The cumulative increase in expenditures on US domestic homeland security over the decade since 9/11 exceeds one trillion dollars. It is clearly time to examine these massive expenditures applying risk assessment and cost-benefit approaches that have been standard for decades. Thus far, officials do not seem to have done so and have engaged in various forms of probability neglect by focusing on worst case scenarios; adding, rather than multiplying, the probabilities; assessing relative, rather than absolute, risk; and inflating terrorist capacities and the importance of potential terrorist targets. We find that enhanced expenditures have been excessive: to be deemed cost-effective in analyses that substantially bias the consideration toward the opposite conclusion, they would have to deter, prevent, foil, or protect against 1,667 otherwise successful Times-Square type attacks per year, or more than four per day. Although there are emotional and political pressures on the terrorism issue, this does not relieve politicians and bureaucrats of the fundamental responsibility of informing the public of the limited risk that terrorism presents and of seeking to expend funds wisely. Moreover, political concerns may be over-wrought: restrained reaction has often proved to be entirely acceptable politically.
A couple of things that often go missing in the dialogue on this that I think are important to raise. One is that it seems to me that the value of deterring terrorist attacks at the margin is often extremely low. A man with a working explosive and a willingness to die for the cause located inside Dulles Airport is going to have an extremely hard time making it through security and blowing up an airplane. But if his second-best alternative is to stand in the middle of the security line and blow himself up there, then how much have we really gained? A related point is security cascades. As we saw with the Oklahoma City bombing, even a very minor federal office building can be an appealing target for terrorists. So when we increase security at the offices that seem “important,” to some extent we’re just pushing the risk onto the remaining less-secured buildings.
Both considerations seem to me to point in the direction of doing extremely rigorous security at a small number of location that’s we’ve deemed to be of super-duper critical importance and easing off on the rest. Israelis at one point had to deal with suicide bombers blowing up buses and pizzarias and coffee shops. That would be horrible. But it’s not something you can prevent by putting metal detectors and bomb sniffing dogs on all your buses.