going to be very difficult to actually quantify?
[1] ‘Martyn’s Law Factsheet’, GOV UK Home Office news team, 13 September 2024
[2] The Terrorism (Protection of Premises) Bill 2024-2025, Commons Library Research Briefing, 5 December 2024