Executive summary
A country where the security picture is regional rather than national: Addis Ababa functions normally while armed conflict, communication restrictions and access denial persist in parts of Amhara, Oromia and the Tigray periphery.
Sources · [4] GDACS · [7] GDELT Project
Full report
Key judgement
A country where the security picture is regional rather than national: Addis Ababa functions normally while armed conflict, communication restrictions and access denial persist in parts of Amhara, Oromia and the Tigray periphery.
Sources · [7] GDELT Project · [10] UKMTO
Threat context
- Armed confrontation between federal forces and organised armed groups in parts of Amhara and Oromia, including attacks on road users and abduction for ransom. - Unresolved tension in and around Tigray and disputed boundary areas, with the risk of renewed escalation. - Inter-communal violence and displacement in Oromia–Somali and Afar periphery areas. - Administrative threats to operations: movement permissions withheld, communication shutdowns, and pressure on staff of particular ethnic backgrounds.
Sources · [8] Institute for Security Studies (ISS Africa) · [11] IOM DTM
Vulnerabilities
- Programmes designed around road movement between regional capitals, where control is not continuous. - Reliance on mobile networks and internet for check-ins, in a context where shutdowns are used as a control measure. - National staff exposed to identity-based pressure at checkpoints, with no written protocol for what they may and may not carry. - Access negotiated informally with local authorities rather than through a documented, escalatable arrangement.
Exposure
- Field offices and monitoring visits in Amhara, Oromia, Afar and the Tigray periphery. - Long-distance road movement, including night arrival at regional towns where curfews change with little notice. - Addis-based staff and visitors, whose day-to-day exposure is far lower but who may travel at short notice.
Sources · [6] NASA FIRMS / Copernicus · [9] Mazin Intel analyst desk
Operational implications
- Staff injury or death from crossfire, roadside devices and armed robbery on regional roads. - Abduction of staff for ransom, with a real prospect of long negotiation. - Loss of programme continuity where access is withheld, and loss of situational awareness during communications shutdowns.
Sources · [9] Mazin Intel analyst desk · [12] INSO
Rated risks
- Staff caught in armed confrontation or crossfire during regional road movement, likelihood 3/5, impact 5/5. Region-specific movement approval; daylight-only travel; route assessment refreshed on the day; abort criteria. - Abduction for ransom on an Amhara or Oromia road corridor, likelihood 3/5, impact 5/5. Reduce predictability; low-profile vehicles and posture; restrict movement disclosure; rehearsed crisis plan. - Loss of contact with a field team during a communications shutdown, likelihood 4/5, impact 3/5. Redundant comms; pre-agreed check-in windows; no-contact procedure with escalation timings. - Access withdrawn or permissions withheld, suspending delivery, likelihood 4/5, impact 3/5. Documented access agreements; partner-led contingency delivery; pre-agreed suspension and resumption criteria. - Identity-based pressure or detention of national staff at a checkpoint, likelihood 3/5, impact 4/5. Agreed checkpoint protocol; documentation discipline; named legal and welfare support; incident reporting without blame.
Sources · [7] GDELT Project · [10] UKMTO
Mitigation
- Region-specific movement rules rather than a single country policy: separate approval levels for Amhara, Oromia, Afar and Tigray-periphery travel. - No night road movement; arrival deadlines set with daylight margin; overnight stops planned, not improvised. - Communications redundancy, satellite messenger or radio where networks are unreliable, with a documented no-contact procedure. - Written protocol for national staff at checkpoints, agreed with them, covering documentation, questioning and what to do if separated. - Access agreements documented at the level that can enforce them, with an escalation route when local permission is withdrawn.
Sources · [6] NASA FIRMS / Copernicus · [9] Mazin Intel analyst desk
Residual risk
Medium to high in the affected regions, low to medium in Addis Ababa. Treat the country as several environments with separate residual risk statements rather than one.
Confidence and sources
Confidence: Moderate. Public event reporting is uneven across regions, and communications restrictions delay and thin the reporting that does emerge.. B
- ACLED[1] conflict event data - UN OCHA[3] situation reports and ReliefWeb country pages - Insecurity Insight aid-security incident data - UK FCDO and US State Department travel advice - National and regional media monitoring - Ethiopian Human Rights Commission public statements - Ethiopian and diaspora media monitoring
Analyst assessment from public sources, Reviewed September 2026. Not a substitute for an organisation's own assessment.
Sources · [8] Institute for Security Studies (ISS Africa) · [11] IOM DTM
Key findings
- Armed confrontation between federal forces and organised armed groups in parts of Amhara and Oromia, including attacks on road users and abduction for ransom.
- Unresolved tension in and around Tigray and disputed boundary areas, with the risk of renewed escalation.
- Inter-communal violence and displacement in Oromia–Somali and Afar periphery areas.
- Staff injury or death from crossfire, roadside devices and armed robbery on regional roads.
- Abduction of staff for ransom, with a real prospect of long negotiation.
Analyst assessment
Medium to high in the affected regions, low to medium in Addis Ababa. Treat the country as several environments with separate residual risk statements rather than one.
Related reports
Footnotes & sources
- [1] ACLED: Armed Conflict Location & Event Data, Africa event recordsL1 Conflict · reliability A
- [2] UCDP: Uppsala Conflict Data Program, organised violence datasetL1 Conflict · reliability A
- [3] UN OCHA / ReliefWeb: Situation reports, access snapshots and humanitarian updatesL2 Early warning · reliability A
- [4] GDACS: Global Disaster Alert and Coordination System alertsL2 Early warning · reliability B
- [5] FEWS NET: Food security outlooks and alertsL2 Early warning · reliability A
- [6] NASA FIRMS / Copernicus: Active fire detections and open satellite imagery for corroborationL3 GEOINT · reliability B
- [7] GDELT Project: Global media event and tone monitoringL5 Strategic · reliability C
- [8] Institute for Security Studies (ISS Africa): Regional political and security analysisL5 Strategic · reliability B
- [9] Mazin Intel analyst desk: Practitioner interviews, field reporting and imagery verificationL6 Verification · reliability B
- [10] UKMTO: Maritime incident advisories, Gulf of Aden and Red Sea approachesL2 Early warning · reliability A
- [11] IOM DTM: Displacement Tracking Matrix, movement and displacement flowsL2 Early warning · reliability A
- [12] INSO: NGO safety incident reporting and access advisoriesL1 Conflict · reliability A
Supporting capability statement
Horn of Africa security capability pack
Download the experience summary, applied risk frameworks and sample operational brief supporting this country threat assessment.
Free operational toolkit
Act on this assessment
Six free operational tools for NGO and charity teams; no sign-up, nothing leaves your browser.
- Travel risk authorisationRisk-tiered approval form with control verification before movement is signed off.
- Vehicle & convoy check13-point pre-departure inspection with go / no-go clearance logic.
- Safeguarding / PSEA referralAnonymised referral log for PSEA and misconduct concerns.
- Cyber hygiene assessmentScored self-assessment producing a prioritised remediation workplan.
- Staff accountability roll callReal-time headcount and status tracking during an incident.
- Endurance calculatorContingency stock planning for water, food, fuel and cash.