Civil unrest is a pertinent risk to organizations and their business operations across the globe. In recent years, growing political polarization, economic instability, environmental concerns, and other social and political issues have prompted, at times, prominent and prolonged civil unrest. Recent protests in the U.S., Europe, and elsewhere underscore the potential for initially peaceful demonstrations to become violent, leading to property damage, operational disruptions, and other impacts to personnel and business assets.
Costs associated with civil unrest can be considerable, depending on the scale and intensity of the unrest. Violent protests across the U.K. following the July 2024 Southport mass stabbing incident resulted in an estimated $270-675 million in losses due to property damage, lost business, and additional policing costs. In 2020, nationwide protests in the U.S. over racial justice cost more than $1 billion in insured losses following rioting and clashes in several major cities. Similarly, the 2019 anti-government protests and rioting in Chile and the 2021 South Africa riots each cost at least $3 billion in insured losses. More recently, the French government disclosed it will cost billions of dollars to rebuild damaged property in New Caledonia following the May 2024 riots. Some costs, such as lost business and other operational disruptions, are difficult to quantify but can be considerable for organizations directly affected by civil unrest and associated violence.
Taking adequate measures to protect personnel, property, and equipment is key to mitigating the impacts associated with civil unrest. Organizations must remain vigilant for potential threats and anticipate when protests and other actions could escalate into violent civil unrest. Mitigating the risk associated with civil unrest often depends on the underlying motivation of protests and how they can evolve into violent unrest.
Motivations for civil unrest
Sociopolitical unrest
Demonstrations often stem from sociopolitical issues, including disputes over politics and government policies, economic concerns, and perceptions of social inequality and injustice. As a tactic, protests can be used to raise awareness of a specific issue or persuade the government to implement reforms or reverse an unpopular policy. Demonstrations can also include acts of civil disobedience, including sit-ins and boycotts against businesses and other organizations to enact change.
Recent examples of sociopolitical unrest include the Black Lives Matter (BLM) movement in the U.S. against police misconduct and racial injustice, and proPalestine protests on college campuses demanding an end to the Israel-Hamas war. Socially and politically driven unrest also includes the Yellow Vest movement and anti-pension reform protests that have occurred throughout France in recent years, as well as the popular uprising that ousted the government of Bangladesh in July 2024. Economic issues in developing nations – including inflation and public debt – have contributed to a wave of unrest, including in Sri Lanka in 2022 and Kenya in 2024.
In countries where governments are perceived to be responsive to dissent and public calls for change, demonstrations are often peaceful and are even considered part of the governing process – although this is not always the case. In countries with high levels of political polarization and social inequality, or in places where opposition to the government is less tolerated, demonstrations can become violent. Violence can be used as a tactic to further pressure the government or may arise from clashes with police and security forces tasked with dispersing unauthorized demonstrations. Potential acts of violent protests and rioting include destruction of public and private property, looting, vandalism, as well as the establishment of roadblocks and barricades to disrupt traffic and law enforcement.
In response to violent unrest, authorities may limit access to certain areas where demonstrations are ongoing and may impose curfews or even disrupt telecommunications and internet access. This can result in disruptions to business operations, including those not directly affected by the ongoing unrest.
Labor actions
Civil unrest may also emerge from labor disputes and associated unions. The prevalence of labor unions varies by country, although many countries in Europe, Latin America, and parts of Asia have a history of strong unions and labor organizing across the public and private sectors. Unions can authorize strikes for a variety of reasons – including disputes over working conditions, pay, and contract negotiations. In some places, labor groups may call for work stoppages as part of broader sociopolitical unrest to add further pressure on the government or businesses during disputes.
Labor actions can manifest as small, localized events to nationwide campaigns. Since the end of the COVID-19 pandemic, European countries, including France, Germany, Italy, and others, have witnessed nationwide strikes over cost-of-living concerns that have caused disruptions to commercial aviation, rail, and other essential services. Similar actions have occurred across Africa, including an August 2024 nationwide strike in Nigeria over inflation and economic difficulties.
Labor actions in the public sector can often lead to broader, more impactful disruptions. In some countries, air traffic control, airport security, customs, rail operators, and other essential services are represented by public sector unions. When labor disputes arise, work stoppages can prompt disruptions to commercial flights, rail travel, customs operations, and other services.
Strikes can also lead to street demonstrations and other protest actions. These events may occur outside government buildings, companies, or industries involved in the labor dispute, or in public squares and other public spaces, to raise awareness among the public. While such labor actions tend to be peaceful, relations between the government and labor unions are more tense in some countries and can result in incidents of violence and even escalation into more pronounced unrest.
Activist campaigns
Certain businesses and organizations, such as those in particularly sensitive industries or sectors, may become the target of coordinated actions by activists and protesters that seek to spread awareness of a specific issue or cause. In recent years, Extinction Rebellion, Just Stop Oil, and other environmentalist groups across Europe have carried out targeted campaigns against governments and an array of industries, including oil and gas, fashion, and others whose operations they consider harmful to the environment.
Groups like Extinction Rebellion and Just Stop Oil have used disruptive and sometimes destructive methods during their protests. Actions taken include blocking major roads and highways to obstruct traffic and using sit-ins to obstruct entry into corporate offices or factories. These can have direct impacts on targeted companies and organizations, but can also impact non-targeted businesses that rely on common infrastructure like roads and ports to conduct their operations.
Some activist campaigns have also resorted to vandalism and other destructive tactics to further their aims. Activists have vandalized office buildings, storefronts, and works of art with paint and other potentially damaging substances. Some groups have carried out more violent and destructive actions as part of their campaigns. For example, in March 2024, a left-wing environmentalist group in Germany carried out an arson attack on an electricity pylon that provided power to a Tesla electric vehicle factory near Berlin. The incident forced the factory, which produces 500,000 vehicles a year, to cease operations for a week.
Since the start of the Israel-Hamas war in October 2023, activist and direct-action campaigns by proPalestine groups have gained traction, particularly in the U.S. and the U.K. Demonstrations and sit-ins on college campuses across the U.S. often devolved into confrontations between pro-Palestine and proIsrael groups and with campus police. At Columbia University, pro-Palestine demonstrators occupied and vandalized university buildings in a standoff with campus police and administrators.
In the U.K., groups like Palestine Action have taken more direct action by explicitly targeting the Royal Air Force, defense industrial companies with ties to Israel, and other sectors perceived to support the defense industry, including insurance. Actions taken by the group include vandalism, destruction of equipment, and sit-ins to disrupt operations. These incidents prompted the U.K. government to proscribe and ban the group under the Terrorism Act, underscoring how activist campaigns can escalate into a larger threat to the state and organizations.
Risk mitigation guidance
Pre-unrest
Risk Assessment
Assess the risk of protests and activist activity to your organization. This can be across the whole organization, a division, region, or portfolio, or specific to one or a small number of locations. This would encompass, as a minimum:
- Assessment of known threat actors to your organization, e.g., unions in the organization, activist groups targeting your organization or peers, or locations where there are relatively high levels of civil unrest and protest.
- Proactive identification of known areas of interest to protest and activist groups near your relevant operations, such as government buildings, embassies, symbolic public locations, and even high-profile customers and suppliers. Past protests are often indicators of future risks.
- Assessment of whether specific individualsin your organization at a higher risk of beingspecifically targeted, such as executives.•
- Identification and assessment of their ideologies, traditional targets, and modus operandi for disruptions, including sit-ins, blockades, or marches. Different groups use different protest tactics, and this can reveal the risk certain groups may pose compared to others.•
- Plausible scenario-based security vulnerability assessment to identify current risk mitigation and insurance you have in place to appropriately treat or transfer the assessed risks, as well as what are your thresholds for tolerating or terminating the risk.
- Identification risk mitigation or insurance required to further mitigate the assessed protest risks to as low as reasonably practicable or within your corporate risk tolerances.
Threat monitoring
- Monitor sociopolitical developments and possible trigger events that could cause protests and civil unrest at or close to your operations.
- If at known risk of activism, monitor social media groups and online forums where activist groups tend to organize and discuss their plans.
- Contribute to or develop local business security forums to communicate – through group communications (e.g., WhatsApp) – on what protesters or activists are planning and any identified specific targets or threats.
- Exploit any existing law enforcement or industry security bodies, common in most large cities, that provide local intelligence on protest activity. Monitor any public information they provide.
Preparedness
- Develop response plans for locations identified as high risk to protest activity or activism. As relevant, consider developing organization-wide response templates and/or guidance for a variety of protest activity.
- Plan reliable communications channels to your assets and people. This should consider the context of your operation, the threat actor modus operandi, and state capabilities (e.g., potential for communications disruption or blackouts).
- As appropriate, conduct drills and tabletop exercises to assess your organization’s potential vulnerabilities to a protest or activist action. This should be relevant to the most plausible (assessed) risks your organization faces, and any lessons learnt should be addressed quickly.
- Determine options for business continuity during civil unrest. These may range from forward planning of stock, working from home or another location, reduced or adapted opening/working hours, enhanced security measures, or, in extreme cases, temporary closure.
- Assess effective options for risk transfer and risk termination, as necessary.
- Ensure facilities and security staff are appropriately trained and aware of risk mitigation measures and emergency response procedures. This includes:
- Awareness of the legal rights of protesters
- The modus operandi of relevant protest groups
- Communications procedures
- Mitigation escalations
- Lockdown and evacuation procedures, and
- Crisis management escalation protocols.
- Forward plan relevant supplies to any high-risk locations. This may include care packages with additional food, water, blankets, and medical supplies, if there is potential for a blockade or drawn-out protest, or additional security supplies, such as additional radios, plywood for windows, and door chocks.
- As appropriate, train staff on the risks, the mitigations in place, their personal responsibilities, and emergency response procedures.
- Communicate to the organization, suppliers, and customers relevant information in advance of planned or expected protest activity, e.g., such as enhanced security mitigation, changes to working/opening hours, etc.
During unrest
Command and control
- Continue threat monitoring of relevant social media, law enforcement updates, local business forums, and internal sources, such as CCTV, to track developments and adjust your postures and risk mitigation accordingly.
- Ensure a crisis management team assumes command on site and is the focus for decision making and communications on actions. Ensure any wider crisis management structures are informed throughout.
- Proactively communicate to staff what is known about the protest, what mitigation is in place, what the lines of communication are, the response protocols, and where further resources are available.
- Proactively communicate with any patrons, customers, or supplies who may be scheduled to be on-site during the protest activity.
- Issue safety guidance for when individuals are caught in a protest. See the “For individuals” section.
- Document all decisions and incidents as they occur for post-incident review and for audit purposes.
- If the demonstration becomes aggressive or property damage is witnessed, activate processes and procedures in line with applicable incident response plans, such as enhanced security measures and lockdown procedures. See the “Lockdown procedures” section.
- Liaise with emergency services, as required: provide them with access, updates, and support to manage the situation effectively.
Property protection
For peaceful protests:
- Continuously assess the perimeter for signs of attempted entry, vandalism, or fire hazards. Ensure all potential points of entry, including fire exits, are closed and secured.
- Lock all internal and external doors that are unused or required for fire safety.
- Ensure staff report suspicious behaviors, including suspicious packages or other items that may seem out of place.
- Ensure keys and other access control items are not accessible to unauthorized personnel.
- Increase access control measures, such as fewer points of entry and exit and additional screening of visitors, staff, and bags. See ‘Soft lockdown’ procedures.
- Ensure video surveillance (CCTV) is operable and recording.
- Ensure fire systems are fully operable throughout the protest duration.
- Where available, closely monitor the protest and the perimeter via video surveillance (CCTV) and security officers.
For more disruptive protests, in addition to the above:
- Equip ground level windows and doors with extra security installations, including temporary barriers, boarded windows and closed roller shutters, as available. See ‘Hard lockdown’ procedures.
- As available, ensure visible security guarding is in place, either when safe outside the exits to the building, or visible inside. Consider temporarily bolstering the guard force.
- Temporarily prevent entry or exit to the building or asset, as appropriate.
- Secure access to the roof and any balconies via roof ladders, fire escapes and hatches. Ensure entry points from the roof and balconies are secure, i.e. windows and doors.
- Turn out interior lighting but leaving exterior lighting on, as relevant.
- Where able, secure any external critical utilities servicing the building.
- Secure key documents and records, as well as servers.
- Remove or move high-value items and inventory from view and relocate them to secure areas, if possible.
Lockdown procedures
Soft lockdown: A security measure where activities within the area continue as usual, but access to and from a building or facility is restricted to prevent potential threats. During a soft lockdown, all exterior doors are locked, and all entry and exit points are closely monitored and controlled. This measure is designed to maintain a sense of normalcy and minimize disruption to daily operations while ensuring the safety and security of everyone inside. The objective is to protect the facility from external threats by limiting access and allowing authorized personnel to maintain control over the environment. Staff and occupants are typically notified of the lockdown status and instructed to remain vigilant and report any suspicious activity.
Hard lockdown: A hard lockdown is a security measure where all normal activities and operations within a facility cease immediately. All entrances and exits are secured, and movement within the facility is more strictly controlled or halted. This measure is implemented to ensure the safety and security of individuals by preventing unauthorized access and minimizing exposure to potential dangers during critical situations such as natural disasters, security threats, or other emergencies.
For Individuals
If the protest activity is peaceful (e.g., demonstrators marching near the premises):
- Quickly identify the agenda of the protest and make a risk assessment of the risk to yourself (i.e., due to image or demographic, your organization, etc.).
- If in the immediate vicinity of your building or intended journey, keep a low profile: avoid displaying logos, staff passes, or other identifiable affiliations that may attract unwanted attention.
- Avoid interacting with protesters, unless necessary. If an interaction is unavoidable, remain respectful, calm, and keep the engagement to a minimum.
- As soon as safe to do so, exit the protest area. Actively plan a path out.
- If unable to exit the area immediately, stick to the outskirts of the protest and closest to points of safety(e.g., office or shop entrances). Avoid the highest risk areas, such as the focus of the protest, symbolic locations, splinter groups, roadblocks, and areas with a heavy law enforcement presence.
- Avoid driving through roadblocks or through a demonstration. If you encounter one, turn around safely and avoid drawing attention to yourself. Do not travel at speed near protesters. If safer on foot, leave the vehicle and move away from the scene promptly.
- Do not use public transport until a good distance from the protest area.
- Follow instructions by your organization, private security, and law enforcement at all times.
- Monitor and respond promptly to emergency notifications received from your organization or public services.
If the protest activity becomes disruptive (e.g., physical damage or confrontations occur), in addition to the above:
- Proactively communicate your location and status to your organization and/or friends and family. If available, switch on location beakers on your phone, e.g., Find My iPhone or WhatsApp live location.
- Seek shelter in a secure location away from the protestor the focus of their protest (e.g., an office or shop). Exit the area quickly and safely when possible.
- If your building is a focus or impacted by disruptive protests, ensure you follow all guidance from your facility and/or security team. This may include lockdown or evacuation procedures. Prevent entry and exit to the building, unless in extremis.
- Avoid engagement with protesters unless necessary. If an encounter cannot be avoided, engagement should be minimal, respectful, and calm. Disengage as quickly and as safely as possible.
- If curfews are imposed, strictly observe regulations and monitor the media for updates.
- If injured, immediately seek medical attention, where possible, away from the protest area.
- Respond promptly to emergency notifications received from the organization and proactively confirm when in a safe location.
Post-unrest
Steps to take:
- Conduct a damage assessment, documenting damage to assets (written, video, and photos), loss of inventory or injury to persons for insurance claims and/or prosecution. If a severe incident, immediately preserve a crime scene and associated evidence.
- Conduct an immediate review of critical life safety and operating requirements, such as access to power, gas and water, fully functioning fire safety systems, and building integrity (i.e., safe and secure).
- As soon as practical, clean up any damage or debris, do emergency work required to prevent further damage occurring, and implement temporary measures needed to resume operations. As appropriate, call on third-party specialists to support these efforts.
- Engage your insurance broker as early as possible to determine coverage and begin the claims process.
- Provide access to mental health services for affected staff and ensure availability and promotion of supporting resources, such as Employee Assistance Programs, if available.
- Risk assess the potential for further civil unrest in the near future to determine the speed with which to return to Business as Usual.
- Evaluate the performance of the response and assess any identified change in threat actor modus operandi or risk exposure, adapting relevant security measures and procedures accordingly.