What Price Security?

That disdain for attempting to pin down such numbers is reinforced by academia. "When you get much beyond the low-hanging fruit that costs little but has obvious benefits — like emergency evacuation plans — you get into a really murky area," says Carnegie-Mellon University risk-management expert H. Keith Florig. With terrorism, "you don't know what the risk is, and you don't know what the risk reduction is when you buy any particular intervention."

The standard cost-benefit calculation calls for expected losses from an incident — say, the destruction of a plant — to be multiplied by the incident's probability. That amount is multiplied again by a factor representing any mitigation activity. The ROI is the difference between the savings and the mitigation cost. "Formulas are nice for keeping concepts in mind, but the amount of irreducible uncertainty in this case is so large that...quantitative estimates of ROI would be deemed not credible," says Florig.

• « previous
• 1
• 2
• 3