Malicious rail incident

This risk is featured in the full matrix, representing the averages of multiple different scenarios presented together in the ‘terrorist attacks on transport’ category.

Impact 5
risk indicator
ID 4
Risk theme Terrorism
Impact & Likelihood
Impact key
5 Catastrophic
4 Significant
3 Moderate
2 Limited
1 Minor
Likelihood key
5 >25%
4 5-25%
3 1-5%
2 0.2-1%
1 <0.2%


The domestic rail network in Great Britain has historically been a target for terrorists. More recently, there have been a number of notable attacks by Islamist terrorists such as the London bombings on the 7th July 2005. Unlike other transport modes such as aviation, there are no security searches when rail users enter the network, which limits the ability of the authorities to detect and prevent attackers. Detection of attacks during the planning stage by the intelligence agencies/police is key, along with deterrent activities, for example encouraging vigilance through the See It Say It Sorted campaign, rail staff undertaking security checks, and British Transport Police patrols. Mitigating the impact of an attack by designing in security and using materials such as laminated glass is also a key priority.


The reasonable worst-case scenario of this risk is based on a terrorist attack taking place on the rail network. Different attack methods could be used including high- or low-sophistication weapons. The incident would result in a large number of fatalities and casualties. Although lower-sophistication attacks are currently considered more likely, attacks involving firearms and improvised explosive devices are still considered likely.

Response capability requirements

The immediate response would require a range of capabilities across the emergency services, including specialist teams. There will likely be a requirement for mutual aid for emergency services. In the medium to long term, casualties will require further medical and psychological treatment and support.


Recovery depends on a number of factors including the precise location and if there is any damage caused by the attack. The time needed for evidence gathering can range from days to a few weeks. Coordination between investigators and the railway is needed to ensure that key areas are returned first. The length of time and cost of repair and reconstruction would depend on the damage. Where there is serious structural damage, temporary works may be required to make safe and/or weatherproof the area pending a longer-term permanent replacement, which could take years. Following an attack we would likely see a reduction in people using the railway due to loss of confidence.