Introduction
The United Kingdom's events industry brings millions of people together every year from music festivals and sporting fixtures to political gatherings, religious ceremonies, and community celebrations. These crowded, publicly accessible environments are precisely the kind of locations that present opportunities for those who seek to cause mass casualties.
The attacks at Manchester Arena in 2017, London Bridge and Borough Market in the same year, and the Southport stabbings in 2024 have demonstrated, in the most painful terms imaginable, that the threat is not theoretical. It is real, it is evolving, and it demands a structured, professional response from anyone responsible for organising a public event on British soil.
This article sets out the essential components of counter-terrorism planning at events: the pre-event preparation that must take place before a single ticket is scanned, the active threat response framework that staff must internalise before they arrive for duty, and the best practices drawn from official guidance, legislation, and hard-won operational experience.
The Legal Landscape: Martyn's Law
The single most significant development in UK event security in recent years is the Terrorism (Protection of Premises) Act 2025, commonly referred to as Martyn's Law. It received Royal Assent on 3 April 2025 and delivers the government's manifesto commitment to strengthen the protective security of public events and venues. A tiered approach has been established under the Act, with those responsible for premises and events required to fulfil different requirements according to the number of individuals it is reasonable to expect may be present.
What the Act Requires
The Act requires venues hosting large events over 200 participants to make plans and train staff for their response to any potential terrorist attacks. Named in memory of Martyn Hett, one of 22 people killed in the Manchester Arena bombing, the legislation makes legally explicit what good practice has always demanded.
The Standard Tier
Covers premises where it is reasonable to expect between 200 and 799 individuals to be present at the same time. When requirements come into force, the person responsible for standard duty premises will have to notify the Security Industry Authority of their premises and have in place.
So far as is reasonably practicable, appropriate public protection procedures those which should be followed by people working at the premises if an act of terrorism were to occur at the premises or in the immediate vicinity. Larger enhanced-tier events face additional obligations including vulnerability assessments and more comprehensive physical security measures.
Addressing Historical Inconsistency
Whilst some premises and events have proactively considered the risk posed by acts of terrorism, there has historically been no consistency across the UK, and counter-terrorism protective security and preparedness have often fallen behind other legally required activities, such as health and safety.
The Act places public protection on a legal footing to address such inconsistency, whilst making it clear who is responsible at qualifying premises. For event organisers, this is not merely a compliance exercise. It is an opportunity to build a security culture that genuinely protects people.
Pre-Event Planning: Building the Framework
Effective counter-terrorism planning does not begin on the morning of the event. It begins weeks or months earlier, embedded into the broader event management process. The event security plan must be developed with the same seriousness and attention to detail as any other operational document.
Assessing Security Risk
Every event is unique, and its security risk must be assessed individually. The UK's national threat level, set by the Joint Terrorism Analysis Centre and MI5, provides the strategic backdrop, currently assessed as "Substantial", meaning an attack is likely. However, this national picture must be overlaid with a bespoke assessment of the specific event when assessing general event risk.
| Topic | Key Considerations | Risk Level |
|---|---|---|
| Martyn's Law Compliance | Register with SIA, set protection procedures, train staff (200+ attendees); enhanced tier adds vulnerability assessments. | 🔴 High |
| Risk Assessment & CT Engagement | Assess vehicle, person, IED, CBR, fire and drone threats; engage CT advisers and ProtectUK early. | 🔴 High |
| Hostile Vehicle Mitigation | Rated barriers, blocks, or temporary measures to block vehicles without hindering emergency access. | 🔴 High |
| Staff & Entry Vigilance | Hand searches, behavioural detection, staff briefed on hostile recon with clear reporting escalation. | 🟡 Medium |
| Active Threat Response | Run, Hide, Tell rehearsed by staff; pre-planned evacuation/invacuation/lockdown; METHANE reporting and JESIP coordination. | 🔴 High |
| Documentation & Exercises | Decision logs kept 6+ years; plans tested via tabletop and live exercises. | 🟢 Low |
The Purple Guide, the industry standard reference for health, safety and welfare at music and other events, recommends that the risk manager consider the full range of attack methods that could be utilised, including:
- Vehicle-based attacks
- Person-based attacks, including bladed weapons and marauding terrorists
- Improvised explosive devices
- Chemical, biological and radiological threats
- Fire as a weapon
- Unmanned aerial vehicle misuse
Each methodology must be assessed for likelihood, vulnerability, and consequence. Only after this analysis can proportionate measures be devised and presented to the risk holder.
Engaging Counter-Terrorism Advisers
Getting a CT Security Adviser Involved
Where practicable, early engagement with law enforcement is essential. A Police Counter Terrorism Security Adviser can provide bespoke security advice, help assess an event's vulnerabilities, and advise on appropriate physical and procedural countermeasures.
Start Early, Not at the Last Minute
This engagement should happen long before the event, not in the days immediately preceding it. Organisers who wait until the last moment will find themselves with insufficient time to implement meaningful changes. The earlier the conversation begins, the stronger the security plan.
ProtectUK: The Central Resource Hub
ProtectUK, the official online counter-terrorism resource for the UK, is the central hub for guidance, training, and practical advice for those responsible for crowded places. It connects organisers, venue managers, and business owners with the expertise of NaCTSO and the National Protective Security Authority. Accessing these resources early should be a minimum standard.
Hostile Vehicle Mitigation
Why Vehicle Mitigation Matters
Vehicle-based attacks have become one of the most common terrorist methods globally, largely because of the ready availability of vehicles and the devastating results achievable even with a small car driven into a crowd. A hostile vehicle mitigation system must be a core part of any credible plan for outdoor or semi-outdoor events.
Physical Separation as the First Choice
The most effective approach is complete physical separation of pedestrians from vehicular access routes, using rated barriers, concrete blocks, or purpose-built street furniture. Where permanent infrastructure isn't possible, temporary measures such as water-filled barriers, earth-filled planters, or large vehicles as soft closures can offer meaningful deterrence.
Using Fencing to Slow Approach
Perimeter fencing combined with physical barriers can significantly reduce approach speeds. It also helps channel vehicular movement away from the highest-density crowd areas.
Balancing Security with Emergency Access
Planners must ensure that any measures implemented do not impede emergency service access or create dangerous choke points during an evacuation. The design must balance protection against crowd flow at all times, particularly in non-terrorism emergencies where rapid dispersal may be needed.
Search Regimes and Entry Controls
Why a Search Regime Is Essential
No counter-terrorism plan is complete without a robust entry regime. Response staff should carry out systematic searches of all attendees, checking for prohibited items most importantly bladed weapons and other instruments capable of causing harm. A thorough hand search regime can detect non-metallic threats that metal detectors alone would miss.
Setting Expectations in Advance
Advertising the search regime ahead of time manages attendee expectations while signalling that security is a priority. It also serves as a deterrent to anyone considering bringing a dangerous item onto the site.
Behavioural Detection Training
The search team should include behavioural detection operatives, personnel trained to identify potential attack behaviours such as nervousness, excessive perspiration, inappropriate clothing for the conditions, or evasive responses to standard questions.
Responding to a Bladed Weapon Find
Any person found carrying a bladed weapon of any kind should be treated as a potential threat. The process for handling both the individual and the item must be clearly defined in the event security plan before the event opens.
Briefing and Encouraging Staff
Briefing Every Member of Staff
Every staff member deployed at an event permanent employees, agency stewards, or volunteers must receive a security briefing before duty begins. Encouraging staff to take an active role in spotting suspicious behaviour is one of the most cost-effective security measures available. Staff familiar with a venue know what "normal" looks like.
Spotting Hostile Reconnaissance
The briefing should cover signs of hostile reconnaissance: people asking unusual questions about security arrangements, filming or taking notes near access and egress routes, loitering around perimeter fencing, or arriving with packages that seem out of place.
Building a Clear Escalation Path
An escalation plan is crucial. Staff who notice something suspicious must feel empowered and supported to report it promptly — whether to a control room, a supervisor, or directly to the police. Training must be delivered properly, not merely offered; a rushed briefing won't produce staff who are genuinely alert.
Active Threat Response: When an Attack Begins
Despite the best preventative measures, a terrorist incident may still occur. The active threat response phase is where pre-event planning is put to its ultimate test. Understanding that an attack starts with speed and disorientation is essential to preparing a response that minimises harm.
Run, Hide, Tell
The nationally recognised framework for responding to a firearms or weapons attack in the UK is the Run, Hide, Tell protocol developed by NaCTSO. The principles are: Run escape if you can, using the safest route without exposing yourself to danger and insist others go with you; Hide if it is not possible to run, seek cover, remain quiet, and barricade yourself in if necessary; and Tell call 999 and provide the police with as much information as possible about the situation, including location, descriptions, and direction of travel of any suspects.
This guidance is not a passive fallback. It must be actively taught and rehearsed by all response staff. Posters and aide-mémoire cards should be available at key positions around the site. For staff unfamiliar with the venue layout, the emphasis must be on knowing the nearest exits or safe place relative to their designated position before the event starts.
Evacuation, Invacuation, and Lockdown
A credible response plan must address three distinct crowd management scenarios when a terrorist incident develops. Evacuation moving people away from a threat is the most instinctive response, but it requires pre-planned routes and assembly points that have been risk-assessed against the event's physical layout.
Critically, attendees must never be evacuated past a suspicious item or device. If the evacuation route passes near a potential improvised explosive device, a dynamic reassessment is required immediately, and consideration must be given to alternative routing.
Invacuation and Lockdown
Invacuation moving people into a secure space within the venue may be appropriate where the threat is external, such as a weapons attack or a public order incident outside the perimeter. Lockdown, the ability to quickly restrict vehicular access and pedestrian movement into the site, can frustrate an attacker seeking to reach the main crowd area.
The physical measures enabling lockdown must be tested in advance; procedures that rely on gates or barriers that have never been operated under pressure will fail precisely when they are needed most.
The (M)ETHANE Protocol and JESIP
When an incident occurs, the event control room must immediately begin passing structured information to the emergency services. The METHANE mnemonic provides the framework for that initial communication:
- M – Major incident declared
- E – Exact location
- T – Type of incident
- H – Hazards
- A – Access
- N – Number of casualties
- E – Emergency services required
Every person with control room responsibility must have this protocol committed to memory or displayed prominently within the control room environment.
As the emergency services arrive and a multi-agency response develops, the Joint Emergency Services Interoperability Principles framework comes into play. JESIP was developed following reviews of major incidents across the UK where a lack of coordination between agencies significantly worsened outcomes.
Event organisers may be required to contribute to a Strategic Coordinating Group, particularly where the incident has complex crowd management implications. Their intimate knowledge of the venue's layout, capacity, staff positioning, and infrastructure is invaluable to the emergency response and should be offered proactively and without delay.
Post-Planning: Documentation and Continuous Improvement
Keeping a Decision Log
All decisions made during the planning process must be recorded in a decision log. This log should capture what was considered, what measures were implemented, and crucially, what was not implemented and why. These records are legally significant and may be called upon in court in the event of an inquiry, a criminal prosecution, or civil litigation. They must be retained for a minimum of six years after the event.
Exercising the Plan
Tabletop exercises and live rehearsals should be conducted prior to the event to test the response plan under realistic conditions. A plan that exists only on paper has not been stress-tested. Response staff must practise their roles, communication lines must be verified, and command structures must be exercised under simulated pressure.
Where the same staff are deployed across a whole event season, investing in appropriate training at the outset will deliver consistent returns throughout the year. Management and supervisor training should be addressed separately, as those in command positions carry distinct responsibilities and must be equipped to respond to developing incidents with clarity and authority.