Nov 30, 2008
To help policymakers deal with the uncertainty surrounding future terrorist threats, this policy brief recommends a capabilities-based, portfolio approach to terrorism prevention planning that combines traditional prevention efforts with mitigation measures. In a consequence-prevention portfolio, some measures are aimed at preventing attacks outright, while others focus on limiting the effects of a terrorist operation. Protective portfolios should be assessed to determine which will perform well across a range of possible futures and be less sensitive to threat uncertainty—and therefore more attractive given an uncertain future.
The uncertain nature of the terrorist threat is a fundamental challenge in the design of counterterrorism policy. For efforts to prevent terrorist attacks before they happen, this uncertainty presents a particular problem: To detect and stop attacks, security organizations need to know how to identify threatening individuals, what type of weapons to look for, and where to be on the lookout in a nation with a multitude of targets that attackers might choose. Though intelligence gathering can reduce threat uncertainty, because of both practical and societal constraints it cannot eliminate it entirely. It is also to terrorist groups' advantage to increase uncertainty by altering their behaviors, tactics, and strategies. This uncertainty complicates decisionmaking about which preventive measures to implement and creates the risk that resources will be expended that—because the threats they are designed to prevent do not materialize as expected—do not produce protective benefits.
These problems have led some to suggest that the country focus on mitigation and resiliency instead of investing in measures designed to prevent attacks. Mitigation and resiliency measures are designed to reduce the impact of a damaging event when it occurs and to make it possible for key infrastructures, economic activities, and other parts of society to rapidly bounce back. While traditional prevention measures buy a chance of preventing all damage from individual attacks by stopping them completely, mitigation and resiliency measures buy a lower, but more certain, payoff: preventing only some of the damage from attacks, but doing so predictably across the many different ways in which threats might become manifest. Such measures can also help address risks that have nothing to do with terrorism, such as accidents or natural disasters.
Instead of seeing an either/or choice between traditional prevention and mitigation or resiliency measures, it is more productive to consider them together in an integrated way—as two complementary elements of a strategy aimed at lessening the consequences of successful terrorist attacks. Doing so essentially stretches the concept of prevention beyond the ideal of halting attacks before they happen to also include efforts to limit the human and economic costs of even successful attack operations. The central advantage to viewing prevention in this way is that it broadens the options available to policymakers to include options that are less sensitive to threat uncertainty.
With such a hybrid approach, policymakers would not be constrained to only investing more in intelligence activities to try to eliminate uncertainties or adding layer upon layer of security in an effort to prevent every attack. Instead, they could assemble combinations of measures that could perform better than either type alone across a wider variety of future threats. This makes it possible to take a portfolio approach to homeland security. In a prevention and mitigation portfolio, some measures would reach for the highest payoff of completely preventing attacks, while others would provide a more stable protective return by limiting the damages from any terrorist operation or other event.
For example, in the area of aviation security, traditional preventive measures (e.g., prescreening passengers for air transport) could be combined with measures such as strengthening airframes or placing checked bags and other cargo in containers reinforced to withstand the effects of a bomb detonation. In such a protective portfolio, the mitigation strategies hedge against the chance attackers will be able to get a weapon onto an aircraft and, by doing so, make prevention less of an all-or-nothing proposition.
Similar capabilities-based strategies for hedging uncertain futures have been pursued in other policy arenas, such as defense planning. The Department of Homeland Security is already applying similar approaches in some areas: Capabilities-based planning has been used in response and recovery planning in an effort to build a national portfolio of capabilities that are suitable for a wide range of possible incidents. These strategies might save resources as well—for example, if the costs associated with trying to reduce uncertainty by improving intelligence gathering are high compared with adding additional mitigation measures, spending on the latter might provide more protection per dollar invested.
Portfolios that combine different ways to prevent the consequences of terrorist attacks will serve the country better than strategies built from either of these options alone. But how should the results of such an approach be assessed? Determining how much better this approach might be requires examining a variety of such portfolios to explore their strengths and weaknesses across a number of possible futures. To get a full picture, assessments should examine
Because the goal is developing protective strategies that are not hostage to the uncertain nature of tomorrow's threats, it will be critical to understand how different portfolios perform in different threat and hazard environments, when threats come from unexpected sources, when attackers use varied attack types, and when groups change their strategic and tactical behavior over time. Protective portfolios that perform well across a range of possible futures would be judged less sensitive to threat uncertainty—and therefore more attractive given an uncertain future.