Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change (2008)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

2 The Critical Contribution of Risk Analysis to Risk Management and Reduction of Bioterrorism Risk Risk management must guide our decision making as we examine how we can best organize to prevent, respond, and recover from an attack. —Department of Homeland Security Secretary Michael Chertoff at Homeland Security Policy Institute, March 16, 2005 Homeland Security Presidential Directive 10 (HSPD-10): events (e.g., earthquakes and hurricanes), technological Biodefense for the 21st Century (The White House, 2004) events (e.g., chemical accidents), and human activity (e.g., cites two applications for which a bioterrorism risk assess- the design and operation of engineered systems or an attack ment is needed: the identification of gaps or vulnerabilities in by a terrorist). the U.S. biodefense posture and the rebalancing and refining In Bioterrorism Risk Assessment, the DHS (2006) report of investment in U.S. biodefense policy. The list of “stake- describing the methodology of the BTRA of 2006, DHS used holders,” or primary public-sector customers, as identified by only two of these elements, problem formulation and risk the Department of Homeland Security (DHS), is presented assessment, as described in Chapter 3 of the present report. in Chapter 4. Although the committee does not know the However, the committee believes that all five steps listed uses to which these stakeholders will apply the Biological above should be unified and taken with the ultimate goal of Threat Risk Assessments (BTRAs) of DHS, it is confident effective risk management. that these uses and the two explicitly mentioned in HSPD-10 will require the use of the BTRA as the basis of a risk analy- Problem Formulation sis system. This chapter examines the components of such a system, especially as they relate to health risk analysis. To undertake any systemic risk analysis, it is necessary to clarify the problem being studied, the key stakeholders, their relationship to one another and to the problem being solved, RISK ANALYSIS IS THE DISCIPLINE and their values and goals (Keeney, 1992). Stakeholders may THAT THE DEPARTMENT OF HOMELAND have different objectives, depending on the potential type SECURITY SHOULD USE of attack being considered: for example, for some, preven- The risk analysis framework consists of five elements: tion may be the primary concern; for others, response and mitigation may be primary. Without a clear understanding • Problem formulation, of stakeholder objectives with respect to alternative terror- • Risk assessment, ist tactics, risk management strategies may be developed • Risk perception, that are unlikely to be implemented. In the context of the • Risk communication, and bioterrorism problem, the key interested parties are the • Risk management. relevant public-sector agencies concerned with this risk, the terrorists (who would like to discover U.S. assessments and Risk analysis offers (1) a framework for applying scien- policies), those who will be directly and indirectly attacked tific knowledge and the data to examine risk management by the terrorists, those adversely affected economically and decision making when the consequences of alternative deci- physically (through adverse health effects), and the taxpayer, sions are uncertain and (2) a systematic method of revising who will have to pay for the risk management and some of decisions in the light of new information or events. The the losses. hazards to be analyzed (e.g., physical, chemical, nuclear, In order to make the best choices, public and private deci- radiological, and biological agents) may result from natural sion makers may require inputs from biologists, public health care professionals, decision analysts, risk analysts, econo-   For more details on the risk analysis framework, see Kunreuther mists, political scientists, policy analysts, psychologists, (2002). sociologists, statisticians, and related professionals. Since 11 

12 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT by the committee’s definition almost everyone in the U.S. models (e.g., statistical models, probabilistic simulation) population is a stakeholder in BTRA information, it is im- of causal relationships between actions and their probable portant to develop strategies to reconcile differences among health effects. Exposure models describe the transport and subpopulations. These subpopulations will perceive risk on distribution of hazardous materials through different media the basis of their own goals and objectives. Techniques such and pathways (e.g., air, foods, drinking water) leading from as value-tree analysis (von Winterfeldt, 1987) may be useful their source(s) to members of the exposed population. Be- in bringing out and reconciling these differences. cause different exposures lead to different health outcomes, a successful exposure assessment should describe the fre- quency distribution of exposures of different parts of the Risk Assessment population. Risk assessment is the process of identifying hazards and Dose-response models ideally quantify the conditional targets and quantifying the risks that the hazards pose (mag- probability of illness caused by each level of exposure as nitude, spatial scale, duration, and intensity) and the associ- well as the degree of uncertainty surrounding these estimates. ated probabilities, including the uncertainties surrounding For some biological agents, it may be necessary to fit sepa- these estimates. The primary goal of risk assessment is to rate dose-response models to “normal” and “susceptible” produce information to improve risk management decisions subpopulations at risk and to account for interindividual by identifying and quantifying cause-and-effect relationships variability in dose-response relations. In general, risk assess- between alternative risk management decisions and their ment requires a description of the severities as well as the consequences and by identifying decisions that may increase frequencies of adverse health outcomes caused by exposures the probabilities of preferred outcomes. Risk assessment may and the potential value of gathering additional information to include a description of the cause-and-effect links between reduce the uncertainty surrounding these risk estimates. different hazards, and the nature of the interdependencies, One useful graphical way to capture the extent of vulnerabilities, and consequences. e ­ xpert knowledge about a particular risk is to construct an Once the problem has been formulated, risk assessment e ­ xceedance-probability (EP) curve. An EP curve specifies begins with hazard identification: the process of specifying the probability that a certain level of losses will be exceeded. the scope of the assessment and summarizing the available The losses can be measured in terms of dollars of damage, empirical evidence showing that a specific “hazard” (such as fatalities, illness, or some other unit of analysis. If one views exposure to a specific pathogen in a specific environment) the loss as a random variable, the EP is simply the comple- causes specified adverse health effects. Hazard identification mentary cumulative distribution of the loss. can serve the following purposes: For example, suppose one were interested in constructing an EP curve for direct dollar losses from the first bioterrorism • Rapid screening of potential hazards by identifying attack described in the aerosol anthrax scenario employed in whether available data support the hypothesized rela- this report (see Chapter 1). Event trees and fault trees, used tionship between the hazard and specific health effects, as part of probabilistic risk assessments, would identify the possibly using formal statistical methods of causal set of conditions and subsequent events that could produce analysis (Shipley, 2000); a given dollar loss, determine the resulting probabilities • Identification of causal relationships between identi- of exceeding losses of different magnitudes, and combine fied hazards and specific adverse human health effects; the results. Based on these estimates, the mean EP curve, and d ­ epicted in Figure 2.1, could be constructed. Suppose that • Identification of risk factors, behaviors, and exposure one focuses on a specific loss, Li. One can see from Figure 2.1 conditions that increase risks to specific exposed popu- that the likelihood that losses will exceed Li is given by pi. lations (e.g., the old, the young). The x axis measures the loss in dollars and the y axis depicts the probability that losses will exceed a particular level. Studies to identify specific hazards, their probability of It is much easier to construct an EP curve for ­ natural occurrence, and the probability of occurrence of their asso- d ­ isasters and chemical accidents than for bioterrorist ciated consequences are a part of risk assessment. In these a ­ ctivities. But even for those more predictable accidents or studies, experts can provide insight into terrorists’ values disasters, there may be considerable uncertainty regarding and objectives—along with their assessments of associated the occurrence of certain risks and the resulting damage. risks—but the experts need to take special care not to filter Providing information on the range of this uncertainty asso- these estimates through their own values. Health risk assessments are specializations of the meth-   See the lexicon in Appendix A for definitions of event tree and fault- ods described above. They typically use explicit analytic tree analysis.   detailed discussion of how one constructs an EP curve and incor- A   See Haimes (1998) for a comprehensive summary of recent work in porates elements of uncertainty on these estimates appears in Grossi and risk assessment. Kunreuther (2005, Chapters 2 and 4). 

THE CRITICAL CONTRIBUTION OF RISK ANALYSIS 13 Probability p(L) that losses will exceed L pi Li Loss, L (in dollars) FIGURE 2.1  Example of a mean exceedance-probability (EP) curve. R01268, Figure 2-1 Lines are fixed image, some text is alterable ciated with risk assessments should increase the credibility For some time those in the scientific community felt that of the expert estimates of these numbers. it was appropriate to ignore the public’s perception of the The model used for the DHS BTRA of 2006, fully de- risk if it differed significantly from their own estimates. It is scribed in Chapter 3 of this report, was used to determine now known that the public did not believe the experts’ assess- the relative risk of the terrorist use of each of 28 specific ments because those assessments were not communicated pathogens, identified in other sources. well, the assumptions on which they were based were not stated well, and there was little understanding by the public of the reasons for disagreement among the experts. In recent Risk Perception years, there has been increased sympathy for including the Risk perception is concerned with the psychological fac- psychological and emotional factors involved in perception tors, including emotional factors, that have been shown to of risk as part of risk assessment. have an enormous impact on behavior (Slovic, 2000). Risk Recent studies have confirmed this view of how the perceptions can be influenced by personal knowledge, experi- public perceives risk by showing that the public will assidu- ence, and beliefs, and they can be affected by an individual’s ously avoid certain activities because they are perceived to changing recognition of the threat, the vulnerabilities, and/or be unduly dangerous. More specifically, there is a stigma the consequences. Risk perception may be influenced by new associated with technologies, places, and products if the information about hazards, risk assessments, risk policies, public perceives them to be hazardous (Flynn et al., 2001) and risk management decisions. even though in many of these cases the scientific evidence In a set of pathbreaking studies begun in the 1970s, suggests that there is little to be concerned about. Stimulated psychologists began measuring laypeople’s concerns about by media reporting, the public’s perception of the risk is of- different types of risks. These studies showed that those haz- ten amplified in ways that are difficult to explain solely by a ards for which a person had little knowledge and which were technical risk assessment (Kasperson et al., 2001). also highly dreaded were perceived as being the most “risky” The problems associated with risk perception are com- (e.g., most probable). For some technologies such as nuclear pounded because of the difficulty individuals have in power and activities such as storing radioactive waste, there making a decision requiring the interpretation of very low was a wide disparity between the general citizenry’s view and probabilities. In fact, there is empirical evidence that people the experts’ view of the risk—that is, of both the hazards and may not even want data on the probability of an event’s oc- their associated probabilities. The finding that laypeople and curring (Huber and Wider, 1997). There is now a large body the scientific community see the world differently also raised of evidence that individuals’ risk perceptions are affected by a set of questions as to the nature of the decision-making judgmental biases. The availability heuristic is one of the process for dealing with risks. most relevant biases for dealing with extreme events: here 

14 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT people estimate the probability of an event by the ease with • To provide information to individuals and groups about which they can imagine or recall past instances (Tversky risks so that they can make better-informed decisions and Kahneman, 1973). In cases where the information on an or seek more information; event is salient, so that individuals fail to take into account • To influence people to change their behaviors, their the base rate, there will be a tendency by many to overesti- attitudes, and beliefs about hazards and their ac- mate the probability of the event’s occurring. Following the ceptance of risk management decisions and policy terrorist attacks of September 11, 2001 (9/11), many people recommendations; refused to fly because they perceived a high probability of • To involve affected parties in the decision process; being hijacked. This was true even though it could be argued and that the probability of being hijacked was extremely low, • To facilitate their participation in conflict-resolution, given the increased vigilance and added protection by the consensus building, and collective decision making federal government. about risk management. There is also a growing body of evidence that emotions play an important role in an individual’s decision processes. The field of risk communication provides guidelines for Such behavior is not irrational. Rather than basing one’s the accomplishment of these goals, derived mainly from choices simply on the probability and consequences of differ- experience, analysis of survey data, and experiments, and ent events, as normative models of decision making suggest, for sharing risk information among stakeholders and deci- individuals are also influenced by emotional factors such as sion makers. fear, worry, and love (Finucane et al., 2000; Loewenstein et As noted above, a number of studies have shown that al., 2001). people have difficulty processing data regarding low- probability events. This raises the problem of effectively communicating information on risk to the public, especially Risk Communication information involving very low or high probabilities—an The importance of risk communication in the overall risk important component in any risk communication strategy management process is emphasized in Homeland Security for dealing with the bioterrorist threat. The use of EP curves Presidential Directive 10 (The White House, 2004): such as that shown in Figure 2.1 can indicate the uncertain- A critical adjunct capability to mass casualty care is effective ties surrounding a particular risk. However, as pointed out risk communication. Timely communications with the gen- above, laypeople are not likely to process these data in the eral public and the medical and public health communities formulaic manner that scientists and engineers might. Risk can significantly influence the success of response efforts, communication approaches must recognize the difficulties including health- and life-sustaining interventions. that individuals have in collecting and analyzing data from experts, particularly with respect to low-probability events. Risk communication is used by risk analysts, decision The format and presentation of risk information and the makers, policy makers, and even intelligent adversaries framing of associated questions or surveys can greatly affect to provide data, information, and knowledge designed to the manner in which recipients respond to, assimilate, and change or to shape the risk perceptions of individuals and or- act on the information. For example, in medical decisions, ganizations and to cause them to assess the risk in a different people are more likely to elect a medical procedure when it way than they otherwise might. Well-designed risk commu- is described as “99 percent safe” than when it is described nication facilitates the effective participation and interaction as having “a 1 percent chance of complications” (Gurm and of technical experts, stakeholders, and decision makers in Litaker, 2000). Presenting relative risks rather than absolute risk management decision processes and deliberations. Risk risks and using loss framing instead of gain framing make communication is also used to present the results of risk anal- it more likely that patients will adopt screening procedures. yses to stakeholders, decision makers, participants, and other In presenting economic risks, the language used may trigger audiences. Communication and deliberation drive much of speculations about the presenter’s motives and undermine his the risk management decision process in many risk manage- or her credibility with the target audience (MacGregor et al., ment applications and are essential for successful outcomes. 1999). Understanding such effects can help in preparing the The relationship of risk communication to risk management presentation of factual information in ways that are likely to is examined in the National Research Council (NRC) report elicit desired responses. entitled Understanding Risk, which states: “the process (of A striking insight from the framing literature is that there risk characterization) must have an appropriately diverse may be no neutral way to present risk information. Any pre- participation or representation of the spectrum of interested sentation carries with it potential presentation and framing and affected parties, of decision makers, and of specialists in effects and biases that may affect the recipients’ attention, risk analysis, at each step” (NRC, 1996, p. 3). interpretation, and actions. Presenting the same information The most common goals for risk communication pro- in different ways and emphasizing fact-rich displays (e.g., grams are these: cumulative risk profiles) that are not strongly associated with 

THE CRITICAL CONTRIBUTION OF RISK ANALYSIS 15 known presentation biases may come as close as possible to of consequences (e.g., by appropriate clinical screening, providing the information needed for rational decision mak- diagnosis, and treatment procedures); and/or the transfer of ing without biasing the decision. However, such displays risk (e.g., insurance and compensation). As with the other may be difficult to understand, as they may lack the brev- elements of risk analysis, it is important to identify the key ity and focus that are most effective in an action-oriented stakeholders and their values and goals as well as their short- presentation. and long-term priorities. How do they perceive the risks, and The challenge of biological agent risk analysis is daunt- what do they need from the risk assessment in order to make ing because it requires inputs from multiple disciplines and, better resource allocation decisions? if properly integrated into risk management, will engage a In combination with risk communication strategies, one vast network of stakeholders across every level of govern- can employ economic incentives to encourage individuals ment, the private sector, the medical community, and the to take protective measures against the bioterrorism threat. media. Progress toward this goal will require that the diverse Fines coupled with specific regulations or standards can be population of stakeholders share a common language and used to encourage the adoption of protective measures, al- terminology with respect to concepts of risk analysis. This though there needs to be a sufficiently high probability that concept has yet to be translated into reality. any negligent individual or firm will get caught. Otherwise Precise terminology has a special urgency in the case of the person or manager is likely to respond to incentives dif- biological agent risk analysis. As is always the case in sci- ferent from those intended (i.e., ignore the regulation). If the ence, the absence of a precise definition of terms frustrates probability is low enough and/or the fine is small enough, a the effort to improve methodologies because experts may person may decide that it may pay in the long run not to take use the same words or phrases differently. For example, the protective action. The behavior in such cases is similar to the word “risk” may be interpreted in very different ways by decision not to put a quarter in a parking meter because one different individuals. figures that there is a small chance of getting a ticket and in The committee stresses the importance of terminology. any case the ticket doesn’t cost much. Because the BTRA is meant to provide a basis for critical Risk management strategies can be evaluated by un- planning and decision making, some of it very costly and dertaking cost-benefit analyses to determine the trade-off with its own risks, imprecision in terminology can have between the reduction of risk and the costs of undertaking serious consequences. In the briefings that the committee such measures. In evaluating a risk management strategy, received, there was ambiguous, conflicting, and incorrect one needs to be concerned with the way that resources are al- use of some technical terms. The committee has made an located (i.e., efficiency considerations) as well as the impact effort to provide authoritative definitions of all of the rel- of these measures on different stakeholders (i.e., distribution evant terms used in this report and includes the lexicon that or equity considerations). it developed as Appendix A. This can serve as a model for A successful risk analysis shows the estimated changes a DHS lexicon. in the frequencies and magnitudes of adverse consequences resulting from different risk management decision options. Recommendation: The Department of Homeland Se- Risk analysis uses probability distributions, confidence inter- curity should use an explicit risk analysis lexicon for vals, and other displays to show the uncertainties about the defining each technical term appearing in its reports and human health consequences of different decisions. It identi- presentations. fies a subset of decision options leading to preferred prob- ability distributions of health risks and other outcomes. The outputs of a health risk analysis should allow a Risk Management risk manager to answer the following questions for each Risk management is the process of constructing, evaluat- risk management decision alternative being evaluated or ing, implementing, monitoring, and revising strategies for compared: reducing (or distributing) losses from future hazards and dealing with the recovery process should a hazard occur. • What change in human health risk would result from Risk management takes scientific information obtained each risk management intervention? If the risk man- from risk assessment and factors influencing risk percep- agement option or action being assessed is imple- tion as inputs, along with value judgments and with policy mented, how will the adverse human health effects goals and constraints, and proposes alternative strategies (e.g., expected numbers of mild, moderate, severe, and for reducing losses from future hazards and dealing with the fatal illnesses per year; expected numbers of illness- recovery process should a disaster occur. Risk management days, duration, and latency) change, both in the entire strategies include a combination of options such as the provi- population and in subpopulations with distinct risks? sion of information (i.e., risk communication); the offering • How certain is the change in human health risk that of economic incentives (e.g., subsidies, fines); prevention would be caused by each risk management action? In- or avoidance (e.g., by reducing exposures); the mitigation stead of a single value, that is, a point estimate of risk, 

16 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT uncertain risks are characterized by intervals or prob- is continuously evolving. The probability and consequences ability distributions indicating how closely the change of a terrorist attack are determined by a mix of actions and in human health risk caused by a proposed risk manage- counteractions developed by a range of involved parties and ment intervention can be predicted. Might management changing over time. This leads to what is called dynamic action cause further damage, such as from unforeseen uncertainty (Michel-Kerjan, 2003). In contrast, actions can effects of large-scale inoculation or the administration be taken to reduce damage from future natural disasters of antidotes? There are several technical options for with the knowledge that the probability associated with the expressing uncertainty around point estimates (e.g., hazard will not be affected by the adoption of these protec- plausible upper and lower bounds, confidence limits, tive measures. For instance, the probability of an earthquake coefficients of variation). of a given intensity in a specific location will not change if • What are the key drivers of hazards and uncertainties property owners design more quake-resistant structures. for each option? The analysis should make clear to the In addition, there are issues of interdependent security that planner the main reasons why the estimated risk from need to be considered when predicting or planning involves each decision option is as high or low as it is. Are the the actions of each individual at risk from a bioterrorist attack results driven mainly by predicted exposure levels, by (Heal and Kunreuther, 2006). This interdependence, as well the responses of sensitive subpopulations, by genetic as issues of perception and communication, was recognized or epidemiological data that establish tight constraints in an earlier NRC report, Terrorism and the Chemical In- on the plausible values, or by other factors? Sensitiv- frastructure (NRC, 2006). Even if an individual or firm has ity analyses plotting the change in estimated risk as taken protective actions, there is still some chance that that input assumptions and estimates vary within plausible entity can be contaminated or infected by others who have ranges (e.g., within a few standard deviations of their not undertaken similar measures and hence are at risk. For median or mean values) and can help to identify the example, if a person has been vaccinated or taken preven- combinations and range of input values that drive the tive medicine against a disease, he or she may still contract main conclusions. the illness from others if the vaccine or medicine is not 100 percent effective. Even if modifications to a single unit of an organization can reduce the chance of a bioterrorist attack to TERRORIST THREATS DIFFER FROM its own operations, that chance can still be adversely affected NATURAL HAZARDS AND FROM OTHER by a second unit that did not undertake similar protective HUMANLY MADE HAZARDS measures. In these cases, where there are complementari- A special challenge in developing risk assessments ties or positive externalities created by an individual taking for a terrorist attack involves human action and reaction. protective measures, there is more incentive for one unit to Although terrorist activities and natural disasters can both invest in protective measures if the other units have taken be characterized as extreme events, there are crucial differ- similar actions. In fact, investing in security is most effective ences between them, in areas including the following: the if all elements of the system obtain protection; weak links availability or lack of historical data, dynamic uncertainty, may lead to suboptimal behavior by everyone (Heal and shifting of attention to unprotected targets, the existence of Kunreuther, 2006; Bier, 2007). negative externalities, and governmental influence on the Information sharing about risk due to terrorism is clearly risk. These characteristics are discussed below and summa- different from information sharing about risk due to natural rized in Tables 2.1-2.3. hazards. In the latter case, new scientific studies normally Large historical databases on losses from natural hazards are common knowledge, so insurers and the individuals are available in the public domain. These data have been and businesses at risk, as well as public-sector agencies, all utilized by modeling firms in conjunction with estimates by have access to these findings. However, information on ter- scientists and engineers on the probability and consequences rorist groups’ activities, possible attacks, or current threats of future disasters in specific locations. In contrast, data on is kept secret by government agencies for national security terrorist groups’ activities and current threats are normally reasons. kept secret for national security reasons. Moreover, while There are also more fundamental differences between the some time-series data on terrorist acts over the past years catastrophic modeling of natural hazards and the modeling are in the public domain, they may not reflect the changing of megaterrorism. The issue of effectively modeling the ac- expectations of planned activities of terrorist groups today. tions of intelligent adversaries by other than probabilistic Because terrorists are likely to design their strategies as a estimates is central to this report and is addressed more function of their own resources and their knowledge of the fully in the remainder of the report. International terrorism vulnerability of their specific targets, the nature of the risk is a matter of national security as well as foreign policy. The government can influence the level of risk of future   For more details on these differences, see Parnell et al. (2005) and attacks through appropriate counterterrorism policies and Golany et al. (2007). international cooperation as well as through adequate crisis 

THE CRITICAL CONTRIBUTION OF RISK ANALYSIS 17 TABLE 2.1  Natural Hazards Versus Terrorism Risks: Comparison of Key Characteristics Characteristic Natural Hazards Terrorist Attacks Historical data Some historical data: A record exists of extreme Very limited historical data: Events of September 11, 2001, were the first events that have already occurred. terrorist attacks worldwide with such a huge concentration of victims and insured damages. Risk of Reasonably well defined: Well-developed models exist Considerable ambiguity: Terrorists can purposefully adapt their occurrence for estimating risks based on historical data and expert strategies depending on their knowledge of a target’s vulnerabilities. estimates. Geographic Specific areas at risk: Areas such as California for All areas at risk: Although some cities may be considered riskier than risk earthquakes or Florida for hurricanes are well known others, terrorists may attack anywhere. for being at risk. Information Information sharing: New scientific knowledge on Asymmetry of information: Government may keep new information natural hazards can be shared with all stakeholders. secret for national security reasons. Event type Natural event: No one can influence the occurrence of Terrorist event: Governments can influence terrorism through foreign extreme natural events. policy, security measures, or international cooperation. Preparedness Measures known: Investments can be made in well- Possible unforeseen events: Weapons and weapon configurations are and prevention known mitigation measures. numerous, and there can be substitution in terrorist activity. Catastrophe Well developed: Developed in late 1980s and early Development needed: First models developed in 2002. modeling 1990s. TABLE 2.2  Natural Occurrence of Anthrax Versus Its Use by Terrorists: Comparison of Key Characteristics Characteristic Natural Occurrence of Anthrax Use of Anthrax by Terrorists Historical data Some historical data: Good understanding exists of the Limited historical data: Limited historical and experimental data exist. modes of transmission and containment. There are no data corresponding to a dispersed nationwide attack. Risk of Well understood: Risk is well understood. Considerable ambiguity: There is a wide range of possible attacks using occurrence existing or unknown strains. Geographic Specific areas at risk: Good scientific understanding of All areas at risk: Terrorists may attack anywhere with the possibility risk the relationship between geography and risk of disease of wide geographic dispersion designed to maximize exposure. exists. Governments can influence local risk through security measures or international cooperation. Information Information sharing: New scientific knowledge can be Asymmetry of information: Government may keep new information shared with all stakeholders. secret for national security reasons. Event type Natural event: Most natural events will not be Terrorist event: Terrorists will seek to maximize their objectives. extreme, but localized. Preparedness Measures known: Investments can be made in well- Possible unforeseen events: Terrorists will attempt to obviate and prevention known mitigation measures. preparations, for example creating a strain resistant to the stockpiled antibiotic. management to limit the consequences should an attack the country. The creation of the U.S. Department of Home- occur. Some decisions made by a government as part of its land Security in 2002 confirms the importance of this role foreign policy can also affect the will of terrorist groups to in managing the terrorist risk. In that sense, terrorism risk attack the country or its interests abroad (Lapan and Sandler, is partly under the government’s control, and it will change 1988; Lee, 1988; Pillar, 2001). depending on at least two complementary strategies by the A government can also devote part of its budget to the defenders: the first entails protective measures that could be development of specific measures on national soil to protect adopted by those at risk; the second consists of actions taken 

18 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT TABLE 2.3  Natural Occurrence of Smallpox Versus Its Use by Terrorists: Comparison of Key Characteristics Characteristic Natural Occurrence of Smallpox Use of Smallpox by Terrorists Historical data Known to be noncatastrophic: There is wide variation No historical data: There is no prior experience with smallpox dispersed in the impact of smallpox between developed and as a modern, large-scale attack. Fatalities could be in the hundreds developing regions. As a natural disease, smallpox is or perhaps even low thousands (but since the vaccine can be usefully not catastrophic to U.S. interests, although it could administered up to 7 days after exposure, early detection of an attack have significant mortality and economic consequences. would be invaluable). Risk of No risk: Essentially zero risk of occurrence exists. Some uncertainty: The creation or acquisition of smallpox is well within occurrence the technical reach of a determined and well-resourced terrorist, but it is not clear that such a terrorist would pursue smallpox over a radiological device or investment in conventional weapons. Geographic Limited risk: There is almost zero risk of occurrence, Containment difficult: A successful aerosol dispersion would require risk except possibly in Eritrea. sophisticated technology and could fail owing to malfunction, weather conditions, or other factors. However, if an attack was carefully planned, containing the disease to the area of attack would be very difficult. Information All in public domain: Essentially all information on Asymmetry of information: If some group has created a weaponized naturally occurring smallpox is in the public domain. version of smallpox, that would be a closely held secret. Similarly, technology for dispersion would be secret. If counterintelligence discovered that a terrorist group was preparing a smallpox attack, the decision on how to use that information would depend on the reliability and completeness of the information. Event type Natural event: Historically, most natural outbreaks Event unlikely: The very public preparation in the United States against were not extreme and “burned out” within a few the possibility of a smallpox attack has probably changed the climate for months (much more rapidly in developed regions). terrorist thinking. Given that this nation has now stockpiled significant quantities of vaccine, and given that smallpox is slow to progress and easy to diagnose, it seems unlikely that a rational terrorist would choose this attack over comparably difficult but more consequential alternatives. Preparedness Smallpox eradicated: The eradication of natural Vaccination possible: Swift vaccination could protect all of the U.S. and prevention smallpox was a great public health success. population except those affected in the first wave of an attack. by the government to enhance the general security and to re- Grossi, P., and H. Kunreuther. 2005. Catastrophe Modeling: A New Ap- duce the probability that attacks will occur. Hence protection proach to Managing Risk. New York: Springer. Gurm, H., and D. Litaker. 2000. “Understanding the Influences on Informed from terrorism is a mixed private-public good. Consent; Is 99% Safe Same as a Risk of 1 in 100?” Academic Medicine Table 2.1 summarizes the distinctions between risks from 75(8):840-842. natural hazards and those from a terrorist attack. Tables 2.2 and Haimes, Y. 1998. Risk Modeling, Assessment and Management. New York: 2.3 particularize these distinctions to apply to anthrax, as in the Wiley. hypothetical scenario used for this report, and smallpox. Heal, G., and H. Kunreuther. 2006. “You Can Only Die Once: Interdepen- dent Security in an Uncertain World.” In H.W. Richardson, P. Gordon, and J.E. Moore II (eds.), The Economic Impacts of Terrorist Attacks. REFERENCES Cheltenham, U.K.: Edward Elgar. Huber, O., and R. Wider. 1997. “Active Information Search and Complete Bier, V. 2007. “Choosing What to Protect.” Risk Analysis 27(June):607- Information Presentation in Naturalistic Risky Decision Tasks.” Acta 620. Psychologica 95(1):15-29. DHS (Department of Homeland Security). 2006. Bioterrorism Risk Assess- Kasperson, R., N. Jhaveri, and J. Kasperson. 2001. “Stigma and the Social ment. Biological Threat Characterization Center of the National Biode- Amplification of Risk: Toward a Framework of Analysis.” Chapter 2 in fense Analysis and Countermeasures Center. Fort Detrick, Md. J. Flynn, P. Slovic, and H. Kunreuther (eds.). Risk Media and Stigma. Finucane, M.L., A. Alhakami, P. Slovic, and S.M. Johnson. 2000. “The Af- London, U.K.: Earthscan. fect Heuristic in Judgments of Risks and Benefits. Journal of Behavioral Keeney, R.L. 1992. Value-Focused Thinking. Cambridge, Mass.: Harvard Decision Making 13(1):1-17. University Press. Flynn, J., P. Slovic, and H. Kunreuther (eds.). 2001. Risk Media and Stigma. Kunreuther, H. 2002. “Risk Analysis and Risk Management in an Uncertain London, U.K.: Earthscan. World.” Risk Analysis 22(4):655-664. Golany, B., E.H. Kaplan, A. Marmur, and U.G. Rothblum. 2007. “Nature Lapan, H., and T. Sandler. 1988. “To Bargain or Not to Bargain: That is the Plays with Dice—Terrorists Do Not: Allocating Resources to Counter Question.” American Economic Review 78(2)16-20. Strategic Versus Probabilistic Risks.” European Journal of Operational Lee, D. 1988. “Free Riding and Paid Riding in the Fight Against Terrorism.” Research. In press. American Economic Review 78(2):22-26. 

THE CRITICAL CONTRIBUTION OF RISK ANALYSIS 19 Loewenstein, G.F., E.U. Weber, C.K. Hsee, and N. Welch. 2001. “Risk as Pillar, P. 2001. Terrorism and U.S. Foreign Policy. Washington D.C.: Feelings.” Psychological Bulletin 127:267-286. B ­ rookings Institution Press. MacGregor D.G., P. Slovic, and T. Malmfors. 1999. How Exposed Is Ex- Shipley, B. 2000. Cause and Correlation in Biology: A User’s Guide to Path posed Enough? Lay Inferences About Chemical Exposure. Risk Analysis Analysis, Structural Equations and Causal Inference. Cambridge, U.K.: 19 (No. 4, August):649-659. Cambridge University Press. Michel-Kerjan, E. 2003. “Large-Scale Terrorism: Risk Sharing and Public Slovic, P. 2000. The Perception of Risk. London, U.K.: Earthscan. Policy.” Revue d’Economie Politique 113(5):625-648. Tversky, A., and D. Kahneman. 1973. “Availability: A Heuristic for Judging NRC (National Research Council). 1996. Understanding Risk: Informing Frequency and Probability.” Cognitive Psychology 5(2):207-232. Decisions in a Democratic Society. Washington D.C.: National Acad- von Winterfeldt, D. 1987. “Value Tree Analysis: An Introduction and emy Press. A ­ pplication to Offshore Drilling.” Chapter 11 in P. Kleindorfer and H. NRC. 2006. Terrorism and the Chemical Infrastructure: Protecting People Kunreuther (eds.). Insuring and Regulating Hazardous Materials: From and Reducing Vulnerabilities. Washington D.C.: The National Acad- Seveso to Bhopal. New York: Springer-Verlag. emies Press. The White House. 2004. Homeland Security Presidential Directive 10 Parnell, G., R. Dillon, and T. Bresnick. 2005. “Integrating Risk Manage- [HSPD-10]: Biodefense for the 21st Century. Available at www.fas. ment with Homeland Security and Anti-Terrorism Resource Allocation org/irp/offdocs/nspd/hspd-10.html. Accessed January 16, 2008. D ­ ecision-Making.” Pp. 431-461 in David Kamien (ed.), The McGraw- Hill Homeland Security Handbook. New York: McGraw-Hill.