The Department of Homeland Security is responsible for protecting the United States from terrorism. It does so partly through the Urban Areas Security Initiative, though its distribution has been criticized for not reflecting risk. This monograph offers a practical definition of terrorism risk and a method for estimating it that addresses inherent uncertainties. It also demonstrates a framework for evaluating alternative risk estimates. Finally, it makes five recommendations for improving resource allocation.

The Department of Homeland Security (DHS) is responsible for protecting the United States from terrorism through prevention, preparedness, and response. In part, this goal is achieved through allocation of resources to states and urban areas. The Urban Areas Security Initiative (UASI) is a DHS grant program designed to enhance security and overall preparedness by addressing unique planning, equipment, training, and exercise needs of large urban areas (DHS, 2004). Although there appears to be agreement among many stakeholders that these allocations should reflect the magnitude of risks to which different areas are exposed, no consensus has emerged on how this might be accomplished. Indeed, the UASI grant program has frequently been criticized for inadequately calculating risk and therefore for failing to distribute resources in proportion to urban areas' shares of total terrorism risk.

The Department of Homeland Security is moving increasingly to risk analysis and risk-based resource allocation, a process that is designed to manage the greatest risks instead of attempting to protect everything. The authors show how a probabilistic terrorism model can be used to assess terrorist risk across cities and within specific cities, and to assist intelligence analysis.

RAND evaluated a terrorism risk modeling tool developed by the Transportation Security Administration and Boeing to help guide program planning for aviation security. This tool, the Risk Management Analysis Tool, or RMAT, is used by TSA to estimate the terrorism risk-reduction benefits attributable to new and existing security programs, technologies, and procedures. RMAT simulates terrorist behavior and success in attacking vulnerabilities in the domestic commercial air transportation system, drawing on estimates of terrorist resources, capabilities, preferences, decision processes, intelligence collection, and operational planning. It describes how the layers of security protecting the air transportation system are likely to perform when confronted by more than 60 types of attacks, drawing on detailed blast and other physical modeling to understand the damage produced by different weapons and attacks, and calculating expected loss of life and the direct and indirect economic consequences of that damage. This report describes RAND's conclusions about the validity of RMAT for TSA's intended uses and its recommendations for how TSA should perform cost-benefit analyses of its security programs.

Establishing tolerable levels of risk is one of the most contentious and important risk management decisions. With every regulatory or funding decision for a risk management program, society decides whether or not risk is tolerable. The Urban Area Security Initiative (UASI) is a Department of Homeland Security (DHS) grant program designed to enhance security and overall preparedness to prevent, respond to, and recover from acts of terrorism, by providing financial assistance for planning, equipment, training, and exercise needs of large urban areas. After briefly reviewing rationales for risk-based resource allocation and challenges in estimating terrorism risk, this paper compares estimates of terrorism risk in urban areas that received UASI funding in 2004 to other federal risk management decisions. This comparison suggests that UASI allocations are generally consistent with other federal risk management decisions. However, terrorism risk in several cities that received funding is below levels that are often tolerated in other risk management contexts. There are several reasons why the conclusions about terrorism risk being de minimis in specific cities should be challenged. Some of these surround the means used to estimate terrorism risk for this study. Others involve the comparison that is made to other risk management decisions. However, many of the observations reported are valid even if reported terrorism risk estimates are several orders of magnitude low. Discussion of resource allocation should be extended to address risk tolerance and include explicit comparisons, like those presented here, to other risk management decisions.

The events of September 11, 2001 changed perceptions, rearranged national priorities, and produced significant new government entities, including the U.S. Department of Homeland Security (DHS) created in 2003. While the principal mission of DHS is to lead efforts to secure the nation against those forces that wish to do harm, the department also has responsibilities in regard to preparation for and response to other hazards and disasters, such as floods, earthquakes, and other "natural" disasters. Whether in the context of preparedness, response or recovery from terrorism, illegal entry to the country, or natural disasters, DHS is committed to processes and methods that feature risk assessment as a critical component for making better-informed decisions. Review of the Department of Homeland Security's Approach to Risk Analysis explores how DHS is building its capabilities in risk analysis to inform decision making. The department uses risk analysis to inform decisions ranging from high-level policy choices to fine-scale protocols that guide the minute-by-minute actions of DHS employees. Although DHS is responsible for mitigating a range of threats, natural disasters, and pandemics, its risk analysis efforts are weighted heavily toward terrorism. In addition to assessing the capability of DHS risk analysis methods to support decision-making, the book evaluates the quality of the current approach to estimating risk and discusses how to improve current risk analysis procedures. Review of the Department of Homeland Security's Approach to Risk Analysis recommends that DHS continue to build its integrated risk management framework. It also suggests that the department improve the way models are developed and used and follow time-tested scientific practices, among other recommendations.

Outlines the essential components of risk assessment and management, which entail the following sequential tasks: Critical infrastructure and key asset inventory; Criticality assessment; Threat assessment; Vulnerability assessment; Risk calculation; and Countermeasure identification. Risk assessment and management concepts and methodologies are evolving rapidly. Here, each component is defined and briefly examined. Protocols are supplied to quantify/calculate criticality, threat, vulnerability, and risk. Experience with risk assessment and management are limited in many law enforcement agencies. To assist in reversing this situation, this report supplies capacity building info. that includes promising programs, software, and training references.

This document distills and synthesizes the proceedings of a workshop in which experts in the field of regulatory analysis and terrorism risk examined alternative approaches for estimating the benefits of regulations designed to reduce the risks of terrorist attacks in the United States. The workshop gave rise to several recommendations for improving the modeling and data collection that support the benefit-cost analysis of terrorism security regulations.