Introduction
Many essays covering the destruction of cultural heritage will begin by reassuring the reader that such actions are nothing new, providing examples from history to demonstrate that heritage destruction and plunder as the spoils of war are a long-standing and unfortunate by-product of human conflict.Footnote 1 Conversely, recent studies covering examples of attacks on heritage by terrorist groups in the twenty-first century suggest this is a “new wave” of heritage destruction,Footnote 2 accompanying an exponential increase in research on the subject.Footnote 3 Publications traditionally focused on heritage issues have ventured into security matters and vice versa, demonstrating the level of concern. Historical reminders may therefore be useful for holding this relatively recent intentional destruction of heritage in context.
While it may be difficult to prove that wartime heritage destruction faced by our ancestors resembles the performative destruction as socially mediated by the modern terrorist,Footnote 4 there are similarities to be found in historic iconoclasm.Footnote 5 The destruction of World Heritage sites, including the Taliban’s destruction of the Bamiyan Buddhas and the destruction of the Temple of Bel by the Islamic State (ISIS) in Syria were partly symbolic, intentionally targeting the remains of preceding culturesFootnote 6, and partly religiously motivated while serving propaganda purposes for the groups. For the avoidance of doubt, ISIS devoted sections in their magazines and newsletters to explaining why they were targeting the heritage of the Kuffar, or non-believersFootnote 7. ISIS, however, did not promote their extensive looting and trafficking of heritage items, perhaps due to the apparent hypocrisy in making money from such idols, or so as not to disclose their sources of financing.Footnote 8
Heritage is deeply related to our identity and has long been subject to manipulation through political, ideological, or religious agendas – dynamics that are now increasingly entangled with security and intelligence concerns.Footnote 9 Terrorism is also a highly politicized phenomenon and has proven to be a destructive threat to heritage in Syria and Iraq. Therefore, any assertions that such terrorist acts are a new wave of heritage destruction warrant closer scrutiny, especially for those charged with heritage protection. To move beyond generalizations and ensure effective and proportionate mitigation, scrutiny must begin with a critical and context-sensitive assessment of terrorism as a threat to heritage.
This process requires the specific circumstances of each case and must remain vigilant against political distortions, necessitating insight into how those responsible for protection evaluate and respond to terrorism. However, primary data has been found wanting in terrorism studies, especially in the surge of material following the 9/11 terrorist attacks. Although there has been an improvement in the use of primary data since 2007Footnote 10 and recent research has incorporated relevant case studies,Footnote 11, empirical evidence relevant to assessing the threat and/or how to make grounded decisions for protecting heritage remains sparse.Footnote 12 Research specifically examining how the intersection of terrorism and heritage affects heritage protection practitioners is especially limited. Yet understanding how such threats are interpreted and managed in practice is vital if research is to inform effective and usable protection strategies.
It is in appreciation of these observations that this exploratory research paper was initiated. This article explores how terrorism is understood as a threat to cultural heritage by two practitioner groups of heritage and security professionals. Drawing on a comparative analysis of 51 interviews, it argues that assuming a blanket threat based solely on previous attacks is flawed and that inconsistencies in threat assessment approaches may undermine effective heritage protection strategies. By exposing critical gaps, particularly around the threat assessment process, the article advances a more contextually grounded and forward-looking approach. Incorporating cultural intelligence and recognised threat assessment techniques, it proposes a new framework that holds threats in context and aims to support more realistic and proportionate protective measures for heritage. The article begins with a critical review of literature on terrorism and cultural heritage before setting out the research methodology and outlining key findings from practitioner interviews. It then discusses emerging insights and proposes a new threat assessment framework. The conclusion reflects on the implications for heritage protection practice and proposed avenues for future research.
While it is appreciated that heritage trafficking has been, and continues to be, a problem associated with terrorist organizations and organized crime groups, detailed analysis of such is beyond the scope of this article, which focuses on the intentional destruction of heritage by terrorist groups. Additionally, while there is evidence of groups like ISIS targeting intangible heritage, such as banning cultural practices that do not align with a particular view of Islam, the research focuses on terrorist destruction of physical heritage. Finally, for brevity, “cultural heritage” is generally shortened to “heritage” throughout this paper, avoiding the acronym “CH” as coded for one participant group.
Literature review
Definitions are important as they remain a notorious point of contention in the field of both terrorism and heritage studies,Footnote 13 and many are too narrow to include attacks on cultural heritage specifically. While it is not attempted to further obscure the matter with additional interpretation, debate on this term will likely continue, and it is important to be clear on the definition by which one abides.Footnote 14 For clarity, and to align with previous studies by the author, the definition of terrorism used in this paper is:
A strategy of deliberately attempting to coerce or the conveying of a political, religious or ideological message through threatening or inflicting pre-meditated acts of violence against the civilian population, military targets, cultural heritage or property to create attention or provocation through shock or fear in a targeted audience wider than the immediate victims.
Cultural heritage suffers similar definition issues.Footnote 15 No definition was offered in the data collection stages of the research, but the preferred definition in this context is that from the United Nations Human Rights Council 17th SessionFootnote 16:
Tangible heritage (e.g. sites, structures and remains of archaeological, historical, religious, cultural or aesthetic value), intangible heritage (e.g. traditions, customs and practices, aesthetic and spiritual beliefs; vernacular or other languages; artistic expressions, folklore) and natural heritage (e.g. protected natural reserves; other protected biologically diverse areas; historic parks and gardens and cultural landscapes).
Literature on terrorism and heritage has been influenced significantly by ISIS’s actions in Iraq and Syria, often framing global heritage as “at risk” or “in crisis” from terrorism.Footnote 17 Scholars have called for coordinated responses to this emerging terrorist tactic,Footnote 18 noting the unique role of social media in publicizing these attacks.Footnote 19 This has assisted in shifting heritage destruction from being perceived solely as a heritage issue to a security issue,Footnote 20 with reciprocal engagement between the two fields. Several authors have become prominent in this subject,Footnote 21 and many papers provide respectable analysis of the actions and aftermath of Ansar Dine, ISIS, and the Taliban’s destruction of heritage, retrospectively. However, some have gone on to speculate that terrorist destruction of heritage remains a dangerous new trend or that terrorist capability of heritage destruction persists.Footnote 22 Time alone is thankfully showing that such apprehensions might have been overstated. Regardless, these concerns have been echoed by cultural organizations, law enforcement agencies, heritage groups, archaeologists, and conservatorsFootnote 23. International organizations, such as UNESCO, adopted new strategies,Footnote 24 stressing that terrorism was a threat requiring reinforcement of operational capacity and a strengthening of defensive tools. Think tanks such as the Nordic Centre for Cultural Heritage and Armed Conflict were established, providing research to governments, militaries, and international organizationsFootnote 25. Potentially as a result of this research NATO has broadened its stance from heritage being a law of armed conflict matter to viewing it as a target for hybrid threats within the strategic security environment.
Beyond literature focusing on the destruction of World Heritage sites, while conflict data over the last two decades shows a rise in the number of non-state armed groups and a reduction in state-versus-state conflicts,Footnote 26 many sources and papers discussing dangers to heritage do not even classify terrorism as a threat in its own right.Footnote 27 Terrorism has also been blended into groups of “embodied risks” for cultural heritage, among them theft and vandalism, for example. It is sometimes included within military activity or armed conflict, which may, in effect, follow the “all-hazards” approach often found in critical infrastructure protection.Footnote 28 These are broad terms, however, and it is potentially unhelpful to lump terrorism in with war, for example, given that mitigative measures would likely be significantly different. Interestingly, some key sources covering heritage protection before ISIS recognize the threat of destruction by armed conflict but make no mention of terrorism at all.Footnote 29
Although the securitization of heritage is acknowledged as an understudied field,Footnote 30 several papers have made important strides in exploring how heritage and security intersect within a “heritage security nexus.”Footnote 31 The example of ISIS is frequently cited to illustrate how hybrid threats such as terrorism impact heritage; however, these studies often stop short of proposing concrete threat assessment processes. If a shift toward the securitization of heritage is indeed underway, it is important to identify the specific threats at play to develop effective protective measures. Recent publications provide excellent overviews of heritage destruction,Footnote 32 yet empirical research on terrorism as an ongoing, unconventional threat to heritage remains limited, particularly compared to retrospective analyses focused on ISIS. Opinions vary as to whether terrorism continues to pose a significant threat, and, thankfully, there is a scarcity of new case studies to examine. Furthermore, some authors point out that threats such as uncontrolled urban sprawl, industrial development, and natural disasters are more frequent yet equally devastating, underscoring the need for robust, threat-specific assessments to inform effective heritage protection strategies.
In established security risk management methodologies, threat is defined as the combination of capability and intentFootnote 33 and must be clearly distinguished from risk, which includes the probability and consequence of attack. A truly credible threat arises from the intersection of capability, intent, and opportunity.Footnote 34 This triad underscores why past acts alone cannot justify assumptions of future threat. ISIS’s ability to destroy heritage at scale was, in part, due to a unique window of opportunity,Footnote 35 including territorial control and unchallenged operational freedom over enough time for them to inflict significant damage.
A starting point for developing an enhanced understanding of threat may be found in industry guidance on security and heritage risk management. However, there are significant differences between fields. Security risk management frameworksFootnote 36 stress the need for formal threat assessments as a precursor to defining credible risk events, a step often absent from heritage-specific models. Documents from the International Centre for the Study of the Preservation and Restoration of Cultural Property (ICCROM), the United Nations Educational, Scientific and Cultural Organization (UNESCO), and other Cultural Property Protection sourcesFootnote 37 include critical cultural parameters, such as heritage value and significance, often absent from the former. However, these documents often conflate safety hazards with deliberate security threats or subsume terrorism under broader armed conflict categories. For instance, the ICCROM ABC method does not clearly distinguish between hazards and threats, potentially limiting its usefulness for drawing out intentional, actor-driven attacks for users with limited experience.
Some sources in academia have proposed useful criteria for threat and risk assessments in heritage. BorumFootnote 38 highlights the lack of empirical data on terrorist threats and advocates for a systematic, transparent approach. LopezFootnote 39 agrees, stressing the need for a more integrated assessment, given the broad range of threats and the absence of uniform definitions of threat and risk. SabuccoFootnote 40 criticizes typical risk management manuals for weak or absent heritage safeguards and emphasizes the importance of ongoing, iterative threat assessments with stakeholder input. However, proposed risk assessment methodologies in academia vary significantly.Footnote 41 For instance, GarziaFootnote 42 uses a highly quantitative process without a specific threat assessment, misusing “threat” and “risk” interchangeably. CantatoreFootnote 43 also offers a contemporary but highly formulaic process that does not include a threat assessment. In stark contrast, BogoeskiFootnote 44 employs a quantitative approach for hazard identification in museums. None suggest including wider stakeholder participation.
Research appropriate to security risks more generally advocates a stringent threat assessment to clearly identify potential adversaries and actions in order that risk and appropriate countermeasures can be established.Footnote 45 Jones summarizes this well with “To calculate risk (R), the project team must have a thorough understanding of the credible threats that apply to a facility. This requires a threat assessment to be conducted by a competent specialist in consultation with stakeholders. It goes without saying, that if the threat assessment is not valid, a protective security system designed using the outcomes of the threat assessment may not be effective in mitigating the real threat.”Footnote 46 An accurate understanding of threat is therefore important, as this encompasses the process of focusing on current adversary behaviors and circumstances in the present,Footnote 47 which should be the dominant element in determining risk exposureFootnote 48.
In conclusion, it is worth considering whether the level of iconoclasm by ISIS represented a new wave of terrorism or was instead an anomaly amplified by ISIS’s extreme violence, effective messaging strategy, and the broader international security context. As Nováček et al. note,Footnote 49 deliberate heritage annihilation on such a scale is rare in recent history. We should also ask whether continual focus on ISIS’s actions creates a form of confirmation bias,Footnote 50 distorting our perception of the broader threat to heritage, and whether this might in turn serve broader political agendas. Given that the securitization of heritage and its potential use as a political tool is now well recognized, it is crucial to ensure accuracy in our assumptions.
It is also apparent that much of the academic literature suggesting terrorism is an enduring threat to heritage has not applied such threat assessment methodologies. Understanding what was missing, particularly the lack of structured threat analysis and consideration of adversary behavior and the freedom of movement over time, is appropriate if future assessments are to improve and be more useful practically. While strong reactions to ISIS’s destruction of heritage are understandable, there appear to be gaps in structured professional judgmentFootnote 51 on the ongoing threat of terrorism to heritage, which may undermine the validity of such assessments. Although terrorism posed a significant threat to heritage at a specific point in time, it is essential to evaluate whether the term “cultural heritage crisis” has been misapplied or if a more enduring threat persists. A review of contemporary literature reveals paradoxes and gaps in best practices, a lack of practitioner perspectives, challenges in gathering empirical data on terrorism,Footnote 52 and ongoing perceptions of heritage as being endangered. Further exploration of the problem is therefore required to determine the most appropriate mitigative measures.
Methodology
To address empirical gaps identified in the literature, this study adopted an exploratory research methodology suitable for deepening understanding and identifying future lines of inquiry.Footnote 53 Data was drawn from two primary professional communities: those involved in the protection or conservation of tangible cultural heritage, and those engaged in counterterrorism or security services. While both contribute to the protection of heritage, they operate within distinct professional paradigms and follow different professional guidance, practices, and methodologies. This presents a valid group comparison for analysis of differences and directly responds to critiques that heritage destruction studies often lack “a consistent, comparative framework or an empirical foundation across different times, contexts, and communities.”Footnote 54
Between December 2022 and August 2023, 51 semi-structured interviews were conducted in English, either in person or via Microsoft Teams, each lasting approximately one hour. Participants were selected purposively and through snowball sampling, using a combination of professional and academic networks and LinkedIn searches for heritage protection keywords. Selection criteria included demonstrated competence in heritage protection or threat mitigation, based on experience, knowledge, and professional practice. While not intended to be statistically representative, the sample provides an informed cross-section of practitioner perspectives. Positionality is acknowledged as a factor shaping both participant responses and researcher interpretation. The author’s dual background in security and heritage provided access and rapport but also risked assumptions of shared understanding. To mitigate potential bias, the sample included divergent perspectives, and data was triangulated with secondary sources and thematically cross-coded. Research supports that, in qualitative exploratory studies, smaller yet diverse non-probabilistic samples are effective for capturing meaningful insights, provided there is sufficient variation in participant perspectives.Footnote 55 A pseudonymized participant list is provided in tables A1 and A2 in Appendix 1.
This approach does not attempt a comprehensive global representation but prioritizes real experiences in regions where cultural heritage sites have faced substantial risks related to terrorism or ideological targeting and draws out under-explored areas for consideration. Interviews were conducted on the basis of anonymity, with each participant pseudonymized and care taken to ensure that participants cannot be identified personally in the text. Throughout the analysis, the participants are given the prefix “CH” or “SE,” respectively, with participant 33 being from a heritage background given the code “CH-33,” for example.
The interview questions were organized into seven themes addressing key areas: participants’ professional backgrounds, their definitions and experiences related to terrorism and heritage threats, specific threat assessment practices, perceptions of security measures, opinions on local and international guidance, views on activist threats to heritage, and expectations for future risks to heritage. Quantitative data was gathered to highlight trends across the sample. With participant consent, interviews were recorded, transcribed, and stored in a structured spreadsheet, separating cultural heritage (CH) and security (SE) groups. Data was imported into NVIVO 11 for thematic analysis, following these steps: initial review of the text to generate primary themes, creation of master codes in NVIVO, sub-coding of master codes, and, finally, the development of a thematic network diagram. The initial thematic questioning was derived from the literature review and directed the data toward specific subjects, guided by the literature but within a known subject area. The semi-structured interview process allowed for the development of conversation points beyond the core questions.
To enhance validity, feedback on preliminary findings was sought from participants, enabling reflective verification of interpretations and improving reliability. Participants concurred with the gaps in current threat assessment practices and noted that limited resources often lead to an overemphasis on high-culture tangible assets. They also verified that there is frequently a focus on consequence over the realistic probability of attack. Those responding expressed agreement with the paper’s conclusions, emphasizing that they align with their professional experiences and observations. These insights grounded the study in the practical challenges faced by heritage and security professionals.
Figure 1 shows the four master codes positioned closest to the center, with sub-codes generated coloured appropriately. The research was undertaken in accordance with the ethical standards of the University of St Andrews, and anonymized data will be held long term in the St Andrews Research Repository.
Figure 1. Thematic network diagram.
Advance observations and emerging theories
This study highlights differences in threat assessment approaches between cultural heritage and security professionals, revealing methodological gaps and opportunities for cross-disciplinary learning. Preliminary observations show that heritage practitioners prioritize local, contextual, and community-driven insights, while security professionals rely more on formal models and historical data. This divergence presents challenges in creating comprehensive and realistic threat assessments, particularly for terrorism.
Emerging theories suggest that cultural intelligence, comprising knowledge of social, political, and economic factors, could be key to assessing threats, providing an adaptable framework for heritage security as included in the discussion section of the paper. Additionally, heritage attractiveness factors, which may motivate threat actors, offer a new dimension to threat assessment models. These insights, combined with the impact of global political shifts and the securitization of heritage, call for a reconceptualization of heritage security strategies to address both conventional and emerging unconventional threats.
Results
Experience and understanding of threats to cultural heritage
The initial discussion points focused on participants’ understanding and experience of terrorist attacks on heritage. Each participant was asked to comment on the definition of terrorism provided in the introduction and whether they agreed with it. Of the 45 who responded, 43 were generally in agreement. The two who disagreed were from the SE group, with SE-40 noting that their work doesn’t require defining terrorism, as they rely on Counter Terrorism Security Advisors (CTSAs), while SE-46 was unsure if the definition adequately covered heritage targeted for its own sake. Both groups emphasised the importance of including state terrorism and intangible heritage, while distinguishing terrorism from other forms of destruction, such as vandalism, protest, and personal frustration. Discussions also highlighted the political nature of the subject and pointed out broader issues with definitions in security and cultural heritage studies, such as the term “museum.”Footnote 56
All participants confirmed awareness of heritage being destroyed by terrorists before the interview. A higher proportion of SE participants had worked on heritage projects where terrorism was an inherent threat (see Table 1), and their awareness often came through direct project experience. Those without direct experience either had not worked on heritage projects or considered themselves researchers rather than practitioners. Around half of the CH participants had not been involved in a project where terrorism was a threat. However, many CH participants discussed relevant examples of terrorist destruction, demonstrating a solid understanding of such attacks, often gained through personal study and media sources.
Table 1. Have you worked on a heritage project where terrorism has been a threat?
Threat information
Many of the CH participants had worked on reports where the threat of terrorism was considered, such as disaster plans, funding applications, insurance documents, heritage impact assessments, or heritage significance reports. However, the vast majority had not carried out a threat assessment per se. In this regard, most relied on security consultants, with those in the UK often citing counterterrorism police or CTSAs providing terrorism information. This contrasts with the SE group, the majority of whom had carried out first-hand threat assessments for cultural heritage.
A key difference between the groups is how threat information is sourced (see Table 2). The CH group often relied on local security experts, such as consultants in the country of their projects, embassy representatives, or protective security personnel, to build a local threat picture. UK-based participants mentioned consultants with military or police backgrounds, who had access to confidential information, sometimes through the National Protective Security Authority (NPSA) or a CTSA. The CH group also frequently gained information from local sources, including heritage site caretakers and the local population, either through direct contact or known contacts. This form of live information was preferred because it provides an up-to-date and accurate understanding of site-specific issues.
Table 2. What sources of threat information do you use? From 20 CH and 20 SE respondents
This approach was in direct contrast to the SE approach. There was no mention of utilizing the local population in such ways, although those working in permissive environments or on projects in their home country would usually carry out their own site survey. Site visits were less likely for overseas projects, that is, for security consultants based in their home country but consulting on new projects in the Middle East. There was no mention from the CH group on being consulted for information by SE practitioners, and only one mention from the SE group on consulting heritage specialists; therefore, this does not seem to be normal practice. Indeed, when discussing threat and risk assessments for multiple heritage assets in the Middle East, SE-16 noted that “they actually onboarded a heritage consultant to give them guidance in relation to heritage issues. So whenever those assessments came in, it was a holistic overview of the risks to those venues,” indicating it is not common practice.
The SE group often mentioned utilizing national agencies, predominantly in the UK where threat information is offered by security authorities such as NPSA or through CTSAs. This source was generally looked on favorably, and it was remarked several times that other countries without this function suffered from a lack of good threat information. For example, when discussing threat information sources in the Middle East, SE-07 stated “So [the security design] was done by a strategic security risk company. Now what was always interesting is that you’d want that to be verified by national security agencies, right? In the UK you go and speak to your CTSA or [NPSA] and you’d get confirmation of what level of protection to provide. Unfortunately that never happened.” However, when discussing a similar process in Australia, SE-37, a security manager for a national monument, noted that
[the national agencies] are linked with the terrorism intelligence unit and together those two units produce information for organizations like us and/or other, you know, places that might be considered targets. Knowing about intelligence, what we get given is low-level rubbish stuff that anyone with half a brain could put together from the internet.
SE participants working in museums generally had a good network of information from local government or police sources and used dynamic data-gathering techniques such as social media intelligence. As SE-04 mentions,
Those [cross-cultural sector security information groups] I’ve mentioned share intelligence on a regular basis … fundamentally, museums, libraries and archives, the government, and the police send specific intelligence which we then cascade to the relevant parts of our community that are affected by that. As a crowded public space, we have a dedicated counterterrorism security adviser for the UK who visits us a minimum of four times a year and assesses our threats.
This process was similar for a comparable facility in Asia. SE-36 noted that
So anyone that attacks the gallery or any intelligence received from our neighbours will be imported into the system, and then we’ll take it from there if it is worth looking at. I think being a good neighbour helps … [the facility] is a historical monument – that adds to the qualification for the gallery to be part of the special infrastructure classification. So all buildings that have been marked as a special or critical infrastructure has to go through a security by design … And if [the information] is not sensitive, they will share the information with us.
In contrast to the CH groups’ use of local data sources, the SE group typically relied on using open-source information for threat assessments, including previous security incidents in the same country as the heritage asset, but also utilizing historic examples in other countries for benchmarking. This was primarily used for establishing capability and attack types, but also to gauge the probability of attacks. Only one participant mentioned using specialist social media intelligence processes to assess current threat data, and none reported consulting updated terrorist sources such as extremist websites or publications like Dabiq, where such intentions might be broadcast.
Threat assessment process
When asked about the threat analysis process, responses were varied even between groups (see Table 3). For the SE group, threats were usually considered as part of a broader risk assessment process. Using the international standard for risk assessments, ISO 31000,Footnote 57 was mentioned only once (perhaps because the threat assessment process is mentioned but not demonstrated in that document), and there were no mentions of using any risk assessment guidance documents tailored to heritage. Several mentioned following their own bespoke methods. One participant described using the concept of “Design Basis Threats,” establishing risk and appropriate treatment measures through detailed examination of credible threat scenarios. Most SE participants noted that terrorism was always considered a threat.
Table 3. How do you go about your threat assessments? From 20 CH and 20 SE respondents
The CH group mentioned following a specific risk assessment standard (ICCROM) only once. Hostile actor threat assessments, especially related to terrorism, were typically provided by others for inclusion in heritage risk assessments, which about a quarter of CH respondents had helped draft. The CH group often included factors beyond the threat actor, such as heritage significance or value, and political considerations, which were central to understanding the threat. In contrast, the SE group rarely mentioned these components.
The inclusion of heritage significance and political considerations in CH threat assessments may stem from mandated requirements, such as those for World Heritage sites set by UNESCO, funding or insurance obligations for collections, or emergency planning for cultural facilities. Conversely, the SE group frequently noted a lack of regulation, with no consistent format or procedural requirements for threat or risk assessments, and no heritage-specific guidance for security consultants. UK participants often cited “Martyn’s law” – the Terrorism (Protection of Premises) Bill – proposed after the Manchester Arena bombing, as a potential “game changer.”
This topic revealed a key difference in how the groups approached threats to projects. The SE group was more likely to work proactively, assessing threats to inform the planning and design of security measures. In contrast, the CH group was often involved in projects facing active threats or dealing with the aftermath of an attack. Another contrast is that the SE group typically focused on the destructive aspect of terrorist threats, with little consideration for how heritage could be used to influence the broader population. This factor was frequently discussed by the CH group, especially in relation to Ukraine. This may stem from the SE group’s focus on risk assessments for specific objects, collections, or buildings, rather than viewing heritage as part of a wider psychological strategy of attack.
Interestingly, the CH group provided some examples of terrorism threat indicators. CH-44 discussed how restrictions to intangible cultural heritage, such as denying music, changing requirements for women’s clothing, or stopping traditional festivals, often come before the destruction of the tangible. Similarly, in talking about a project in Syria, CH-42 mentioned how funding was suddenly cut some time before ISIS had begun terrorist operations in the country. This indicator was echoed by CH-19, who mentioned a similar effect for conservation architects in Yemen. “Whenever funding dried up for them, that was a huge kind of indicator that international donors aren’t wanting to fund certain activities in Yemen because it’s too risky.”
An important consideration emerging in this theme was that of threat being related to how and where it is attracted, suggesting that threat targeting is often related to specific attraction characteristics of heritage. Attractiveness was often discussed in the context of why some heritage is more appealing to terrorists or criminals than others, thereby increasing risk exposure through enhanced probability of attack over other forms of heritage. The factors affecting attractiveness offered are shown in Table 4.
Table 4. Factors of attractiveness offered during the interviews
Participants were asked their opinion on the most common threats facing heritage and what they felt the most significant threat was. Tables 5 and 6 show differences in opinions both inside and between the two groups, demonstrating a range of experience and understanding. While mentioned often, “terrorism” is likely to have been influenced by the fact it was core to the overall discussion, although respondents generally felt that terrorism was not a priority threat, due to the low likelihood of a terrorist event transpiring.
Table 5. What are the common threats to cultural heritage?
Table 6. What is the most significant threat to cultural heritage? (Note some respondents gave two answers)
The SE group in particular discussed how terrorism is nearly always considered in risk assessments, whether realistic or not, due to its potential to cause catastrophic damage. This is an important observation. For example, SE-04 mentioned:
You know terrorism’s always going to sit somewhere near the top on your executive board agenda. But in reality my assessment of it is that we have a 2.6 billion chance of being attacked by terrorists. If you look at it statistically, we have a much higher risk of being burned down. That doesn’t mean that [a terrorist] can’t walk in tomorrow morning and then one couldn’t come a week later.
Related threats
The role of media in heritage protection was frequently discussed, with 14 CH and 15 SE participants offering opinions. Positive aspects included raising awareness of heritage attacks, sharing information on protection initiatives like Martyn’s law, providing social media intelligence, and helping to understand threats and security gaps. Negative aspects included amplifying the effects of performative destruction, achieving terrorist messaging goals, increasing sensitivity to heritage destruction, facilitating activism, leveraging insider threats from disgruntled employees, and, especially for mainstream media, serving political agendas. Only three participants suggested that attacks on heritage and threats in general were increasing, with some acknowledging that heightened media attention contributes to such perceptions.
Limited funding was often highlighted, with funding gaps affecting complete protective strategies and making realistic threat analysis crucial to balance security expenditures with other essential conservation costs. Related issues included security plans developed during design phases not being carried over to the operational phase and authorities being reluctant to install security measures during peacetime. There was also evidence of downplaying the terrorism threat on occasion to avoid implementing counterterrorism measures, which might create perceptions of weakness or the country being at risk on the global stage. Administrative gaps, such as overlapping responsibilities between departments and stakeholders, were also highlighted, as were the competing requirements of different stakeholders. Additionally, staff turnover in key positions during projects led to a loss of consistency, further complicating policy implementation and hindering the success of heritage protection efforts.
Discussion
Experience and understanding
Finding an appropriate definition of terrorism in relation to cultural heritage was given value. Given the recent increase in activist and social justice movements targeting heritage,Footnote 58 it is sensible to differentiate terrorism from other threats such as vandalism and activism, if only to assess threats accurately and justify proportionate security measures. However, it should be recognized that there are elements that feature in iconoclasm and vandalism, especially the religious, political, and ideological motivations,Footnote 59 which are shared and make isolating threats into neat categories difficult. In the end, the mitigative process may be similar, but having clear definitions would assist with appropriate labeling of threat actors. This will keep political agendas in check through reservation of pejorative terms, so that those partaking in other forms of attack or protest do not face disproportionate reprimand, such as facing terrorism charges for defacing the protective cover on a painting.Footnote 60
Standing out in terms of experience and understanding in the research is the work and role of the security manager in museums and similar cultural facilities. This role would seem to be a model of best practice, both in terms of realistic threat assessments and adopting dynamic and proportionate security measures. This is made possible through making best use of information from external stakeholders, including national intelligence and special interest groups (such as the National Museum Security Group or the International Committee for Museum Security), and utilizing dynamic threat information such as social media intelligence. Having an enduring role also means they develop a deep knowledge about the facility and threats specific to their heritage. This would correspond with research suggesting museum security managers have a significant role in working with intelligence agencies.Footnote 61 That their role or processes follows a degree of confidentiality is perhaps commensurate with successful implementation.
Threat information and indicators
The results highlight difficulty in obtaining credible information to assess the intent component (and thus likelihood) in terrorism threat assessments. As noted by Ezell et al.,Footnote 62 “It is arguable that one of the best sources of information on the nature and intelligence of our adversaries, although limited, uncertain, and incomplete, is the intelligence community.” Having a model where local security agencies such as the NPSA provide credible threat information would seem valuable. The UK model, where CTSAs and NPSA provide credible heritage threat information to security managers, is highly valued, especially since intelligence from global agencies is not always forthcoming. This difficulty partially explains the reliance on historical data, despite its known limitations in estimating attack probabilities. Nevertheless, historical data remains crucial, particularly at the local level, where it has more validity. As SE-16 noted, failing to consider relevant local security incidents would undermine the reliability and completeness of a threat assessment in that geographical area.
The use of external indicators to provide early warning of heritage being targeted is an interesting and understudied subject that had received some attention by the then RAND researcher Erik Nemeth, in his conceptual studies as summarized in his 2015 book Cultural Security. Footnote 63 The timing of that research is interesting as it commenced in the aftermath of the Taliban’s destruction of the Bamiyan Buddhas in 2001 but concluded before ISIS, allowing the indicators proposed to be tested against the perceived shift from ideological heritage manipulation strategies in the Cold War to the religiously inspired destruction that was developing. There are two significant strands within Nemeth’s research that the current research can be examined against.
Nemeth’s framework for studying the interrelation of heritage and global security encompasses three dimensions: physical security, economics, and politics. Changes in one dimension, such as increased art market values, can signal threats to the others, like heightened targeting of heritage. Assessing these shifts is part of “cultural intelligence,” aiding decision-makers in foreign policy, attack prediction, and heritage protection. Participants’ suggestions that funding changes and targeting of intangible heritage may signal increased terrorist threats might be considered valuable contributions to cultural intelligence. Incorporating heritage significance and political context, as emphasized by the CH group, further enriches this intelligence framework, supporting both site-specific predictions and broader foreign policy implications. Similarly, the CH group’s reliance on local expertise and community input is an important cultural intelligence resource, akin to “human terrain analysis,”Footnote 64 critical not only in understanding the threat picture and operational environmentFootnote 65 within which heritage sits, but also in understanding contemporary hybrid warfare.Footnote 66 Applying the intelligence cycle to hybrid warfare and heritage protection would benefit from further exploration.
Nemeth also highlighted the shift from Cold War threats to post–Cold War political violence targeting cultural sites.Footnote 67 Increasing international sensitivity to heritage protection and rising antiquities trafficking signaled threats beyond armed conflict, foreshadowing Ansar Dine and ISIS. Reapplying this observation today, the literature review reveals exponential growth in studies and media coverage on heritage destruction over two decades. The SE group’s focus on historical, open-source threat examples, primarily related to ISIS, risks perpetuating a fixation on religiously inspired attacks. Globally, this could obscure emerging threats tied to an evolving “Cold War II,”Footnote 68 characterized by asymmetrical power struggles.Footnote 69 The UK and US shift from countering religious terrorism to addressing hostile state activityFootnote 70 aligns with NATO’s positioning of heritage within its hybrid threat agenda.Footnote 71
Threat assessment
Discussions on threat assessment processes revealed gaps and differences between the CH and SE groups, as well as within individual approaches in the same professional group. These differences are understandable, given the groups’ distinct terms of engagement. However, this variation is significant because similarly to how military representatives typically “own” the threat assessment process in conflict zones,Footnote 72 SE professionals are often responsible for conducting threat assessments in non-military contexts. These assessments occur more frequently and cover a broader range of heritage sites, making consistent and accurate approaches essential. It can reasonably be assumed that different approaches would achieve different results, and that improvements in consistency of approach would reduce gaps and misunderstandings, benefiting heritage sites overall.
Threat assessments are often subsumed into broader risk assessments, which focus on understanding risk exposure and implementing countermeasures. While logical, this can result in the threat assessment itself receiving insufficient attention, particularly in heritage-focused processes. Combined with limited credible information on terrorism, and reliance on past events from different regions, periods, or political contexts, this creates a challenging situation. As Cunliffe identifies,Footnote 73 these factors can either magnify or reduce comparative relevance, resulting in risk assessments that may be overly cautious, leading to unnecessary costs, or too relaxed, thereby endangering lives and heritage. A potential solution to this is adopting DBTs as a more comprehensive threat assessment process. Although mentioned only once in the research, DBTs are widely used in threat and risk management textbooksFootnote 74 and are adopted in other high-threat industries such as critical national infrastructure.Footnote 75 DBTs require detailed assessments of potential adversaries, their motivations, and attack scenarios, forming the basis for designing and evaluating security systems. For heritage sites with limited budgets, following the DBT process can help ensure security measures are proportionate and appropriate. However, focusing only on the threat actor can also lead to critical gaps. One must also understand the context within which the heritage, and need to protect it, exists. While this factor is emphasized in heritage risk assessment reference documents,Footnote 76 it may be underutilized in practice. Understanding the internal and external context is important as it forms the basis for later decision making.Footnote 77 Although there are multiple contextual points to consider for heritage projects, including the limitations of one’s terms of engagement, the research draws out two important points worthy of discussion.
The first component is stakeholder engagement, which appears to be more limited within the SE group. Identifying and consulting stakeholders is crucial for establishing accurate and relevant context, and stakeholders can vary widely depending on the type of heritage in question: end-users, collection managers, insurers, caretakers, museum organizations, law enforcement, military units, and so on. Engaging with local communities about their heritage may also provide valuable insights into its social value and the level of resistance to potential destruction.Footnote 78 A lack of consultation can also lead to feelings of resentment and disconnection from protective strategies.Footnote 79 While understanding and balancing stakeholder needs with security measures may be challenging,Footnote 80 comprehensive engagement is essential to achieve a shared understanding of the significance of the heritage being protected.
The second significant component under the umbrella of context is that of attractiveness. This is often not considered specifically in heritage threat and risk assessment studies for terrorismFootnote 81 but is more likely to be considered for art crime.Footnote 82 In a similar way to DBTs, attractiveness features more heavily in security risk management textbooks, as a factor for estimating threat potential.Footnote 83 In the absence of solid intelligence on a threat actor’s intentions, attractiveness can be used to gauge motivation (and therefore likelihood) behind destruction, a core element of understanding why heritage is targetedFootnote 84 and in mitigating risk.Footnote 85 Another important factor of attractiveness identified in the research is that of heritage being within a “crowded place,” a targeting factor widely appreciated in counterterrorism strategies.Footnote 86 Half of the SE participants identified that heritage sites may be more likely to be targeted by virtue of the crowd density of those coming to view the heritage, with the visitors being the primary target rather than the heritage itself. The 1997 Luxor attack in Egypt and the 2017 Bardo National Museum attack in Tunisia demonstrate how heritage facilities may be targeted due to the crowd density or the number of tourists in the crowd.Footnote 87 It was in the crowded places context that Martyn’s law was discussed as a positive step in the UK, whereby public venues, including cultural venues with 200 or more individuals, will likely be required to consider the threat of terrorism and implement appropriate and proportionate mitigation measures.Footnote 88
Such site attractors are rarely mentioned in academic studies of terrorism and destruction of cultural heritage, perhaps because they are often focused on World Heritage (and therefore assumed to be attractive) or dedicated to the previous actions of ISIS. However, the fact remains that some heritage sites will have a greater combination of the factors of attraction than others and are therefore more likely to attract threats, making attraction an important part of the structured professional judgmentFootnote 89 required in the threat assessment process for heritage.
Perception of threat
The research has also revealed an interesting contradiction in opinions. While there was consensus that the threat of terrorism to heritage is low, most felt that terrorism will continue to be a significant threat to heritage in the future. Opinions on the former were not based upon appraisals of the traditional threat components of capability and intent. Rather, these opinions were formed in appreciation of the very low likelihood of terrorist attacks to heritage transpiring.Footnote 90 This emphasizes why separating threat and risk is important, because even if the likelihood of a terrorism threat transpiring is considered low, the risk exposure may still be deemed high for an individual site due to the impact an attack might have on irreplaceable heritage. This risk rating process is typically shown diagrammatically in a traditional risk matrix (see Figure 2). For heritage, this approach may be oversimplified, however, because it would always push terrorist attacks into the very high category, suggesting countermeasures and expenditure are likely required. As SE-10 mentioned, “That’s the approach that engineering companies will take. That’s because they do not understand the cultural sector; it’s a lack of heritage expertise.” Similarly, SE-51, a security specialist in a large heritage body, noted “Coming through experience [in military intelligence], in the organization I’ve got the highest risk appetite. Ironically, it’s other people who flap around, [in reaction to global heritage attacks].” We should also consider that if the probability of threats occurring is based upon historical data extrapolated into the future,Footnote 91 as would seem to be common in practice, then this might further misrepresent the realism of this risk. There is very little scholarly material to be found on the probability of terrorist attacks on heritage or how to balance a heritage risk appetite; therefore this may be a useful area of research to assist in realistic assessment of risk and support security managers in rational decisions on expenditure.
Figure 2. Typical risk matrix showing how unlikely or rare terrorist events may still score high on a risk matrix. Augmented risk matrix from Paladin (2018).
The nearly unanimous view among participants that terrorism will pose a significant future threat to heritage appears contradictory to its low likelihood. However, these concerns were not framed in terms of traditional risk components like likelihood or impact. Instead, they emphasized the societal and identity-driven importance of heritage, which make it both attractive and vulnerable to political, ideological, and religious exploitation, as previous research has shown.Footnote 92 These factors are central to arguments on heritage securitization. The future significance of heritage was also discussed in terms of political narratives. For instance, CH-22 noted, “For political reasons, the ISIS problem has been blown out of proportion, contrary to other sources of looting and destruction because it was politically convenient to do so.” This aligns with Christensen’s observation that focusing on religious terrorism supported the global war on terror narrative, often ignoring comparable acts elsewhere. A wider shift in focus to hostile state activities and a reconceptualization of Cold War–style security threats may significantly influence political narratives on heritage in the future, making robust threat assessment processes important.
Terrorism threat assessment framework for cultural heritage
Using observations from the research, a new threat assessment framework for cultural heritage is proposed in Figure 3. This model draws on principles from multiple existing risk assessment resourcesFootnote 93 while directly addressing limitations in both existing security and heritage risk assessment methodologies. It improves upon broad frameworks such as ISO 31000, HB167, and API 780 by embedding specific and relevant heritage criteria, particularly within the lenses of attractiveness and likelihood, to generate more credible threat scenarios. In contrast to heritage-focused models like the ICCROM ABC method or Cunliffe’s risk-based approaches, this framework integrates adversary motivation and formal threat analysis to foreground deliberate security-based threats. It also advances beyond NATO models such as Cultural Property Protection (CPP), Civil-Military Co-operation (CIMIC) doctrine, and post-conflict “first aid” guidance by providing a forward-looking, practitioner-oriented model applicable outside law of armed conflict contexts. Moreover, it enhances the utility of UNESCO’s heritage impact assessment guidance by introducing the need for specific threat identification and advocating for the use of competent consultants during the planning stage.Footnote 94
Structured in three phases, the process flows from left to right including the following key stages:
-
1. The perimeter of the large circle demonstrates cultural intelligence factors, such as stakeholder engagement, social and political context, and threat indicators, which shape and inform the overall threat landscape. These have a magnifying or reducing effect on the threat scenario process.
-
2. The internal parts of the large circle demonstrate the initial threat assessment process and apply structured threat analysis involving capability, motivation, and opportunity, leading to credible potential threat scenarios.
-
3. The model then evaluates these scenarios through a lens of defined attractiveness and likelihood metrics to determine which should be developed into DBTs.
Unlike some high-level models, this framework is tailored for direct application by heritage professionals and consultants across both local and international contexts, including, but not limited to, World Heritage sites or military assessments. It aims to produce credible threat profiles to underpin protective measures and guide proportionate security designs.
Figure 3. Terrorism threat assessment framework for cultural heritage.
As an illustration, the model can be applied to two museum facilities in the UAE – the Sharjah Heritage Museum and the Louvre Abu Dhabi – both of which were visited by the author in 2025 for research purposes. Given their shared typology and national context, the sociopolitical threat indicators represented in the model’s first circle, and thus the initial threat assessment at the center, would be broadly similar. However, as the analysis progresses outward through the model, differences in location, crowd density, visitor profile, exhibition content, and the value of exhibits significantly influence the level of attraction for hostile actors. In this case, the Louvre Abu Dhabi presents a higher-value target and therefore generates more probable threat scenarios. The corresponding design basis threats would thus need to be tailored to the Louvre, resulting in more stringent security measures, a distinction that aligns with the actual security postures observed at both museums at the time of writing. Analyzing a facility in another region would likely result in different cultural intelligence factors, and therefore a different threat analysis in the first two stages. This would then produce different threat scenarios to assess through the lens of attractiveness and likelihood.
Conclusion
This article has used empirical data sourced through interviews of two professional groups to test observations from a review of contemporary literature concerning the destruction of heritage through terrorism. It goes on to consider their opinions on different threats to heritage, and how the threat of terrorism specifically is considered and positioned in practice. This exploratory methodology was designed to reveal interesting lines of inquiry not possible through a literature review alone.
Differences in approaches between CH and SE groups are revealed, in both the sources of information used and the guidance adopted. There are also significant differences in the threat assessment approach, even within groups, which leads to questioning of the systematicity and validity of results in agreement with the literature review findings. Although the differences in approaches between the two groups reveal potential gaps, they also demonstrate opportunities for learning from other specializations within the broader field of heritage protection. The museum or cultural facility security manager has emerged as an exemplar, demonstrating how the use of dynamic cultural intelligence, special interest groups, and rational approaches to threats can result in effective countermeasures through an enduring interest.
The study also shows that credible threat information, covering intent and likelihood of attack, is difficult to source. There is a significant reliance on historic threat information that currently may self-perpetuate a focus on religiously inspired terrorist destruction. Coupled with potential flaws in the traditional risk assessment process, this may elevate the risk of terrorism attacks on heritage to unrealistic heights. Threat assessments must be realistic to be effective for the practitioner, especially considering the tight budgets often faced in heritage management. The potential for political and media distortion, coupled with the broad range of threats to the wide variety of heritage, dictates that a comprehensive threat assessment is required. In appreciation of this, an enhanced approach to threat assessment is offered as a framework incorporating important aspects such as cultural intelligence, attractiveness, and cultural threat barometers to remain forward facing.
The research contributes to the growing body of research on the securitization of heritage through highlighting where terrorism intersects with other unconventional threats and how to assess and distinguish terrorism in context. It also connects with earlier scholarship on cultural security, particularly studies marking the transition from ideological manipulation of heritage to religiously motivated destruction. Together, these insights suggest the potential for a reconceptualization of heritage security, shifting emphasis from religious symbolism to identity-based and sociopolitical targeting as heritage becomes entangled in the dynamics of renewed great power rivalries and proxy conflicts reminiscent of a new Cold War.
Finally, the research shows doubt that terrorist destruction of cultural heritage is increasing, reinforcing the proposition that the attacks of ISIS were an anomaly facilitated by the time, space, and freedom of movement brought about by their expansive control of land. Although it is understandable that the significant destruction brought about by ISIS raised such concerns and it has been important to look back to understand what happened, it is important to avoid the potential for confirmation bias through this approach. More importantly for security matters, it is now appropriate to consider what should be done differently in the future. Fixation on ISIS may result in missing future trends, which, paradoxically, may require us to look further back to the Cold War period for lessons on how to forecast new and emerging unconventional threats to heritage.
Appendix 1: List of pseudonymised participants
Table A1. List of CH Participants
Table A2. List of SE Participants
Open access
