Using Risk Terrain Modeling for the Risk Assessment of Explosive ATM Attacks ^†

Abstract

In this article, we present the use of risk terrain modeling for the risk assessment of explosive ATM attacks in North Rhine-Westphalia, Germany. We give a brief overview of three methods used for this purpose: risk terrain modeling, recapture rate index, and time series analysis. The results show that by using these methods, police can gain a deeper understanding of the patterns and trends associated with explosive ATM attacks and better allocate their resources by focusing on higher-risk ATMs.

1. Introduction

Automated teller machines (ATM) have become ubiquitous in modern society, providing easy access to cash and other financial services. However, they have also become a prime target for criminals, particularly those seeking to carry out explosive attacks. These attacks not only pose a serious threat to public safety, but also cause significant financial losses to the banking industry.

In recent years, explosive ATM attacks have become a major issue in Germany. In 2022, more than a third of all explosive ATM attacks recorded throughout Germany were committed in North Rhine-Westphalia. In a nationwide comparison, North Rhine-Westphalia is, thus, the most severely affected federal state. This can be attributed in particular to the large number of opportunities to commit the crime: more than 10,000 ATMs, the good opportunities to escape due to the dense, well-developed road network, and the proximity to the border with the Netherlands—the perpetrators are predominantly members of Dutch criminal groups. Predicting the occurrence of these crimes is crucial for law enforcement agencies to allocate resources effectively, avoid losses for banks and customers, and prevent threats to citizens from explosive ATM attacks. To address this problem, law enforcement agencies need to be able to predict where and when these crimes are likely to occur. In recent years, various prediction models have been developed to tackle this issue, but their effectiveness remains to be proven.

Traditionally, law enforcement agencies and security experts have relied on historical crime data and expert knowledge to identify high-risk areas for ATM explosive attacks. While these methods can be effective, they are often limited by the availability and quality of data, as well as the subjective nature of expert opinion. In recent years, the field of risk terrain modeling (RTM) has emerged as a promising approach for identifying high-risk areas for various types of crime, including ATM explosive attacks. RTM is a spatial analysis technique that uses a combination of environmental and socio-demographic variables to predict the likelihood of crime occurring in a given area [1]. RTM is based on the idea that certain environmental and socio-demographic factors can create a “terrain” that is more conducive to criminal activity. For example, areas with poor lighting, high foot traffic, and limited natural surveillance may be more attractive to criminals looking to carry out an ATM explosive attack. RTM can identify these high-risk areas by analyzing a variety of spatial and non-spatial data, such as street networks, land use patterns, and demographic characteristics [2].

Thus, risk is understood here as a metric “to tie different parts of the crime problem together as it offers a probabilistic interpretation of crime analysis that allows us to suggest that certain things are likely to happen” [3] (p. 11). Following the idea of “risk metrics”, Caplan and Kennedy [4] (p. 7) conceptualized risk as a “continuous dynamic value that increases or decreases intensity and clusters or dissipates in different places over time.” In this understanding, crime risk is primarily tied to geography.

RTM methods are able to assess the risk of future crime occurrence from a spatial perspective. This approach is part of the SKALA (System for Crime Analysis and Anticipation) approach of the State Office of Criminal Investigation of North Rhine-Westphalia (LKA NRW). The intention of SKALA is to understand the main use of crime analysis and forecast algorithms to investigate crime patterns at different spatial and temporal scales to support crime prevention [5]. The findings concerning the risk assessment of explosive ATM attacks using RTM are presented and discussed below.

The purpose of this paper is to examine the effectiveness of RTM for predicting the risk of explosive attacks on ATMs. We will begin by providing a brief overview of the methodology and principles underlying RTM. We will then describe the data sources and variables used in our analysis, as well as the statistical techniques employed. Finally, we will present our findings and discuss the implications of our study for law enforcement and security professionals.

Overall, the use of RTM for identifying high-risk areas for ATM explosive attacks has the potential to greatly enhance the effectiveness of law enforcement and security efforts. By providing a more accurate and data-driven approach to risk assessment, RTM can help prevent and mitigate the impact of these dangerous and costly criminal activities.

2. Explosive ATM Attacks in North Rhine-Westphalia

In recent years, North Rhine-Westphalia (NRW) has become the most severely affected federal state in Germany in terms of explosive ATM attacks. In 2022, 496 explosive ATM attacks have been recorded by the police in Germany (Figure 1). The number of cases has, thus, reached its highest level to date. Over a third of all recorded explosive ATM attacks were committed in NRW (Figure 2). The amounts of loot and property damage resulting from these crimes are in the tens of millions of euros each year.

How can this high rate of explosive ATM attacks in a single federal state be theoretically explained? Environmental criminology provides two interrelated theories that explain why crime occurs in the places and at the times it does. Assuming the routine activity theory, crimes only occur when motivated offenders, suitable targets, and the absence of capable guardians against a violation converge in space and time [6]. The crime pattern theory [7] provides an explanation of where these convergences occur. Starting with the individual offender, the crime pattern theory postulates that the offender moves along fairly predictable paths between his nodes of routine activity, so-called awareness space. Crime can, therefore, only occur where the offender’s awareness space intersects with opportunities for crime. In practice, to approximate the individual (and usually unknown) awareness space of the individual offender, the most likely locations for crimes are estimated based environmental factors that describe crime generators, crime attractors, and crime-neutral areas. Crime generators are areas that attract many people regardless of crime, e.g., shopping malls or train stations. They generate crime by their mere presence, as they can easily arouse desire in potential offenders, open up opportunities to commit crimes, and offer opportunities for escape (arrival/departure). Crime attractors are defined as areas that potential offenders find particularly attractive. The transitions between crime generators and crime attractors are sometimes fluid. Indicators are conceivable that, with a slightly different connotation, could be assigned equally to both (e.g., public transport stops). Crime neutral areas are areas that neither attract many people nor are particularly attractive to potential offenders [8].

Looking at the phenomenon of explosive ATM attacks, we see that the perpetrators are predominantly members of Dutch criminal groups; North Rhine-Westphalia borders the Netherlands [9]. With the dense, well-developed road network, and the preventive measures in the Netherlands, in particular the nightly closure or technical shutdown of ATMs, which have made the committing of such crimes in the Netherlands less attractive [10], these motivated offenders are more likely to act in areas “near” the border so that they are able to escape more quickly. Besides, the high rate of attacks can be attributed to the large number of suitable targets: there are more than 10,000 ATMs located in North Rhine-Westphalia, which have different installation locations and security measures. Due to the large number and varying security features of the ATMs, it is not possible to protect every ATM with police measures at all times. Besides, the attacks are often committed at night and in areas not heavily frequented, as there are fewer or no customers in the area of the ATMs, which can be regarded as informal guardians.

Given the framework of the Crime Pattern Theory, the occurrence of explosive ATM attacks is also closely linked to the spatial structure. It seems trivial that blasts only occur where ATMs are also installed. In context of explosive ATM attacks, ATM locations can, therefore, be understood as crime attractors themselves. In addition, North Rhine-Westphalia is characterized by its polycentric structure, i.e., it is shaped by many large cities that are connected by a dense road network. Many highways and expressways connect the cities with each other and also North Rhine-Westphalia with the Netherlands. ATMs are installed not only inside bank branches, but also on exterior walls, in shopping malls, at gas stations, and at train stations, and can be found both in inner cities and in rural areas. This spatial structure offers perpetrators diverse opportunities to expand their awareness space and locate potential targets. The road network contributes to the fact that the majority of ATM locations are a maximum of 10 min from the nearest highway access and can be reached within half an hour to an hour from the Netherlands. Looking at the distribution of explosive ATM attacks, this suggests that not all ATMs (as crime attractors within an awareness space) are equally at risk, but rather, certain site factors may contribute to a higher or lower risk of detonation.

3. Data and Methods

3.1. Methodological Approach

The risk assessment procedure comprises different steps. On the basis of scientific literature and discussions with internal and external police experts, a total of 20 hypotheses were formulated as to which factors may be decisive for perpetrators when selecting a crime object. A distinction was made between spatial and temporal factors (e.g., escape possibilities at the ATM location, informal social control at the ATM location), factors relating to characteristics of the ATMs and their locations (e.g., security measures at the building/at the ATM), police-related factors (e.g., distance to the nearest police station), and offender-related factors (e.g., degree of professionalization). In the next step, the established hypotheses were operationalized and tested.

3.2. Data and Preprocessing

For the risk assessment, data were collected from the police authorities of North Rhine-Westphalia and from the financial institutions. Police data consist of information on explosive ATM attacks, such as time and location of the attack, locality, building type, ATM equipment, and security measures. Not only the data on explosive ATM attacks be included in the analysis for a risk assessment, but also the risk assessment must be based on all ATMs; thus, further data were collected from the financial institutions in order to represent as many ATMs as possible in the dataset. In addition, sociostructural data, e.g., on building structure, population structure, transport accessibility, mobility, and pedestrian frequency, were included and some spatial distance variables were computed, e.g., the distance of every ATM to the nearest highway, to the nearest police station, and to the common border with the Netherlands.

Since the distance at which a particular risk factor affects crime is not generally known a priori, independent variables are calculated at several different distance bandwidths. Here, four bandwidth distances are used for each factor, such as distance the state borders or distance to the next highway junction. For each factor, content-specific distance categories were selected. Both proximity and density measures are converted to 0/1 indicators, with proximity effects calculated as 1 if the crime generator or attractor is within the particular distance bandwidth. This means that the continuous estimates were turned into dummy variables, e.g., if there is a highway access within 100 m, the dummy variable is coded 1; otherwise, it is coded 0. Since we also use the kernel density estimation (KDE), the respective dummy variable is coded 1, if the z-score of the KDE is above 2 [11]. Thus, in the end there is a collection of several dichotomous dummy variables created from the distance variables.

These separate datasets were then processed and merged. Based on the dataset generated in this way, the hypotheses were tested. Where hypotheses were empirically confirmed, the associated indicators were considered in the modeling.

3.3. Time Series Analysis

Time series analysis is a valuable tool for identifying patterns in temporal changes in crime data, which is critical for crime prediction and prevention. To achieve this, various methods, such as time series decomposition and auto-regressive integrated moving average (ARIMA) modeling, can be used [12].

ARIMA modeling is a powerful method for time series analysis and short-term forecasting and has been successfully applied in many fields including economics, marketing, industry production, and social issues, but also in crime forecasting [5]. In particular, ARIMA modeling has been used for forecasting property crime [12]. In this study, the ARIMA model was used to predict one year in advance from the observations of explosive ATM attacks in NRW.

The ARIMA modeling was performed according to the study by Seidensticker and Schwarz [5] and provides a forecast for one year for this offence with monthly aggregated data.

3.4. Recapture Rate Index

The recapture rate index (RRI) is a useful measure for assessing prediction precision. In this study, we utilized the RRI to examine spatial-temporal variations in police authority areas in NRW. The RRI is a ratio of recaptured crime hotspots during the predicted time period (period 2) to those in the historical time period (period 1), standardized for the change in crime density in the study region between the two periods [13].

Although the RRI is typically used to compare hotspot crime densities, we adapted it for our study by using police agency areas instead. Furthermore, we compared two past time periods to demonstrate the change in attack rates over time relative to space, which we then implemented in our risk model.

Interpreting the RRI values is straightforward: a value below 1.0 indicates a decrease in crime prediction from one period to another, while a value above 1.0 indicates an increase [14]. The RRI, therefore, provides valuable insights into temporal changes in crime patterns and can be a powerful tool for developing proactive law enforcement strategies.

3.5. Risk Terrain Modeling

In this paper, we propose using risk terrain modeling (RTM) to predict ATM attacks in Germany as a data-driven method for spatial risk assessment of crime. RTM utilizes crime and environmental data to identify areas at a higher risk for crime occurrence [1,4]. This raster-based approach examines the relationship between place-based factors, such as crime generators and attractors, and crime to generate a spatial risk profile and predict crime risk based on geographic attributes, rather than merely extrapolating past crime history [1]. Therefore, it is a genuinely predictive model [15]. In this study, we transferred the raster-based approach to the point level to evaluate each ATM separately.

RTM predicts the counts of crime aggregated to each ATM using count-based regression models, providing a consistent operationalization of the effects of various risk factors on crime. The effects of various crime generators are reduced to proximity effects, density effects, or both in RTM [16]. An estimated risk map is produced by RTM identifying potential causal factors which are contributing to the risk on crime, but also the potential areas of crime displacement. These are identified by analyzing similar criminogenic environmental characteristics. This model improves typical hotspot maps by not only predicting areas of future high risk but also identifying potential causal factors [2,16].

To create a better understandable risk assessment model, we applied a variable selection technique in RTM, which picks variables with a positive coefficient on the crime outcome and takes regularization into account [4,17]. A restricted regression strategy is used to select the best-fitting model with the lowest Bayesian information criterion (BIC) score [4,16].

In addition to the spatial approach, temporal factors were included, such as the recapture rate index (RRI) and auto-regressive integrated moving average (ARIMA) methods to account for the temporal variability of explosive ATM attacks.

The risk calculation results in a value between 0 and 1, with 0 representing no risk and 1 representing the highest possible risk. The risk of explosive ATM attacks is classified into three classes (class 1: high risk; class 2: medium risk; class 3: moderate risk) to assist in police force deployment and action planning. Based on these classifications, we prioritize ATMs with the highest risk of explosive attacks, on which police actions such as prevention measures can be planned. ATMs are assigned to the highest risk class with 5% of the highest risk. The lowest risk class is assigned to 60% of the ATMs with the lowest risk. The remaining 35% belong to the medium risk class. ATMs with a high number of missing data were not assigned a risk class.

4. Results and Discussion

4.1. Time Series Analysis

The results of the monthly aggregated offense time series ARIMA modeling demonstrate the usefulness of crime time series analysis. The ARIMA model fitting captures the fluctuating number of cases over the year and the continuous increasing trend (Figure 3). As there is no specific seasonality, as with other property crimes like residential burglary, ARIMA modeling should not represent seasonality. However, the low number of cases during the summer months in 2022, which was not previously evident, led to an overestimation of the numbers. Despite this, the predicted values fall within the confidence interval, making them suitable for further action planning.

These findings suggest that ARIMA modeling is an effective tool for understanding and predicting temporal changes in crime patterns. It can provide valuable insights for proactive law enforcement strategies and resource allocation. However, caution should be taken in interpreting the results, especially when there are sudden changes in the data that may affect the accuracy of the predictions. In such cases, additional data sources and analytical techniques should be applied to improve the accuracy of such temporal predictions.

4.2. Recapture Rate Index

The importance of analyzing the temporal and spatial characteristics of explosive ATM attacks is apparent from the results of the adjusted RRI calculation (Figure 4). A RRI value above 1 indicates an increasing tendency, and the results reveal that large parts of NRW are experiencing a strong increase in explosive ATM attacks. In particular, the western regions near the Netherlands border have RRI values above 3, indicating a substantial increase in 2022 compared to 2021. Overall, half of the police authority areas exhibit increasing numbers of ATM attacks.

These findings were also integrated into the RTM analysis to account for temporal and spatial changes. The risk assessment considers the most recent developments by incorporating the past 365 days from the valuation date. This ensures that the latest trends and changes in explosive ATM attacks are taken into account, providing a more accurate risk prediction.

The results of this study emphasize the importance of continuous monitoring of crime patterns and trends, especially for offenses that are rapidly increasing. By integrating both temporal and spatial factors, law enforcement agencies can develop proactive strategies to prevent and reduce the incidence of such crimes.

4.3. Risk Terrain Modeling

The results of this study, presented in Figure 5, demonstrate that RTM is able to assess the risk of each ATM to be attacked and can be leveraged to improve resource allocation and prevention strategies. By identifying patterns in time series data, RTM methods can determine areas where explosive ATM attacks are more likely to occur. This enables law enforcement agencies to allocate resources effectively, prevent possible threats to citizens from explosive ATM attacks, and avoid losses for banks and customers.

The model accuracy was evaluated using retrograde analyses, which involved determining the risk for an earlier valuation date and evaluating it based on future transactions on the reporting date. The risk assessment for ATMs with at least an increased risk (risk classes 1 and 2) showed a model accuracy of 87%. However, if only ATMs with the highest risk (risk class 1) are considered, the model accuracy drops to 41%.

These findings suggest that RTM methods can be a powerful tool for predicting and preventing explosive ATM attacks in Germany. However, it is crucial to consider the limitations of the model and the accuracy of the risk assessments. Future studies should focus on improving the model accuracy and incorporating additional factors that may affect the incidence of explosive ATM attacks, such as socioeconomic factors and environmental conditions.

5. Potential and Limitations

The potential benefits of using RTM methods to predict explosive ATM attacks are clear. By using RTM, police can better allocate their resources by focusing their efforts on ATM of increased risk. Moreover, the use of RTM provides the police with a deeper understanding of the patterns and trends associated with explosive ATM attacks and empowers them to develop more effective prevention strategies. However, there are also limitations to the approach that need to be considered. For example, RTM methods may be limited by the quality and availability of data and may not capture all relevant factors that influence the occurrence of explosive ATM attacks. Moreover, such models can easily generate maps showing most of the populated area of a jurisdiction as a hotspot, because many geographic features can be mere proxies for populated areas (Perry et al., 2013). Thus, it is questionable whether a causal relationship actually exists between the particular risk factors and the crime.

In conclusion, our results demonstrate the potential of RTM methods to predict explosive ATM attacks in Germany and provide valuable insights for law enforcement agencies. By combining RTM methods with the SKALA approach, we can provide accurate predictions of explosive ATM attacks and support effective resource allocation and prevention strategies.

Overall, crime forecasting methods offer a wide range of possible applications that enable criminal expertise to be enriched by scientific findings, if these are understood as complementary tools and reflected upon in light of their respective limitations.