On 26 June, a man was walking along a beach in the Tunisian resort of Sousse carrying a parasol. Concealed within that parasol was an assault rifle, and in the ruthless attack that followed, 38 would be killed and 39 injured.

The determined brutality of the perpetrator speaks for itself, but as the latest in a series of assaults on luxury resorts and tourist attractions in the Middle East and North Africa, the tragedy also sent further shockwaves across the hotel industry.

First opening fire on the beachfront close to the Imperial Marhaba, gunman Seifeddine Rezgui later made his way into the hotel itself, where his familiarity with the layout was apparent, witnesses say.

According to Marc Josselin, operations director at leading security consultants Whispering Bell, preventing these increasingly common ‘lone-wolf’ attacks is especially difficult due to the large degree to which malevolent individuals or groups are able to familiarise themselves with hotels in advance.

"A main disadvantage of hotel establishments is that anyone can walk in undetected, sit in reception drinking a coffee and make a plan of attack," he says. "They can get in a lift, book into a room and conduct the attack from the inside – that’s how easy it is. That wouldn’t be possible in a UK or US Embassy in Baghdad, for example."

Josselin argues that the recent phenomenon of the ‘lone-shooter’ type of attack is particularly hard for hotels to counter, specifically because of its lack of complexity. While hotels today incorporate many physical deterrents into the design of their premises, such measures primarily guard against the kind of vehicle-borne IED threat that was more common in previous decades. Such measures, he says, can be quite easily defeated by a pair of running shoes and an assault rifle. What’s more, the relatively autonomous approach to today’s attacks makes the latter harder to intercept.

"What we were considering as the main threat from the turn of the century was more centralised; it was ordered from the caves of Tora Bora, for example," Josselin says. "But this ISIS threat now is so disparate and hard to detect that, in reality, we are always going to be behind the curve. The simplicity of these attacks gives them an advantage. We are now in a difficult era with regard to such acts."

 

Protection or discretion?

The challenge that hotels face is achieving a balance between ample security and discretion, because as much as guests want to feel protected, the last thing they want is armed guards outside their room.

"You can add more physical measures, but the measures you would need to block a man with an AK-47 would end your business," Josselin says. "You start having a prison-like entry system, and when you do that, you’re no longer in the industry of hospitality."

Such an approach could be seen in Sousse in the aftermath of June’s attack, with 1,000 extra police deployed to patrol tourist beaches, bearing arms and masked with balaclavas. Amid such emphatic scenes, the decision of several states to advise against all but essential travel to Tunisia was perhaps unsurprising, whatever additional intelligence they may have been party to. "I think people would prefer to know that things are being done that they don’t see, and that these measures are effective, as opposed to men in balaclavas with assault rifles standing around hotels," Josselin says.

While the nature of the terrorist plot has clearly evolved, the threat level itself has not actually increased, according to security leaders at Carlson Rezidor. Paul Moxness, vice-president corporate safety and security, and Tony Johnson, area security manager, Middle East and sub-Saharan Africa, told me about the latest incidents and the implications for security in the region.

"When it comes to the attack in Tunisia and the things that have gone on in Libya in recent years, we don’t actually view those as game changers to the threat perspective," Moxness says. "We think it is existing threat that has just manifested itself in recent incidents. But it obviously has a big impact on the business side."

For Moxness, a hotel’s security programme should be based on constant monitoring rather than individual events. "That’s why the threat assessment is so important for us on a continuous basis, but it’s also where everything starts," he says. "Then we’re not jumping up and down every time something happens, but hopefully we’ve seen it coming and been able to put things in place ahead of time."

Precisely because of the current high-threat environment, Carlson Rezidor conducted an audit of its hotels in Tunisia in January. In acknowledging terrorists’ changing tactics, it also updated its hotel lockdown procedure and active shooter guidance for all of its hotels; but Moxness and Johnson are eager to point out that the threat is a global one. It’s an easy case to make, with high-profile shootings in Paris and Copenhagen at the beginning of this year, and in Canada just months before.

"Concerning our Middle East properties, my fear of this lone-shooter scenario is far less than for our European hotels," Johnson says. "We have all the security in place, and we do get support from the military or the ministry of the interior, depending on the country."

Hotels based in the MENA region are also at an advantage in that they do not face the same limiting factor of the considerable cost of full-time security staff in Europe.

"The perceived threat viewed through Western eyes is that the Middle East is dangerous and Europe is safe," Moxness says. "But in reality, it’s not necessarily like that, and when it comes to preparedness levels – the physical security measures, the manpower – everything like that is much higher in Middle Eastern than in European hotels. On the other hand, in most European cases, we probably have better equipped law enforcement that can provide assistance to the hotels and lower the threat."

 

Strength in numbers

Establishing strong partnerships with police, security agencies and other hotels is essential all over the world. For Carlson Rezidor, this means working on the corporate level with other major hotel groups, and on the local level with individual hotels encouraged to build relationships with nearby law enforcement. Hotels should also drive the security agenda by doing so as part of hotel associations, Moxness says.

"One of the main organisations we use is the Overseas Security Advisory Council, which is run by the US embassies in each country, and we as a hotel group are actively involved," Johnson says. "The organisation is only as strong as the people involved in it in each country, and most of them have a good network of corporate organisations feeding information to the embassy. That, in turn, comes back out by email to every member of the chapter in the country."

As coordination with local police and security on the ground gain importance, changes to the required skill set of hotel security managers are also evident.

Johnson explains: "When we need a new security manager, we proactively target a certain group of people; usually local ex-police officers and ex-military who already have a relationship with those bodies in that country."

Risky business

The security manager’s role has evolved in other ways, too. In medium and high-risk countries, where political turbulence and travel restrictions mean tourists are few, it is business travellers who continue to check-in unabated. When making these bookings, companies looking to ensure the safety of their employees often contact hotel security management long before the sales department. For this reason, highly educated candidates with language skills are also sought, who can act as the prime contact for corporate clients and embassies, Moxness says.

In providing the reassurance such clients require, another factor has started to emerge that has been markedly absent from hotels’ safety and security policies, but for which Moxness, Johnson and Josselin have all recognised a need.

Moxness explains: "In the business world in the past few years, one of the biggest buzz words has been ‘compliance’, and the hotel industry doesn’t have any internationally accepted guidelines or standards when it comes to security. There are local rules and regulations everywhere, but they’re not always aligned, as is the case in air transport, for example."

For this reason, Carlson Rezidor has introduced an independent certification for its hotels that began with the audit in Tunisia at the start of the year as part of an agreement with Swedish company Safehotels. In the scheme, Safehotels Alliance measures a hotel’s safety and security programme against a series of markers. If these are met, the establishment receives the Global Hotel Security Standard certification. This doesn’t provide any guarantees but does signify that the hotel has implemented adequate measures to reduce risks. How widespread within the industry this scheme and others like it will become remains to be seen, but it is by all accounts a sign that safety-conscious corporations and travellers are seeking more concrete assurance that every possible precaution has been taken.

While Josselin emphasises that there is no infallible solution, he argues that by ensuring a site is better protected than those around it, hotels can hope to deflect interest from would-be terrorists. Above this, it is a case of having a carefully prepared crisis-management plan that covers all eventualities.

The kind of terror attack witnessed in Sousse, Josselin says, was a once-in-a-lifetime incident – but that doesn’t mean hotels shouldn’t plan for it, put measures in place and train staff to respond to it.