Read an Excerpt

Estimating Terrorism Risk

Rand Corporation

Chapter One

The Urban Areas Security Initiative (UASI) is a Department of Homeland Security (DHS) grant program designed to enhance security and overall preparedness to prevent, respond to, and recover from acts of terrorism. These goals are accomplished by providing financial assistance to address the unique planning, equipment, training, and exercise needs of large urban areas (DHS, 2004).

In fiscal year 2004, UASI provided $675 million to 50 urban areas perceived to be at highest risk from terrorist attacks. These funds were allocated using a formula that accounted for several indicators of the terrorism risk to which each urban area might be exposed. Though precise details of the formula are not publicly available, it reportedly calculates each urban area's share of total terrorism risk based on city population, infrastructure, and threat information, giving indicators for each factor an importance weight of nine, six, and three, respectively. Despite this effort to allocate homeland security resources based on the relative risks to which each urban area is exposed, the Department of Homeland Security has frequently been criticized for inadequately calculating risk and therefore for failing to distribute resources in proportion to urban areas' shares of total terrorism risk (U.S. House of Representatives, 2003).

Debatesabout the proper allocation of resources have suffered from several problems. For instance, currently, there is no shared and precise definition of terrorism risk, so stakeholders in the debate are often referring to different concepts of risk. Even if a precise definition were widely used, there are no standard methods for estimating and monitoring changes in the level and nature of terrorism risks. Instead, various indicators of risk have been used (for instance in the UASI formula) or proposed (e.g., Canada, 2003), which are presumed to correspond in some way with true terrorism risk. To our knowledge, however, no systematic frameworks for selecting these indicators or aggregating them into a unitary measure of risk are yet available. Moreover, terrorism risk changes over time as terrorist motives, capabilities, and targets change and adapt to risk-mitigation efforts. These facts defy the efficacy of any simplistic model that attempts to enumerate a single index as a measure of risk. Measuring terrorism risk must always reflect uncertainties in estimates of the relative risks faced by different cities.

Risk Assessment Versus Resource Allocation

Ultimately, efficient allocation of homeland security resources would be determined based upon assessment of the cost effectiveness of alternative risk-reduction opportunities. This requires understanding the cost effectiveness of different types and amounts of investment. As a hypothetical example, even if terrorism risks were greater in New York City than in Des Moines, Iowa, allocating resources according to proportion of risk would not be optimal if available countermeasures are more cost effective in Des Moines. For example, terrorists could respond strategically to countermeasures in New York City and target less-protected areas, or the marginal effectiveness of resources spent in New York City may decrease with continuing investment. Neither the methods nor the data are available to answer questions about the effectiveness of available risk-reduction alternatives or to determine reasonable minimum standards for community preparedness. Until these questions are answered, allocating homeland security resources based on risk is the next best approach since areas at higher risk are likely to have more and larger opportunities for risk reduction than are areas at lower risk. That is, resources would be allocated roughly proportionally to the distribution of risk across areas receiving funding.

There are several other reasons why it is still important for decisionmakers to understand the levels and distribution of terrorism risk. First, because assessing risk and risk reduction is a critical first step in assessing cost effectiveness of counterterrorism efforts, methods developed to support terrorism risk assessment will also support analysis of resource allocation. Further, even when large risks are not mitigated by current efforts, identifying them can help direct intelligence gathering, research, and future counterterrorism efforts. Finally, following changes in the levels and patterns of terrorism risk over time provides insights into the effectiveness of current efforts and the emergence of new risks.

Scope and Limitations

In this monograph, we propose a specific definition of terrorism risk that can be operationalized for practical problems facing DHS and develop a method of constructing a single measure of risk that accounts for uncertainties in risk measurement. We then propose and demonstrate a framework for evaluating this measure, along with alternative measures of risk, to understand resulting errors given uncertainties in their measurement. Finally, we offer recommendations on future efforts to calculate the shares of total terrorism risk to which different areas are exposed.

While the discussions in this monograph focus on a specific program, the UASI grants, the problems discussed previously are common to a number of risk estimation problems in homeland security. Thus, the problem is a general one of decisionmaking under uncertainty, and the solutions presented here are also generalizable to similar decision contexts.

This monograph does not address all problems identified previously. This treatment of risk estimation does not fully inform specification of a formula for risk-based allocation of homeland security resources. As noted previously, before such a formula can be constructed, additional research is needed to understand the relationship between resource allocation and risk reduction.

The scope of this project is further limited to the direct consequences associated with terrorism threats. Thus, we do not include in our estimates of terrorism risk the secondary and higher order economic or other losses that result from an attack on a given location. These effects are important and may well constitute the major portion of the risk but can be handled by the methods we develop here given additional resources. Such analysis would extend this current work to further improve the evaluation of the relative risks to which different urban areas are exposed and thus would help to improve the allocation of homeland security resources.

Overview of This Monograph

The remainder of this monograph is organized as follows. Chapter Two defines terrorism risk and the factors it comprises. Chapter Three discusses the sources of uncertainty that must be addressed when incorporating terrorism risk assessment into policy decisionmaking and provides guidance on how each form of uncertainty can be addressed. In Chapter Four, we discuss alternative approaches to estimating levels of terrorism risk across UASI-funded urban areas and propose a method for combining diverse risk estimates into a single estimate of each urban area's share of total terrorism risk. In Chapter Five, we develop a framework for evaluating the performance of different risk estimators given uncertainties about the distribution of true terrorism risk and the diversity of types of consequences that must be considered. Finally, we discuss the performance of the alternative risk estimators and the implications our findings have for homeland security policy.

Chapter Two

Differing notions of terrorism risk frequently fuel disagreements about the relative risks to which different regions or cities are exposed. Some arguments implicitly link risk to terrorism threats. If, for example, one city were known through gathered intelligence or past history to be the preferred target for terrorists, this view would support a claim that this city has a high level of terrorism risk. Alternatively, others argue that risk is more closely associated with infrastructure vulnerabilities within a region because these represent logical targets for terrorism. Thus, for example, even if we do not know of a threat to a nuclear power plant, reason and prudence argue that we should include that facility in considering a region's risk. Finally, discussions of risk occasionally emphasize the possible consequences of terrorist attacks in evaluating risk. Thus, if two cities have similar chemical storage facilities, but one has the facility located close to its population center, a persuasive argument can be made that the nearer-to-population city's chemical facility presents a greater risk than the other city's.

Clearly, strong arguments can be made that threats, vulnerabilities, and consequences play a significant part in the overall risk to which a city is exposed. What has been less clear is how these three components are related. In this chapter, we offer a definition of risk that links them. We also distinguish between definitions for threat, vulnerability, consequences, and risks and the measures that can be used to assess and track each.

Threat

People or organizations represent a terrorist threat when they have the intent and capability to impose damage to a target. Note that neither intentions without capabilities nor capabilities without intentions pose a threat. Threat only exists when both are manifested together in a person or organization. Allocating homeland security resources to protect critical infrastructure or cities requires measuring the threats posed to specific targets or from specific types of attack. When the scope of threat is defined in terms of a specific set of targets, a specific set of attack types, and a specific time period, probability can be used as a measure of the likelihood that an attack will occur. Thus, we define a measure of threat as follows:

Measure (Threat): The probability that a specific target is attacked in a specific way during a specified time period, or

Threat = P (attack occurs)

This measure of terrorist threat emphasizes a specific type of attack on specific targets. Radiological attack represents a different threat to a specific target than nuclear attack. Attacks on stadiums represent different threats than attacks on skyscrapers. A complete description of the threats to which a target is exposed would require consideration of every mode of attack separately. In practice, however, it may suffice to focus on a limited number of attack types that are representative of chemical, biological, radiological, or nuclear (CBRN) and explosive attack modes. Similarly, it may suffice to focus on a limited number of target types or groups of targets in a region.

This measure of threat is specified in terms of attack types and targets. The intelligence community more customarily considers threat in terms of groups of attackers given its interest identifying and stopping those who might pose a threat. An attack-type perspective is more useful for the task of resource allocation because the decision context is most concerned with what targets are threatened than with by whom and why.

Finally, since our measure for threat is uncertain, one should keep in mind that it can also be represented by a probability distribution, not a point estimate. These definitions are consistent with methods and terminology proposed through applications of engineering risk analysis to terrorism risk assessment (Ayyub, 2005; Paté-Cornell, 2005; von Winterfeldt and Rosoff, 2005).

Vulnerability

Clearly, not all threats of the same type are equally important. Furthermore, the threat of terrorism is dynamic in that it adapts to current conditions that affect the likelihood of attack success. For example, even if a typical hotel and fortified military base have equal probability of being subjected to a car-bomb attack, the attack would be more likely to achieve the aim of causing significant damage at the less-secure hotel. Therefore, we also need a precise definition of vulnerability that captures information about the infrastructure in which we are interested.

Paraphrasing Haimes, vulnerability is the manifestation of the inherent states of the system (e.g., physical, technical, organizational, cultural) that can result in damage if attacked by an adversary. Referring again to the domain of engineering risk analysis, where threat can be thought of as being a load or force acting on a system, vulnerability can be thought of as being the capacity of a system to respond to this threat (Paté-Cornell, 2005). To use this definition for measurement, we must be more specific and ask, "vulnerable to what?" Probability can be used as a measure of the likelihood that vulnerability will lead to damage when attacks occur.

Measure (Vulnerability): The probability that damages (where damages may involve fatalities, injuries, property damage, or other consequences) occur, given a specific attack type, at a specific time, on a given target, or

Vulnerability = P (attack results in damage | attack occurs)

In other words, a target's vulnerability can be articulated as the probability that an attack of a given type will be successful once it has been launched and, as articulated, measures vulnerability to specific types of damages only (i.e., there would be separate vulnerability assessments for deaths, injuries, and property damage).

Note that for the measure specified above, magnitude of the damage is not part of the definition of vulnerability. This measure assumes a simplified representation of vulnerability in which there is either a successful attack with damage or no success with no damage. As a result, we define "success" in terms of whether or not damage, having a distribution of magnitude, is inflicted by the attack. Consequence measurement is discussed below. A more general model (used in many military analyses) is that there is a range of damage levels, each associated with its own probability. This is simply a more discrete representation of damage and defense mechanisms.

Consequences

We define "consequence" as the magnitude and type of damage resulting from successful terrorist attacks. To define a measure of consequence, specificity is again required. In this case, specificity requires treatment of two important considerations: how consequences are measured and how uncertainty is addressed. Formally, we state this as follows:

Measure (Consequence): The expected magnitude of damage (e.g., deaths, injuries, or property damage), given a specific attack type, at a specific time, that results in damage to a specific target or,

Consequence = E (damage | attack occurs and results in damage)

Consequences can be expressed in terms of fatalities, injuries, economic losses, or other types of damage. Other aspects of consequences can also be considered using the approach we outline here and this definition. For example, the damage or destruction of critical infrastructures that cause injury, loss of life, and economic damage outside the area of immediate attack are important. They may in fact dominate the results of an analysis if the impact on society as a whole is considered rather than the impact on the target and its occupants and owners. In this monograph, however, we limit our focus to mortality, morbidity, and economic loss at the point of attack in order to illustrate an approach to risk estimation in a manner that is transparent yet relevant to real-world policy decisions.

As discussed in detail in Chapter Three, consequences are determined by many uncertain factors, such as wind speed or relative humidity (which could be important factors in a chemical or biological attack, for example). These uncertainties can be addressed by considering a full distribution for potential consequences or specific points along this distribution. Haimes (2004) notes that risk assessment of rare and extreme events requires special consideration of the tails of these distributions, and that the expected value often misrepresents true risk. Conversely, estimates of the tail of the distribution will be very dependent upon assumptions when considering events like terrorism where there is great uncertainty about events and limited historical information. For this reason, and to simplify, our continued discussion of consequences considers the expected value of the distribution of damage.

(Continues...)

---

Excerpted from Estimating Terrorism Risk by Henry H. Willis Andrew R. Morral Terrence K. Kelly Jamison Jo Medby Copyright © 2005 by RAND Corporation. Excerpted by permission.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.

---