Introduction

A common finding in analyses of spatial and temporal variation in risk of terrorist attacks is that they are spatially clustered (Berrebi and Lakdawalla 2007; Townsley et al. 2008; Johnson and Braithwaite 2009; Siebeneck et al. 2009; Medina et al. 2011; Behlendorf et al. 2012; Mohler 2013; Tench et al. 2016). However, the spatial analyses that have been completed thus far have been unable to identify the potential correlates of these hotspots—just the fact they exist. Fortunately, risk terrain modelling (hereafter RTM) was developed in the study of urban crime to quantitatively assess the spatial influence of features of the urban landscape to identify areas where criminal activity is likely to emerge or persist. RTM has been applied to many different urban crimes including burglaries (Gale and Hollernan 2013; Moreto et al. 2014), robberies (Kennedy and Gaziarifoglu 2011; Dugato 2013), shootings (Caplan et al. 2011; Drawve et al. 2016a), aggravated assaults (Piza et al. 2011; Kennedy et al. 2016; Anyinam 2015; Kocher and Leitner 2015), and assaults on police (Drawve and Barnum 2018). Because RTM includes contextual information relevant to the social and physical environment, it should be an appropriate approach to assessing terrorism risk. In comparison, retrospective hot spot mapping attempts to predict the likelihood of future attack locations based solely on where attacks have previously occurred (Johnson et al. 2007), RTM can be used to estimate future risks of all areas, based on the presence or absence of identified risk factors.

Indeed, RTM can outperform retrospective mapping. The inclusion of environmental risk values produced better violent crime prediction models than those produced solely with hot spots (Kennedy et al. 2011; Caplan et al. 2013a). In both Yerxa (2013) and Dugato (2013), RTM outperformed kernel density estimation (KDE), a non-parametric method used to estimate the density of events and identify hotspots. In Drawve (2016) RTM was more precise than the nearest neighbor hierarchical (Nnh) method, which groups events together based on spatial proximity. This research consistently demonstrates that RTM can be an important crime prevention tool (Kennedy et al. 2011). However, its application to terrorist attacks has been extremely limited, with only two published studies available (according to the authors’ knowledge) (Onat 2016; Onat and Gul 2018).

In this paper, RTM will be used to identify risk factors related to violent dissident Irish Republican activity in Belfast, Northern Ireland, and to assess the predictive accuracy. This article examines the influences of social and physical context on target selection for two incident types: bombings and bomb hoaxes. Where bombings are concerned, there may be additional logistical elements involved in setting up and detonating viable devices that are not required for hoax devices. Hoaxes are intended to achieve different ends (to disrupt civilians and occupy the security services’ time) than bombings and can be carried out in riskier locations than bombings. The results demonstrate that there are differences between types of incident and provide further support for the argument that terrorists are rational actors. The results demonstrate that there are differences between types of incident and provide further support for the argument that terrorists are rational actors.

As well as being the first paper to apply RTM to terrorism in a Western context, it is the first to compare two types of terrorist incident using this method. Analyses of this kind can be an effective way of guiding the interventions and allocation of security resources needed to manage terrorist related incidents. Most recent analyses regarding spatial and temporal patterns of group terrorism using finer scales of analysis have been focused on conflicts in Middle Eastern countries such as Israel (Berrebi and Lakdawalla 2007; Kliot and Charney 2006), Pakistan, Afghanistan and Iraq (i.e. Townsley et al. 2008; Siebeneck et al. 2009; Johnson and Braithwaite 2009; O’Loughlin et al. 2010; Zammit-Mangion et al. 2012). Little has been done to examine the threat from a sustained campaign of violence in the West (with the exception of studies such as LaFree 2012; Behlendorf et al. 2012).

Literature Review

First, we give an overview of the nature of the threat from dissident Republican activity in Northern Ireland. We then discuss the current literature regarding the use of RTM and crime. Next, to develop the RTMs used in this study, potential risk factors for dissident Republican attacks must be determined. As such, we then review existing target selection studies and literature relevant to the Northern Irish context to identify potential correlates.

Violent Dissident Republican Activity

Prior to their final ceasefire on July 20, 1997, the Provisional Irish Republican Army (PIRA) was the most prolific terrorist organization operating within Northern Ireland. Since then, the Republican threat has instead emerged from multiple and distinct dissident groups who reject the constitutional compromise accepted by PIRA leadership. Collectively, dissident Republican organizations maintain that the only acceptable outcome is the complete reunification of the island of Ireland (Frampton 2011, 2012; Evans and Tonge 2012). They also take the view that PIRA and its political wing, Sinn Féin, have become collaborators with the British state particularly through their endorsement of the Police Service of Northern Ireland (PSNI). This is regularly demonstrated in their organisational statements (Morrison 2016).

In January 2007, Sinn Féin made the historic announcement of their acceptance of PSNI as the legitimate police force of Northern Ireland. Since then there has been a steady rise in paramilitary violence from the dissident Republican groups who fundamentally oppose Republican engagement in the wider peace process and this acceptance of the PSNI (Horgan and Morrison 2011; Morrison and Horgan 2016). These groups, including the Continuity IRA and the New IRA, have continued their paramilitary campaigns in the aftermath of 1998s Good Friday Agreement which ostensibly brought an end to the 29-year conflict known as ‘the Troubles’. They want to demonstrate that the peace process has failed and regard violence as a legitimate means of achieving a united Ireland (Frampton 2011, 2012; Bean 2012; Evans and Tonge 2012).

Their principle strategy is to undermine the regime created by the Good Friday Agreement in a number of ways including: obstructing its institutions, seeking to increase British Army presence on the streets, offering alternative policing functions, seeking to recruit young members of the Catholic community, targeting Catholic members of the security and police forces and ultimately by precluding the establishment of a normalized existence. In essence, they hope to emphatically demonstrate that the agreement has failed (Frampton 2011, 2012; Bean 2012). Their use of violence therefore intends to act as both a “medium of mobilisation and propaganda against the state” (Bean 2012: 213). However, lacking a comparable capability to the PIRA (Frampton 2012), they have been unable to undertake an intense and high profile campaign of violence. Instead, they use persistent and often low-level violence to shatter any illusion of peace and to occupy the resources of the police services, limiting their ability to fulfil their traditional role and consequently undermining their authority (Frampton 2011; 2012, Horgan and Morrison 2011).

Although their campaign has thus far been less intensive than that of PIRA, they still pose a significant threat to UK security, and their activity demonstrates a rising sophistication in strategy and expertise. They have become increasingly competent in producing viable devices and have incorporated the use of bomb hoaxes into their strategy, which cause distress to the public and diminish police service resources. However, for the most part dissident Republican activity has not seen any significant engagement with Loyalist paramilitaries.

To date, the literature surrounding dissident Republican related terrorism has been largely descriptive. To the authors’ knowledge, at present there is only one study that looks specifically at the targeting of contemporary groups. Morrison and Horgan (2016) conclude that civilians are most at risk for violence (especially post 2009) and can be considered the dominant target of the dissident Republican campaign. 63.5% of attacks were against civilians, with attacks occurring in residential, urban and rural areas (Morrison and Horgan 2016). Targeting of the security services also remains a prominent feature of dissident Republican violence and were the second most targeted category in the study. In March 2009, Stephen Carroll became the first police officer to be killed since the Good Friday Agreement. The Continuity IRA stated the following in their claim of responsibility: “As long as there is British involvement in Ireland, these attacks will continue.” To discourage others from joining the police, dissident Republicans have focused on the targeting of Catholic and nationalist officers (Morrison and Horgan 2016). This reinforces their characterisation of an unrepresentative police force, demonstrating that, to them, the British police force is not legitimate, and is a means of setting themselves apart from Sinn Féin.

Risk Terrain Modelling

Building on the foundations of environmental criminology, Caplan et al. (2011) developed RTM as a spatial diagnostic technique to operationalize features of the environment and determine their spatial influences related to a specific outcome. Each location has an associated value to an offender, which is determined by the opportunity for crime that it offers. RTM can be used to identify the locations that have the greatest estimated opportunity and therefore pose the highest level of risk. RTM identifies high risk locations that are potentially correlated with the presence or absence of future event(s) in a particular location. The number of relevant features deemed to have a spatial influence on increasing the likelihood of crime determine the level of risk. In combination, these correlates of criminal events identify areas within a city at the highest risk of future incidents.

As previously stated, RTM has been applied to a wide number of crime types and the spatial features examined vary from study to study. For example, Gale and Hollernan (2013) applied RTM to residential burglaries in Lawrence Township, New Jersey (NJ). They found significant associations between burglaries and concentrations of bus stops, which can offer an offender easy access and escape when committing their crimes. Calls to the police reporting the presence of suspicious vehicles and persons were also significant correlates for residential burglary. The areas with the highest concentrations of these three factors had the highest concentration of offences. Moreto et al. (2014) found residential burglaries were more likely to occur in places spatially influenced by factors such as the presence of pawn shops, at-risk housing and drug markets.

Kennedy and Gaziarifoglu’s (2011) analyses of street robbery in Newark found five associated risk factors: bus stops, retail venues, banks, drug arrests and prostitution arrests. Once these factors had been combined and reclassified according to risk levels, they concluded that a robbery was almost 2.3 times more likely to occur with every unit increase in the risk value of a cell. Dugato (2013) identified transport stations, public housing, prostitution offences, banks, licensed premises and post offices as risk factors for robberies in Milan, Italy. Daley et al. (2016) applied RTM to identify areas at high risk of instances of child maltreatment, including neglect, physical abuse and sexual abuse in Fort Worth, Texas. In the year after the study, half of all instances occurred in the top 10% of the areas deemed as having the highest risk, with 98% of cases occurring in areas that were identified by the model as being at elevated risk.

RTM has also been successfully applied to violent crimes. Kennedy et al. (2016) found known problem buildings, foreclosures and gang hotspots to be significantly correlated with aggravated assaults in Chicago. Interestingly, variables that are typically associated with assaults in other cities, such as bars and liquor stores, were less likely to be associated with this type of crime within the Chicago context. Drawve et al. (2016b) tested the predictive accuracy of RTM for shootings in Little Rock, Arkansas. Six of the seven social and physical environmental measures in the RTM significantly predicted future gun crime locations: on-site consumption and off-site consumption alcohol establishments; fast food establishments; drug incidents; percentage of black residents and percentage of male residents. Drawve and Barnum (2018) applied RTM to aggravated assault and found bus stops and liquor stores to be consistently present as risk factors for different areas in Little Rock.

Although the application of RTM to terrorism has been limited, it has been used to identify risk factors related to armed conflict (Gaziarifoglu et al. 2012) which include variables commonly used to study terrorism such as population density, political instability and ethnic or religious divisions in society (i.e. Collier and Hoeffler 2004; Fearon and Laitin 2003; Goldstone et al. 2010). However, almost all risk indicators identified so far are based on studies of armed conflict in African countries and therefore may yield different results to those in Europe (Buhaug and Rød 2006). Prior studies are also largely focused on social factors, which tend to be consistent across large geographical areas, and as such provide little utility to prevention efforts at micro places.

Because RTM includes contextual information relevant to the social and physical environment it should be an appropriate approach to assessing terrorism risk. Whilst retrospective hot spot mapping attempts to predict the likelihood of the locations of future attacks based solely on where attacks have previously occurred (Johnson et al. 2007), RTM can be used to estimate future risks of all areas. To the authors’ knowledge, at present there have only been two applications of RTM to terrorist attacks at the micro level. Onat (2016) identified areas that were at risk of attack from terrorist groups in Istanbul. He found the riskiest factor in the urban environment to be the presence of bakeries. Although this type of building has no symbolic value, bakeries have a social meaning in Turkish culture and are visited frequently by most residents. Thus, bakeries have a role in an individual’s daily routine. Because they attract large numbers of people daily, they can be considered a generator of many available targets. This again highlights the importance of considering an individual’s every day behaviour, and their awareness space (Brantingham and Brantingham 1981), in the selection of targets. Other significant correlates included religious facilities, bars and clubs, and grocery stores. Whereas these latter significant correlates may be generalisable to other conflicts, the presence of bakeries may be culturally-specific to certain contexts. Thus, RTM’s application to terrorism warrants further testing in non-similar cities.

Building from the prior RTM Istanbul terrorism study, Onat and Gul (2018) identified differences in terrorist targeting according to two ideologies: separatist and leftist groups. Grocery stores, bakeries, bars/clubs, and educational facilities were identified as significant risk factors for both types. Onat and Gul (2018) also found differences in risk factors for attacks by each group. Religious facilities and office blocks were significant correlates of separatist attacks but not for leftist attacks. Government buildings were found to be a significant risk factor for leftist attacks only. This paper also built on Onat (2016) by testing the predictive accuracy of the RTM. They found that a model based on the preceding 36-month period was accurate in predicting the locations of almost half the attacks in the top 10% highest risk cells, and nearly 80% in the top 20% highest risk cells, in the 20-month period that followed.

Spatial Risk Factors of Dissident Republican Attacks

To test the utility of RTM for terrorism, as well as to generate the relevant hypotheses and risk factors, it was necessary to first select a geographical area that had experienced several incidents. As well as being the capital of Northern Ireland, Belfast has been central to the Northern Ireland conflict and has experienced the most dissident Republican activity and was therefore selected. Next, to develop the RTM, potential risk factors for attacks must be determined through a review of existing target selection literature to identify potential correlates. These can then be operationalised to geographic units over a continuous surface and incorporated into the model. The following features are considered: crime generators, ideology, social context and other related crimes committed by dissident Republicans.

Crime generators are places that attract large numbers of people for reasons unrelated to criminal motivation, but offer increased opportunities for crime due to the high footfall (Clarke and Eck 2003). For terrorist attacks, crime generators are likely to attract offenders due to the large amount of people in one space, therefore increasing the likelihood of a high number of casualties and witnesses, and increased likelihood of disruption. These areas also offer easy means of escape, as the attacker can move discreetly throughout the crowd. As suggested above, the existing RTM literature consistently suggests two types of such crime generators: commercial enterprises (pubs/bars, restaurants/cafes, shops) and transport hubs. Additionally, for the Northern Ireland context, it might be worth considering the presence of sports clubs. Such locations, such as football clubs, attract large numbers of people and play an important part in Northern Irish culture. Football is religiously divided in Northern Ireland (Cronin 2000; Bairner and Shirlow 1998), and violent conflict between clubs is well known and documented (Bairner 1999).

Ideology impacts terrorist targeting because it “sets out the moral framework within which they operate” (Drake 1998: 53). There should therefore be some consideration of Republican ideology and further highlights the need for conflict-specific risk terrain modelling. Since dissident Republicans reject UK government rule in Northern Ireland, government buildings are likely to act as crime attractors due to the quantity of government workers present in the buildings and in the surrounding areas. When considering urban crimes, premises such a police stations can be considered as crime detractors. However, dissident Republican groups consider the police an illegitimate force in Northern Ireland. It is likely therefore that premises such as police stations will act as crime attractors, due to their symbolic nature. This also further highlights the need for crime-specific risk terrain modelling. The Orange Order (The Loyal Orange Institution), whose members are overwhelmingly Protestant, are in favour of Northern Ireland’s union with the UK. There has been a lot of conflict surrounding Orange Order marches, where individuals march carrying flags depicting scenes from Protestant and Orange Order history. There is therefore the possibility that Orange Order halls and lodges could act as attractors.

Gimenez-Santana et al.’s (2017) RTM of crime in the highly segregated city of Bogota, demonstrates the utility of examining the social context of a city. Low strata neighbourhoods were significantly correlated with personal injury and homicide. High strata neighbourhoods were significantly correlated with theft. In the Northern Irish context, churches are a good measure of the social context/segregation. Belfast, in particular, is highly segregated and it is likely that the religiosity of the area would influence target selection. It may be that areas within the city with a Catholic majority are more likely to be attacked as it is likely that they are more familiar with certain areas and would also be less likely to be detected as a member of the ‘opposition’. Areas within an individual’s awareness space are more likely to be targeted (Gill et al. 2017; Marchment et al. 2018). Catholic churches may therefore serve as ‘risky places’ for attacks. On the other hand, it could be that a Catholic majority could deter offenders choosing these areas as to not risk attacking someone they know, and areas with a Protestant majority may offer a higher number of targets. Therefore, the effects of both will be examined.

RTM research also demonstrates the importance of considering other (perhaps related) crimes in the modelling. For example, Kennedy et al. (2011) successfully predicted the location of shootings by using drug arrests as a risk factor because the underlying factors that drive these crimes are similar (e.g. high levels of gang related activity in areas that are socially disorganised). Gale and Hollernan (2013) found a statistically significant association between burglary and calls for suspicious persons and vehicles. Dugato et al’s (2017) RTM of organised crime violence in Italy from 2004 to 2011 found that other crime activities of the group such as drug-dealing were significant correlates of mafia homicides (Dugato et al. 2017). 11% of the city area was identified as being at high risk. This area contained 85% of homicides that occurred in the following year. Such predictors out-performed social disorganisation variables, such as poor socio-economic conditions, percentage of unemployed residents and residential instability, which were non-significant. Escudero and Ramírez (2018) found that illicit drug markets were significantly correlated with motorcycle thefts. Anyinam (2015) found the most important predictor for violent crimes to be public calls regarding drug offences.

The current threat from dissident Republican groups is characterised by a parallel strategy of nationalised terrorism alongside localised violent vigilantism (Morrison and Horgan 2016). Believing they possess a ‘responsibility’ to defend and protect their community is a key component of modern Republican ideology (O’Doherty 1998). This covers both protection from Loyalist violence, and protection from anti-social behaviour and crime within the community (McEvoy and Mika 2001). Paramilitary groups claim to better represent the local communities than the PSNI and have taken it upon themselves to enact forms of vigilante justice on local criminals such as sex offenders and drug dealers. These ‘punishment attacks’ can also act as a form of internal policing within the groups themselves (i.e. punishing suspected informers). These are not acts of terrorism, rather acts of violence committed by terrorists, to gain support and power within their community. These activities may influence the locations of attacks due to increased familiarity with these areas, increasing the recognition of opportunities, as well as ease of escape. We therefore include other known dissident Republican activity, such as punishment attacks; protests and riots; or arms finds.

Differences in Attack Type

Different types of crime exhibit different spatial patterns (Andresen and Linning 2012). Barnum et al’s (2017) examination of drug dealing locations in Chicago found grocery stores and foreclosures to be risk factors across all types of drugs studied (cannabis, heroin, crack and cocaine). However, the degree of spatial influence of these common risk factors varied. There were also multiple other risk factors that varied for each drug, for example parks and homeless shelters were correlates of heroin dealing only. This highlights the importance of disaggregating data.

Any analysis of terrorist activity should consider differences between attack types, as they serve different purposes. For bomb hoaxes, the goal is not to cause casualties, but to occupy the security services’ time, portray them as ineffective, carry out ‘dry-runs’ for actual bombings and disrupt political normality. Also, the associated risks with carrying out a successful bombing are much higher than a bomb hoax. Building a viable device requires a higher level of capability and resources. A bomb may need to be activated by someone in the vicinity shortly before, whereas a bomb hoax can be left for a long period of time. Therefore, it is likely that there is more consideration about risk of detection and ease of escape in the commission of an attack involving a viable device, so the locations of these types of incidents should differ.

Data and Analytical Strategy

Incident Data

The data of terrorist incidents was obtained from a previously compiled dataset that was created for the ‘Violent Dissident Republican Project’ (Horgan and Morrison 2011) and has been updated regularly since (Morrison and Horgan 2016). It was created using open sources and at the time of analysis contained dissident Republican incidents in Northern Ireland from 1990 until the end of 2016. The dataset consisted of violent and non-violent incidents and included information regarding the date and time of the incident, the location of the incident, incident type, victim type, and so on. To maximise the utility for potential use by practitioners only attacks that took place during the most recent wave (the Contemporary wave as defined by Morrison and Horgan 2016)—January 2007 to December 2016—were used for the analyses.Footnote 1 All bombings and bomb hoaxes within this period where a geographical location was known were used for the subsequent analyses.Footnote 2 Incidents from January 2007 to December 2013 were used to develop each RTM, consisting of 99 bombings and 89 bomb hoaxes. Incidents from January 2014 to December 2016 were used to test the predictive accuracy of each model. Each dataset was geocoded and converted into a point file, to be used as the event data for the relevant model.

Geographical Domain

Belfast is the capital and largest city of Northern Ireland and is on the flood plain of the River Lagan. The geographical boundary (polygon) data was obtained from the Northern Ireland Statistics and Research Agency (NISRA).

Risk Factors

To operationalise the risk factors, data were obtained from several sources. Most locations of the physical infrastructure to create the feature sets were obtained from Open Data NI. This included the following: pubs, bars, restaurants, cafes, sports clubs, Catholic and Protestant churches, railway and bus stations, and government buildings.Footnote 3 Addresses for Police Service of Northern Ireland (PSNI) stations were obtained from an existing dataset created by John Morrison. The locations of Orange Order Lodges were received from Professor Eric Kaufmann.Footnote 4 The data concerning riots/protests, arms finds and punishment attacks was drawn from the original ‘Violent Dissident Republican Project’ dataset.

Care was taken to ensure that there was no overlap between cases. To prevent overlap of incidents which could invalidate the results, each bombing and hoax that were included in the outcome events were separate from the other dissident Republican activity that was included in the risk factors. For example, none of the bombings occurred during any of the riots. Each feature set was geocoded and converted into a point shapefile using ArcGIS and used as a layer to represent the presence or absence of risk factors in each grid square.

RTMDx Utility

The RTMDx Diagnostics Utility (Caplan and Kennedy 2013; Caplan et al. 2013b) software automates the statistical procedures involved in RTM and was used to identify the significant risk layers. This tool evaluates the relative influence and importance of risk factors using a bidirectional stepwise regression process. The variables are examined and the most problematic risk factors are selected, along with their most appropriate spatial influence distance, to build the overall best model.

The software requires several parameters to be set prior to analysis. The relevant file of event data (aggregated to raster cells) was selected as the outcome event for each model. The polygon shapefile of Belfast was used to define the boundary to be tested. RTMDx allows for two types of model: aggravating (to identify factors that increase risk) and protective (to identify factors that decrease risk). An aggravating model was used for the analyses conducted in this paper, to determine which factors increased the risk of dissident Republican incidents.

The parameter ‘operationalization’ was used to select how the spatial influence of each variable was to be assessed, based on proximity or density. Spatial influence for proximity is operationalized as the presence of a physical feature within the defined distance from the event. Spatial influence for density is operationalized as a high concentration of a physical feature within the defined distance from the event. To determine which of these two functions was appropriate, it was necessary to compute a nearest neighbor index (Nni) for each risk factor using the CrimeStatIV software to determine whether they were clustered. A nearest neighbour index (Nni) of less than 1 is indicative of clustering, values of more than 1 are indicative of dispersion. Risk factors that were significantly clustered were operationalized by ‘density’, and those that weren’t were operationalized by ‘proximity’ (see Table 1).

Table 1 Nearest neighbour indexes and operationalisations of risk factors to be used in the model
Full size table

It was also necessary to define the grid cell size for the outputs. Caplan and Kennedy (2010) suggest that using the average street length (in this case 100 m), with a cell raster size of half a street length (50 m) is appropriate to create the cells. To maximize the potential utility of the model, the risk factors were operationalized to a maximum spatial influence of 400 m (four streets). Taylor and Harrell (1996) propose that places prone to crime consist of a few streets, and this measure is a realistic area to use for the guidance of future policing measures. Each file was converted into a raster layer via the Density and Proximity Tools in ArcMap’s Spatial Analyst extension. Each raster map contained equally sized 50 m × 50 m cells to reflect half of the average street length in Belfast, as measured within ArcMap. Each cell received a count of points falling within its boundaries.

The first model used bombings as the outcome event, and the second model used bomb hoaxes. For each model, the 13 risk factors defined above generated 58 variables (testing the spatial influence of each risk factor as a function for either proximity or density at 100, 200, 300 and 400 m) that were tested for significance. The testing process began by building an elastic net penalized regression model assuming a Poisson distribution of events. The process then selected variables that may be potentially useful through cross validation, which were then utilised in a bidirectional step-wise regression process (starting with a null model), to build the optimal model by optimising the Bayesian Information Criteria (BIC). This score is a balance of complexity of the model and fit of the data. The models also include two intercept terms that represent the background rate of events and overdispersion of the event counts. Exponentiated coefficient values were used to produce the relative risk values, which can be interpreted as the weights of the risk factor (Caplan et al. 2013b).

Results

Bombings

The RTMDx Utility determined that the best risk terrain model was a Negative Binomial type II model with 3 risk factors and a BIC score of 1174.1. The selected risk terrain model was assigned relative risk scores to cells ranging from 1 for the lowest risk cell to 460.1 for the highest risk cell. A cell with a value of 460.1 has an expected rate of bombings that is 460.1 times higher than a cell with a value of 1 (Table 2).

Table 2 Results of the bombings RTM
Full size table

Previous protests and riots were the riskiest factor for this model, with a relative risk value of 14.07 and a spatial influence of 100 m.Footnote 5 The second riskiest factor was areas dense with punishment attacks with a relative risk value of 6.56 and a spatial influence of 300 m. Areas dense with pubs and bars had a relative risk value of 4.98, with a spatial influence of 200 m.Footnote 6

A point density layer for the risk factors operationalised by density were derived using the ArcGIS ‘Kernel Density’ tool, and those based on proximity were created using the ‘Euclidean Distance’ tool. They were then combined to produce a composite risk terrain map for each of the two models. Using ‘Map Algebra’ in the ‘Raster Calculator’ function in the ‘Spatial Analyst’ extension in ArcMap the risk terrain map for bombings was produced using the following formula:

$${\text{Exp}}\left( { - \,6.9640 + 2.6443\,*\,{\text{``Protests''}} + 1.8809\,*\,{\text{``Punishment}}\,{\text{Attacks''}} + 1.6062\,*\,{\text{``Pubs/Bars''}}} \right)/{\text{Exp}}\left( { - \,6.9640} \right)$$

For the risk terrain maps Belfast was modelled as a continuous surface grid of 100 m × 100 m cells. Each cell was reclassified into 1 of 4 risk levels, according to standard deviational breaks (Fig. 1). Low risk was classified as a cell value between 0 and the mean cell value (1.47); medium risk was classified as a cell value between the mean and 1 standard deviation (SD) (1.48–6.28); high risk was between + 1SD and + 2SD (6.29–11.09); and very high risk were all cell values above + 2SDs (> 11.09).

Fig. 1
figure 1

Risk terrain map for bombings in Belfast 2007–2013

Full size image

Bomb Hoaxes

The RTMDx Utility determined that the best risk terrain model was a Negative Binomial type II model with 3 risk factors and a BIC score of 1195.2. The selected risk terrain model was assigned relative risk scores to cells ranging from 1 for the lowest risk cell to 94.3 for the highest risk cell (Table 3).

Table 3 Results of the bomb hoaxes RTM
Full size table

Punishment attacks were the riskiest factor for this model, with a relative risk value of 10.77 and a spatial influence of 100 m. This was followed by police stations with a relative risk value of 8.76 and a spatial influence of 200 m, and places dense with shops, with a relative risk value of 6.94 and spatial influence of 400 m.

For bomb hoaxes, the formula for the risk terrain map was as follows:

$${\text{Exp}}\left( { - \,7.1510 + 2.3764\,*\,{\text{``Punishment}}\,{\text{Attacks''}} + 2.1703\,*\,{\text{``Police}}\,{\text{Stations''}} + 1.9378\,*\,{\text{``Shops''}}} \right)/{\text{Exp}}\left( { - \,7.1510} \right)$$

As before, each cell was reclassified into 1 of 4 risk levels. Low risk: 0—mean (0–2.21); medium risk: mean—+ 1SD 2.22–10.61); high risk: + 1SD—+ 2SD (10.62–19.01) and very high risk were all cell values above + 2SDs (> 19.01) (Fig. 2).

Fig. 2
figure 2

Risk terrain map for bomb hoaxes in Belfast, 2007–2013

Full size image

Predictive Accuracy

The risk terrain maps in Figs. 1 and 2 show the areas within Belfast that are most likely to attract or enable bombings or bomb hoaxes. In line with previous research it would have been preferable to run binary logistic regressions to ascertain the predictive accuracy of the models. However, due to an insufficient amount of data, this was not possible. Therefore, some descriptive statistics will be provided using bombings and bomb hoaxes between 2014 and 2017 (see Table 4). These results demonstrate that several post-2013 incidents occurred in places that appear to be the most vulnerable.

Fig. 3
figure 3

Risk terrain map with 2014–2017 bombings (n = 28)

Full size image
Table 4 Frequency of incidents per risk level, 2014–2017
Full size table

During this period, 28 bombings occurred. Seven bombings occurred in the cells that were inferred as being at very high risk. Seven occurred in high risk cells. 2 bombings occurred in medium risk cells and 12 bombings occurred in areas deemed to be at low risk (see Fig. 3). Eight hoaxes occurred post-2013. Four occurred in medium risk areas, two in high risk areas and two in very high risk areas. No hoaxes occurred in areas deemed to be at low risk (see Fig. 4).

Fig. 4
figure 4

Risk terrain map with 2014–2017 bomb hoaxes (n = 8)

Full size image

Discussion

This study identified areas in the city of Belfast that could be at risk for future incidents of dissident Republican violence, based on the spatial influence of features identified through a review of previous literature. A combination of factors contributed to the associated risk levels, which were determined through RTM. As hypothesized, different risk factors were identified for the two different incident types. The results indicated that previous experience of protests/riots and punishment attacks, and the presence of pubs/bars were associated with bombings. Previous experience of punishment attacks and the presence of police stations and shops were associated with bomb hoaxes.

To be consistent with previous research such as Caplan et al. (2011), a binary logistic regression was originally planned to determine whether bombings and bomb hoaxes in a second defined period occurred in cells which were deemed to be ‘high risk’. However, the total dataset was deemed too small to split reliably and in a meaningful manner. The descriptive statistics that were implemented as an alternative are promising and indicate that it may be useful to incorporate this method in guiding counter-terrorism measures. Half of bombings and bomb hoaxes in the post-RTM study period occurred in high or very high risk cells, and it can be suggested that these areas should be hardened where possible. Seeing as only a small proportion of the city was deemed to be at the high or very high levels of risk, this is impressive. However, some caution should be advised due to the small amount of data used to test this. A large proportion (43%) of bombings did occur in low risk cells. Although several did occur very close to areas deemed to be at risk, the predictive accuracy of this method is therefore difficult to determine. If enough data for the years post-RTM could be obtained, a logistic regression could be used to see if the odds of a bombing or bomb hoax occurring increases as the spatial risk value of the cells increases.

The riskiest factor for bombings was protests/riots. This was followed by punishment attacks which were also the riskiest factor for bomb hoaxes. This highlights the importance of considering other known activity of the group being studied. It is likely that these areas would have been known to the individuals involved in the attacks, and the increased familiarity with these areas increases the recognition of opportunities, as well as ease of escape. This concurs with the results of Onat’s (2016) RTM study of PKK attacks in Turkey, where bakeries were found to be a significant correlate due to their role in individuals’ daily routines. The RTM identified other associated dissident Republican activity as strong influences on the locations of bombings. This finding is also consistent with Dugato et al. (2017), who found the highest correlates of mafia homicides in Naples to be other Camorra related activity.

It was proposed that there may be an increased risk in areas surrounding premises relevant to the group’s ideology. Police stations were identified as risky places for bomb hoaxes, however this risk factor was not significantly correlated with bombings. This difference could be explained by the perceived level of security at these premises and therefore increased likelihood of detection/reduced likelihood of success. As Morrison and Horgan (2016) highlight in their study of dissident Republican target selection, the targeting of police services naturally comes with a higher risk of arrest, due to the presence of police officers surrounding the point of attack. This result suggests that there is some assessment of risk by the offenders, and that they are selecting targets rationally. This is consistent with the findings of Gill et al. (2018), who concluded that fear of detection plays a strong role in the decision-making encompassing a terrorist event by those groups not intending the offender’s death at the scene of the attack. It can be proposed that there may be differences between targets relevant to ideology and realistic targets with increased chance of success.

Places dense with pubs and bars were significantly correlated with bombings, and those dense with shops were significantly correlated with bomb hoaxes. For the data used in this study, bombings were more frequent in the late evening and very early morning. Hoaxes were more frequent in the late morning, afternoon and early evening. This would explain the difference in identified risk factors between the two incident types, as it is likely that areas dense with shops are more likely to be targeted during the day and at weekends, and areas dense with pubs and bars more likely to be targeted in the evenings. Further research should examine the level of risk each factor poses according to temporal variables. As the period studied spans 10 years, it could be argued that the infrastructure underwent some changes during this time. However, Caplan et al. (2011) argue that generally infrastructure is stable over time.

Urban areas that have a high human density with plenty of foot flow and low levels of security are vulnerable to attacks. They allow the attacker to potentially operate discretely, increase the chances of escaping undetected, and offer a predictable amount of human density. As well as these factors, the high concentration of individuals also makes these areas an attractive target due to the number of potential casualties and fatalities. These findings are consistent with Onat and Gul’s (2018) findings and with Webb and Cutter’s (2009) argument that the spatial strategies of terrorism have shifted towards places of everyday activity. This seems to be the case with more recent attacks inspired by Daesh, who have targeted highly populous public spaces.

Restaurants and cafes, Protestant churches, sports clubs, transport hubs and arms finds were not significant correlates of bombings or bomb hoaxes. Dissident Republican groups are known to attack along the railway lines (Horgan and Morrison 2011), however it was not possible to add the length of the lines onto the RTM. Government buildings may have a high level of security and therefore deter attacks, with the actors preferring more populous areas with less security measures.

It would have been preferable to examine the effects of residential segregation in more detail. However, the only religious data that could be obtained was for Small Area (SA) level. As there is a high degree of variation in the land area that SAs cover it was deemed inappropriate to use the centroids of majority Catholic or Protestant areas as a risk factor. If grid square level data was obtainable, this could have been a useful addition to the model, although the land area that each grid square covers (typically 1 km2) is likely to have been too large to establish a meaningful connection.

This study is subject to some limitations. Only one city was modelled, and one ideological group studied, therefore it may not be appropriate to generalise these findings. The results of the models suggest that risk terrain modelling could be an important tool in the policing of terrorist events in Northern Ireland. Although they may have limited applicability to other regions, some of the findings may also be valid in other contexts. For example, the finding that populous areas such as places dense with pubs, bars and shops are significant correlates of attacks may hold in other cities, and future research should endeavour to study this. Until this is established, it should not be assumed that the results of this RTM can be applied across all environments. Some of the risk factors that were identified were a unique combination of Republican ideology and Northern Irish culture, and so the risk factors identified may be specific to the spatial and situational contexts of dissident Republican activity. Further, as with all open source data, there is always the possibility that the locations of some events were not recorded accurately, and as such the distances from the risk factors could be under or over estimated.

Conclusion

The mode of analysis applied in this paper can be a useful tool in guiding targeted responses to the dissident Republican threat in Belfast. It has identified specific areas that are more vulnerable to attacks than elsewhere in the city and should therefore be prioritized in security measures. Other known activity of the group, symbolic buildings and populous areas were all found to be correlates of terrorist incidents. This has important implications for the policing of terrorism in Belfast and has the potential to be applied to other cities within Northern Ireland. Extra resources could be deployed to the areas identified as being high risk when necessary, and target hardening can be implemented in these areas. It should not be assumed that all areas which were identified as being high risk will be targeted. Some caution is advised as the hotspots were created using retrospective data. If an intervention is implemented there is the possibility for displacement. However, as this type of model identifies the key correlates of the hotspots, rather than solely their location, other possible future locations can be identified based on the risk values of the variables.