Interactive Toolkit Advances Counterterrorism Opportunity Theory

Researchers Paul Ekblom and Andrew Newton have developed an interactive digital toolkit designed to assist security managers of large, complex transport hubs in preventing terrorist attacks and routine crimes. Published in the journal Crime Science in April 2026, the study details the creation of this software, which integrates the concept of opportunity from crime science with traditional security and risk management practices. The project, funded by the European Commission, addresses a significant gap in applied security practice where the theoretical concept of opportunity has remained largely implicit and static for decades. By operationalizing these concepts, the toolkit aims to guide practitioners through structured risk analysis and intervention selection in environments characterized by extreme organizational and environmental complexity.

The development of the toolkit was driven by the specific challenges faced by security managers in multimodal land transport hubs. These stations are large, heterogeneous, and dynamic risk environments where routine activities generate crime, while dense concentrations of people and infrastructure attract both opportunistic offenders and highly motivated attackers. Governance fragmentation further complicates risk management, as stations typically involve multiple operators, transport providers, retail tenants, private security firms, and police forces. This multiplicity hinders comprehensive risk assessment and coordinated security action, leaving security managers with constrained resources and a need for substantial analytical support to deliver effective prevention and preparedness.

A primary obstacle in this domain is the scarcity of high-quality evaluative evidence regarding terrorism prevention. The authors note that while databases like the RAND database document attack types, they lack the granularity required for site-specific prevention. Furthermore, a major systematic review by Lum et al. identified only seven studies meeting relaxed evidentiary standards out of approximately 20,000 examined, producing findings that were often too general to be relevant to land transport contexts. This evidentiary deficit reflects the rarity of terrorist incidents and the secrecy surrounding counterterrorism measures, which together preclude robust experimental evaluation. Consequently, existing toolkits often function as searchable catalogues of interventions rather than providing process-oriented guidance for practitioners.

To address these challenges, the researchers adopted a mixed-methods strategy to assemble and structure knowledge on risk, threat, and security action. They extrapolated from tested crime science theory and evidence syntheses, combined with Situational Crime Prevention (SCP) principles derived from the project team’s applied research experience. A Realist review of academic and grey literature on terrorist attacks and interventions was conducted, prioritizing the theoretical plausibility of causal mechanisms over effect sizes, which were largely unavailable. This review covered 15 bibliographic databases and extensive consultation with organizations and experts, yielding 409 relevant sources, of which 139 were reviewed in depth. Fieldwork comprised visual audits and interviews at four complex stations across EU member states, involving security staff, police, and site managers.

The conceptual architecture of the toolkit rests on several linked components, primarily the Conceptual Attack Framework (CAF) and the Security Action Tree (SAT). The CAF characterizes the range of terrorism risks at complex stations by covering tactical attack methods, weapons, targets, and attack procedures. Drawing initially on the RAND terrorism database, the CAF was extended to incorporate detailed attack procedures derived from the UK’s Project Griffin. This yielded approximately 11 generic action stages, from reconnaissance to entry, movement, attack, and exit, which were adapted for complex station contexts. The SAT organizes intervention knowledge graphically, structured by the 5Is process model: Intelligence, Intervention, Implementation, Involvement, and Impact/process evaluation. Each entry in the tree includes a concise intervention description, source attribution, and an evidence quality rating.

Central to the toolkit is the concept of reducing risk by matching security actions to the threat posed by offenders. The authors define threat as offender-centered, comprising resources, capabilities, goals, intent, motivational and emotional readiness, and presence. Risk is defined as the likelihood and harm of adverse events, emerging from the interaction of threat with a conducive environment. Situational risk attributes, which make the risk of harmful events more or less likely, cover both target-related and site-zone-related factors. These include precipitators, opportunity attributes affecting effort, risk, and reward, and harm attributes such as vulnerability and exploitable hazards. This framework reframes the Routine Activities model in more security-specific terms, integrating situational and offender factors into a unified approach.

The interactive design of the toolkit was driven by concerns about cognitive load on users handling the complexity of threat and environmental context. The software guides users stepwise through risk analysis and intervention selection, presenting choices specific to the nature of the terrorism or crime threat, the range of local situational risk attributes, and the available repertoire of intervention methods. Key design features include a focus on one kind of crime, one attack method, and one station zone at a time, along with context-specific conditional dropdown menus. Clear screen labelling, breadcrumb trails, and progress indicators help manage complexity, while sidebars summarize user choices and enable easy backtracking. The toolkit also allows for extensive local customization, including adding regulatory requirements, defining zones, and uploading and marking up site maps with structured symbol sets.

In operation, the toolkit supports setup, tutorial, and main risk-analysis sessions. Main sessions begin by selecting the offence type and specifying the offender’s primary operational goal. Users then select the relevant attack method or technique, which frames subsequent analysis. The focus then shifts to a situational perspective, where users analyze the station in zones corresponding to stages of offender movement and action. Zone-based analysis reflects the context dependence of SCP, with users identifying risk attributes that might boost the likelihood of, and harm from, offender action in that zone. The particular risk attribute menus are customized for different crime types and attack methods to ease the cognitive load on users.

The study illustrates the toolkit’s application through an example of hostile vehicle ramming in a station foyer. In this scenario, the vehicle serves as the primary weapon, and the offender approaches, enters, acts within, and exits the zone using a car or larger vehicle. The toolkit identifies situational risk attributes that make such an attack more likely or more harmful, such as easy vehicle movement, weak screening at entry points, or inadequate shelter. After risks are identified, users review existing security measures and decide whether they offer sufficient protection. If not, the toolkit provides context-specific security options, such as reorganizing queues, relocating hazards, dispersing crowds, or conducting regular evacuation drills. A final session summary consolidates the analysis, including the focus of the session, risks identified, and selected security recommendations.

The theoretical contribution of this work lies in the strengthening and extension of the concept of opportunity within crime science. The authors argue that opportunity has remained conceptually underdeveloped, functioning as a largely intuitive and vernacular construct insufficiently integrated with the field’s principal theoretical frameworks. By bridging crime science with conventional security, which centers on threat, the researchers reframed opportunity as an interaction between offender and environment rather than a property of the situation alone. This required the explicit inclusion of offender goals, intent, motivation, resources, perceptions of risk and effort, and physical or remote presence. The resulting model provides a more holistic, system-oriented account of how crimes and terrorist attacks occur, including those involving highly motivated actors.

Despite these advances, the study acknowledges several limitations. The fundamental evidentiary deficit in SCP remains, with most SCP-terrorism studies being non-empirical. The project scope was constrained by time, funding, and limited institutional capacity to actively promote uptake. In an ideal scenario, the authors would have extended guidance to cover implementation and involvement, conducted more extensive field testing to assess usability, and undertaken formal evaluation of toolkit impacts. Future work would benefit from contractual arrangements that support feedback, maintenance, and iterative improvement, as well as broader dissemination within crime science and security communities. The toolkit is designed to be updateable, allowing future iterations to evolve with emerging research evidence and threats.

The development of this interactive toolkit represents a significant step in the practical application of crime science to counterterrorism. By integrating opportunity-based approaches with threat- and risk-centered security practices, the researchers have created a tool that is fit for contemporary and emerging challenges. The study demonstrates that while the concept of opportunity has been central to situational crime prevention for fifty years, it has yet to fully mature. This work shows that opportunity, when extended and developed within a more integrated theoretical approach, can be effectively used to guide security managers through complex risk analysis, decision-making, and intervention design in high-stakes environments.

Subject of Research: Opportunity extended — via development of an interactive counterterrorism toolkit

Article Title: Opportunity extended — via development of an interactive counterterrorism toolkit

Article References: Ekblom, P., & Newton, A. (2026). Opportunity extended — via development of an interactive counterterrorism toolkit. Crime Science, 15(1), Article 15. https://doi.org/10.1186/s40163-026-00280-2

Image Credits: AI Generated

DOI: 10.1186/s40163-026-00280-2

Keywords: Opportunity, extended, development, interactive, counterterrorism, toolkit, scientific research