Securing Car Parks, Public Concourses, the Meeters and Greeters: Five Years After The Burgas Bombing

This issue of Aviation Security International coincides with the five-year anniversary of the Burgas Airport bombing. In June 2012, five Israelis and the Bulgarian driver of a bus transporting the arriving tourists from Burgas Airport to their Bulgarian resort were killed when a bomb detonated. The attacker exited the terminal with the passengers and attempted to load his rucksack onto the bus before being challenged by some of the Israeli tourists, at which point the device detonated, either initiated by the man himself or remotely by accomplices. Alice Vincent considers this incident, as well as the Brussels and Istanbul Airport attacks of 2016, drawing out implications for landside airport security design and operations.

Burgas Bombing

On 18 July 2012, an improvised explosive device (IED) detonated on a passenger bus at Burgas Airport in Bulgaria. The alleged perpetrator had a bomb comprising of 2-3kg of TNT powder in a rucksack and reportedly placed it in the luggage compartment of the vehicle. The device detonated whilst the bus was stationary and the vehicle caught fire. The bus was transporting 42 Israelis, mainly youths, whose flight had landed from Tel Aviv and who were about to make the journey from the airport to their hotels. The explosion killed the perpetrator, five Israeli passengers and the Bulgarian bus driver, and injured a further 35 people. The attacker was identified as Mohamad Hassan El-Husseini of dual Lebanese-French citizenship. Husseini’s two accomplices allegedly had links to Hezbollah.

Brussels Airport Attack

On 22 March 2016, two IEDs were manually detonated by terrorists nine seconds apart in the main terminal building at Brussels Airport. A third device exploded on a train at Maelbeek Metro station in central Brussels. All three explosions were part of a coordinated suicide bomb attack perpetrated by, according to the Belgian authorities, Belgian nationals. The Islamic State claimed responsibility. The IEDs in Brussels Airport were packed with nails and concealed in two suitcases. The attackers arrived at the airport together in a taxi before detonating their devices in the departures hall. Thirteen people were killed in the explosions and more than 80 injured. A third unexploded IED was discovered and disposed of by security forces in a controlled detonation. All IEDs used in the attacks are suspected of being comprised of TATP, a highly unstable homemade explosive.

Ataturk International Airport Attack

On 28 June 2016, a co-ordinated terrorist attack was launched against Terminal 2 at Ataturk International Airport, Istanbul. Three attackers assaulted a terminal (pre-check-in) screening checkpoint at the main entrance to the terminal building. The attackers arrived by taxi and opened fire on armed airport police and security personnel at the entrance to the arrivals hall of the terminal; one attacker gained entry to the building. The attacker was shot and injured by airport police but still managed to detonate an IED. A second attacker succeeded in penetrating the departures hall on the first floor where he opened fire on passengers. The attacker detonated a person-borne IED near the entrance to the departures hall. The final attacker exploded his device immediately outside the terminal building. The attack killed 45 people and injured at least 239 others.

Airport Landside Operations and Design – Vulnerabilities and Implications

These three attacks highlight that compliance-driven airport design and security measures are not sufficient on their own to address security vulnerabilities at landside areas of airports. Risk-based security design is likely to offer superior security and resilience for landside areas of airports in the event of an attack.

jetBlue, Terminal 5 JFK Airport (Credit: Arup)
jetBlue, Terminal 5 JFK Airport (Credit: Arup)

Attractiveness of Landside Areas for Terrorists

Landside areas of airports are highly likely to be priority targets for terrorists. They are locations where it is possible to cause mass casualties, as well as identify and target specific nationalities. They also provide the opportunity to attack airline check-in desks, which are, in the case of some national airlines, seen as proxies for national government targets. A Belgian-led investigation of the Zaventem Airport attack believed the American Airlines check-in counter was targeted and CCTV footage allegedly shows one attacker following a group of Hasidic Jews in the terminal before detonating his device. There is also the possibility to attack security forces patrolling landside areas. For instance, in March 2017, a lone attacker attempted to seize a police officer’s rifle in Orly Airport’s south terminal. An additional targeting draw at airports is the opportunity to attack and undermine a country’s tourism industry, causing economic losses for the industry and the government.

“…install a blast-tested glazed façade and terminal entrance doorways to minimise the risk of damage to the façade and fragmentation hazards to users…”

Istanbul Airport Departures Terminal (Credit: Arup)
Istanbul Airport Departures Terminal (Credit: Arup)

Security Vulnerabilities of Landside Areas

  • They are by nature crowded public places. This increases the potential for a threat actor to cause mass casualties as well as secondary casualties arising from a probable stampede of fleeing passengers through a terminal building.
  • They offer easy, largely unimpeded, access for threat actors. This includes areas such as car parks, access roads, drop-off zones and arrivals/departures halls.
  • Identifying suspicious behaviour/objects in a terminal building is difficult.
  • They are large geographical areas that are difficult to fully observe and control.
  • There is a high pedestrian flow rate through landside areas, which is necessary for an airport to function efficiently. However, this is likely to mean there is less opportunity to delay a malicious threat actor in order to minimise the impact of an attack.
  • There is an increasing use of glazing in terminal façades, which may present a secondary fragmentation risk to users of the building if the glazing is not enhanced against ballistics or blast attack.
  • There are typically a large quantity of fixtures and fittings inside terminal buildings, which may present a risk of secondary injuries to users of the building in the event of a blast event if not well-secured.

Reducing Property Damage to Landside Areas

The damaging consequences of explosive attacks can often be reduced through appropriate and proportional structural and glazing enhancements, which are designed to increase the resilience of a building against an attack. The explosions inside Terminal 2 at Istanbul Airport highlighted the potential consequences of internal explosions inside crowded public spaces, which were made clear only a few months earlier in the attack on Zaventem Airport’s terminal building. Damage to glazing, interior fixtures and fittings, ceilings, doorways and the floor slab was visible in images of the aftermath of these attacks. To reduce the damaging impact of future explosive attacks, airport designers, engineers and security managers could consider incorporating a range of measures into the design of landside areas:

  • Design the primary structure to withstand the loss of a key structural element. This is likely to help reduce the risk of a structural collapse of the building due to an explosion.
  • Minimise the use of brittle materials such as acrylic that may break into sharp objects in the event of an explosion.
  • Install a blast-tested glazed façade and terminal entrance doorways to minimise the risk of damage to the façade and fragmentation hazards to users of the building.

“…minimise balconies and mezzanines in terminal design – especially those that overlook check-in zones – to prevent an armed attacker firing down into the crowd…”

Terminal 5 JFK Airport, Security Screening
Terminal 5 JFK Airport, Security Screening (Credit: Arup)

Minimising Casualties to Users of Landside Areas

Designs that adopt measures to minimise crowding or that reduce the potential for secondary injuries from flying glass, should be considered. These risks are likely to appear in future attacks given the tactical profiles of attackers affiliated with, inspired or directed by the Islamic State. These attackers are highly likely to enter crowded public buildings with the intention of causing mass casualties. The resilience of future terminal buildings against explosive and marauding firearms attacks could benefit from a variety of measures that often help to mitigate these risks.

  • Minimise crowd packing in check-in zones to reduce the formation of crowded spaces that are likely to be more attractive targets to terrorists.
  • Tether or securely fasten internal fixtures and fittings that could cause injuries or even fatalities if dislodged by an explosion. This should include ceilings and false ceilings, which may be at risk of collapse following an explosion.
  • Minimise balconies and mezzanines in terminal design – especially those that overlook check-in zones – to prevent an armed attacker firing down into the crowd from a raised position.
  • Consider measures to enable swift and safe evacuation following an attack such as multiple wide exit/entry routes and appropriate way finding and signposting. This will help users of the building find their way out and to minimise further casualties as a result of trampling in a stampede. Videos posted on social media following the Istanbul Airport attack clearly showed a stampede of people attempting to flee the explosions inside the arrivals and departures halls. Consideration should also be given to the location and management of emergency assembly points and the risk of an attack on a crowd at a predictable time and place such as through a placed IED. In the Brussels Airport attack, the location of the explosions in the terminal building suggest that the attackers may have tried to use a pincer style attack by detonating one device causing the crowd to run before detonating a second device in the midst of the fleeing crowd.

Identifying Suspicious Behaviour at Landside Areas

The benefits of effectively identifying suspicious terrorist behaviour in landside areas of airports are that it may offer the opportunity to prevent an attack before it happens. By their nature, landside areas of airports are generally extremely busy places with high pedestrian traffic through terminal buildings as well as static groups of people waiting to greet arriving passengers or airline passengers waiting for pick-up. The size, complexity and activity of landside areas increase the difficulty of recognising potentially suspicious behaviour. Suspect terrorist behaviour is likely to include hostile reconnaissance in the early stages of attack planning and suspicious actions in the minutes or hours leading up to an attack. For example, detailed reports of the Istanbul attack suggest that one of the perpetrators had been caught on CCTV inside the terminal building in the hours leading up to the attack. Moreover, the perpetrators aroused the suspicion of guards manning the security checkpoint at the entrance to the terminal building because of their dress: at least one gunman was wearing a heavy jacket/coat – most likely to conceal his IED – in warm weather. Likewise, in the Burgas attack, the attacker was captured on CCTV walking around the parked buses an hour before the attack. To aid the identification of potentially suspicious behaviour, airport planners and designers could consider adopting design mitigation measures in landside areas such as:

  • Ensuring that the interior design of landside infrastructure offers good lines of sight and natural surveillance in order to increase the opportunity to detect potentially suspicious behaviour and reduce an attacker’s ability to conceal a weapon. The effectiveness of this measure could also be enhanced through the provision of good lighting throughout.
  • Deploying video surveillance and CCTV to provide full coverage of terminal buildings, multi-storey car parks and other covered infrastructure at landside areas as well as coverage of the terminal forecourt and main approach roads. This measure may be augmented with video analytics technologies to increase the likelihood of detecting suspicious terrorist behaviour.
  • Enabling the deployment of behavioural detection programmes to help security – and non-security staff – recognise indicators of potentially suspicious behaviour.

“…in the Burgas attack, the attacker was captured on CCTV walking around the parked buses an hour before the attack…”

One of the Istanbul terrorists caught  on CCTV in the termianl building
One of the Istanbul terrorists caught
on CCTV in the termianl building (Credit: Twitter)


Recent attacks have shown that terrorists will adopt proven and simple attack methods. They will actively seek to exploit observed security vulnerabilities at landside areas of airports. Security design can enhance operational security measures, e.g., natural lines of sight to observe suspicious behaviour. Design can also contribute to reducing the attractiveness of an airport as target. For example, if an identified vulnerability is a crowded place then operational planning to minimise crowding can make the target less appealing from a potential attacker’s point of view.

While more recent attacks have specifically focused on targeting the airport terminal, other landside areas such as car parks and bus areas – as exemplified by the Burgas incident – are similarly vulnerable and potentially appealing to malicious threat actors. Landside airport design should aim to take a holistic approach by reducing, if not designing-out, vulnerabilities as well as designing-in measures to enable a high standard of security but that do not conflict with the airport’s overall objectives. Finally, fostering a security culture that engages the aviation community beyond individuals with designated security responsibilities is likely to open up further opportunities to create safer and more secure airports.

Alice Vincent
Alice Vincent

Alice Vincent is a security risk consultant at Arup, working in their Resilience, Security & Risk team. She specialises in assessing malicious risks to buildings and infrastructure projects. Arup is currently supporting ACI’s development of global guidance on landside security. Alice can be contacted at