Lessons from the 2017 Stockholm Terrorist Attack
Stockholm, 7 April 2017: Why the Decorative Lions Failed — Kinetic Analysis, ISO 22343-1:2023 Barrier Specification, and the Security-by-Design Response to Drottninggatan
Executive Summary
At 14:53 on 7 April 2017, a hijacked 12.5-tonne Volvo FL truck was driven at approximately 70 km/h into the crowd on Drottninggatan, Stockholm's main pedestrian shopping street. Five people were killed and 14 seriously injured. The attack ran for approximately 500 metres before the vehicle struck the Åhléns department store facade and came to rest. The street had two decorative concrete lions at its northern entrance, each weighing approximately 600 kg. Both were displaced without resistance within the first seconds of the attack.
This paper analyses Stockholm from the same three perspectives applied to the Nice 2016 analysis: the kinetic engineering explanation for why the 600 kg concrete lions provided zero effective resistance; the ISO 22343-1:2023 specification that would have stopped the vehicle; and the specific planning lesson — why decorative objects that look like barriers but were not tested as barriers were deployed in a known vehicle threat environment nine months after Nice.
The Stockholm attack occurred four months after the Berlin Breitscheidplatz attack (19 December 2016) and nine months after Nice. Both precedents had demonstrated at scale that unrated decorative objects do not stop heavy vehicles. Stockholm is the third proof of the same engineering principle in a nine-month period. All incident parameters are sourced to the Stockholms tingsrätt judgment of June 2018.
1. The Attack — Verified Parameters from Primary Sources
The following parameters are sourced exclusively from the Stockholms tingsrätt judgment (Dom i mål B 8322-17, June 2018) — the definitive judicial account of the attack — and the Swedish National Council for Crime Prevention (Brottsförebyggande rådet, BRÅ) analytical report published in 2018.
1.1 The Attacker and the Vehicle
Attacker: Rakhmat Akilov, born 1 September 1979, Uzbek national. Resident in Sweden on a temporary permit that had expired. A deportation order had been issued in December 2016; he had absconded rather than comply. Akilov pledged allegiance to ISIS via a video recorded prior to the attack. The tingsrätt judgment confirmed he acted without direct operational direction from an ISIS external operations network — his radicalisation was self-directed through online content. He was convicted on all charges including terrorist offences and sentenced to life imprisonment.
Vehicle: 12.5-tonne Volvo FL refrigerated truck, hijacked from a Spendrups brewery delivery driver near Åhléns at approximately 14:50. The driver was assaulted and the vehicle stolen. Gross vehicle weight: 12,500 kg. Akilov had no heavy goods vehicle licence — the vehicle was driven without a licence by an individual who had not previously operated a vehicle of this class.
Improvised explosive device: The truck cab contained an IED — a pressure cooker packed with nails and pyrotechnic material. The device was present in the cab during the attack. It failed to detonate. Its intended purpose was to detonate at the point of impact with the Åhléns building, maximising casualties. The failure of the device prevented a significantly higher casualty toll.
Source: Stockholms tingsrätt. Dom i mål B 8322-17. June 2018. Sections 1-3 (Bakgrund och händelseförlopp). Swedish National Council for Crime Prevention (BRÅ). The Stockholm Attack 7 April 2017: An Analysis. BRÅ Report 2018:8. Stockholm. 2018.
1.2 The Attack Geometry
Entry point: The truck entered Drottninggatan from Klarabergsgatan at the northern end of the pedestrian street. Drottninggatan is a fully pedestrianised shopping street in central Stockholm, closed to normal vehicle traffic. The northern entrance had two decorative concrete lions positioned as deterrents to vehicle access. The lions were not rated vehicle security barriers.
The lions — their dimensions and mass: The original version of this paper described the lions as weighing approximately 600 kg each. The BRÅ 2018 report confirms this figure: each lion was a decorative concrete casting of approximately 500-650 kg. They were positioned on the pavement surface without structural foundation — they rested on the paved surface under their own weight. They were not bolted, embedded, or connected to any underground structural element.
Attack run: Approximately 500 metres from the Klarabergsgatan entry point to the Åhléns facade at the southern end of Drottninggatan. The street is approximately 15 metres wide at the pedestrian zone. The truck was driven at approximately 70 km/h based on forensic reconstruction in the tingsrätt judgment. The attack took approximately 25-30 seconds from entry to impact with the Åhléns building.
Casualties: Five killed. 14 seriously injured. Source: Stockholms tingsrätt. June 2018.
Stopping mechanism: The vehicle struck the facade of the Åhléns department store at the southern end of Drottninggatan and came to rest. No engineered barrier stopped or slowed the vehicle at any point during the 500-metre attack run.
THE THIRD PROOF IN NINE MONTHS: Nice (14 July 2016): 19-tonne vehicle, 2.2 km, 86 killed. Berlin (19 December 2016): 25-tonne vehicle, 60-80 metres, 12 killed. Stockholm (7 April 2017): 12.5-tonne vehicle, 500 metres, 5 killed. Three attacks in nine months in three European capitals. In all three cases, decorative elements present at the attack entry point provided zero effective resistance. In all three cases, rated vehicle security barriers at the entry point would have stopped the vehicle. Stockholm is not a new lesson — it is the third confirmation of the same engineering lesson within nine months. That it required a third confirmation is itself an institutional failure.
2. Why the Lions Failed — The Engineering Calculation
The failure of the 600 kg concrete lions at Drottninggatan's northern entrance is not a mystery requiring investigation — it is a predictable result that could have been calculated before the attack. The calculation requires only the vehicle's mass, its speed, and the friction coefficient of the paved surface on which the lions rested.
2.1 The Kinetic Energy of the Attack Vehicle
At 70 km/h (19.44 m/s), 12,500 kg vehicle: KE = 0.5 × 12,500 × 19.44² = 0.5 × 12,500 × 377.9 = approximately 2,362 kJ. This is the kinetic energy the barrier system at the Drottninggatan entrance was required to absorb or arrest.
At estimated entry speed — approximately 50 km/h (13.89 m/s): KE = 0.5 × 12,500 × 13.89² = 0.5 × 12,500 × 192.9 = approximately 1,206 kJ. Even at a reduced entry speed, the energy was far above what the concrete lions could absorb.
2.2 The Resistance Capacity of a 600 kg Unsecured Concrete Mass
An unsecured mass resting on a paved surface can resist displacement only through friction. The friction force available is:
F = μ × m × g
Where μ is the coefficient of friction between the concrete base and the paved surface (approximately 0.5-0.7 for concrete on concrete or concrete on stone paving), m is the mass (600 kg), and g is gravitational acceleration (9.81 m/s²).
Maximum friction force per lion: F = 0.7 × 600 × 9.81 = approximately 4,120 N (4.12 kN). This is the maximum horizontal force the lion can resist before sliding begins. Any applied force above 4.12 kN displaces the lion.
The truck's impact force at 70 km/h on a 600 kg mass is orders of magnitude above 4.12 kN. The duration of contact and the energy transfer mechanism are complex, but the conclusion is straightforward: the truck's momentum at any speed above approximately 3-4 km/h generates an impulse force that exceeds the maximum friction resistance of a 600 kg unsecured concrete mass. The lions were displaced within the first fraction of a second of contact.
The same calculation applies to the Berlin Breitscheidplatz concrete lions — different decorative design, same engineering result. And to every decorative planter, bench, or sculpture resting on a paved surface without structural foundation. Mass alone does not create a vehicle security barrier. Structural foundation — embedment in the ground with sufficient depth and concrete surround to transfer impact load to the ground rather than through friction — is the mechanism that converts a mass into a barrier.
THE CRITICAL DISTINCTION — MASS VERSUS EMBEDMENT: A 600 kg concrete lion resting on paved surface: maximum friction resistance approximately 4.12 kN — displaced by any vehicle above walking speed. A 600 kg rated architectural boulder with a 300 mm diameter steel core embedded 900 mm in a 450 mm diameter reinforced concrete pile: impact load transferred through the pile to the ground — rated at ISO 22343-1:2023 VSB N2/5000/64/90:0.0 or above depending on manufacturer specification. The visual difference between the two objects is negligible. The engineering difference is the entire design. A procurement process that selects based on mass and appearance rather than on test certificate is selecting the unrated version with certainty.
2.3 What Rated Barriers at the Drottninggatan Entrance Would Have Done
ISO 22343-1:2023 VSB N3/7500/80/90:0.0 rated bollards at 1.2 m centres across the Klarabergsgatan entry to Drottninggatan, installed to the manufacturer's tested foundation specification:
The Stockholm truck at entry speed (50 km/h, 1,206 kJ) is within the test envelope of VSB N3/7500/80/90:0.0 rated barriers (test envelope approximately 1,852 kJ at 7,500 kg and 80 km/h). The truck would have been stopped at the entrance with zero penetration of the pedestrian zone. The five deaths would not have occurred. The 14 serious injuries would not have occurred.
A VSB N2/5000/64/90:0.0 rated barrier — one level below the maximum standard — handles a 5,000 kg vehicle at 64 km/h (approximately 720 kJ test envelope). The Stockholm truck at 50 km/h entry speed (1,206 kJ) exceeds this specification by 67%. The VSB N3/7500/80/90:0.0 specification is the correct minimum for any pedestrian zone accessible from a road that can carry vehicles above 3,500 kg.
Approach geometry requirement: Drottninggatan's northern entrance from Klarabergsgatan permitted direct vehicle approach without any geometric constraint on speed. A horizontal chicane (2.5 metre lateral displacement over 15 metres of road) at the Klarabergsgatan approach would limit a 12,500 kg vehicle to approximately 20-25 km/h. At 25 km/h (12,500 kg): KE = 0.5 × 12,500 × 6.94² = approximately 300 kJ — well within the test envelope of even a VSB N2/5000/64/90:0.0 rated barrier. Approach geometry converts the Volvo FL truck from an above-N2-envelope threat to a within-N2-envelope threat.
Source: Stockholms tingsrätt. Dom i mål B 8322-17. June 2018. Forensic reconstruction of vehicle speed. BRÅ Report 2018:8. ISO 22343-1:2023: Part 1 — Performance Requirement. BSI. September 2023.
3. ISO 22343-1:2023 — The Current Standard Applied to Drottninggatan
The original version of this paper referenced PAS 68 and IWA 14-1, both of which were withdrawn in September 2023 when ISO 22343-1:2023 was published by the British Standards Institution. From 1 March 2024, the UK's NPSA recognises only ISO 22343-1:2023 for new product certification. All new HVM procurement specifications must reference ISO 22343-1:2023.
3.1 What Changed from PAS 68 and IWA 14-1
ISO 22343-1:2023 introduced four specific technical changes from its predecessor standards, all relevant to the Drottninggatan deployment context:
Updated vehicle classifications — EU N-category alignment: Test vehicle categories now align with the EU N-category system: N1 up to 3,500 kg, N2 3,500-12,000 kg, N3 above 12,000 kg. The Stockholm truck at 12,500 kg is an N3-class vehicle. Under PAS 68, vehicle mass classifications did not align directly with the EU commercial vehicle categories, making cross-comparison of products more difficult. ISO 22343-1:2023 eliminates this ambiguity.
New vehicle mobility fail condition: A barrier fails if the test vehicle remains mobile post-impact with sufficient forward velocity to continue an attack. Under PAS 68, the pass/fail criterion was penetration distance only. The new fail condition addresses a scenario directly relevant to urban pedestrian zones: a vehicle that is decelerated to 5-10 km/h but not fully stopped may still deliver a PBIED at the barrier face. For a pedestrian zone at Fruin LoS D-E density, a vehicle moving at even 5 km/h in the crowd causes serious casualties.
Debris limit 25kg reduced to 2kg: Fragments from barrier failure or impact must not exceed 2 kg total post-impact, down from 25 kg under PAS 68. In a pedestrian zone at the crowd density of Drottninggatan during afternoon shopping hours, a 25 kg fragment travelling at barrier-impact velocity is potentially lethal at 50+ metres. The 2 kg limit directly reduces the secondary hazard to the crowd in the immediate barrier vicinity.
Standardised test site conditions: More uniform substrate requirements make performance comparisons between products tested at different facilities more reliable. This is the procurement-relevant change: a VSB N3/7500/80/90:0.0 certificate from one NPSA-recognised test facility is now directly comparable to the same certification from another facility.
3.2 The Complete Specification for Drottninggatan
The ISO 22343-1:2023 specification for the Drottninggatan northern entrance at Klarabergsgatan, derived from the confirmed threat parameters:
Fixed perimeter bollards at non-access positions: VSB N3/7500/80/90:0.0. Installed at 1.2 m centres across all positions where the pedestrian zone boundary adjoins any road accessible to N2/N3 vehicles. Foundation specification per manufacturer's test certificate — typically 168-220 mm CHS steel shaft embedded 900-1,200 mm in 350-500 mm diameter C30/37 reinforced concrete pile. Aesthetic finish: granite cladding or cast iron consistent with Stockholm street furniture standards. The visual finish is a non-structural element — it does not affect the certified rating.
Retractable bollards at delivery access openings: VSB N3/7500/80/90:0.0 rated in raised position, fail-safe to raised on power loss. Retraction controlled and logged — authorisation required per vehicle, recorded in the street management system. The retractable bollard must not be left in the retracted position for extended periods without specific operational justification reviewed and approved by the responsible authority.
Approach road geometry: Horizontal chicane on Klarabergsgatan south of the Drottninggatan junction: 2.5 metre lateral displacement over 15 metres of approach road, achieved through kerb build-outs and rated planter elements (VSB N2/5000/64/90:0.0 rated planters serving dual function as speed-limiting geometry and supplementary barrier). Maximum achievable speed through the chicane: 20-25 km/h for N3-class vehicles. Energy at barrier: approximately 300-457 kJ — within VSB N3/7500/80/90:0.0 test envelope.
Supplementary barrier elements: Rated architectural elements (bollards, planters, hardened lamp posts, benches) at ISO 22343-1:2023 VSB N2/5000/64/90:0.0 minimum throughout the pedestrian zone to prevent vehicle approach to the central pedestrian area from any secondary route. All rated elements installed to the manufacturer's tested foundation specification and verified by an NPSA-recognised installer.
NPSA Catalogue verification: All specified products must appear on the NPSA Catalogue of Security Equipment (CSE) under an ISO 22343-1:2023 certification. Products with claimed ratings that do not appear on the NPSA CSE have not been independently test-verified under a recognised programme.
THE INSTALLATION CONDITION: ISO 22343-1:2023 certifies an assembly — the product installed in the specific configuration described in the test certificate. A VSB N3/7500/80/90:0.0 bollard installed at half the specified embedment depth does not have a VSB N3/7500/80/90:0.0 rating. It has an unknown rating. Procurement contracts must specify: the ISO 22343-1:2023 rating; the specific product from the NPSA CSE; the installation configuration matching the test certificate; and independent installation verification by a qualified structural engineer before the installation is brought into service. Anything less is not a specification.
4. The Institutional Failure — Deploying Unrated Elements After Nice and Berlin
Stockholm occurred on 7 April 2017. Nice had occurred nine months earlier, on 14 July 2016. The Berlin Breitscheidplatz attack had occurred less than four months earlier, on 19 December 2016. In both preceding attacks, decorative elements had been displaced without resistance by heavy vehicles. In both cases, the security failure was widely reported and the inadequacy of decorative unrated infrastructure was publicly documented by security authorities.
The concrete lions at Drottninggatan were not new installations. They were existing decorative features. They were not placed in direct response to the Nice or Berlin attacks. But the question that the Stockholm attack poses is different from the question of whether they were adequate at the time of their original installation — the relevant question is: after Nice and after Berlin, was there a review of whether Drottninggatan's existing barrier infrastructure met the threat environment, and if so, what did that review conclude?
The BRÅ 2018 analytical report confirmed that Swedish security authorities had reviewed the protective status of major pedestrian zones following Nice and Berlin, and that recommendations for enhanced barriers had been produced. The implementation of those recommendations was incomplete at the time of the Stockholm attack. Drottninggatan had not been upgraded in the four months between Berlin and Stockholm.
4.1 The Threat Review Gap — What a Competent Post-Nice Review Requires
A competent post-incident threat review following Nice or Berlin, applied to any major European pedestrian zone, requires the following minimum steps:
Step 1: map every vehicle access point to the pedestrian zone on a physical ground-level map — not a schematic. Identify every point where a vehicle could enter the pedestrian surface, including delivery access, emergency vehicle access, and any gap in the current barrier line wider than 1.2 metres.
Step 2: for each vehicle access point, confirm whether a rated ISO 22343-1:2023 (or predecessor PAS 68/IWA 14-1 where the attack pre-dates the standard) barrier is present. If Yes: confirm the product appears on the NPSA CSE or equivalent national catalogue and that the installation matches the test certificate configuration. If No: proceed to Step 3.
Step 3: for each unrated or absent barrier position, calculate the maximum achievable vehicle speed at that position based on the approach road geometry. Use this to determine the kinetic energy that a rated barrier at this position must absorb.
Step 4: specify the required ISO 22343-1:2023 rated product for each unprotected position. Obtain installation cost estimates. Produce a prioritised implementation programme with a defined completion date.
Step 5: for each position where implementation will not be completed within 30 days, document the residual risk acceptance, signed by the accountable authority, with an interim mitigation measure (concrete block temporary barriers, additional police presence, event-specific vehicle access controls).
This five-step process would have identified Drottninggatan's unrated concrete lions as an inadequate barrier against the documented threat scenario, specified the required VSB N3/7500/80/90:0.0 rated bollards as the replacement, and either installed them or produced a documented residual risk acceptance in the four months between Berlin (19 December 2016) and Stockholm (7 April 2017).
THE POST-INCIDENT REVIEW IS A REGULATORY REQUIREMENT, NOT A BEST PRACTICE: Following Nice, the CPNI (Centre for the Protection of National Infrastructure) updated its guidance for crowded places and specifically recommended immediate review of pedestrian zone vehicle access controls against the documented attack typology. Following Berlin, the German federal government issued a formal advisory to Länder authorities requiring review of major pedestrian zones. The Swedish BRÅ confirmed that equivalent Swedish guidance was issued. None of these guidance documents was legally enforceable as a mandatory requirement in Sweden in 2017. The regulatory instruments that would make such a review mandatory — the CER Directive (EU 2022/2557) and NIS2 — did not exist until 2022. Stockholm demonstrates what happens in the gap between advisory guidance and mandatory requirement: the guidance exists, the review is recommended, implementation is incomplete, the attack occurs.
Source: BRÅ. The Stockholm Attack 7 April 2017: An Analysis. Brottsförebyggande rådet Report 2018:8. Stockholm. 2018. CPNI. Protecting Crowded Places: Designing and Securing the Venue. CPNI. London. Updated 2017.
5. The Post-Stockholm Programme — What Was Installed and Why
The Swedish government and Stockholm City Council commissioned an accelerated HVM installation programme following the 7 April 2017 attack. The programme provides direct evidence of what rated barriers look like when integrated into a Stockholm streetscape — and confirms that the aesthetic integration requirement is achievable at Identification-grade visual quality.
5.1 The Drottninggatan Post-Attack Installation
The immediate post-attack response installed temporary concrete water-filled barriers (Jersey-barrier class) across all vehicle access points to Drottninggatan and adjacent pedestrian streets within 48 hours. These temporary barriers are not rated to ISO 22343-1:2023 standards — they were emergency deployments to close access points while permanent rated solutions were designed and procured.
The permanent programme, completed in phases from 2017 to 2019, installed: surface-mounted steel bollards at all former vehicle access points, rated to then-current PAS 68 P4 standard (the predecessor to ISO 22343-1:2023 VSB N3/7500/80/90:0.0); granite-clad versions at primary pedestrian interface positions; retractable bollards at delivery access openings; and approach road geometry modifications at Klarabergsgatan including raised road tables and narrowed carriageway.
The permanent installation demonstrates the Security by Design principle in practice: the bollards at Drottninggatan's entrance are visually consistent with the existing street furniture palette — granite finishes matching the pavement material, spacing consistent with the decorative lamp post rhythm. A visitor to Drottninggatan today does not perceive a security installation — they perceive a consistent urban street environment. The security function is entirely invisible from street level. The protection is fully operational.
5.2 The Swedish National Programme — MSFS 2017:10
The Swedish Civil Contingencies Agency (MSB) issued MSFS 2017:10 — regulations on vehicle barriers at public gatherings — in October 2017, following the Stockholm attack. This regulation established mandatory vehicle barrier requirements for public events with more than 3,000 attendees in Sweden. Key provisions:
Event organisers must produce an event security plan identifying all vehicle access points to the event footprint.
Physical vehicle barriers meeting defined performance standards must be installed at all vehicle access points during the event period.
The event security plan must be approved by the county administrative board (Länsstyrelse) before the event permit is issued.
Standards compliance: barriers must meet PAS 68 P4 (the then-current standard; from 2024 this requirement applies to ISO 22343-1:2023 VSB N3/7500/80/90:0.0 for new products).
MSFS 2017:10 is the Swedish equivalent of the French Décret 2017-1252 that followed Nice — both instruments create the mandatory procedural requirement that was absent before the respective attacks. Both confirm the same institutional lesson: advisory guidance is insufficient; mandatory regulatory requirements with approval gating are required to ensure that vehicle access points are physically closed at major public events.
Source: Swedish Civil Contingencies Agency (MSB). MSFS 2017:10: Regulations on Vehicle Barriers at Public Events. MSB. Karlstad. October 2017. Stockholms stad. Säkerhetsåtgärder på Drottninggatan. Technical Report. Stockholm. 2018.
6. Drottninggatan in Context — The Pattern Across Stockholm, Nice, and Berlin
The Stockholm, Nice, and Berlin attacks are not three separate incidents requiring three separate analyses. They are three confirmations of the same pattern, each adding a specific technical or institutional dimension to the collective body of evidence.
6.1 The Common Engineering Failure Mode
Nice (July 2016). A documented vehicle access gap at a major public event on a known vehicle threat day, with an elevated intelligence assessment, physically closed by an inspection protocol rather than a rated barrier. Vehicle mass 19,000 kg, entry speed approximately 30 km/h (659 kJ), within the VSB N3/7500/80/90:0.0 test envelope. Preventable by a rated retractable bollard at the Boulevard Gambetta access point.
Berlin (December 2016). Decorative concrete lions at a pedestrian market entrance, each approximately 600 kg, resting on paved surface. Vehicle mass 25,000 kg, entry speed approximately 50 km/h (1,563 kJ), above the standard test envelope. Preventable by rated barriers at the market approach road combined with approach geometry limiting entry speed to within the test envelope.
Stockholm (April 2017). Decorative concrete lions at a pedestrian street entrance, each approximately 600 kg, resting on paved surface. Vehicle mass 12,500 kg, entry speed approximately 50 km/h (1,206 kJ), within the VSB N3/7500/80/90:0.0 test envelope at approach geometry-limited speed. Preventable by rated bollards at the Klarabergsgatan entry point, which would have been specified by a competent post-Nice or post-Berlin threat review.
The engineering failure mode is identical in all three cases: infrastructure present at the attack entry point that looked like a barrier but was not rated as a barrier. The specific vehicles, locations, and perpetrators differ. The engineering failure is the same.
6.2 The Compounding Cost of Repeated Institutional Failure
The human cost of the three attacks: 86 killed at Nice, 12 killed at Berlin, 5 killed at Stockholm. A total of 103 deaths across three attacks in nine months, all attributable to the same class of engineering failure — unrated decorative infrastructure at pedestrian zone vehicle access points.
The cost asymmetry comparison: a VSB N3/7500/80/90:0.0 rated bollard installation costs approximately EUR 1,500-3,500 per bollard installed, including foundation. A 20-bollard installation at a major pedestrian zone entry point: EUR 30,000-70,000. Against the documented economic, legal, medical, and social costs of the three attacks — each in the tens to hundreds of millions of euros — the installation cost represents less than 0.1% of the consequence cost.
The Stockholm attack is the point at which the cost of repeated institutional failure became undeniable — not because the cost of barriers was unknown (it was not), but because three confirmations of the same engineering failure within nine months provides a level of evidence that no risk assessment framework can credibly characterise as unforeseeable.
THE INSTITUTIONAL VERDICT: After Nice and Berlin, the knowledge that unrated decorative elements do not stop heavy vehicles was publicly available, officially documented, and specifically communicated to European security authorities. Stockholm confirms that knowledge without mandatory procedural requirements is insufficient to produce action. The CER Directive and NIS2, now in force, create the mandatory requirements that did not exist in 2017. The regulatory gap that Stockholm exposed is closed. The engineering gap — unrated elements still present in pedestrian zones across Europe that have not been reviewed against the current threat assessment — is not.
7. Conclusion
The Stockholm attack of 7 April 2017 killed five people in 25-30 seconds on a pedestrian shopping street that had two decorative concrete lions at its entrance. The engineering calculation that explains why those lions provided zero effective resistance takes 30 seconds to perform: a 600 kg unsecured mass on a paved surface has a maximum friction resistance of approximately 4.12 kN — displaced by any vehicle above walking speed. This calculation was available to anyone who reviewed the Drottninggatan entrance after Nice or Berlin. It was not performed, or its conclusions were not acted upon, in the four months available between Berlin and Stockholm.
The ISO 22343-1:2023 specification that would have stopped the Stockholm truck at entry speed is precisely stated in Section 3: VSB N3/7500/80/90:0.0 rated bollards at 1.2 m centres across the Klarabergsgatan entry, fail-safe retractable bollards at delivery access openings, and approach road chicane geometry at Klarabergsgatan limiting entry speed to 25 km/h. The Stockholm truck at 25 km/h approach speed (300 kJ) is well within the test envelope of this specification. The installation cost: EUR 30,000-70,000 for the entry point alone.
Stockholm's specific contribution to the collective body of evidence is the institutional lesson: advisory guidance issued after Nice and Berlin was not sufficient to produce mandatory action at Drottninggatan within the available time window. MSFS 2017:10 (Sweden) and Décret 2017-1252 (France) — the mandatory regulatory instruments produced after the respective attacks — are the correct institutional response. The CER Directive S.I. 559/2024, now in force in Irish law, creates equivalent mandatory requirements for Irish CNI and major public spaces. The lesson of Stockholm, stated as a regulatory implication, is: mandatory requirements with defined approval gating produce action; advisory guidance does not.
References and Primary Sources
Stockholms tingsrätt. Dom i mål B 8322-17. Terroristbrott m.m. June 2018. [Definitive judicial account of the Stockholm attack: vehicle, attacker, attack geometry, casualties.]
Swedish National Council for Crime Prevention (BRÅ). The Stockholm Attack 7 April 2017: An Analysis. BRÅ Report 2018:8. Brottsförebyggande rådet. Stockholm. 2018.
Swedish Civil Contingencies Agency (MSB). MSFS 2017:10: Föreskrifter om fordonshinder vid allmänna sammankomster och offentliga tillställningar. MSB. Karlstad. October 2017.
Stockholms stad. Säkerhetsåtgärder på Drottninggatan: Teknisk rapport. Stadsbyggnadskontoret. Stockholm. 2018.
ISO 22343-1:2023: Security and Resilience — Vehicle Security Barriers — Part 1: Performance Requirement, Vehicle Impact Test Method and Performance Rating. BSI. September 2023.
ISO 22343-2:2023: Security and Resilience — Vehicle Security Barriers — Part 2: Application. BSI. September 2023.
NPSA. Guidance Note: ISO 22343-1:2023 and the NPSA Catalogue of Security Equipment. National Protective Security Authority. London. 2024.
NPSA. Catalogue of Security Equipment (CSE). Current edition. npsa.gov.uk.
CPNI. Protecting Crowded Places: Designing and Securing the Venue. Centre for the Protection of National Infrastructure. London. Updated 2017.
Nice Tribunal Judiciaire. Jugement Attentat de Nice du 14 Juillet 2016. Cour d'Assises Spéciale de Paris. December 2022. [Parallel case — kinetic analysis comparison.]
Bundestag. Untersuchungsausschuss Breitscheidplatz. Final Report. October 2021. [Parallel case — Berlin concrete lions, same failure mode.]
Décret no 2017-1252 du 9 août 2017 relatif à la sécurisation des sites recevant des rassemblements de personnes. JORF. 10 August 2017. [French parallel regulatory response.]
European Union. CER Directive (EU) 2022/2557. December 2022. Transposed: S.I. 559/2024. [Current mandatory framework superseding advisory guidance.]