08 November 2013

Risk metrics and airport security

'Cost-Benefit Analysis of Australian Federal Police Counter-Terrorism Operations at Australian Airports' (ARC Centre of Excellence in Policing & Security Working Paper 2013) by Mark G. Stewart and John Mueller [PDF] is a paper that crunches some numbers about security theatre,  recommends the standard nostrums of identity imaging (ANPR, cards, CCTV and so forth) and can be read subversively in debunking fashionable hyperbole from particular politicians and agencies.

The authors comment that
The terrorist attacks of 11 September 2001 highlighted the vulnerabilities of airports and aircraft. Further attacks in 2002, 2007 and 2009, have led to major government reforms in passenger processing and airport access. The security of Australian airports has also followed this trend, with an increased police presence. However, limited consideration has been given to the costs of these measures, compared to benefit. This Working Paper identifies the factors to be considered in such cost-benefit analyses and the authors outline their preliminary findings. The scope for further research is highlighted, particularly in relation to risk analysis and cost.
The authors state that
Much research on aviation security focuses on airplanes due no doubt to the events of September 11 2001 and to the more recent attempts to bomb U.S. bound flights in 2002, 2006 and 2009. However, Elias (2010) notes that an airport has ‘unique vulnerabilities because it is unsecured’. There is little information about whether airport security satisfies a cost-benefit assessment, or how airport policing can be made more effective. The Australian Office of Best Practice Regulation, U.S. Office of Management and Budget, and other regulatory agencies strongly recommend risk and cost-benefit assessments of major programmes. A risk and cost-benefit assessment quantifies risk reduction of security measures, losses from a successful attack, threat likelihood, probability that attack is successful, and cost of security measures. This allows costs and benefits of security measures to be compared and optimal security measures to be selected. This Working Paper seeks to assess the risks and cost-effectiveness of Australian Federal Police (AFP) airport counter-terrorism (CT) policing designed to protect airport terminals and aircraft from terrorist attack. 
They conclude
If the annual threat probability at all airports in Australia is less than 1% (or one in a hundred) the BCR [benefit to cost] for airport CT policing is significantly less than one, and the security measure consequently fails to be cost-effective by a considerable margin. However, a threat probability of 50% (or one attack every two years) would yield a BCR of 15.8 and airport CT policing would be cost-effective under that condition, and $1 of cost would buy $15.80 in benefits. Table 3 shows that airport CT policing would also be cost-effective when the annual threat probability exceeds 5% or one attack every 20 years - that is, it would have to be solely responsible for deterring, foiling, or protecting against one threat every twenty years for the security measures to be cost-effective. It also needs to be kept in mind that many threats against the aviation industry would be deterred, foiled or prevented by other (non airport) police and security measures (as well as by public awareness and response, etc.). ... The co-benefit of CT airport policing may well exceed $25 million per year, particularly if CT airport policing is able to utilise number plate recognition capability, passenger photograph identification and other measures to apprehend people with outstanding criminal issues. If a security measure also enhances the passenger experience, there would be an additional co-benefit, dramatically improving the measure’s cost-effectiveness. ....
This Working Paper sets out the basic principles of risk and cost-benefit analysis. These principles are applied to airport CT policing provided by the AFP. The results are preliminary, and based on our ‘best estimates’ using publicly sourced material, and are a starting point for this type of risk analysis. The preliminary results show the combinations of risk reduction and threat probability that allow airport CT policing to be cost-effective. For example, airport CT policing is costeffective if it reduces risk by approximately 25% and that the probability of an attack at any airport in Australia exceeds 5% per year. The co-benefits of airport CT policing - such as reduction in crime and reassurance to the travelling public - can be considerable, and will dramatically improve the costeffectiveness of airport CT policing. Further work should focus on more comprehensive threat scenarios; the layers of airport security, interactions and interdependencies; analysis of operational data on effectiveness of airport CT policing; and improved cost data, including co-benefits. The scope could be broadened to encompass all airport police, their rates of crime deterrence and prevention, and propose how airport policing may be made more effective/efficient by the use of other security measures, for example, number plate recognition capability and passenger photograph identification ID.
Send policemen, guns and money, in other words ... and stop along the way to follow up the authors' citation of their  ‘The Price is Not Right: The U.S. spends too much money to fight terrorism’ in (2011) 58(10) Playboy 149-150. Personally I preferred Mueller's Atomic Obsession: Nuclear Alarmism from Hiroshima to Al-Qaeda (Oxford University Press, 2010)