Expert Insights: Kidnap and Extortion

S-RM spoke to David Lawson, Deputy Head of Crisis Response, about some of the recent global trends in kidnapping and extortion, and to hear about some of the key considerations for S-RM’s Crisis Response team when they are working on a live case.

Data for reported kidnappings suggest the duration of kidnappings is getting shorter. For example, the average kidnap duration in 2011 was 29 days, while the average duration in 2018 was down to 5 days. Has this shift impacted your approach in responding to kidnapping incidents?

From a response perspective, the ‘Holy Trinity’ never changes: first and foremost, the overarching objective is always to seek the safe, timely and secure release of the victim. Second, the handling of the incident should be in a manner that protects the best interests of the victim, the victim’s family, and/or the victim’s employer – whilst mitigating future risk. Third, we always act within the law as it applies in every appropriate jurisdiction with an ‘interest’ in the case. And, in relation to the primary objective of achieving a ‘safe and timely release’ it is important to understand that ‘timely’ does not necessarily mean ‘quick’.

Whilst every kidnap is unique, time has an important bearing on strategy for both the kidnapper and the responder, but it is rarely the key driver. Once a kidnap has occurred, the kidnapper ‘owns’ time and, generally speaking, will not make an agreement until such time as he is convinced that there is no more profit to be made from continuing to negotiate. Pressures that play on a kidnapper’s dominance of time are relatively few: pressure from law enforcement; the impact time may have on his sense of a ‘return on his investment’; and internal time pressures to reach an agreement that emanate from within the kidnap group. In some cases, a hostage’s poor or deteriorating health can exert some time pressure on kidnappers. However, the responder can also expect to be leveraged over this fact as the kidnapper seeks to exploit the situation first.

For the responder, time can be made to work to advantage but creates frictions of its own. These chiefly relate to the need to maintain a balance between the conflicting pressures of: the time taken to ensure a safe release, versus the risks associated with offering a concession too quickly, versus the risks that resisting a kidnapper’s demands have for the life of the victim(s). And with all three underwritten by a moral imperative not to extend the period of captivity for the victim(s) unnecessarily.

Taken at face value, therefore, it is true that the pace of kidnap negotiations has quickened over the last five or so years, and that (as a global average) durations have declined from 29+ days in 2011 to five days or fewer by 2018. It must be noted, however, that this is a global average and that there are significant regional variations where differing constraints and contextual variations play on the timeline.

"The essential truth is unaltered: kidnappers do not tend to release a victim until they believe there is no more profit to be made.”

Equally, it is important to recognise that the essential truth is unaltered: kidnappers do not tend to release a victim until they believe there is no more profit to be made. What has altered, particularly in certain kidnap hotspots such as Nigeria and Mexico, has been the apparent adoption of a model where some kidnappers operate a high turnover, rapid settlement strategy where they seek to maximise profits through high volumes of victims as opposed to large profits attained over extended durations. However, as a generality, it should be noted that longer case durations tend to occur in jurisdictions where a lack of governance, reach, capability or competence allow kidnappers to extend the length of an incident with relative impunity and hold out for bigger concessions (whether financial or non-financial).

How have advancements in technology, such as instant messaging and the emergence of virtual currencies, changed the way responders interact with kidnappers or extortionists?

Over the last five to ten years, most ransom demands (90%+) have continued to contain a financial element of some sort, and this is unlikely to change whilst the majority of kidnappers remain motivated, primarily, by financial gain. In line with this statistic, it is probably a fair assumption that the vast majority of financially-motivated kidnappers remain ‘low-tech/low-level’ criminals, and that they continue to prefer low-tech communication solutions such as the mobile telephone or intermediaries when making their demands known and for conducting any subsequent negotiation.

"The vast majority of financially-motivated kidnappers remain ‘low-tech/low-level’ criminals, and they continue to prefer low-tech communication solutions such as the mobile telephone."

However, as our familiarity with cryptocurrencies has increased so, perhaps unsurprisingly, has the willingness of criminals to make use of them as a means of receiving ransom payments – and not just in cyber cases. Traditionally, kidnappers did not trust electronic fund transfers, preferring to ‘touch, count and smell’ hard cash and to control its further distribution, but the relative ease and anonymity with which crypto-payments can be made has meant that there has been an increase in demands for, for example, Bitcoin and Monero all over the world. Caution should be exercised, however, in ascribing too much significance to this, as the subject remains relatively ‘newsworthy’ and the risk of over-reporting brings a risk of over-inflating the incidence of such cases. This is particularly true at the lower end of the kidnap spectrum, where the additional administration and due diligence involved in setting up and administering crypto-wallets and accessing ‘hard cash’ after payment are likely to continue to mitigate against their use.

Kidnappers have long been wary of over-using telephones and have traditionally made use of either the victim’s communications devices or of one or more ‘burner’ mobile phones. As governments have tightened rules for the registration of phone numbers/SIM cards, and technology has made it quicker and easier to triangulate a caller’s location via geolocation, so have (some) kidnappers made greater use of platforms guaranteeing a greater degree of anonymity by virtue of encrypted servers, anonymous retransmission and network proxy technologies.

As with cryptocurrencies though, we should be wary of over-emphasising the use of such platforms, as the majority of kidnappers remain of the ‘low-tech/low-level’ variety with a tendency to be driven by ego and preferring the shock value of oral expression. That said, kidnappers have and will continue to make effective use of social media platforms including Facebook, communications apps such as Messenger, WhatsApp and Telegram, or email communication using anonymous proxy servers.

For the responder, whatever the medium used for communication, the principles vary little, with a focus on structured resistance to the demand, achieved by demonstrating empathy, and a willingness to co-operate as a ‘neutral, trusted intermediary’; to listen, understand and receive/pass messages, and thus buy time for decisions to be made.

How do private operators like S-RM liaise with government authorities when responding to kidnap and extortion cases?

There are three critical issues to be considered here. However, since we do not offer expert legal advice, we can only point out the issues and encourage clients to take formal advice from their lawyers on the following:

• Firstly, like all responsible response providers, S-RM requires us to operate not only in accordance with UK law, but also in accordance with the laws of any other jurisdiction with a legitimate interest in any case we respond to. Consequently, we cannot advise a client to break any applicable law and, in any event, to do so would be likely to invalidate any insurance cover in place.
• Secondly, kidnap and extortion are criminal offences and so, setting aside their willingness and/or capability to do so, police and law enforcement authorities across the world have a duty and a responsibility to investigate them and to bring offenders to justice. It follows, therefore, that to wilfully obstruct those authorities by withholding information of potentially evidential value would itself also constitute a criminal offence.
• Thirdly, the law in some countries may also set constraints/parameters on several legal issues (e.g. on dialogue/negotiation; on the payment of ransom; on the informing of the authorities; on the use of consultants and on terrorist-related legislation). Clients should ensure that they are aware of the legal requirements in each of these areas, and in each relevant jurisdiction.

Having established contact and liaison, the responder needs to take account of client concerns surrounding the ‘realpolitik’ of dealing with local authorities, who might range in terms of credibility, capability, competence and level of resource across a spectrum from first-world to failed state! And so, whilst the law may be explicit in relation to some, or all, of these issues and thus cannot be broken or ignored, clients often have the severest of reservations about complying. However, whilst the law may be specific on the requirement, it is usually silent on subjects such as ‘how’, ‘where’, ‘when’ and ‘to whom’ matters should be reported, and so there is often a ‘ways and means’ act whereby we can ensure a client meets the spirit of its obligations without giving away sensitive tactical detail potentially compromising a sensitive negotiation.

Responsible responders, therefore, advocate a principle that a client should establish contact early and maintain liaison at a senior level with all appropriate government agencies throughout a case, not least with representatives of the victim’s own government.

Read our 2020 Travel Security Special Edition for more global security insights.