A Threat-Response Model of Counter-Terrorism: Implications for Information Security and Infrastructure Risks

This paper critically reviews the literature and best practices to develop and apply a qualitative model for managing terrorism threats. The research shows how risk is too complicated to be reduced to a binary system of safe and unsafe attributes. The researchers show how uncertainty can be reduced through the application of resources, by using a protection profile. The second component in the model is a damage profile, which shows how, as security increases, the additional value of more security decreases. When this relationship is adjusted for the costs of security (reflected in the protection profile), the result is an equilibrium showing an economically-rationalized level of security but generally short of complete safety. The model is then simulated to show how the equilibrium is shifted by such factors as an increase in vulnerability or consequences, a more effective adversary, changed costs and advances in technology. Although an equilibrium model with known functions is useful, a number of real-world limitations prevent straightforward application of the model to calculate a security equilibrium. These limitations include discontinuous risks and distributed decision-making authority. Finally, the model is analyzed to estimate the likely effects of litigation and security mandates on counter-terrorism.