Cost-Effective Responses to Terrorist Risks in 

Constructed Facilities 

Robert E. Chapman and Chi J. Leng 

U.S. Department of Commerce 

Technology Administration 

National Institute of Standards and Technology

Office of Applied Economics 

Building and Fire Research Laboratory 

Gaithersburg, MD 20899 

NISTIR 7073
 

Cost-Effective Responses to Terrorist Risks in 

Constructed Facilities 

Robert E. Chapman and Chi J. Leng 

Sponsored by: 

National Institute of Standards and Technology 

Building and Fire Research Laboratory 

March 2004 

U.S. DEPARTMENT OF COMMERCE 

Donald L. Evans, Secretary 

TECHNOLOGY ADMINISTRATION 

Philip J. Bond, Under Secretary for Technology 

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 

Arden L. Bement, Jr., Director 

U.S. Department of Commerce 

Technology Administration 

National Institute of Standards and Technology

Office of Applied Economics 

Building and Fire Research Laboratory 

Gaithersburg, MD 20899 

NISTIR 7073
 
i

Abstract 

The September 11th attacks on the World Trade Center and the Pentagon and the 

potential for future terrorist attacks have changed the way the owners and managers of 

constructed facilities approach homeland security-related issues. 

This report presents a three-step protocol for developing a risk mitigation plan for 

optimizing protection of constructed facilities. This protocol helps decision makers 

assess the risk of their facility to damages from low-probability, high-consequence 

events; identify engineering, management, and financial strategies for abating the risk of 

damages; and use standardized economic evaluation methods to select the most costeffective combination of risk mitigation strategies to protect their facility. By using these 

economic evaluation methods, the owners and managers of constructed facilities can 

reduce the life-cycle costs associated with low-probability, high-consequence events. 

The development of a cost-effective risk mitigation plan is facilitated through the 

use of evaluation methods and software for implementing these methods. This report 

focuses on the development of a decision methodology covering step three of the 

protocol—the economic evaluation of alternative risk mitigation strategies—and a 

proposed software product for implementing the decision methodology. 

The decision methodology is based on the life-cycle cost method. This method is 

supported by a voluntary industry standard, ASTM E 917. Three additional standardized 

methods are employed to demonstrate how the use of multiple measures of economic 

performance enhances decision making. 

The report also includes information on a variety of disaster mitigation-related 

issues. These sections of the report provide guidance and insights for readers interested 

in learning more about ways in which economic analysis contributes to protecting 

constructed facilities against natural hazards and terrorist acts that occur infrequently, but 

result in devastating damages. 

Keywords 

Building economics; disaster mitigation; economic analysis; homeland security; lifecycle cost analysis; optimization; terrorism; risk assessment. 
ii
iii

Preface 

This study was conducted by the Office of Applied Economics in the Building and Fire 

Research Laboratory at the National Institute of Standards and Technology. The study 

develops a methodology for evaluating security-related investments and expenditures in 

constructed facilities. The intended audience is the National Institute of Standards and 

Technology as well as other government and private sector organizations that are 

concerned with evaluating how to efficiently allocate scarce financial resources among 

security-related investment alternatives. 

Disclaimer 

Certain trade names and company products are mentioned in the text in order to adequately specify the 

technical procedures and equipment used. In no case does such identification imply recommendation or 

endorsement by the National Institute of Standards and Technology, nor does it imply that the products are 

necessarily the best available for the purpose. 

Cover Photographs Credits 

Photograph of Washington Dulles International Airport courtesy of Loudoun County Department of 

Economic Development. Microsoft® Clip Gallery images used in compliance with Microsoft Corporation’s 

non-commercial use policy. 
iv
v

Acknowledgements 

The authors wish to thank all those who contributed so many excellent ideas and 

suggestions for this report. They include Dr. William Grosshandler of the Fire Research 

Division in the Building and Fire Research Laboratory (BFRL) at the National Institute 

of Standards and Technology (NIST), manager of BFRL’s Research and Development 

for the Safety of Threatened Buildings Program, for his technical guidance, suggestions, 

and support. Special appreciation is extended to Dr. Harold E. Marshall and Ms. Amy S. 

Rushing of BFRL’s Office of Applied Economics for their thorough reviews and many 

insights and to Mrs. J’aime L. Maynard for her assistance in preparing the manuscript for 

review and publication. Special thanks are due to each of the Steering Committee 

members—Ms. Janet S. Baum, Health, Education + Research Associates, Inc.; Mr. 

Robert N. Harvey, Washington Group Infrastructure Corporation; Mr. David Henry, U.S. 

Department of Commerce; Mr. Muthiah Kasi, Alfred Benesch & Company; Mr. Douglas 

N. Mitten, Project Management Services, Inc.; and Dr. Stephen R. Thomas, Construction 

Industry Institute—for their guidance throughout the production of this report. Special 

thanks are also due to Dr. Howard Kunreuther, Co-Director, Risk Management and 

Decision Processes Center, Wharton School, University of Pennsylvania, for his review 

and insights. The report has also benefited from the review and technical comments 

provided by Dr. Saul I. Gass and Dr. Howard K. Hung of NIST’s Information 

Technology Laboratory, Dr. Shyam Sunder, manager of BFRL’s Investigation of the 

World Trade Center Disaster, and Dr. Walter J. Rossiter, Jr., of BFRL's Materials and 

Construction Research Division. 
vi
vii

Contents 

ABSTRACT.......... ............................................................................................................... I

PREFACE............ ............................................................................................................. III

ACKNOWLEDGEMENTS......................................................................................................... V

LIST OF TABLES.... .............................................................................................................IX

LIST OF FIGURES .................................................................................................................. X

LIST OF EXHIBITS................................................................................................................ XI

LIST OF ACRONYMS ..........................................................................................................XIII

1 INTRODUCTION ........................................................................................................... 1 

1.1 Background....................................................................................................... 1 

1.2 Purpose.............................................................................................................. 1 

1.3 Scope and Approach ......................................................................................... 2 

2 RISK MITIGATION STRATEGIES ................................................................................... 7 

2.1 Engineering Alternatives .................................................................................. 8 

2.2 Management Practices .................................................................................... 10 

2.3 Financial Mechanisms .................................................................................... 11 

2.3.1 Insurance.............................................................................................. 11 

2.3.2 Financial Incentives ............................................................................. 15 

2.3.2.1 Government Financial Incentives ......................................... 15 

2.3.2.2 Market-Based Financial Incentives....................................... 16 

3 A THREE-STEP PROTOCOL FOR CREATING A RISK MITIGATION PLAN...................... 19 

3.1 Risk Assessment ............................................................................................. 19 

3.1.1 Software-Based Risk Assessment........................................................ 20 

3.1.2 Risk Assessment Guidance Documents............................................... 20 

3.1.3 Qualitative Approaches to Risk Assessment ....................................... 23

3.1.4 Sources of Hazards Data...................................................................... 23 

3.2 Identification of Potential Mitigation Strategies............................................. 26 

3.2.1 Engineering Analysis........................................................................... 26 

3.2.2 Software-Based Engineering Analysis ................................................ 27 

3.3 Economic Evaluation...................................................................................... 29 

4 DECISION METHODOLOGY: CHOOSING THE MOST COST-EFFECTIVE RISK 

MITIGATION PLAN .................................................................................................... 31 

4.1 Types of Analysis ........................................................................................... 31 

4.1.1 Baseline Analysis................................................................................. 31 

4.1.2 Sensitivity Analysis ............................................................................. 32 

4.2 Overview of Evaluation Methods ................................................................... 32 

4.2.1 Life-Cycle Cost Method ...................................................................... 35 

4.2.2 Present Value of Net Savings .............................................................. 36 

4.2.3 Savings-to-Investment Ratio................................................................ 37 

4.2.4 Adjusted Internal Rate of Return ......................................................... 37 

4.2.5 Appropriate Application of the Evaluation Methods........................... 38 
viii

4.2.6 Applying the Evaluation Methods: A Case Study ............................... 40 

4.3 The Need for a Detailed Cost-Accounting Framework .................................. 47 

5 PROPOSED SOFTWARE PRODUCT FOR IMPLEMENTING THE DECISION 

METHODOLOGY ........................................................................................................ 53 

5.1 How the Software Links to the Cost-Accounting Framework........................ 53 

5.2 Cost Summary Window and Main Menu ....................................................... 54 

5.3 Project Information ......................................................................................... 55 

5.3.1 Input Costs ........................................................................................... 56 

5.3.2 Event-Related Costs............................................................................. 58 

5.3.3 Alternative-Specific Feature: The Edit Costs/Events Group Box ....... 62 

5.4 Output Reports................................................................................................ 62 

5.5 Analysis Features and Software Rollout......................................................... 63 

6 ADDITIONAL CONSIDERATIONS OF RISK MITIGATION DECISIONS............................. 65 

6.1 Decision Making for a Single Building .......................................................... 65 

6.2 Organization-Wide Decision Making............................................................. 66 

6.2.1 Collocated Structures or Campuses ..................................................... 66 

6.2.1.1 Collocated, Interconnected Structures ................................... 67 

6.2.1.2 Collocated, Independent Structures ....................................... 67 

6.2.2 Geographically Distributed Structures................................................. 68 

6.2.2.1 Geographically Distributed, Interconnected Structures......... 68 

6.2.2.2 Geographically Distributed, Independent Structures............. 68 

6.3 Social Welfare Considerations........................................................................ 69 

7 SUMMARY AND SUGGESTIONS FOR FURTHER RESEARCH.......................................... 71 

7.1 Summary......................................................................................................... 71 

7.2 Suggestions for Further Research ................................................................... 72 

7.2.1 Decision-Making Under Uncertainty................................................... 72 

7.2.2 Financial Incentives ............................................................................. 72 

7.2.3 Sequential Investment Decisions ......................................................... 73 

7.2.4 Multiattribute Decision Analysis ......................................................... 73 

APPENDIX A: A NATION AT RISK ...................................................................................... 75 

A.1 Constructed Facilities at Risk ......................................................................... 75 

A.2 Risks, Hazards, and Consequences................................................................. 78 

A.2.1 A Classification of Hazards ................................................................. 80 

A.2.2 Three Dimensions of Hazards.............................................................. 80 

A.2.3 Examples and Illustrations................................................................... 81 

A.2.3.1 Natural Hazards..................................................................... 82 

A.2.3.2 Accidents............................................................................... 83 

A.2.3.3 Sabotage................................................................................ 83 

A.2.3.4 Terrorism............................................................................... 83
ix

APPENDIX B: PROCESS FOR IDENTIFYING AND CLASSIFYING BENEFITS AND COSTS.......... 85 

B.1 Identification of Key Stakeholders ................................................................. 85 

B.2 Classification of Benefits and Cost Savings Derived from the Use of 

Mitigation Strategies................................................................................. 86 

B.3 Classification of Costs and Benefit Reductions Associated with Risks or 

the Use of the Mitigation Strategies.......................................................... 91 

B.4 How Benefits and Costs Accrue to Stakeholders ........................................... 93 

APPENDIX C: A NOTE ON CALCULATING THE SAVINGS-TO-INVESTMENT RATIO .............. 99 

APPENDIX D: THEORETICAL FOUNDATIONS OF RISK MITIGATION DECISIONS................. 103 

D.1 Model 1: Choosing Engineering Alternatives for Risk Mitigation............... 104 

D.2 Model 2: Choosing Engineering Alternatives and Management Practices 

for Risk Mitigation........................................................................................ 111 

D.3 Model 3: Choosing Engineering Alternatives, Management Practices, and 

Financial Mechanisms for Risk Mitigation................................................... 113 

D.4 Model 4: Choosing Multi-period Engineering Alternatives, Management 

Practices, and Financial Mechanisms for Risk Mitigation ........................... 116 

APPENDIX E: SUBSTITUTION IMPLICATIONS OF RISK MITIGATION ACTIVITIES................ 119 

APPENDIX F: GLOSSARY OF TERMS ................................................................................. 123 

REFERENCES...... ............................................................................................................ 129 

List of Tables 

Table 2-1 Annual Value of Construction Put in Place: 1998 to 2002...........................13

Table 2-2 Annual Percent Change in Value of Construction Put in Place: 1999 

to 2002 ..........................................................................................................13

Table 3-1 Potential Risk Mitigation Strategies .............................................................29

Table 4-1 Summary of Appropriateness of Each Standardized Evaluation Method 

for Each Decision Type ................................................................................40

Table 4-2 Summary Statistics Due to Changes in All of the Variables ........................45 

Table 4-3 Summary of Life-Cycle Costs for the Data Center Case Study....................51

Table A-1 Proposed Classification of Constructed Facilities ........................................76 

Table A-2 Critical Infrastructure and Assets in the United States: 2003.......................77 
x

Table A-3 Constructed Facilities at Risk: 1998, 1999 ...................................................78 

Table A-4 Responsiveness Classification of Hazards....................................................81

Table B-1 Hierarchy of Stakeholders by Groups and Classes of Individual 

Stakeholders..................................................................................................87

Table B-2 Hierarchy of Customers by Groups and Individual Customers....................88

Table B-3 Classification of Benefits and Cost Savings Derived from the Use of 

Mitigation Strategies.....................................................................................89

Table B-4 Classification of Costs and Benefit Reductions Associated with Risks 

or the Use of Mitigation Strategies ...............................................................92

Table B-5 Types of Benefits (or Cost Savings) Classified by Stakeholder Group........95 

Table B-6 Types of Costs (or Benefit Reductions) Classified by Stakeholder Group ..97 

Table E-1 Level of Damage Due to Terrorist Attack ..................................................121 

List of Figures 

Figure 4-1 Life-Cycle Costs for Each Alternative in Thousands of Dollars Due 

to Changes in All of the Variables............................................................ 46 

Figure 4-2 Overview of the Cost-Accounting Framework: Dimensions and Cost 

Types......................................................................................................... 48 

Figure 5-1 Cost Summary Window When Starting a New Project............................ 54 

Figure 5-2 Project Description Window for the Data Center Case Study.................. 55 

Figure 5-3 Edit Costs/Events Window for the Data Center Case Study: Input 

Costs for the Base Case............................................................................. 57 

Figure 5-4 Capital Investment Cost Information Window for the Data Center 

Case Study: Basic Renovation.................................................................. 57 

Figure 5-5 Other Cost Information Window for the Data Center Case Study: 

Change in Traffic Pattern for the Proposed Alternative ........................... 58 

Figure 5-6 Event Information Window for the Data Center Case Study: 

Description of the Cyber Attack Scenario for the Base Case ................... 59 
xi

Figure 5-7 Edit Outcomes/Outcome Costs window for the Data Center Case 

Study: Base Case Cyber Attack Outcomes............................................... 60 

Figure 5-8 Outcome Information Window for the Data Center Case Study: 

Probability Information for the Base Case Cyber Attack Scenario .......... 60 

Figure 5-9 Event/Outcome Cost Information Window for the Data Center Case 

Study: Identity Theft Cost Item for the Base Case Cyber Attack 

Scenario..................................................................................................... 61 

Figure 5-10 Cost Summary Window for the Data Center Case Study......................... 63

Figure A-1 Classification of Hazards by Responsiveness to Mitigation..................... 82 

Figure D-1 Change in Exceedance Probability in Response to Increase in Total 

Value of the Facility................................................................................ 109 

Figure D-2 Change in Exceedance Probability in Response to Increase in Level 

of Protective Capital ............................................................................... 110 

Figure E-1 Building Protection and Substitution Toward Soft Targets.................... 120 

List of Exhibits 

Exhibit 4-1 Summary of the Data Center Case Study ................................................. 43
xii
xiii

List of Acronyms 

AACE Association for the Advancement of Cost Engineering, International 

AIRR adjusted internal rate of return 

ALOHA Areal Locations of Hazardous Atmospheres 

AMA American Management Association 

ANSS Advanced National Seismic System 

ASME American Society of Mechanical Engineers 

ASTM American Society for Testing and Materials, International 

BFRL Building and Fire Research Laboratory 

CATS-JACE Consequence Assessment Tool Set-Joint Assessment of Catastrophic 

Events 

CBECS Commercial Buildings Energy Consumption Survey 

CBRE chemical, biological, radioactive, and explosive 

CBW chemical and biological weapons 

CCTV closed-circuit television camera 

CERF Civil Engineering Research Foundation 

CFD computational fluid dynamics 

CII Construction Industry Institute 

COTS commercial off-the-shelf 

DFIRMs Digital Flood Insurance Rate Maps 

DOD Department of Defense 

DOE Department of Energy 

DTRA Defense Threat Reduction Agency 

FAA Federal Aviation Administration 

FBI Federal Bureau of Investigation 

FDS Fire Dynamics Simulator 

FEMA Federal Emergency Management Agency 

FIRMs Flood Insurance Rate Maps 

FIS Flood Insurance Study 

FY fiscal year 

GAO General Accounting Office 

GIS geographic information systems 

GSA General Services Administration 

HAZUS Hazards U.S. 

HAZUS-MH Hazards U.S. Multi-Hazard 

HE high-explosive 

HPAC Hazard Prediction and Assessment Capability 

HVAC heating, ventilation, and air-conditioning 

III Insurance Information Institute 

ISO International Organization for Standardization 

K-12 kindergarten through 12th grade 

LCC life-cycle cost 

MARR minimum acceptable rate of return 

MECS Manufacturing Energy Consumption Survey 

MSA metropolitan statistical area 
xiv

NBC nuclear, biological, and chemical 

NEIC National Earthquake Information Center 

NFIP National Flood Insurance Program 

NIBS National Institute of Building Sciences 

NIST National Institute of Standards and Technology 

NTSB National Transportation Safety Board 

OAE Office of Applied Economics 

O&M operations and maintenance 

PVNS present value of net savings 

RAMPART Risk Assessment Method—Property Analysis and Ranking Tool 

RMS Risk Management Solutions, Inc. 

ROI return on investment 

SAVE Society of American Value Engineers, International 

SIR savings-to-investment ratio 

SPV single-point vulnerability 

TISP The Infrastructure Security Partnership 

TRIA Terrorism Risk Insurance Act of 2002 

USGS U.S. Geological Survey 

WMD weapons of mass destruction 
1 

1 Introduction 

1.1 Background 

The September 11, 2001 attacks on the World Trade Center and the Pentagon, and 

the subsequent dispersion of anthrax through the postal system, have changed the way 

many in the United States approach security and safety. Human losses from the events of 

September 11th were 2 749 fatalities at the World Trade Center site, 189 fatalities at the 

Pentagon, and 44 passenger and crew fatalities at the Pennsylvania plane crash site. In 

addition, numerous individuals at these locations sustained serious injuries. In the weeks 

following the September 11th attacks, the spread of inhalation anthrax through the postal 

system caused the deaths of five individuals among the confirmed cases of the disease, as 

well as expenditures of almost $1 billion to test for, remediate, and prevent anthrax 

contamination.1

 Additional information on the tragic events of September 11th and other 

natural and man-made disasters is presented in Appendix A. 

These events have prompted the owners and managers of constructed facilities2

 to 

address terrorist risks and protect the occupants, property, and functions of their facilities. 

Future attacks could result in harm to occupants; physical damage to buildings, industrial 

facilities, and infrastructure; business interruptions; and financial losses. 

These realities have led to changes in the way key decision makers respond to the 

risk of terrorist attacks. Among these changes are the way that owners and managers 

think about the design, location, construction, management, and renovation of buildings, 

industrial facilities, and infrastructure. The range of responses available to decision 

makers is extensive, as is the potential expense. Parallel to the reality of the risks is the 

reality of budget constraints. Owners and managers of constructed facilities are 

confronted with the challenge of responding to potential terrorist attacks in a financially 

responsible manner. The two objectives—safeguarding assets and satisfying financial 

constraints—must be balanced through cost-effective responses to terrorist risks. 

1.2 Purpose 

This report is the second in a series about the application of economic evaluation 

methods to the security of constructed facilities.3

 The purpose of this report is to describe 

 

1

 Information on World Trade Center fatalities is from Lipton (Lipton, Eric. “New York Settles on a 

Number That Defines Tragedy: 2,749 Dead in Trade Center Attack,” New York Times, January 23, 2004, p. 

B7). Information on non-World Trade Center facilities is from Hartwig (Hartwig, Robert. “The Long 

Shadow of September 11: Terrorism and Its Impacts on Insurance and Reinsurance Markets,” July 2002, 

http://server.iii.org/yy_obj_data/binary/687221_1_0/sept11.pdf). Information about consequences of 

anthrax contamination is from the United States Postal Service (U.S. Postal Service. 2001 Comprehensive 

Statement on Postal Operations, 2001, p. 76) and Gugliotta and White (Gugliotta, Guy and White, Ben. 

“Tests Clear Home, Mail of Anthrax Victim,” Washington Post, November 24, 2001, p. A1). 2

 The term “constructed facilities,” as used in this report, includes buildings, industrial facilities, and 

infrastructure (see Table A-1 in Appendix A for a proposed classification of constructed facilities). 3

 The first report demonstrates how to apply life-cycle cost analysis to a complex homeland security 

investment decision (Chapman, Robert E. Applications of Life-Cycle Cost Analysis to Homeland Security 

Issues in Constructed Facilities: A Case Study. NISTIR 7025 (Gaithersburg, MD: National Institute of 

Standards and Technology, 2003).). 
2 

economic evaluation methods for cost-effectively allocating limited resources to 

implement mitigation strategies to reduce personal harm, financial losses, and property 

damage. Given these limited resources in the face of numerous vulnerabilities and 

potential strategies, a tool to aid decision makers to prioritize and plan for protective 

measures is essential. Economic evaluation methods will enable key decision makers—

the intended customers4

—to produce a risk mitigation plan that responds to the potential 

for terrorist attacks in a financially responsible manner. By using economic evaluation 

methods to promote more informed decisions, both intended customers and other 

stakeholders will benefit from reduced exposure to terrorism-related losses. 

1.3 Scope and Approach 

To address terrorism threats, we propose an approach based on three risk 

mitigation strategies: (1) engineering alternatives; (2) management practices; and (3) 

financial mechanisms. How each of these mitigation strategies is integrated into a 

cohesive and practical risk mitigation plan is a complex decision problem. In order to 

make efficient decisions about protective measures, owners and managers of constructed 

facilities require information about threats and vulnerabilities and the effectiveness and 

cost of protective measures. Decision makers also require a method for processing this 

information to yield a cost-effective risk mitigation plan. 

This report presents a three-step protocol for developing a cost-effective risk 

mitigation plan for constructed facilities. This protocol helps users determine the 

vulnerability of their facility to damages from low-probability, high-consequence events; 

identify engineering, management, and financial strategies for abating the risk of 

damages; and use standardized economic evaluation methods to select the most costeffective package of risk mitigation strategies to protect their facility. By using these 

economic evaluation methods, owners and managers can reduce the life-cycle costs 

associated with terrorism. These life-cycle costs include initial investment, operations 

and maintenance costs, expected losses due to terrorist or other uncertain hazards, and 

other costs, such as disposal costs. Financial incentives to invest in protective measures, 

such as government grants, subsidies or cost sharing, also factor into the investment 

decision. 

Creating a risk mitigation plan is complicated because investments often result in 

significant but infrequent lump-sum outlays; operations and maintenance costs are 

distributed over a period of many years; and costs affect stakeholders in different ways. 

These cost considerations introduce four complicating factors into the capital asset 

decision-making process: (1) Which mitigation strategies should we employ and how 

will they operate, both singly and in combination? (2) How do we produce a risk 

mitigation plan that demonstrates superior economic performance? (3) How do owners 

and managers of multiple properties identify which constructed facilities to protect and 

why? (4) Who bears which costs? To address these questions, a formal methodology is 

needed to insure that all relevant costs are captured and analyzed using well-defined 

 

4

 Customers are the intended users of the economic tools; they are either directly or indirectly empowered 

to decide which combination of mitigation strategies to employ. Stakeholders are organizations or 

individuals affected by mitigation activities or disaster-related losses. Therefore, customers are a subset of 

stakeholders. 
3 

metrics to identify an economically superior risk mitigation plan. Life-cycle cost analysis 

and the related economic methods covered in this report provide those metrics. 

To implement the economic evaluation methods proposed in this report, the 

Office of Applied Economics (OAE) in the Building and Fire Research Laboratory 

(BFRL) at the National Institute of Standards and Technology (NIST) intends to produce 

a software product as a companion to this report. Embedded in this user-friendly, 

decision-support software will be a methodology based on well-established economic 

evaluation methods. The software will help the owners and managers of constructed 

facilities make choices to reduce expected losses due to terrorism and other hazards. The 

decision support software tool will be used with risk, threat, vulnerability, and 

consequence assessments to construct responses to terrorist threats. 

This report contains six chapters and six appendices in addition to the 

Introduction. The chapters treat the core topics, and the appendices add in-depth 

elaboration in support of the chapters. The reader may refer to the appendices when you 

want to know more about a given topic. 

Chapter 2 describes three types of risk mitigation strategies: engineering 

alternatives, management practices, and financial mechanisms. Engineering alternatives 

are design, material, or component choices in the construction or renovation of 

constructed facilities, their systems, or their subsystems. Management practices include 

the security, training, communications, and emergency procedures that an organization 

establishes and implements to prevent or respond to terrorist attacks. Decisions about 

facility location as well as access to its systems are also management tools. Financial 

mechanisms are another set of devices that facility owners and managers can utilize to 

reduce their exposure to terrorism risk. They include purchase of insurance policies and 

responding to external financial incentives to engage in engineering-based or 

management-based risk mitigation. Examples of such financial incentives are 

government subsidies for investments to harden a facility or rental premiums paid by 

tenants who value the facility’s added safety features. 

Chapter 3 describes a three-step protocol for creating a risk mitigation plan: risk 

assessment, identification of potential mitigation strategies, and economic evaluation of 

risk mitigation alternatives. It describes the risk assessment that facility owners and 

managers must conduct to characterize the threats to a facility as well as identify its 

vulnerabilities and areas of criticality. Once owners and managers assess the risk of 

terrorism to the constructed facility, they must identify potential strategies to mitigate this 

risk. The identification includes potential risk mitigation measures and predictions of the 

effectiveness of these measures. The final step in the protocol for creating a risk 

mitigation plan is economic evaluation of the risk mitigation alternatives. The finalized 

plan describes the most cost-effective combination of mitigation strategies 

Chapter 4 presents the decision methodology which provides the technical basis 

for the economic evaluation of risk mitigation alternatives. The decision methodology is 

based on two types of analyses, four standardized economic evaluation methods,5

 and a 

cost-accounting framework. The chapter also includes a discussion of how to identify, 

classify, and estimate on a year-by-year basis the key benefits and costs entering into the 

 

5

 ASTM International. ASTM Standards on Building Economics (West Conshohocken, PA: ASTM 

International, 1999). 
4 

economic evaluation. The two types of analysis—baseline analysis and sensitivity 

analysis—are designed to complement and reinforce each other. The baseline analysis 

serves as a reference point for the sensitivity analysis. The sensitivity analysis provides 

the means for evaluating financial risks associated with a wide variety of project-related 

costs. Together they provide the necessary insights to produce the risk mitigation plan. 

The four economic evaluation methods—life-cycle cost, present value of net savings, 

savings-to-investment ratio, and adjusted internal rate of return—are designed to cover a 

wide spectrum of investment decisions. The focus of this report is on the life-cycle cost 

method. Guidance is given, however, on applying the other three methods and on how 

the use of multiple measures of economic performance enhances decision making. The 

chapter concludes with a discussion of how the cost-accounting framework facilitates the 

decision-making process by identifying unambiguously who bears which costs, how costs 

are allocated among several widely-accepted budget categories, and how costs are 

allocated among key building components and the three types of risk mitigation 

strategies. 

Chapter 5 describes the proposed software product. The software will implement 

the economic evaluation methods described in Chapter 4. The material presented in 

Chapter 5 includes screen shots from the forthcoming beta version of the software 

product scheduled for public release in September 2004. The chapter describes how the 

software product makes use of the cost-accounting framework and illustrates the linkage 

between the software product and the framework through reference to a series of data 

input screens. 

Chapter 6 describes several decision-making scenarios for risk mitigation 

planning under varying conditions of ownership. It describes considerations for 

protecting a single facility; multiple collocated structures (including both interconnected 

and independent facilities) that share an owner; and geographically distributed structures 

belonging to the same owner. The various decision-making scenarios give rise to 

different criteria for the allocation of protective resources among the constructed 

facilities. 

Chapter 7 concludes with a discussion of areas for future research. 

Appendix A expands upon the material presented in Section 1.1 by presenting an 

inventory of the constructed facilities at risk in the United States as well as the risks, 

hazards, and consequences that these facilities face. Included in the discussion of these 

risks is a proposed classification of hazards according to the responsiveness of different 

dimensions of hazards to risk mitigation measures. The dimensions of each hazard are: 

probability of an event; type or magnitude of an event; and shift in the risk of an event. 

This classification is intended to characterize and highlight some indirect effects that risk 

mitigation measures may have on the overall risk posed by these hazards. 

Appendix B builds on two topics introduced in Chapter 4, the identification and 

classification of benefits and costs. Appendix B develops hierarchies of benefits and 

costs and relates them to a hierarchy of stakeholders. These hierarchies provide 

important linkages between the economic evaluation methods and the cost-accounting 

framework. The appendix also includes a “priority setting” procedure that facilitates the 

collection of the types of data needed to generate the year-by-year estimates used as 

inputs to the economic evaluation methods. 
5 

Appendix C augments the Chapter 4 description of the savings-to-investment ratio 

method by addressing cases in which the decision criterion presented in Section 4.2.3 

needs to be qualified. 

Appendix D uses four analytical models to provide the theoretical foundations for 

the single facility risk mitigation decision-making scenarios described in Chapter 6. The 

first model presents and describes the economic optimization conditions for investment in 

engineering alternatives in a single period. The second and third models allow for 

expenditures to implement management practices and financial mechanisms, 

respectively, in each period of the study period. The fourth model describes the optimal 

allocation of resources over time when investments in engineering alternatives as well as 

expenditures for management practices and financial mechanisms are allowed in multiple 

time periods. 

Appendix E presents a simple economic representation of the negative 

externalities that arise when some, but not all, facility owners and managers implement 

risk mitigation plans. When a facility owner or manager implements a risk mitigation 

plan that is observable to a potential attacker, it may reduce the probability that the newly 

protected facility will suffer a terrorist attack. The added protection may, however, lead 

to a transfer of this risk to other facilities that did not receive observable security 

upgrades (i.e., perceived “soft” targets). 

Appendix F contains a glossary of terms that will be helpful in understanding and 

implementing the three-step protocol. 
6 
7 

2 Risk Mitigation Strategies 

The focus of this report is the cost-effective use of strategies to mitigate the risk 

of terrorism to constructed facilities. We examine three types of risk mitigation strategies 

available to building owners and managers to accomplish this goal: (1) engineering 

alternatives; (2) management practices; and (3) financial mechanisms. Each of these 

mitigation strategies may complement the other two to achieve the broad objectives of 

building owners and managers to reduce injuries, fatalities, property damage, loss of use, 

and business interruptions due to terrorist incidents.6

The objectives of the risk mitigation strategies are to: 

1. Detect security breaches. Detection measures are intended to alert building 

officials to attempted breaches before they occur (or just as they are occurring). 

Detection may allow building security or other personnel to prevent the attack, 

delay or avert its full effects, or capture the attackers. Examples of possible 

detection measures are closed-circuit television (CCTV) cameras, alarms, motion 

or thermal sensors, x-ray machines, metal detectors, and security patrols. These 

measures may be evident or inconspicuous, and may incur one-time or recurring 

costs. 

2. Deter terrorists from attacking. Mitigation can deter an attack by increasing 

either the resources potential attackers need to inflict a given level of damage to 

the facility or the probability of being thwarted or apprehended. Mitigation may 

deter terrorist attacks by making the terrorists’ objectives more difficult, 

dangerous, or costly to achieve.7

 Deterrents are most effective when they are 

obvious, whereas other measures may be most effective when they are 

undetectable or secret.8 Examples of deterrents are controlled access points, 

security personnel, and physical perimeter controls such as concrete barriers or 

tire shredders. 

3. Protect the facility if an attack occurs. Hardening and reinforcing the building 

skin, creating redundancies in critical systems, and increasing setback distances 

are some examples of protective measures. Included in this category are 

measures designed to contain or delay the attack or the onset of its consequences, 

 

6

 Each type of strategy may also be used to offset inadequacies or constraints on the use of the other two. 

For example, a building in an urban setting may be located on a busy street with a setback of only several 

yards or meters. Physical restrictions on an existing building may prevent the building owner or manager 

from increasing the setback to reduce the building’s vulnerability to a bomb attack. To counterbalance the 

owner’s or manager’s inability to use the management practice of building location in their risk mitigation 

plan, they may instead rely on engineering alternatives to reduce this vulnerability, such as by reinforcing 

existing beams and columns or installing more shatter-resistant laminated safety glass. 

7

 Deterrence partially depends on the desire of the attacker to escape and survive. For attackers 

unconcerned with their survival or escape after an attack, the deterrent effect of engineering alternatives 

that may increase their risk of capture may be negligible. Measures that make a breach more difficult may 

still have deterrent effect. 

8

 It is possible that the existence of security measures may embolden potential terrorists, if a successful 

breach is perceived as a demonstration of the terrorist organization’s capabilities. In this case, introducing 

security measures may increase the probability of an attack, even if an attempted attack on a strongly 

defended target may entail greater risks, higher costs, or alteration to a plan of action on the part of the 

terrorists. See Drake (Drake, C.J.M. Terrorists’ Target Selection (London: Macmillan Press, Ltd, 1998)), 

pp. 111-112. 
8 

to “buy time” to activate countermeasures, or to implement damage controls. 

Two examples of such measures are automatic depressurization of a room where 

airborne contaminants are detected to prevent or reduce the spread of the 

contaminants to other areas, and installation of bulletproof wallboard to protect 

against shrapnel and other projectiles caused by an explosion. 

4. Apprehend transgressors. These measures help onsite security or law 

enforcement personnel apprehend individuals attempting or committing a security 

breach. Examples of these resources are trained security personnel, use of attack 

dogs, video surveillance, searchlights, and sealed corridors or other exit controls. 

5. Recover and restore operations and the mission of the facility. Building in 

system redundancies, establishing sheltering procedures, stocking shelters with 

emergency provisions and first aid, and diversifying the locations of critical 

facilities and systems are examples of measures that building owners and 

managers can take to improve survival and facilitate a facility’s recovery. 

Some strategies may serve multiple objectives. Measures designed to deter 

attempted attacks could help detect breaches, protect the building, or apprehend the 

transgressors. Such measures contribute to the overall risk mitigation effort throughout 

the timeline of an emergency: deterrence and detection prior to an attack, protection 

during an attack, and apprehension and recovery after an attack. 

While the goals of risk mitigation strategies may be detection, deterrence, 

protection, apprehension, and recovery and restoration, the measures to achieve them 

may affect existing objectives of constructed facilities. These effects may be 

countervailing. The potential for competing objectives may be greatest in the area of fire 

safety. Exit controls designed to impede an attacker’s escape after a breach, for example, 

may also impede occupants from evacuating a building or emergency first responders 

from entering during a fire hazard. In another example, concrete bollards placed around a 

building to increase its setback may become shrapnel if a bomb explodes nearby. On the 

other hand, measures such as employee evacuation drills may serve parallel objectives 

and contribute to fire safety efforts. Where competing objectives exist and are 

unavoidable, the tradeoffs may be evaluated through probabilistic scenario development, 

multiattribute analysis, and other analysis methods. 

2.1 Engineering Alternatives 

Engineering alternatives are one approach for building owners and managers to 

mitigate losses from disasters. They are technical options in the construction or 

renovation of constructed facilities, their systems, or their subsystems to reduce the 

likelihood or consequences of disasters. Engineering alternatives are actualized through 

designs, materials, and components. 

Detection is one objective of engineering alternatives. Examples of engineering 

alternatives intended to detect illicit activities are heating, ventilation, air-conditioning 

(HVAC) sensors to detect airborne contaminants; thermal sensors to detect body heat or 

motion (or occupancy) sensors in areas that are typically unoccupied; X-ray equipment in 

mail rooms and building entrances; and metal detectors at building entrances. 
9 

Second, engineering alternatives may be intended to deter terrorists from 

attempting an attack on the facility by increasing the risk to the terrorist of being 

detected, captured, or thwarted. Measures that deter terrorists from attacking a building 

reduce the probability of an attack on that building, but may cause terrorists to go 

elsewhere. For engineering alternatives to be effective at deterring terrorist attacks, they 

must be visible. Examples of such alternatives are high-elevation air intake units, CCTV 

cameras, or sprinkler systems.9

Finally, engineering alternatives may be used to protect against terrorist threats. 

Protective engineering alternatives are intended to reduce harm to occupants, damage to 

the structure, and disruption of business if a terrorist attack occurs. Protective 

engineering alternatives may improve the structural integrity of a building, facilitate 

evacuation of occupants, or circumvent compromised systems. For example, use of 

laminated safety glass, reinforced or additional structural columns, fire-resistant 

materials, and increased floor loads would enable a building to better withstand an attack 

of conventional explosives. Tire shredders used in conjunction with a long setback 

distance from vehicle-accessible areas would reduce the blast effects of explosives on the 

building and its occupants. Installation of additional stairwells and building exits may 

expedite occupant evacuation, facilitate access for emergency and rescue personnel, and 

improve survival. Improvements to HVAC systems and operations, such as isolation or 

negative pressurization of mail rooms, loading docks, lobbies, or other vulnerable or 

critical areas; improved filtration and air cleaning; ability to purge recirculated indoor air 

with fresh air; air quality sensors; and compartmentalized (such as floor-by-floor) air 

ventilation systems may improve the ability of building owners and managers to respond 

to and contain the losses from chemical or biological attacks. 

There is some overlap among engineering alternatives that deter, detect, and 

protect against terrorist attacks. Detection and protective engineering alternatives that are 

observable to potential terrorists may deter them from attacking. CCTV, for example, is 

designed to detect unauthorized activities, but its visibility may deter these activities. 

Risk mitigation strategies may also be hazard-specific. Reinforced building shell, 

shatter-resistant glass, and increased setback distances are examples of engineering 

alternatives that protect against high-explosive (HE) conventional blast. Building 

pressurization and improvements in HVAC systems and operations address chemical and 

biological hazards. Building structure, installation of sprinklers, and choice of materials, 

for example, address fire hazards. 

Engineering alternatives are also governed by state and local building codes. 

Well-enforced building codes require building owners and managers to use appropriate 

designs, safeguards, or materials that improve occupant survival during emergencies such 

as a terrorist attack. Numerous and unobstructed stairwells, for example, facilitate timely 

 

9

 Deterrence may not require the would-be terrorist to have specific knowledge about implementation of 

mitigation measures. Ayres and Levitt (Ayres, Ian, and Levitt, Steven D. “Measuring Positive Externalities 

from Unobservable Victim Precaution: An Empirical Analysis of Lojack,” Quarterly Journal of 

Economics, Vol. 113, No. 2, February 1998, pp. 43-77.) demonstrate this result in the context of Lojack and 

auto thefts. They assume that potential thieves do not know exactly which cars in a city are equipped with 

Lojack but do know the proportion of cars that have the device. Ayres and Levitt show that, even if 

potential thieves do not have specific knowledge of Lojack use in an area, the probability of auto theft falls 

when a higher proportion of automobiles are installed with Lojack. 
10 

occupant evacuation. Codes that specify the use of certain materials may protect a 

building from a blast. 

2.2 Management Practices 

Building owners and managers can use management practices to reduce their risk 

from terrorism. These management practices can be procedural or technical. Some 

practices relate to security, training, and communications. Others relate to location of the 

building and access to its systems and subsystems. Some management practices 

complement engineering alternatives, while others substitute for them. 

Security practices are the use of security personnel and procedures to prevent 

terrorist breaches from happening by detection or deterrence. They may be used to 

perform identification checks at building entrances, conduct background checks on 

individuals with access to sensitive areas and information, patrol facilities, and monitor 

CCTVs. Security personnel may also be used to capture attackers or facilitate recovery if 

a breach occurs. 

Training practices are used primarily to prepare responses to terrorist breaches. 

Building owners and managers may institute periodic emergency response drills for 

building occupants. These drills may include information about evacuation routes or 

sheltering procedures to improve survival during emergencies.10 Security and facility 

management personnel may receive training about proper techniques for responding to 

breaches and containing damage. Training may also be used for prevention: building 

security personnel and occupants may be trained in detection of suspicious activities and 

notification procedures. 

Building owners and managers may also develop and implement communications 

practices to coordinate responses with emergency personnel and to relay information and 

instructions to occupants during emergencies. Communications practices include setting 

up emergency phone numbers or instituting building-wide audio or e-mail broadcast 

mechanisms. Coordinated communications can play a key role in occupant safety. For 

example, according to The New York Times, after the North Tower of the World Trade 

Center was struck on September 11, 2001, there was confusion in the South Tower about 

whether to evacuate, which led some occupants of upper floors who had begun to 

descend the stairs to return to their offices.11 Building owners and managers can develop 

communications procedures to coordinate with first responders, security staff, and other 

emergency personnel responding to the incident. Finally, communications practices can 

be used by firms occupying the building to facilitate recovery, assess consequences, and 

minimize disruptions to the organization’s mission or business. 

Another management practice available to building owners and managers relates 

to the building structure. Decisions concerning location (such as within the country, 

region, or city) come into play for new construction and for acquisitions of existing 

buildings. Setback distances, which have effects that are interdependent with some 

engineering alternatives, are a component of the management decision about location. 

 

10 Hays, Constance L. “As Important as the Corporate Disaster Plan Is How Fast the Employees Carry It 

Out,” New York Times, September 12, 2001, p. C10. 11 Moss, Michael and Bagli, Charles V. “Instincts to Flee Competed with Instructions to Remain,” New 

York Times, September 13, 2001, p. A6. 
11 

For new construction, managers may choose a site within a lot that satisfies a minimum 

setback distance. When acquiring existing property, managers may make a choice based 

on the physical characteristics of the available properties. Other structure-related 

management decisions concern access to the building itself and its sensitive areas. These 

access areas include attached garages, mail rooms, loading docks, side entrances, 

connected buildings, driveways, and rooftops, for example. Sensitive areas include 

rooms housing HVAC equipment, sensors, and controls; servers, network connections, 

and other information technology (IT) assets; and CCTV monitoring equipment. 

Emergency preparation is another management practice to reduce terrorist risk. 

Some preparations are intended to improve survival: establishing evacuation assembly or 

shelter areas, appointing evacuation coordinators, stockpiling essential supplies and 

provisions in shelters, and ensuring redundant electrical and HVAC systems. Some 

preparations are intended to expedite recovery. These include system redundancies, data 

backups, and remote facilities.12 Although such preparations come into play only if an 

emergency occurs, they may be critical to the survival of occupants and the recovery of 

organizations housed in the facility. 

2.3 Financial Mechanisms 

Building owners and managers can explore financial mechanisms to reduce their 

pecuniary risks from terrorism. There are two types of financial mechanisms to address 

risk mitigation: insurance and financial incentives. Building owners and managers may 

reduce their risk exposure to disasters by purchasing insurance for worker’s 

compensation, property damage, business interruptions, event cancellation, and liability. 

Financial incentives fall into two categories: government incentives and market-based 

incentives. 

Government incentives are explicitly designed public policy instruments that 

encourage decision makers to make certain choices over others. Market-based incentives 

reward decision makers for making some choices over others through private 

transactions. In the case of risk mitigation, these incentives are policies, measures, or 

characteristics that enhance the motivation of building owners and facility managers to 

implement risk mitigation measures in their buildings. 

2.3.1 Insurance 

Insurance is a financial mechanism that building owners and managers can pursue 

to reduce risk. While insurance against terrorist risk may be attractive to building owners 

to reduce exposure in the event of a terrorist attack, the provision of terrorism coverage in 

the period after the September 11th attacks was limited. Until the passage of the 

Terrorism Risk Insurance Act of 2002 (TRIA) in November 2002, terrorism exclusions 

were permitted in 45 states, the District of Columbia, and Puerto Rico.13 As of April 

 

12 Chapman, Robert E., Gass, Saul I., Filliben, James J., and Harris, Carl M. Evaluating Emergency 

Management Models and Data Bases: A Suggested Approach. NISTIR 88-3826 (Gaithersburg, MD: 

National Institute of Standards and Technology, 1989). 

13 The legislation removed permissions for these exclusions. California, Florida, Georgia, New York, and 

Texas had not approved terrorism exclusions as of April 2002. 
12 

2002, only seven carriers offered stand-alone terrorism coverage for U.S. properties, with 

capacity limits per location ranging from $50 million to $500 million and deductibles for 

property damage between $5,000 and $50 million.14 The largely unregulated reinsurance 

industry, to which primary insurers turn to further diversify risk and which, by some 

estimates, bore two-thirds of the covered losses of the September 11th attacks, reduced its 

exposure to terrorism after September 11th by selectively excluding terrorism coverage, 

reducing limits, increasing pricing, and raising collateral requirements. The severe postSeptember 11th shortage of reinsurance against terrorism meant that, for insurers to 

provide their clients with the same amount of coverage they offered prior to September 

11th, they had to find capital from other sources. During the fall of 2001, it was not 

unusual for investors to require a return on investment (ROI) of 20 percent to invest in 

terrorism coverage. This requirement led many insurers to exclude terrorism as part of 

their commercial property policies.15

Other factors affecting the viability of insurance as a risk mitigation tool prior to 

passage of the TRIA include high premiums, cancellation clauses, and the absence of 

multi-year terms. Premiums, which were based on location, building security, and 

amount of coverage, ranged from 0.5 % to 1 % of the insured value. For some locations 

in New York City, however, premium amounts were as high as 10 % of the insured 

value. Some policies included clauses that allowed the insurer to cancel a policy with as 

little notice as 30 days, which opened the possibility of an insurer canceling policies 

when the terrorism climate worsened, such as during a period of heightened terror alert. 

Such cancellation clauses limited the time horizon of certainty for building owners to just 

one month. Lastly, the availability of only single-year policies was especially 

problematic for multi-year construction projects, many of which required three-year 

insurance policies for financing.16

The unavailability of insurance coverage, uncertainty of coverage, inadequate 

duration of insurance policies, and the high price of coverage in the marketplace shifted 

the preponderance of terrorism risk to building owners. The General Accounting Office 

(GAO) has cited anecdotal evidence of the effect of inadequate insurance capacity and 

high premiums on commercial construction lending and investment.17 The nonresidential construction sector experienced a slowdown during 2001 and 2002 (see Tables 

2-1 and 2-2). While the explanation may lie in the weak economy, it is possible that lack 

of insurance may have also played a role. During 2002, the real value of private nonresidential construction put in place fell 18.6 %, compared to a drop of 6.3 % in 2001. 

The industrial, office, and hotel/motel components of private non-residential construction 

 

14 The seven carriers were: Lloyd’s of London syndicates, American International Group, ACE USA, AXIS 

Specialty, Berkshire Hathaway, Endurance Re, and Renaissance Re. While the stated range of capacity 

limits is wide, more common per location limits were in the $5 million to $200 million range. See Betterley 

(Betterley, Richard S. “The Terrorism Coverage Market: Hope for Coverage in a Difficult Market,” The 

Betterley Report, April 2002). 15 Kunreuther, Howard, Michel-Kerjan, Erwann, and Porter, Beverly. “Assessing, Managing and Financing 

Extreme Events: Dealing with Terrorism,” NBER Working Paper 10179, December 2003. 16 Betterley, “The Terrorism Coverage Market,” p. 4. 

17 U.S. General Accounting Office. “Terrorism Insurance: Rising Uninsured Exposure to Attacks Heightens 

Potential Economic Vulnerabilities,” Testimony of Richard J. Hillman Before the Subcommittee on 

Oversight and Investigations, Committee on Financial Services, House of Representatives, February 27, 

2002. 
13 

were hardest hit. Industrial construction put in place fell by almost 45 % in 2002, more 

steeply than any other segment (compared to a 10.4 % drop during the year before). The 

value of office construction put in place declined in 2002 by over 29 %, compared to a 

smaller 9.3 % decline in 2001. The value of hotel and motel construction put in place fell 

over 30 % in 2002, compared to a decline of 14.3 % in 2001.18 

Table 2-1 Annual Value of Construction Put in Place: 1998 to 2002 

in Millions of Constant (1996) dollars 

1998 1999 2000 2001 2002 

Private Construction Nonresidential Buildings 177 644 173 429 178 074 166 852 135 764 

Industrial 37 720 29 206 27 194 24 358 13 475 

Office 39 333 42 552 47 534 43 126 30 536 

Hotels, motels 13 794 14 274 13 944 11 950 8 359 

Other commercial 49 915 50 870 51 635 50 077 45 404 

Religious 6 139 6 590 6 858 6 908 6 676 

Educational 9 039 8 621 9 726 10 371 10 434 

Hospital and institutional 12 853 12 102 12 342 12 295 14 161 

Miscellaneous 8 850 9 214 8 842 7 766 6 719 

Source: U.S. Census Bureau. 

Table 2-2 Annual Percent Change in Value of Construction Put in Place: 1999-

1999 to 2002 

Real Year-on-Year Percent Change 

1999 2000 2001 2002 

Private Construction Nonresidential Buildings -2.4 % 2.7 % -6.3 % -18.6 % 

Industrial -22.6 % -6.9 % -10.4 % -44.7 % 

Office 8.2 % 11.7 % -9.3 % -29.2 % 

Hotels, motels 3.5 % -2.3 % -14.3 % -30.1 % 

Other commercial 1.9 % 1.5 % -3.0 % -9.3 % 

Religious 7.3 % 4.1 % 0.7 % -3.4 % 

Educational -4.6 % 12.8 % 6.6 % 0.6 % 

Hospital and institutional -5.8 % 2.0 % -0.4 % 15.2 % 

Miscellaneous 4.1 % -4.0 % -12.2 % -13.5 % 

Source: U.S. Census Bureau. 

The consequences of inadequate terrorism insurance on construction lending and 

investment prompted calls for Federal government action. On November 26, 2002, 

President Bush signed into law the Terrorism Risk Insurance Act of 2002,19 which sets a 

ceiling on potential insurance payouts, provides substantial burden sharing, and increases 

the capacity of insurers. Among its provisions are mandatory participation by insurers, 

rescission of state exclusions, transitional terrorism coverage for insured losses in all 

 

18 U.S. Census Bureau, Value of Construction Put in Place: January 2003, Series C30 (March 2003). Table 

1, January 2003. Percentages are based on constant 1996 dollar values. 

19 For brief descriptions of government terrorism insurance policies in other countries, see Appendix 1 of 

Jaffee and Russell (Jaffee, Dwight and Russell, Thomas. “Extreme Events and the Market for Terrorism 

Insurance,” Fisher Center for Real Estate and Urban Economics, Working Paper 02-282, April 2002.) and 

Hartwig (Hartwig, “The Long Shadow of September 11,” p.79). 
14 

property and casualty policies, and a Federal backstop for terrorism losses. The 

legislation only covers events that result in losses of at least $5 million. The insurer’s 

deductible is calculated annually as a predetermined percentage of direct earned 

premiums from the 2002 calendar year. This percentage will increase each year, from 

1 % in 2002 to 7 % in 2003, 10 % in 2004, and 15 % in 2005. Of the claims exceeding 

the deductible, the Federal government will assume 90 % of the excess, with the insurer 

responsible for the remaining 10 %. The legislation sets an annual aggregate cap of $100 

billion on insured losses on government or insurer liability, and the program will phase 

out completely on December 31, 2005. 

Difficulties remain, however, if insurers are determined to be the appropriate 

mechanism for dealing with terrorism risks. The barriers to serving that function are 

legal obstacles to industry-wide pooling, regulatory restrictions, financial requirements to 

raise large sums of private investment to cover risk, and actuarial challenges in terrorism 

risk modeling.20 The first three are institutional, however, which can be addressed by 

government action. The last barrier, actuarial challenges, is a technical and informational 

one not as easily ameliorated by public policy and reflects concerns that insurers have 

when the risk is considered to be highly ambiguous. In a study of underwriter pricing 

behavior, Kunreuther et al21 found that for the case where both the probability and losses 

were ambiguous, the premiums were between 1.43 and 1.77 times higher than if 

underwriters priced a non-ambiguous risk. Similar behavior was observed in a study of 

actuaries in insurance companies. 

Swiss Re22 identifies the general criteria for an insurable risk: the ability to assess 

the probability and magnitude of losses; randomness and unpredictability of an event; 

mutuality of risks to encourage pooling and diversification of risks, geographic and 

otherwise; and economic feasibility to charge a premium which reflects the risk. In the 

case of terrorism, these criteria do not hold, although the mandated participation of the 

TRIA expands the risk community and diversifies the risk base. The relative infrequency 

of terrorism, a “low-probability, high-consequence” event, complicates the task of pricing 

its risk. 

In addition to the TRIA, the Federal government has also used regulatory devices 

to ease the burden caused by the unavailability or high cost of terrorism insurance. For 

example, in March 2003, the Department of Housing and Urban Development announced 

that new Federal Housing Administration-insured multifamily mortgages under $50 

million would not be required to carry terrorism insurance.23

Carrying insurance reduces the financial exposure of owners of constructed 

facilities to terrorist attacks, but payments on claims represent a transfer of the costs of an 

attack from the insurer to the insured. It does not address the issue of reducing the 

 

20 Kollar, John J. “Terrorism Insurance Coverage in the Aftermath of September 11th,” A Public Statement 

by the Extreme Events Committee of the American Academy of Actuaries, April 17, 2002. 21 Kunreuther, Howard, Meszaros, Jacqueline, Hogarth, Robin, and Spranca, Mark. “Ambiguity and 

Underwriter Decision Processes,” Journal of Economic Behavior & Organization, Vol. 26, No. 3, May 

1995, pp. 337-352. 

22 Schaad, Werner. “Terrorism—dealing with the new spectre,” Swiss Re Focus Report, 2002. 23 Koprowski, Gene. “Soft Targets,” Homeland Defense Journal, Vol. 1, No. 1, April 2003, pp. 34-37. 
15 

injuries to occupants and destruction of property in the event of an attack.24

The role of the Federal government as an insurance backstop is a tangible 

example of its formal stake in the private behavior of building owners and managers. 

Any protective measures that a facility adopts would, in the event of a terrorist attack, 

ease the burden of the Federal government and private insurers if they reduce casualty or 

property damage claims due to an extreme event. This intertwining of objectives may 

make the Federal government and private insurers willing to offer such incentives.25

2.3.2 Financial Incentives 

2.3.2.1 Government Financial Incentives 

Federal, state, and local governments can institute direct incentives that reduce the 

price that building owners and managers pay to protect their buildings. These incentives 

include subsidies or tax write-offs for investments in protective measures. Other 

examples of government-initiated financial incentives are formal cost sharing of the 

protective investments and loan guarantees to ease the short-term financial burdens of 

structural upgrades. 

Tobin26 has described several additional types of incentives to encourage property 

owners to reduce the vulnerability of their buildings in the context of earthquake hazards. 

These include assessment limits, grants, credits, and rebates; reduced retrofitting costs; 

technical assistance; exemptions from some planning and zoning requirements; and 

penalties (i.e., disincentives). The California Department of Insurance, for example, has 

earthquake grant and loan programs that provide financial assistance to low- and 

moderate-income residential property owners for seismic improvements. Several 

California municipalities also provide loans to qualified homeowners for such 

improvements. 

Government financial incentives to guide implementation of risk mitigation 

measures may be appropriate where private incentives differ from public benefits. Such 

discrepancies arise when the consequences of risk mitigation are not fully appropriable to 

building owners and managers. One example may be taken from a blast scenario. A 

building that is fortified with reinforced concrete columns and laminated safety glass may 

generate less shrapnel if it is attacked than an unfortified building. The reduction in 

shrapnel in turn means that surrounding buildings are less adversely affected. If the 

neighboring buildings are not owned by the same party, then the benefit of lower damage 

due to the building’s fortification does not accrue to the building owner who paid for the 

measures. The consequence is a socially sub-optimal level of risk mitigation. 

 

24 This statement is true unless insurers offer incentives for policyholders to implement risk mitigation 

measures. 

25 The Federal Government’s obligations under the Terrorism Risk Insurance Act are not its only stake in 

reducing terrorism losses. For example, the Federal Government bore a substantial portion of the costs of 

the September 11th attacks. 26 Tobin, L. Thomas. “California Case Study: Examples of Incentives to Encourage Earthquake Resistant 

Communities,” presented at the Wharton School, Economic Incentives for Building Safer Communities 

Wharton Risk Management and Decision Processes Center Roundtable, June 11, 2002. 
16 

Conversely, it is possible for a building owner’s risk mitigation activities to 

adversely affect other parties. One potential example is the use of concrete bollards. 

While they may increase a building’s setback from public roads and reduce its 

vulnerability to a blast source, an explosion may render the bollards concrete shards, 

contributing to the shrapnel problem. The possibility that risk mitigation measures can 

have both positive and negative social consequences from a terrorist attack suggests that 

any public policies to promote the adoption of risk mitigation measures must consider all 

the implications of the incentives. 

2.3.2.2 Market-Based Financial Incentives 

Financial incentives for risk mitigation in constructed facilities may also be 

market based. The transmission of these incentives occurs through a multitude of private 

relationships and transactions. Building owners have commercial relationships with 

insurers, tenants, employees, potential buyers, and lenders. These parties may each 

benefit from a building’s reduced vulnerability. Therefore, each of these relationships is 

a potential transmission mechanism of rewards for risk mitigation activities. 

Insurance companies benefit from risk mitigation measures through fewer claims 

due to lower risk of an attack and smaller claims if an attack occurs. To encourage 

owners to adopt risk mitigation, insurers may reduce insurance premiums for buildings 

that have protective measures. Building owners may also be able to attain more 

favorable insurance policies, such as those that are longer term, have lower deductibles, 

or have fewer exclusions. 

Building owners who lease commercial space may find that tenants value a 

building’s safety features and are willing to pay a leasing premium. For owner-occupied 

buildings, employees may also value the added safety of a less vulnerable building. The 

perception of danger may affect employees’ willingness to work in a particular location.27

Potential buyers are another party from which a building owner can extract 

rewards for the building’s risk mitigation measures. The installation of protective capital 

in a building is an improvement that increases the value of the asset. The building owner 

may realize the benefit of increased property value when the property is turned over. 

Owners of leveraged buildings may also receive incentives from their lenders to 

protect their assets. Lenders would suffer direct financial losses if the destruction of a 

building led to the building owner’s insolvency. To encourage owners to make choices 

that reduce the likelihood of such destruction, lenders may offer preferential financing 

terms on the building loan. Another possibility would be for the financer to make funds 

available to the owner to implement the risk mitigation improvements. Another way 

building owners are potentially rewarded in their relationships with financial institutions 

for their risk mitigation efforts is through the increased collateral value of their buildings. 

 

27 The new Federal building which opened in December 2003 kitty-corner to the site of the bombed Alfred 

P. Murrah Building in Oklahoma City provides one example. In spite of safety features incorporated into 

the design of the new building, several Federal employees have refused to move to the location. One basis 

of the refusal is the perception that the concentration of Federal agencies in one building makes it less safe. 

See Federal Employees News Digest (Federal Employees News Digest, “Employees Fighting Transfer to 

New Building,” Vol. 53, No. 14, October 27, 2003), p. 5. 
17 

One challenge to the implementation of a system of financial incentives by the 

Federal government and by private insurers is the need for performance metrics for risk 

mitigation measures. Calibrating incentives requires information about the linkage 

between risk mitigation measures and reduced losses. To ensure that the incentive is 

proportionate to the reduction in expected loss, there must be quantification of the 

benefits. This information can be based on predictions or actual outcomes. Predictive 

information is ex ante and of broader scope, although less precise. Engineering 

experimentation, simulations, and analysis can be used to model structural damage, 

casualties, and other losses associated with various fortification measures under various 

attack scenarios. Outcome-based data include actual claims or vulnerability history (data 

on thefts, break-ins, and other crime inside and in the immediate vicinity of the building) 

after the measures are implemented. These outcomes can be compared cross-sectionally 

(with nearby buildings) or intertemporally (with pre-installation performance). While 

these quantifications are certain and known, this type of metric is ex post. As such, it is 

not as useful in inducing building owners to install hardening measures, although the data 

on these outcomes can be used to parameterize predictive models. 

This chapter has proposed to building owners and managers three types of 

approaches—engineering alternatives, management practices, and financial 

mechanisms—to formulate a risk-mitigation plan. Characterizing these three types of 

approaches is only one part of the solution. A method to assess their need, identify their 

applicability, and evaluate the alternatives is necessary. Chapter 3 develops a three-step 

protocol for building a plan using these three approaches. 
18 
19 

3 A Three-Step Protocol for Creating a Risk Mitigation Plan 

Producing a risk mitigation plan requires three essential components: risk 

assessment, identification of potential mitigation strategies, and economic evaluation. 

Risk assessment is used to identify the risks confronting a facility. It includes 

development of possible scenarios of attack, probability assessment for these scenarios, 

and identification of the facility’s vulnerabilities and critical areas.28 Identification of 

mitigation strategies—engineering alternatives, management practices, and financial 

mechanisms—provides performance data for the possible combinations of risk mitigation 

strategies. The third component, economic evaluation, enables building owners and 

managers to choose the cost-effective combination of risk mitigation strategies and the 

optimal sequence for implementing them. 

3.1 Risk Assessment 

The first step to creating a risk mitigation plan is a risk assessment for the facility. 

Risk assessment is made up of assessments of threat, vulnerability, and criticality for 

each facility. Threat assessment identifies scenarios of attack, develops an understanding 

of the motivations behind different terrorist groups’ selection of targets, and determines 

probabilities (absolute or relative) of attack. Vulnerability assessment includes 

identification of, for example, single-point vulnerabilities (SPVs), the absence or 

inadequacy of system redundancies, collocation of critical systems components, and 

exposed or easily accessible areas of the facility or its systems. Criticality assessment 

determines how essential the facility, its system, and its contents are to the organization’s 

mission and function. This last element is necessary for decision makers to establish 

priorities for protective resources. 

Threat assessment requires specific information about terrorist intentions, 

resources, and capabilities. Much of this information is primarily gathered and analyzed 

by government intelligence and law enforcement organizations. The three leading private 

risk modeling firms, EQECAT, AIR Worldwide, and Risk Management Solutions 

(RMS), have also completed development of proprietary terrorism risk models. While 

some of this information is available to the public, access is typically restricted. To make 

best use of the information that is publicly available, alternative approaches to threat 

assessment are needed. Analysts without access to classified or proprietary data need a 

framework to define procedures to make “best-guess” assessments of these characteristics 

and predictions of probabilities using the information that is publicly available. 

Vulnerability assessment is typically performed by architecture and engineering 

firms and security experts. Vulnerabilities can be identified through, for example, visual 

inspection of the facility site, floor plans, and geographic information systems (GIS) 

resources. Criticality assessment is based on the mission and business of the organization 

located at the facility and the functions of its systems. 

 

28 Some may also include consequence assessment as a fourth element of risk assessment. Here, 

consequence assessment is included as a part of the second component of the risk mitigation plan, 

identification of mitigation strategies. 
20 

3.1.1 Software-Based Risk Assessment 

Researchers have developed a number of risk assessment tools to model terrorist 

decision processes as well as risks from natural hazards and other manmade hazards. 

One such tool is the Risk Assessment Method—Property Analysis and Ranking Tool 

(RAMPART) software, developed at Sandia National Laboratories as a contractor for the 

General Services Administration (GSA).29 RAMPART combines building- and sitespecific information elicited from facility managers with geography-based seismic, 

weather, and crime data using its expert system of rules to predict the vulnerability of a 

building to several categories of consequences due to man-made and natural hazards. In 

RAMPART, categories of consequences include casualties, damage to property and 

contents, and loss of use and mission. RAMPART addresses natural hazards (hurricanes, 

earthquakes, flooding, and winter storms) and several manmade hazards (crime inside the 

building, crime outside the building, and terrorism).30

Another software tool designed to provide individuals, businesses, and 

communities with information and tools to mitigate hazards and reduce losses from 

disasters is Hazards U.S. (HAZUS).31 HAZUS is a natural hazard loss estimation 

methodology developed by the National Institute of Building Sciences (NIBS) with 

funding from the Federal Emergency Management Agency (FEMA). HAZUS allows 

users to compute estimates of damage and losses from natural hazards using GIS 

technology. Originally designed to address earthquake hazards, HAZUS is being 

expanded into HAZUS Multi-Hazard (HAZUS-MH), a multi-hazard methodology with 

new modules for estimating potential losses from wind (including hurricane) and flood 

hazards. HAZUS-MH will also contain a third party model integration capability that 

will provide access and operational capability to a wide range of natural and man-made 

hazard models that will supplement the natural hazard loss estimation capability in 

HAZUS-MH. For chemical, biological, radiological, nuclear, and explosive threats, for 

example, HAZUS-MH can be used with the ALOHA dispersion software model to 

predict the footprints of plumes downwind from the releases.32

3.1.2 Risk Assessment Guidance Documents 

In addition to these software products, several guidance documents are available 

to help facility managers assess the risks facing their structures. FEMA has developed a 

series of guidance manuals to assist state and local communities in planning for risk 

 

29 Hunter, Regina L. “Risk Assessment Method—Property Analysis and Ranking Tool: Risk Analysis 

Software for the GSA Property Manager,” mimeo, Sandia National Laboratories, 2001. 30 RAMPART is designed for application to Federal facilities, but this limitation only means that some 

hazard data exist only for GSA-owned or -managed buildings. The software could be used for privately 

owned, non-GSA buildings, but the analysis will not include all four natural hazards. In addition, while the 

hazard data for the natural hazards and crime are based on existing incidence data or probability estimates, 

determination of the terrorism hazard is based entirely on data values entered by the user. These data are 

processed according to an “expert system of rules” devised by researchers at Sandia. This data limitation is 

primarily due to insufficient empirical data on building-related terrorist incidents in the United States. 

31 http://www.fema.gov/hazus/hz_meth.shtm 

32 Bouabid, Jawhar. “HAZUS-MH and Technological Hazards,” November 2002, 

http://www.fema.gov/hazus/zip/dl_tech.zip. 
21 

mitigation. These manuals address the need for risk assessment for a variety of hazards. 

They describe the processes of identifying hazards,33 identifying and developing 

mitigation strategies,34 implementing risk mitigation plans,35 and applying these 

processes to man-made hazards.36 Understanding Your Risks addresses natural hazards 

but offers descriptions of the risk assessment process that can be generalized to other 

types of hazards. The four-step process consists of: (1) identifying the hazards; (2) 

profiling the hazard events to determine magnitudes and pinpoint more specific asset 

vulnerabilities; (3) inventorying assets; and (4) estimating losses. Developing the 

Mitigation Plan provides state and local decision makers with the tools to identify 

mitigation objectives and strategies. Bringing the Plan to Life describes the steps that 

planners can take to implement the strategies that were identified in Developing the 

Mitigation Plan to accomplish the stated risk mitigation objectives. Integrating HumanCaused Hazards directly relates to terrorism and “technological disasters.” All four 

FEMA guidance manuals are designed to be used at the community level rather than at 

the level of individual businesses or buildings. But building owners and managers may 

benefit from increased awareness of local hazards and the types of personnel and 

expertise that FEMA recommends, particularly if they undertake risk mitigation in 

coordinated fashion with local emergency responders. 

FEMA recently launched a new series of publications directed at providing design 

guidance for mitigating terrorist risks. The objective of the Risk Management Series is to 

reduce physical damage to structural and nonstructural components of buildings and 

related infrastructure, and to reduce casualties resulting from conventional bomb attacks, 

as well as attacks using chemical, biological, and radiological agents. Emphasis is on 

improving security in high occupancy buildings to better protect the nation from potential 

threats by identifying key actions and design criteria to strengthen buildings from forces 

that might be anticipated from a terrorist attack. The first publication in the series, 

FEMA 426,37 is a reference manual. FEMA 426 provides guidance to architects and 

engineers on how to reduce physical damage to buildings, related infrastructure, and 

people caused by terrorist attacks. The manual presents incremental approaches that can 

be implemented over time to decrease the vulnerability of buildings to terrorist threats. 

The second publication, FEMA 427,38 is a primer. FEMA 427 introduces a series of 

 

33 Federal Emergency Management Agency. Understanding Your Risks: Identifying Hazards And 

Estimating Losses. FEMA 386-2 (Washington, DC: Federal Emergency Management Agency, August 

2001). 

34 Federal Emergency Management Agency. Developing The Mitigation Plan; Identifying Mitigation 

Actions and Implementing Strategies. FEMA 386-3. (Washington, DC: Federal Emergency Management 

Agency, April 2003). 

35 Federal Emergency Management Agency. Bringing the Plan to Life: Implementing the Hazard 

Mitigation Plan. FEMA 386-4. (Washington, DC: Federal Emergency Management Agency, August 

2003). 

36 Federal Emergency Management Agency. Integrating Human-Caused Hazards Into Mitigation Planning. 

FEMA 386-7 (Washington, DC: Federal Emergency Management Agency, September 2003). 

37 Federal Emergency Management Agency. Reference Manual to Mitigate Potential Terrorist Attacks 

Against Buildings. FEMA 426 (Washington, DC: Federal Emergency Management Agency, December 

2003). 

38 Federal Emergency Management Agency. Primer for Design of Commercial Buildings to Mitigate 

Terrorist Attacks. FEMA 427 (Washington, DC: Federal Emergency Management Agency, December 

2003). 
22 

concepts that can help building designers, owners, and state and local governments 

mitigate the threat of hazards resulting from terrorist attacks on new buildings. FEMA 

427 contains extensive qualitative design guidance for limiting or mitigating the effects 

of terrorist attacks focusing primarily on explosions, but also addressing chemical, 

biological, and radiological attacks. The third publication, FEMA 428,39 is a primer on 

school projects. The purpose of FEMA 428 is to provide the design community and 

school administrators with the basic principles and techniques to make a school that is 

safe from terrorist attacks. The fourth publication, FEMA 429,40 is a primer on risk 

management. The purpose of FEMA 429 is to introduce the building insurance, finance, 

and regulatory communities to the issue of terrorism risk management in buildings and 

the tools currently available to manage these risks. Additional publications are planned 

in the Risk Management Series. For additional information on new or planned 

publications in the series, visit the Risk Management Series Publications web site.41

On July 31, 2002, the Department of Defense (DOD) published a Uniform 

Facilities Criteria (UFC) for unrestricted distribution entitled, “DoD Minimum 

Antiterrorism Standards for Buildings.” The objective of these standards is to improve 

the survival of DOD personnel from terrorist attacks.42 Although the UFC system applies 

to the military departments, DOD agencies, and DOD field activities, the standards 

identify and highlight several key aspects of site planning, structural design, architectural 

design, and electrical and mechanical design that play a role in protecting buildings from 

explosives threats. The criteria apply to construction projects beginning in FY2004, new 

leases in FY 2006, and lease renewals by FY 2010. They provide an example of explicit 

tradeoffs among two approaches to improving survival from a terrorist attack on a 

constructed facility: setback distance and structural hardening. DOD’s focus on 

minimum setback distance as the primary approach separates it from GSA and the 

Department of State, which place more emphasis on building hardening.43

The American Management Association (AMA) recently published The Facility 

Manager’s Emergency Preparedness Handbook.

44 This handbook is intended as a 

reference for emergency preparedness planning. It provides guidelines, tools, and 

checklists to facility managers to prepare for several types of emergencies. A sample of 

these emergencies includes: terrorism, fire emergency, lockout, and workplace violence. 

In 2003, R.S. Means published Building Security: Strategies & Costs45 to assist 

building owners and facility managers to assess risk and vulnerability to their buildings, 

 

39 Federal Emergency Management Agency. Primer to Design Safe School Projects in Case of Terrorist 

Attacks. FEMA 428 (Washington, DC: Federal Emergency Management Agency, December 2003). 40 Federal Emergency Management Agency. Insurance, Finance, and Regulation Primer for Terrorism 

Risk Management in Buildings. FEMA 429 (Washington, DC: Federal Emergency Management Agency, 

December 2003). 

41 www.fema.gov/fima/rmsp.shtm 

42 U.S. Department of Defense. DoD Minimum Antiterrorism Standards for Buildings, UFC 4-010-01, July 

31, 2002. 

43 Bradshaw, III, Joel C. “Protecting Personnel at Risk: DOD Writes Anti-Terrorism Standards to Protect 

People in Buildings,” AMPTIAC Quarterly, Vol. 6, No. 4, February 2003, pp. 11-15. 44 Lewis, Bernard T. and Payant, Richard P. The Facility Manager’s Emergency Preparedness Handbook

(New York: AMACOM Books, 2003). 

45 Owen, David D. and R.S. Means Engineering Staff. Building Security: Strategies & Costs (Kingston, 

Massachusetts: Construction Publishers & Consultants, 2003). 
23 

develop emergency response plans, and make choices about protective measures and 

designs. Building Security also includes pricing information for several security-related 

components, systems, and equipment, as well as the labor required for installation. In 

addition to materials and equipment, the cost data also includes information about other 

security and prevention measures such as command (guard) dogs, exterior plants, and 

planters. 

The American Society of Mechanical Engineers (ASME), through funding from 

the Department of Homeland Security, is developing a guidance document on risk 

assessment to inform resource allocation decisions for the protection priorities of critical 

infrastructure. This guidance document will provide a review of the existing approaches 

to assessing risk, highlight the common terminology and basis for reporting results, and 

present recommended methodology and best practices. 

3.1.3 Qualitative Approaches to Risk Assessment 

There are also qualitative approaches to modeling terrorist risk to constructed 

facilities. Rather than attempting to compute an absolute measure of risk, the authors of 

these approaches propose methodologies to measure the relative risk facing different 

facilities or structures. Because their result is a ranking of priorities, they provide 

guidance in the budget prioritization process. 

Paté-Cornell and Guikema46 propose an overarching model with probabilistic 

scenarios of attack and consequences, deriving von Neumann-Morgenstern expected 

utilities.47 The authors identify scenarios of attack and generate probabilities of these 

scenarios based on information about the intentions and resources of the potential 

attackers and the “attractiveness” of the target. They also assign values to the utility or 

disutility that the decision makers derive from the realization of the scenarios. Based on 

this information, the authors run influence diagrams and compute the maximum expected 

utility for the two agents, the attackers and the defenders. For defenders, the ranking of 

the scenarios by expected disutility allows policymakers to set priorities among 

countermeasures. Scenarios can be alternatively ranked based on damage level or on 

probability of occurrence. 

Kowalski48 presents a methodology to compute the risk of chemical or biological 

attack that a building faces relative to the risk to other buildings. He extends Zilinskas’49 

formulation of risk as a function of the product of hazard (i.e., degree of danger posed) 

and exposed population. Kowalski applies this formulation of risk to the case of 

buildings by including ordinal or indexed values of a building’s profile and vulnerability. 

The relative risk, or normalized probability, is thus computed in Equation (3.1) as the 

geometric mean of the four factors, hazard (H), occupancy (O), profile (P), and 

vulnerability (V): 

 

46 Paté-Cornell, Elisabeth and Guikema, Seth. “Probabilistic Modeling of Terrorist Threats: A Systems 

Approach to Setting Priorities Among Countermeasures,” Military Operations Research, Vol. 7, No. 4, 

2002, pp. 5-23. 

47 Von Neumann, John and Morgenstern, Oskar. Theory of Games and Economic Behavior (Princeton, New 

Jersey: Princeton University Press, 1953). 

48 Kowalski, Wlayslaw Jan. Immune Building Systems Technology (New York: McGraw-Hill, 2003). 49 Zilinskas, Raymond A. Biological Warfare (Boulder, CO: Lynne Rienner Publishers, Inc., 2000). 
24 

4 R = ⋅⋅⋅ H OPV (3.1) 

Kowalski assigns values to each of these four variables subjectively. Because all 

chemical and biological weapons (CBWs) are potentially fatal, he assigns a value of 

100 % to the hazard factor.50 Building occupancy is assigned a value between 1 

(extremely low) to 100 (extremely high) to indicate relative occupancy. The author treats 

building profile in a similar fashion. Building profile can be decomposed into two 

components: profile of the facility itself and profile of the building’s tenants.51 

Vulnerability, which is similarly measured, is determined by accessibility and threat to 

occupants. Publicly accessible buildings with little or no immunity are considered high 

vulnerability, while well-fortified, high security facilities would be considered low 

vulnerability. 

The computed risk is a normalization of the probabilities associated with these 

four factors. The normalizations allow for different buildings to be ranked by the level of 

relative risk. Normalization using the geometric mean in Equation (3.1) is based on the 

assumption that the probabilities of the four factors are independent and the four factors 

are weighted equally. This formulation can be generalized to take into account other risk 

factors, such as location, or explicitly stated threats to the facility. The vulnerability 

factor could also be separated into its two components, building security and building 

immunity. The normalized risk for n multiplicity of factors, expressed as a probability, is 

the nth root of the product of values of these factors. 

Alternatively, relative risk can be computed as an average of the risk factors. 

Whether these factors are weighted differently will depend on subjective assessment of 

their relative importance to the overall risk that a building faces. For both methods of 

computing risk, geometric mean and arithmetic mean, lower values of this measure of 

relative risk indicate lower risk to the facility. 

3.1.4 Sources of Hazards Data 

Data about the frequency and consequences of natural and man-made hazards are 

helpful when assessing the risks that a particular facility faces from these hazards. 

Historical patterns of natural disasters, in particular, may indicate which areas are more 

prone to these specific hazards in the future. Some analysts may also refer to past 

incidences of man-made hazards, such as crime, as predictors of future occurrences. 

Statistics about the frequency, severity, and damages from natural hazards in the United 

States are available at national and local geographic levels. Historical data on 

earthquakes, hurricanes, winter storms, tornadoes, coastal and river flooding are available 

through multiple U.S. government sources. 

The U.S. Geological Survey (USGS) is one source of such information. The 

USGS has produced six maps illustrating the areas within the 48 contiguous states with 

 

50 If this approach were applied to other hazards that do not carry a high potential for fatality, including 

natural hazards, the hazard factor may be less than 100. 51 A building’s profile is high if it is a signature or landmark structure. It may also be high if it houses 

high-profile tenants, such as political entities, law enforcement organizations, or prominent companies. 
25 

“relatively high risk or relatively frequent actual occurrences” of six natural hazards: 

floods, earthquakes, landslides, volcanic eruptions, hurricanes, and tornadoes.52 A 

starting point for data gathering about these hazards is available at USGS.53 Researchers 

at the USGS Coastal and Marine Geology Program are also developing models to predict 

the occurrences, severity, and consequences of natural disasters such as hurricanes, 

earthquakes, and floods.54 Moreover, the USGS National Earthquake Information Center 

(NEIC),55 National Seismic Hazard Mapping Project,56 and Advanced National Seismic 

System (ANSS)57 provide data and hazard maps for earthquakes. The earthquake hazard 

data are available by zip code or by latitude and longitude. The USGS Coastal and 

Marine Geology Program has several projects associated with hurricane and coastal 

storm prediction. The Coastal Classification Mapping Project58 characterizes and 

classifies pre-storm ground conditions for states located along the Gulf of Mexico that, 

when combined with data about beach stability and prior storm impact studies,59 provide 

indications of an area’s vulnerability to hurricanes or other extreme coastal storms. To 

address other flooding hazards, the Office of Surface Water at the USGS has developed 

several flood frequency analysis software products.60

FEMA is a primary source of information from the Federal Government 

concerning flood hazards due to rivers and streams and along coastal areas and lake 

shores. The agency manages the National Flood Insurance Program (NFIP). In addition 

to administering the flood insurance program and issuing floodplain management 

regulations, the NFIP maintains a bank of flood insurance maps, available both on hard 

copy and digital media, from its Map Service Center.61 Some of these maps are available 

online and interactively produce public flood maps by street address. The NFIP also 

provides Flood Insurance Study reports (FIS) containing data on flood risk and floodprone areas. The FIS reports, which are available at the sub-county, city, or community 

level, are the bases of the Digital Flood Insurance Rate Maps (DFIRMs) and Flood 

Insurance Rate Maps (FIRMs). Online city-level hazard maps to promote awareness of 

general risks from several natural hazards—flood hazard areas, earthquakes (recent and 

historical), historical hail storms, hurricanes, wind storms, tornadoes—are also available 

through a FEMA National Partnership.62

The National Weather Service collects state and national data about the 

consequences of severe weather in the United States.63 Data for 1995 through 2003 cover 

lightning, tornado, tropical cyclone, heat, flood, cold weather, winter storm, wind, and 

other hazards. Consequences are grouped by number of fatalities and injuries and 

amount of property damage and crop damage. 

 

52 http://www.usgs.gov/themes/hazards.html 53 http://www.usgs.gov/themes/hazpics.html 

54 http://pubs.usgs.gov/fs/natural-disasters/index.html 55 http://wwwneic.cr.usgs.gov 

56 http://eqhazmaps.usgs.gov 

57 http://www.anss.org 

58 http://coastal.er.usgs.gov/coastal-classification/index.html 

59 http://coastal.er.usgs.gov/hurricanes/index.html 

60 http://water.usgs.gov/osw/techniques/floodfreq.html 

61 http://www.msc.fema.gov 

62 http://www.esri.com/hazards/ 63 http://www.nws.noaa.gov/om/hazstats.shtml 
26 

Data about natural hazard risks are also provided through private industry sources. 

The insurance industry is a key source. The Insurance Information Institute (III)64 and 

the Insurance Services Office65 collect and provide data about property claims, although 

the latter’s products are primarily designed to serve insurers. Some private insurers 

publish hazard incidence and consequence data. Swiss Re produces sigma, a publication 

series which includes annual reports of natural catastrophes and man-made disasters 

across the world.66 These reports list the dates, locations, events, casualties, and damage 

associated with catastrophes. Natural catastrophes are grouped by floods, storms, 

earthquakes, drought and forest fires, cold and frost, hail, and other. 

Data about the frequency and geography of man-made hazards in the United 

States are also available through public and private sources. The Federal Bureau of 

Investigation (FBI) collects statistics concerning the reported incidences of crime through 

the Bureau of Justice Statistics67 and National Institute of Justice Data Resources68

programs. Data from these programs are also available at the National Archive of 

Criminal Justice Data,69 which is housed by the University of Michigan’s Inter-university 

Consortium for Political and Social Research. These data include incidents by state, by 

reporting local agency, such as county police departments, and by metropolitan statistical 

area (MSA). 

For some hazards, information is available through reports, rather than data. 

Chemical accidents are one example. The Chemical Safety Board compiles news reports 

of chemical incidents throughout the country.70 Terrorism is another example where 

information is provided through incident reports. The U.S. Department of State and the 

FBI both maintain chronologies of significant terrorist incidents. The State Department’s 

Patterns of Global Terrorism is available for 1995 through 2002.71 The FBI series, 

Terrorism in the United States, is available for 1996 through 1999.72

3.2 Identification of Potential Mitigation Strategies 

3.2.1 Engineering Analysis 

Engineering analysis is an essential counterpart to risk assessment and economic 

evaluation. Engineering analysis helps identify potential mitigation strategies and 

provides the information used to assess the consequences of the attack scenarios 

developed in the risk assessment. While engineering analysis is useful in estimating the 

exposures and vulnerabilities of facilities, it also serves a critical role in the identification 

of potential mitigation strategies. Engineering analysis is used to: (1) identify risk 

mitigation measures; (2) evaluate the performance of these strategies under different 

 

64 http://www.iii.org 

65 http://www.iso.com 

66 http://www.swissre.com/INTERNET/pwswpspr.nsf/fmBookMarkFrameSet?ReadForm&BM=../vwAllbyIDKeyLu/CMUR-4V8AVQ 67 http://bjsdata.ojp.usdoj.gov/dataonline/ 

68 http://www.ojp.usdoj.gov/nij/dataprog.htm 

69 http://www.icpsr.umich.edu/NACJD/index.html 

70 http://www.csb.gov/CIRC/index.cfm 71 http://www.state.gov/s/ct/rls/pgtrpt/ 

72 http://www.fbi.gov/publications/terror/terroris.htm 
27 

scenarios and conditions; and (3) map these approaches to probabilistic damage 

outcomes. 

3.2.2 Software-Based Engineering Analysis 

Engineering analysis can be software based. One example of an analysis tool that 

predicts and simulates damage from airborne contaminants is NIST’s CONTAMW73

software package. CONTAMW captures user-defined building structure characteristics 

to simulate and model the spatial distribution of airborne contamination over time, based 

on information about the physical properties of the contaminants and design 

characteristics of the structure and its subsystems. This analysis tool could be used for 

the probabilistic assessment of damage under chemical or biological attack scenarios. It 

was used to model the transport of the anthrax spores in the Hart Senate Office Building 

in October 2001. It provides important input data for evaluation of risk mitigation 

measures relating to emergency first responders and building egress. 

NIST researchers have also developed the Fire Dynamics Simulator (FDS) and 

the companion Smokeview software.74 FDS is a computational fluid dynamics (CFD) 

model of fire-driven fluid flow, while Smokeview is a visualization program that displays 

the results of the FDS simulations. Using user-defined data about the building’s 

structure, materials, and contents, FDS simulates the spread of flames, smoke, and heat 

within the structure. 

Several other government and private sector modeling, prediction, and simulation 

software tools are available. The Department of Defense’s Modeling and Simulation 

Information Analysis Center of the Defense Modeling and Simulation Office has 

compiled a list of these resources.75 These software tools perform predictions, 

simulations, and assessments of consequences, hazards, detection, and environmental 

impacts. One software cited in the list links setback distance with exterior building 

materials, explosive characteristics, and structural damage and casualties.76 The software 

can be used to determine the tradeoffs between setback distance and wall and window 

construction materials needed to protect the building or mitigate the damage from a 

terrorist attack. 

There are several additional software tools available that perform damage and risk 

assessment from various natural and manmade hazards over larger geographic regions. 

The Consequence Assessment Tool Set with Joint Assessment of Catastrophic Events 

(CATS-JACE) was developed with support from Defense Threat Reduction Agency 

(DTRA) and FEMA. This software estimates damage and assesses consequences to 

population, infrastructure, and resources from a number of incidents. These incidents 

 

73 http://www.bfrl.nist.gov/IAQanalysis/CONTAMWdesc.htm 74 http://fire.nist.gov/fds/ 

75 http://www.msiac.dmso.mil/wmd/msres.asp 

76 This software computes the overpressure caused by an explosive device of a given size and type based on 

the types of materials used to construct the building walls and windows. The overpressure and distance 

from the blast determine building structural damage and whether people within the building or near the 

explosion will experience physical harm ranging in severity from aural injury to fatality. Once the user 

selects the characteristics of the explosive device and the structure, the software computes radii associated 

with minor, medium, and major levels of damage or injury. 
28 

include: chemical/nuclear facility accidents; incidents involving weapons of mass 

destruction (WMD), such as nuclear, biological, and chemical (NBC) weapons; and highexplosive (HE) blasts. It encompasses natural hazards, such as hurricane, earthquake, 

and tornadoes, and analysis is not geographically limited to the United States.77 HPAC 

is a hazard prediction model for NBC hazards from the destruction of NBC facilities. It 

provides the capability to predict the effects of releases of hazardous materials into the 

atmosphere and the impact of these releases on populations using particulate transport 

models and meteorological data. 

Another type of tool is crisis information management software (CIMS). CIMS is 

designed to augment emergency management agency responses to crisis situations and 

enhance emergency management planning and mitigation. The National Institute of 

Justice has published a report that describes the results of testing of ten commercial 

CIMS products to compare their characteristics and features.78

CONTAMW, Smokeview, CATS-JACE, and HPAC simulate the timing, 

transmission, and consequences of varying hazards. This information is used to identify 

the needs and identify mitigation strategies to reduce risks to owners, occupants, and 

users of constructed facilities. To address these hazards and consequences, building 

owners and managers need to identify combinations of engineering alternatives, 

management practices, and financial mechanisms. To illustrate, take the hypothetical 

example of a building owner seeking to reduce the threat from high explosives to an 

existing property. The building owner would like to protect occupants from injuries and 

fatalities, reduce damage to the structure, minimize loss of use and contents, and reduce 

financial losses. While the building owner cannot change the location in the short run, he 

can achieve these objectives by implementing several less drastic strategies. Table 3-1 

lists some of the potential strategies.79 Varying the combinations of these strategies 

presents the building owner with numerous possibilities. For example, Combination A 

could be represented by E2, E3, M2, F3. Combination B may be E1, E2, M5, F1, and F2. 

Associated with each potential strategy are protective, risk-reducing effects and costs to 

implement and maintain the measures. 

 

77 The CATS-JACE software functions within a commercial GIS software which serves as the operating 

system for CATS. It is distributed with DTRA’s Hazard Prediction and Assessment Capability (HPAC). 78 National Institute of Justice. Crisis Information Management Software (CIMS) Feature Comparison 

Report, NCJ 197065, October 2002, Special Report, http://www.ojp.usdoj.gov/nij/pubs-sum/197065.htm. 79 The list of strategies included in Table 3-1 is not intended to be exhaustive of the potential risk mitigation 

measures among which a building owner or manager can choose. 
29 

Table 3-1 Potential Risk Mitigation Strategies 

Mitigation Strategies 

Engineering alternatives Management Practices Financial Mechanisms 

E1: Install reinforced concrete 

columns 

M1: Perform identification 

checks at facility access 

points 

F1: Purchase business 

interruption insurance 

E2: Install fire sprinkler 

system 

M2: Implement random 

security sweeps 

F2: Purchase property loss 

insurance 

E3: Replace existing tempered 

glass with laminated 

safety glass 

M3: Relocate parking spaces 

that are adjacent to 

building 

F3: Purchase an option to 

lease nearby building 

space 

E4: Install fabricated window 

coverings to reduce 

explosive fragments 

M4: Begin quarterly building 

evacuation and 

emergency response 

drills for employees 

F4: Purchase an option to buy 

a nearby building 

E5: Apply flame retardant 

coating to building 

M5: Coordinate 

communications with 

local first responders 

F5: Participate in government 

cost sharing program 

... ... ... 

3.3 Economic Evaluation 

The final component of a risk mitigation plan is economic evaluation. Economic 

evaluation is critical to the process of choosing risk mitigation strategies to minimize lifecycle costs (LCC), which include expected losses from terrorist attacks and other hazards. 

Economic evaluation is used to combine the risk, threat, vulnerability, and consequence 

assessments with information about mitigation strategies and their costs to determine the 

most cost-effective combination of strategies to protect constructed facilities. 

The economic evaluation takes into account the possibility of interdependence 

and substitution among different strategies. For example, a building’s large setback 

distance from public roads and garages conveys protection from explosive devices that 

affects the need for structural measures. For buildings in urban settings with limited 

setback distances, however, decisions about structural enhancements would be different. 

The economic evaluation methods are sufficiently flexible to address the possibility that 

different measures can compensate for situations that are difficult or impractical to 

change. 

Chapters 4 and 5 describe the economic tools which are used to determine the 

cost-effectiveness of protective measures. These economic tools are the economic 

evaluation methods and the proposed software tool for implementing these methods. The 

economic evaluation methods discussed in Chapter 4 have the flexibility to address a 

variety of financial strategies to mitigate the risk to buildings. These strategies include 

the purchase of insurance against hazardous events. It also includes the provision of 

additional financial incentives from government entities or insurance companies. Such 

incentives may include tax incentives, cost sharing, or reductions in insurance premiums. 

The proposed software tool is described in Chapter 5. 
30 
31 

4 Decision Methodology: Choosing the Most Cost-Effective Risk 

Mitigation Plan 

This chapter describes a methodology for measuring the economic performance of 

alternative combinations of risk mitigation strategies. The methodology includes several 

methods of economic evaluation and provides a case illustration of how to use them to 

choose the most cost-effective risk mitigation plan. 

The decision methodology is based on two types of analysis, four methods of 

economic evaluation, and a cost-accounting framework. The two types of analysis are 

baseline analysis and sensitivity analysis. They are described in Section 4.1. The four 

evaluation methods are life-cycle cost, present value of net savings, savings-toinvestment ratio, and adjusted internal rate of return. They are described in Section 4.2. 

The cost-accounting framework is described in Section 4.3. 

An economic evaluation may be divided into four stages: (1) identification; (2) 

classification; (3) quantification; and (4) presentation. The identification stage identifies 

the investment alternatives to be evaluated. The identification stage involves identifying 

and listing all of the “effects” of the alternatives being analyzed. In principle, this set of 

effects produces a checklist of all items that should be taken into consideration. The 

second stage entails classifying these effects into investment and non-investment cost 

categories. The third stage produces year-by-year estimates of the values of each of the 

cost categories. Readers wishing an in-depth discussion of how to identify and classify 

benefits and costs are referred to Appendix B. Appendix B also includes a “priority 

setting” procedure for linking classes of benefits and costs to key stakeholder groups. 

The priority setting procedure is designed to assist the analyst in collecting the type of 

data needed for the year-by-year estimates. The final stage is the presentation and 

analysis of the measures of economic performance in a form that clearly details the 

important assumptions underlying the economic evaluation and the implications of these 

assumptions for the study’s conclusions. 

4.1 Types of Analysis 

4.1.1 Baseline Analysis 

The starting point for conducting an economic evaluation is to do a baseline 

analysis. In the baseline analysis, all data elements, and any functional relationships 

among these elements entering into the calculations, are fixed. For some data, the input 

values are considered to be known with certainty (e.g., a physical constant or a value that 

is mandated by legislation). Other data are considered uncertain and their values are 

based on some measure of central tendency, such as the mean or the median. Baseline 

data represent a fixed state of analysis. For this reason, the analysis results are referred to 

as the baseline analysis. Throughout this report, the term baseline analysis is used to 

denote a complete analysis in all respects but one; it does not address the effects of 

uncertainty. 
32 

4.1.2 Sensitivity Analysis 

Sensitivity analysis measures the impact on project outcomes of changing the 

values of one or more key data elements or input variables about which there is 

uncertainty. Sensitivity analysis can be performed for any measure of economic 

performance (e.g., life-cycle cost, present value of net savings, savings-to-investment 

ratio, adjusted internal rate of return). Since sensitivity analysis is easy to use and 

understand, it is widely used in the economic evaluation of government and privatesector applications. Office of Management and Budget Circular A-94 recommends 

sensitivity analysis to federal agencies as one technique for treating uncertainty in data 

elements or input variables.80 Therefore, a sensitivity analysis complements the baseline 

analysis by evaluating the changes in output measures when selected data or input 

variables are allowed to vary about their baseline values. Readers interested in a 

comprehensive survey on methods for dealing with uncertainty for use in government and 

private-sector applications are referred to the study by Marshall81 and the subsequent 

video82 and workbook.83

4.2 Overview of Evaluation Methods 

Several methods of economic evaluation are available to measure the economic 

performance of a new technology, a building, a building system, or like investment, over 

a specified time period. These methods include, but are not limited to, life-cycle cost, 

present value of net savings, savings-to-investment ratio, and adjusted internal rate of 

return. These methods differ in their mathematical formulation and, to some extent, in 

their applicability to particular types of investment decisions. 

To ensure consistency in computation, application, and interpretation, the four 

methods described in this section are based on ASTM International standard practices.84 

The four “standardized” evaluation methods used in this report are generic. Readers 

interested in an in-depth survey covering these as well as other methods are referred to 

Ruegg and Marshall.85

Once all costs have been identified and classified, it becomes necessary to 

develop year-by-year estimates for each of the cost categories for each alternative under 

analysis. We denote the alternatives as Aj (where the index for j ranges from 0,..., N, for 

a total of N+1 alternatives). 

 

80 Executive Office of the President. OMB Circular A-94 (Washington, DC: Office of Management and 

Budget, 1992). 

81 Marshall, Harold E. Techniques for Treating Uncertainty and Risk in the Economic Evaluation of 

Building Investments. NIST Special Publication 757 (Gaithersburg, MD: National Institute of Standards 

and Technology, 1988). 

82 Marshall, Harold E. Uncertainty and Risk—Part II in the Audiovisual Series on Least-Cost Energy 

Decisions for Buildings (Gaithersburg, MD: National Institute of Standards and Technology, 1992). 83 Marshall, Harold E. Least-Cost Energy Decisions for Buildings—Part II: Uncertainty and Risk Video 

Training Workbook. NISTIR 5178 (Gaithersburg, MD: National Institute of Standards and Technology, 

1993). 

84 ASTM International. ASTM Standards on Building Economics, pp 25-57. 85 Ruegg, Rosalie T. and Marshall, Harold E.. Building Economics: Theory and Practice, (New York: 

Chapman and Hall, 1990). 
33 

Each alternative under consideration meets certain feasibility requirements. First, 

it must satisfy all of the specified functional requirements. Second, it must not exceed 

any stated budget constraints. The first requirement insures that all technical criteria 

(e.g., thermal performance and indoor air quality) and all regulatory constraints (e.g., 

building codes and standards) are met. The second requirement excludes any proposals 

which cannot be implemented due to insufficient funds. 

Chapter 6 summarizes how alternatives are analyzed and optimally configured 

subject to budget constraints. The material presented in this chapter assumes that all 

alternatives are feasible in that they meet the functional requirements and have been 

screened vis-à-vis any stated budget constraints. Thus, there is no requirement that 

alternatives be optimally configured, although the evaluation methods presented in this 

chapter are all applicable to choosing among a set of optimally configured alternatives. 

Associated with each alternative are investment cost categories k (where the index 

k ranges from 1,..., Kj) and non-investment cost categories m (where the index m ranges 

from 1,..., Mj). The potential for future terrorist attacks, as well as other natural and manmade hazards, are measured by the expected value of annual losses. Associated with 

each alternative are expected loss categories p (where the index p ranges from 1,..., Pj). 

Some of the expected loss categories accrue to investment costs and some accrue to noninvestment costs. Expected losses are modeled separately from investment costs and 

non-investment costs to better characterize the nature of low-probability, highconsequence events.86 

It is important to note that some costs entering the analysis may be negative. For 

example, the salvage and sale of equipment and components at the end of the study 

period result in a salvage value whose present value equivalent is subtracted from other 

investment costs. Similarly, improvements to indoor air quality may result in 

productivity improvements which favorably impact occupants; these “savings” are 

subtracted from non-investment costs. Any pure benefits which result (e.g., increased 

rental income due to improvements) are subtracted from non-investment costs (i.e., 

benefits are treated as negative costs). 

At the heart of the economic evaluation methodology is an economic concept 

referred to as the time value of money. This concept relates to the changing purchasing 

power of money as a result of inflation or deflation, along with consideration of the real 

earning potential of alternative investments over time. The discount rate reflects the 

decision maker’s time value of money. The discount rate is used to convert, via a process 

known as discounting, costs which occur at different times to a base time. Throughout 

this report, the term “present value” will be used to denote the value of a cost found by 

discounting cash flows (present and future) to the base time. The base time is the date 

(base year) to which costs are converted to time equivalent values. 

In order to describe each of the four standardized methods of economic 

performance—life-cycle cost, present value of net savings, savings-to-investment ratio, 

and adjusted internal rate of return—we define a series of terms. 

 

86 The information needed to perform the expected loss calculations is a byproduct of the risk assessment 

(see Section 3.1) and the identification of potential mitigation strategies (see Section 3.2). 
34 

t = a unit of time;87

T = the length of the study period in years; 

d = the discount rate expressed as a decimal. 

The prefix, PV, is used to designate dollar denominated quantities in present value 

terms. The present value is derived by discounting (i.e., using the discount rate) to adjust 

all costs—present and future—to the base year (i.e., t=0). The present value terms are: 

the present value of investment costs (PVI), the present value of non-investment costs 

(PVC), and the present value of expected losses (PVE(L)). Because PVE(L) includes 

some loss categories which accrue to investment costs and some which accrue to noninvestment costs, we denote the present value of investment costs inclusive of losses as 

PVI' and the present value of non-investment costs inclusive of losses as PVC'. 

The cost terms that make up the mathematical formulations for the four 

standardized methods are given in Equations (4.1) through (4.6). While there may be 

many different ways of classifying costs (i.e., classification schemes), their explicit 

treatment in both the mathematical formulation and the standardized methods ensures 

that a close coupling results between the mathematical formulation and each standardized 

method. 

The investment costs for alternative Aj in year t are expressed as: 

1

K j

jt kjt

k

I I

=

= ∑ (4.1) 

where Ikjt = the estimated cost accruing to the k

th investment cost category for alternative 

Aj in year t. 

The non-investment costs for alternative Aj in year t are expressed as: 

1

M j

jt mjt

m

C C== ∑ (4.2) 

where Cmjt = the estimated cost accruing to the m

th non-investment cost category for 

alternative Aj in year t. 

The expected losses for alternative Aj in year t may now be expressed as: 

() ( )

1

Pj

jt pjt

p

EL EL == ∑ (4.3) 

 

87 Denote the beginning of the study period as the base year (i.e., t=0) and end of the study period as T. 

Thus, the length of the study period in years is T.
35 

where Lpjt = the expected loss accruing to the p

th loss category for alternative Aj in year t. 

The present value of investment costs for alternative Aj are expressed as: 

0 1

/(1 )

T K j

t

j kjt

t k

PVI I d

= =

⎛ ⎞

= + ⎜ ⎟ ⎜ ⎟ ⎝ ⎠

∑ ∑ (4.4) 

The present value of non-investment costs for alternative Aj are expressed as: 

0 1

/(1 )

T M j

t

j mjt

t m

PVC C d

= =

⎛ ⎞

= + ⎜ ⎟ ⎜ ⎟ ⎝ ⎠ ∑ ∑ (4.5) 

The present value of expected losses for alternative Aj are expressed as: 

() ( )

0 1

/(1 )

T Pj

t

j pjt

t p

PVE L E L d

= =

⎛ ⎞

= + ⎜ ⎟

⎝ ⎠

∑ ∑ (4.6) 

4.2.1 Life-Cycle Cost Method88

The life-cycle cost (LCC) method measures, in present-value or annual-value 

terms, the sum of all relevant costs associated with owning and operating a constructed 

facility over a specified period of time. The basic premise of the LCC method is that to 

an investor or decision maker all costs arising from that investment decision are 

potentially important to that decision, including future as well as present costs. Applied 

to constructed facilities, the LCC method encompasses all relevant costs over a 

designated study period, including the costs of designing, purchasing/leasing, 

constructing/installing, operating, maintaining, repairing, replacing, and disposing of a 

particular design or system. Should any pure benefits result (e.g., increased rental 

income due to improvements), include them in the calculation of LCC. 

The LCC method is particularly suitable for determining whether the higher initial 

cost of a constructed facility or system specification is economically justified by lower 

future costs (e.g., losses due to natural or manmade hazards) when compared to an 

alternative with a lower initial cost but higher future costs. If a design or system 

specification has both a lower initial cost and lower future costs relative to an alternative, 

an LCC analysis is not needed to show that the former is economically preferable. 

The LCC for alternative Aj may now be expressed as: 

 

88 For a detailed description of the ASTM life-cycle cost standard, see ASTM International. “Standard 

Practice for Measuring Life-Cycle Costs of Buildings and Building Systems,” E 917, Annual Book of 

ASTM Standards: 2002. Vol. 04.11. West Conshohocken, PA: ASTM International. 
36 

( )

0 11 1

/(1 )

T KM P jj j

t

j kjt mjt pjt

t km p

LCC I C E L d

= == =

⎛ ⎞

= ++ + ⎜ ⎟

⎝ ⎠

∑∑ ∑ ∑ (4.7) 

The LCC for alternative Aj may also be expressed in present value terms as: 

LCCj = PVIj + PVCj + PVE (Lj) (4.8) 

or, by explicitly including losses in investment costs and non-investment costs, as: 

LCCj = PVI'j

 + PVC'j (4.9) 

Denote the alternative with the lowest initial investment cost (i.e., first cost) as A0; 

it is referred to as the base case. Then: 

00 0j I < I for j = 1,..., N (4.10) 

The LCC method compares alternative, mutually exclusive, designs or system 

specifications that satisfy a given functional requirement on the basis of their life-cycle 

costs to determine which is the least-cost means (i.e., minimizes life-cycle cost) of 

satisfying that requirement over a specified study period. With respect to the base case, 

alternative Aj is economically preferred if, and only if, LCCj < LCC0. 

4.2.2 Present Value of Net Savings89

The present value of net savings (PVNS) method is reliable, straightforward, and 

widely applicable for finding the economically efficient choice among investment 

alternatives. It measures the net savings from investing in a given alternative instead of 

investing in the foregone opportunity (e.g., some other alternative or the base case). 

The PVNS for a given alternative, Aj, vis-à-vis the base case, A0, may be 

expressed as: 

PVNSj:0 = LCC0 - LCCj (4.11) 

Any pure benefits that result (e.g., increased rental income due to improvements) 

are included in the calculation of PVNS, since they are included in the LCC calculation. 

With respect to the base case, if PVNS j:0 is positive, alternative Aj is economic; if 

it is zero, the investment is as good as the base case; if it is negative, the investment is 

uneconomical. 

 

89 For a detailed description of the ASTM present value of net savings standard, see ASTM International. 

“Standard Practice for Measuring Net Benefits for Investments in Buildings and Building Systems,” E 

1074, Annual Book of ASTM Standards: 2002. Vol. 04.11. West Conshohocken, PA: ASTM International. 
37 

4.2.3 Savings-to-Investment Ratio90

The savings-to-investment ratio (SIR) is a numerical ratio whose size indicates 

the economic performance of a given alternative instead of investing in the foregone 

opportunity. The SIR is savings divided by investment costs. The LCC method provides 

all of the necessary information to calculate the SIR. The SIR for a given alternative, Aj, 

is calculated vis-à-vis the base case. The numerator and denominator of the SIR are 

derived through reference to Equation (4.9). 

The numerator equals the difference in the present value of non-investment costs 

inclusive of losses between the base case and the given alternative, Aj. The resultant 

expression, denoted as present value of savings, is given by: 

PVSj:0 = PVC'0 - PVC'j (4.12) 

The denominator equals the difference in the present value of investment costs 

inclusive of losses for the given alternative, Aj, and the base case.91 The resultant 

expression, denoted as present value of increased investment costs, is given by: 

PVIIj:0 = PVI'j - PVI'0 (4.13) 

The SIR for a given alternative, Aj, vis-à-vis the base case may be expressed as: 

:0

:0

:0

j

j

j

PVS

SIR

PVII = (4.14) 

A ratio less than 1.0 indicates that Aj is an uneconomic investment relative to the 

base case; a ratio of 1.0 indicates an investment whose benefits or savings just equal its 

costs; and a ratio greater than 1.0 indicates an economic project. Readers interested in a 

mathematical derivation of the SIR calculation and how to interpret the calculated value 

of the SIR for three special cases are referred to Appendix C. 

4.2.4 Adjusted Internal Rate of Return92

The adjusted internal rate of return (AIRR) is the average annual yield from a 

project over the study period, taking into account reinvestment of interim receipts. 

Because the AIRR calculation explicitly includes the reinvestment of all net cash flows, it 

 

90 For a detailed description of the ASTM savings-to-investment ratio standard, see ASTM International. 

“Standard Practice for Measuring Benefit-to-Cost and Savings-to-Investment Ratios for Investments in 

Buildings and Building Systems,” E 964, Annual Book of ASTM Standards: 2002. Vol. 04.11. West 

Conshohocken, PA: ASTM International. 

91 Do not use the savings-to-investment ratio as a decision criterion if PVI'j ≤ PVI'0. See Appendix C for a 

discussion of this and other topics associated with the calculation of the savings-to-investment ratio. 

92 For a detailed description of the ASTM adjusted internal rate of return standard, see ASTM International. 

“Standard Practice for Measuring Internal Rate of Return and Adjusted Internal Rate of Return for 

Investments in Buildings and Building Systems,” E 1057, Annual Book of ASTM Standards: 2002. Vol. 

04.11. West Conshohocken, PA: ASTM International. 
38 

is instructive to introduce a new term, terminal value (TV). The terminal value of an 

investment, Aj, is the future value (i.e., the value at the end of the study period) of 

reinvested net cash flows excluding all investment costs. The terminal value for an 

investment, Aj, is denoted as TVj. 

The reinvestment rate in the AIRR calculation is equal to the minimum acceptable 

rate of return (MARR), which is assumed to equal the discount rate, d, a constant. When 

the reinvestment rate is made explicit, all investment costs are easily expressible as a time 

equivalent initial outlay (i.e., a value at the beginning of the study period) and all noninvestment cash flows as a time equivalent terminal amount. This allows a 

straightforward comparison of the amount of money that comes out of the investment 

(i.e., the terminal value) with the amount of money put into the investment (i.e., the time 

equivalent initial outlay). 

The AIRR is defined as the interest rate, rj, applied to the terminal value, TVj, 

which equates (i.e., discounts) it to the time equivalent value of the initial outlay of 

investment costs. It is important to note that all investment costs are discounted to a time 

equivalent initial outlay using the discount rate, d. 

Several procedures exist for calculating the AIRR. These procedures are derived 

and described in detail in the report by Chapman and Fuller.93 The most convenient 

procedure for calculating the AIRR is based on its relationship to the SIR. This 

procedure results in a closed-form solution for a given alternative, Aj, vis-à-vis the base 

case, rj:0. The AIRR is that value of rj:0 for which: 

1

:0 :0 (1 )( ) 1 T

j j r d SIR =+ − (4.15) 

 With regard to the base case, if rj:0 is greater than the discount rate (also referred 

to as the hurdle rate), alternative Aj is economic; if rj:0 equals the discount rate, the 

investment is as good as the base case; if rj:0 is less than the discount rate, the investment 

is uneconomical. 

4.2.5 Appropriate Application of the Evaluation Methods94

The four evaluation methods presented in the previous sections provide the basis 

for evaluating the economic performance of homeland security-related investments in 

constructed facilities. The equations underlying the methods presented earlier are all 

consistent with ASTM standard practices. All of the methods are appropriate for 

evaluating accept or reject type decisions. But among the methods are several 

 

93 Chapman, Robert E. and Fuller, Sieglinde K. Benefits and Costs of Research: Two Case Studies in 

Building Technology. NISTIR 5840 (Gaithersburg, MD: National Institute of Standards and Technology, 

1996). 

94 For a comprehensive treatment of how to choose among economic evaluation methods, see the 

NIST/BFRL video (Marshall, Harold E. Choosing Economic Evaluation Methods—Part III in the 

Audiovisual Series on Least-Cost Energy Decisions for Buildings (Gaithersburg, MD: National Institute of 

Standards and Technology, 1995).) and workbook (Marshall, Harold E. Least-Cost Energy Decisions for 

Buildings—Part III: Choosing Economic Evaluation Methods Video Training Workbook. NISTIR 5604 

(Gaithersburg, MD: National Institute of Standards and Technology, 1995).). 
39 

distinctions that relate to the type of investment decision that the decision maker is 

facing. 

Investment decisions associated with alternative building designs or systems are 

frequently project-related, where a project could be the construction of a new building, 

the renovation of an existing constructed facility (e.g., a bridge), or the modernization of 

an existing system (e.g., an HVAC upgrade). For a given project, the decision maker has 

to choose among a number of competing alternatives, all of which satisfy the same 

functional requirements. If the project is to upgrade a building’s HVAC system and to 

address a number of generic security concerns, then each of the alternatives being 

considered will satisfy the functional requirements specified by the building’s 

owner/manager or some other designated decision maker. The four evaluation methods 

provide the means for identifying which alternative is the most cost-effective choice for 

implementing the project. At a higher level of aggregation, construction-related 

investment decisions often involve collections of projects. This section summarizes both 

the types of investment decisions and the applicability of the evaluation methods to these 

decision types. 

There are four basic types of investment decisions for which an economic analysis 

is appropriate: 

(1) whether to accept or reject a given alternative/project; 

(2) the most efficient alternative/project size/level, system, or design; 

(3) the optimal combination of interdependent projects (i.e., the right mix of sizes/levels, 

systems, and designs for a group of interdependent projects); and 

(4) how to prioritize or rank independent projects when the available budget cannot fund 

them all. 

Each type of investment decision is important. First and foremost, decision 

makers need to know whether or not a particular alternative/project or program should be 

undertaken in the first place. Second, how should a particular project/program be 

configured? The third type of decision builds on the second and introduces an important 

concept, interdependence. Consequently, for a given set of candidate projects and 

implied interdependencies, the problem becomes how to choose that combination of 

projects that minimizes LCC (or equivalently maximizes PVNS). The fourth type of 

decision introduces a budget constraint. The aim is how to get the most impact for the 

given budget. 

Table 4-1 provides a summary of when it is appropriate to use each of the 

evaluation methods described earlier. Note that the LCC and PVNS methods are 

appropriate in three of the four cases. Only in the presence of a budget constraint is the 

use of either LCC or PVNS inappropriate and even in that case it plays an important role 

in computing the aggregate measure of performance. 

In summary, no single evaluation method works for every decision type. First 

and foremost, managers want to know if a particular project is economic. Reference to 

Table 4-1 shows that all of the evaluation methods address this type of decision. Second, 
40 

as issues of design, sizing, and packaging combinations of projects become the focus of 

attention—as often occurs in conjunction with budget reviews—the LCC and PVNS 

methods emerge as the principle means for evaluating a project’s or program’s merits.95 

Finally, the tightening budget picture involves setting priorities. Consequently, decision 

makers need both measures of magnitude, provided by LCC and PVNS, and of return, 

provided by either the SIR or the AIRR, to assess economic performance. Multiple 

measures, when used appropriately, ensure consistency in both setting priorities and 

selecting projects for funding. 

Table 4-1 Summary of Appropriateness of Each Standardized Evaluation 

Method for Each Decision Type 

Decision Type LCC PVNS SIR AIRR 

Accept/Reject Yes Yes Yes Yes 

Design/Size Yes Yes No No 

Combination (Interdependent) Yes Yes No No 

Priority/Ranking (Independent) No No Yes Yes 

Source: “Standard Guide for Selecting Economic Methods for Evaluating Investments in Buildings and 

Building Systems.” E1185. ASTM International, 2002. 

4.2.6 Applying the Evaluation Methods: A Case Study 

The data center case study presented in this section illustrates how to apply the 

evaluation methods for a prototypical commercial building.96 It is based on an actual 

building renovation project. However, for purposes of confidentiality, a number of key 

building features have been changed. The case study, as in the actual building renovation 

project, focuses exclusively on two of the three mitigation strategies—engineering 

alternatives and management practices—for protection against terrorism. 

 The data center undergoing renovation is a single-story structure located in a 

suburban community. The renovation has been planned for some time to upgrade the 

data center’s HVAC, telecommunications and data processing systems and to address a 

number of generic security concerns. Specific risks evaluated in the case study are 

associated with the vulnerability of information technology resources, and the potential 

for damage to the facility and its contents from chemical, biological, radiological, and 

explosive (CBRE) hazards. 

The site upon which the data center is located is traversed by a thoroughfare that 

has been used by local residents since the data center was constructed. Alternative routes 

are available and convenient to local residents, subject to a short detour. Plans have been 

made by the community to put in a new street which better links the affected 

 

95 If incremental values of the SIR or AIRR are computed, they can be used to make design/size and 

packaging decisions. See Ruegg and Marshall, Building Economics, pp. 54-58 and 85-87. 96 For an in-depth description of the data center case study, see Chapman, Applications of Life-Cycle Cost 

Analysis to Homeland Security Issues in Constructed Facilities, pp. 21-68. 
41 

neighborhoods and does not traverse the data center’s site. The new street will be 

available for use within two years of the renovation. 

Senior management is considering two alternative renovation strategies. The 

basic renovation has an initial investment cost of $1 100 000 ($1 100K); it is designated 

as the Base Case. The enhanced renovation has an initial investment cost of $1 750K; it 

is designated as the Proposed Alternative. The renovation strategy that results in the 

lowest life-cycle cost will be the recommended alternative for use in the risk mitigation 

plan. 

Two types of analyses are employed to evaluate the merits of the Proposed 

Alternative vis-à-vis the Base Case. First, a baseline analysis is performed in which all 

values are fixed. Second, a sensitivity analysis based on Monte Carlo simulation is 

performed in which 21 key input variables are allowed to vary in combination according 

to an experimental design. These analysis types complement and reinforce each other. 

 The case study covers a 25-year period beginning in 2003. Life-cycle costs are 

calculated using a 4 % real discount rate for the baseline analysis. In the sensitivity 

analysis, the discount rate varies from 0 % to 8 %. Information on cost items is needed in 

order to calculate life-cycle costs. Cost items are classified under two broad headings: 

(1) input costs and (2) event-related costs. 

Input costs represent all costs tied to the building or facility under analysis that are 

not associated with an event. Input costs include the initial capital investment outlays for 

facilities and site work, future costs for electricity for lighting and space heating and 

cooling, future renovations, and any salvage value for plant and equipment remaining at 

the end of the study period. Input costs are classified as either investment costs or noninvestment costs; they are represented mathematically by Equations (4.1) and (4.2). 

Input costs serve to differentiate the Base Case and the Proposed Alternative. The 

life-cycle cost method (ASTM E 917) defines the base case as the alternative with the 

lowest initial capital investment cost. The additional costs of the “enhanced” renovation 

result not only in expected reductions in event-related costs, they also reduce the annual 

costs for electricity and telecommunications services and increase staff productivity due 

to improved indoor air quality. Finally, the change in the traffic pattern resulting from 

the enhanced renovation generates an increase in commuting costs for local residents 

until a new road is opened in two years. 

Event-related costs are based on annual outcomes, each of which has a specified 

probability of occurrence. Each outcome has a non-negative number of cost items 

associated with it (i.e., an outcome may have no cost items associated with it if it results 

in zero costs). In this case study, we model the risks associated with cyber attacks and 

CBRE attacks exclusively. The event modeling methodology, however, can also be used 

to model multiple hazards, such as those associated with earthquakes, high winds, or an 

accident resulting in widespread damage due to fire or chemical spills. 

Annual probabilities for the outcomes associated with each attack scenario are 

postulated along with associated outcome costs. The annual probabilities and outcome 

costs differ by renovation strategy. However, both the Base Case and the Proposed 

Alternative have similar types of outcome costs. Should a cyber attack occur, it results in 

damage to financial records and identity theft for a small set of corporate customers. 

Should a CBRE attack occur, it results in several non-fatal injuries, physical damage to 

the data center, interruption of business services at the data center, and denial of service 
42 

to corporate customers during recovery. Event-related costs are represented 

mathematically by Equation (4.3). 

Exhibit 4-1 summarizes the key findings from the baseline analysis. It provides a 

brief description of each renovation strategy and covers the background, approach, and 

results of the economic evaluation. Exhibit 4-1 is based on the summary format 

described in ASTM Standard Guide E 2204.97 The material presented in Exhibit 4-1 

provides a concise statement of why the Proposed Alternative is the “preferred” choice 

and documents the reasons for its selection. 

 The life-cycle cost figures presented in Section 3.a of Exhibit 4-1 enable us to 

calculate several additional economic measures that taken together provide useful 

information to decision makers. First, the difference between the life-cycle cost of the 

Base Case and the Proposed Alternative equals the present value of net savings (PVNS) 

resulting from choosing the Proposed Alternative. For the baseline analysis, the PVNS of 

the Proposed Alternative amounts to $682K. Second, the way in which the Budget 

Category cost items are defined enables us to calculate both the savings-to-investment 

ratio (SIR) and the adjusted internal rate of return (AIRR). The SIR equals the difference 

in non-investment costs—the savings stemming from the use of the Proposed Alternative 

rather than the Base Case—divided by the increased capital investment cost for the 

Proposed Alternative. Reference to Section 3.a of Exhibit 4-1 shows that the increased 

capital cost of the Proposed Alternative of $604K results in savings of $1 286K. These 

figures translate into an SIR of 2.13 (i.e., every dollar invested in the Proposed 

Alternative is expected to generate $2.13 in cost savings). Using the computed value of 

the SIR, we can calculate the AIRR. In this case, the AIRR over the 25-year study period 

is 7.2 %, which exceeds the hurdle rate of 4 %. Finally, the use of multiple economic 

measures provides alternative views of the same decision process. Specifically, PVNS 

provides a measure of magnitude, whereas the SIR is a multiplier, and the AIRR is an 

annual rate of return. 

Exhibit 4-1 provides a compact summary of the results of the baseline analysis. 

Although the baseline analysis guides the formulation of the risk mitigation plan, it does 

not address the implications of uncertainty in the values of the key input variables. A 

sensitivity analysis augments the baseline analysis by providing the decision maker with 

additional background and perspective. The sensitivity analysis uses the same data and 

assumptions as the baseline analysis for its starting point. The objective of the sensitivity 

analysis is to evaluate how uncertainty in the values of 21 input variables translates into 

changes in each of five key economic measures. The five economic measures evaluated 

in the sensitivity analysis are: (1) the life-cycle costs of the Base Case (LCCBC); (2) the 

life-cycle costs of the Proposed Alternative (LCCAlt); (3) the present value of net savings 

(PVNS) resulting from the Proposed Alternative; (4) the savings-to-investment ratio 

(SIR) produced by the additional capital investment in the Proposed Alternative; and (5) 

the adjusted internal rate of return (AIRR) on the additional capital investments 

associated with the Proposed Alternative. The calculation of each economic measure is 

based on a “sample of 1,000 observations” produced by the Monte Carlo simulation. 

 

97 ASTM International. “Standard Guide for Summarizing the Economic Impacts of Building Related 

Projects,” E2204, Annual Book of ASTM Standards: 2002. Vol. 4-12. West Conshohocken, PA: ASTM 

International.
43 

Exhibit 4-1 Summary of the Data Center Case Study 

1.a Significance of the Project:

The data center undergoing renovation is a single-story 

structure located in a suburban community. The floor area of the 

data center is 3 716 m2

 (40 000 ft2). The replacement value of the 

data center is $20 million for the structure plus its contents. The 

data center contains financial records that are in constant use by 

the firm and its customers. Thus, any interruption of service will 

result in both lost revenues to the firm and potential financial 

hardship for the firm’s customers. The occupants of the data center 

are part of the same parent company, but not part of the same 

corporate division responsible for facilities construction and 

renovation. 

The building owners employ two different renovation 

strategies. The first, referred to as the Base Case, employs 

upgrades which are consistent with pre-9/11 levels of security. 

Thus, the Base Case represents maintenance of the status quo. The 

second, referred to as the Proposed Alternative, recognizes that in 

the post-9/11 environment the data center faces heightened risks in 

two areas. These risks are associated with the vulnerability of 

information technology resources and the potential for damage to 

the facility and its contents from chemical, biological, 

radiological, and explosive (CBRE) hazards. Two scenarios—the 

potential for a cyber attack and the potential for a CBRE attack—

are used to capture these risks. 

1.b Key Points:

1. The objective of the renovation project is 

to provide cost-effective operations and 

security protection for the data center. 

2. The renovation has been planned for 

some time to upgrade the data center’s 

HVAC, telecommunications and data 

processing systems and to address a 

number of generic security concerns. 

3. Two upgrade alternatives are proposed: 

 - Base Case (Basic Renovation) and 

 - Proposed Alternative (Enhanced 

Renovation), which augments the Base 

Case by strengthening portions of the 

exterior envelope, limiting vehicle 

access to the data center site, 

significantly improving the building’s 

HVAC, data processing and 

telecommunications systems, and 

providing better linkage of security 

personnel to the telecommunications 

network. 

2. Analysis Strategy: How Key Measures are Estimated 

The following economic measures are calculated as present-value (PV) amounts: 

(1) Life-Cycle Costs (LCC) for the Base Case (Basic Renovation) and for the Proposed Alternative (Enhanced 

Renovation), including all costs of acquiring and operating the data center over the length of the study period. 

The selection criterion is lowest LCC. 

(2) Present Value Net Savings (PVNS) that will result from selecting the lowest-LCC alternative. PVNS > 0 

indicates an economically worthwhile project. 

Additional measures: 

(1) Savings-to-Investment Ratio (SIR), the ratio of savings from the lowest-LCC to the extra investment required 

to implement it. A ratio of SIR >1 indicates an economically worthwhile project. 

(2) Adjusted Internal Rate of Return (AIRR), the annual return on investment over the study period. An AIRR > 

discount or hurdle rate indicates an economically worthwhile project. 

Data and Assumptions: 

- The Base Date is 2003. 

- The alternative with the lower first cost (Basic Renovation) is designated the Base Case. 

- The study period is 25 years and ends in 2027. 

- The discount or hurdle rate is 4.0 % real. 

- Annual probabilities for the outcomes for each attack scenario are given along with outcome costs. 

- Annual probabilities and outcome costs differ by renovation strategy. 

- Both the Base Case and the Proposed Alternative have similar types of outcome costs. Should a cyber attack 

occur, it results in damage to financial records and identity theft for a small set of corporate customers. Should 

a CBRE attack occur, it results in several non-fatal injuries, physical damage to the data center, interruption of 

business services at the data center, and denial of service to corporate customers during recovery. 
44 

3.b Key Results: 

 LCC 

Base Case $5 937K 

 Proposed Alt. $5 255K 

 PVNS from Alt. $682K 

 SIR 2.13 

 AIRR 7.2 %

3.a Calculation of Savings, Costs, and Additional Measures 

Savings and Costs in Thousands of Dollars ($K) 

 PV of Investment Costs Base Case Proposed Alt. 

 Capital Investment $1 168K $1 772K 

 Increased Total PV Investment for Proposed Alt. $604K 

PV of Non-Investment Costs Base Case Proposed Alt. 

 O&M Costs 4 082K 3 201K 

 Other Costs 687K 282K

 $4 769K $3 483K 

 PV of Non-Investment Savings for Proposed Alt. $1 286K 

LCC Base Case Proposed Alt.

 PV of Investment Costs 1 168K 1 772K 

 PV of Non-Investment Costs 4 769K 3 483K

 $5 937K $5 255K 

PVNS from Proposed Alternative $682K 

Savings-to-Investment Ratio (SIR) 

PV of Non-Investment Savings $1 286K 

Divided by PV of Incr. Investment 604K 

 SIR = 2.13 

Adjusted Internal Rate of Return (AIRR) 

(1+0.04) 2.131/25 – 1 = 0.072 

 AIRR = 7.2 % 

which exceeds the hurdle rate of 4.0 % 

3.c Traceability: 

Life-cycle costs and supplementary 

measures were calculated according to 

ASTM standards E 917, E 964, E 1057, 

and E 1074. 

Variations in the values of the 21 variables translate into the value of each 

outcome (e.g., the SIR) in such a manner that the impacts of uncertainty can be measured 

quantitatively.98 Three of the 21 variables apply to both the Base Case and the Proposed 

 

98 Readers wishing greater detail on the sensitivity analysis are referred to the companion document, 

NISTIR 7025. The companion document provides detailed information on each of the 21 input variables 

evaluated in the sensitivity analysis, including their “best” case and “worst” case settings and how the 

probability distribution for each variable was specified. Among the key variables included in the 

sensitivity analysis were the discount rate, the probability and severity of an attack, the costs of the basic 

and enhanced renovations, the costs of business interruption should an attack occur, and the damages to the 

data center associated with an attack. Special attention was given to the event-related costs and their 

drivers (e.g., the probability and severity of an attack) because greater uncertainty is associated with their 

values than for input costs (e.g., renovation costs). The companion document includes a deterministic 

sensitivity analysis as well as the Monte Carlo simulation presented in this report. The deterministic 

sensitivity analysis was used to identify those variables having the greatest impact on life-cycle costs. This 

was accomplished by varying each input variable singly while holding all other input variables at their 

baseline values. The variables having the greatest impact on life-cycle costs were the discount rate, 

Exhibit 4-1 Summary of the Data Center Case Study (Cont.) 
45 

Alternative. Eight of the variables apply to the Base Case. The 10 remaining variables 

apply to the Proposed Alternative. 

The results of Monte Carlo simulation are presented in both tabular and graphical 

formats. The tabular format—Table 4-2—records information on each of the five 

economic measures; it reports a variety of computed statistics for each economic 

measure. Figure 4-1 records the distribution of the observed values for the life-cycle 

costs of the Base Case and the Proposed Alternative side-by-side as an indication of the 

degree to which the Proposed Alternative is preferred to the Base Case. 

The statistical measure and its corresponding value are recorded under the 

heading Statistical Measure in Table 4-2. Seven statistical measures are reported to 

characterize the results of each Monte Carlo simulation. The calculation of these 

statistical measures is based on a “sample of 1 000 observations” produced by the Monte 

Carlo simulation. These statistical measures are: (1) the minimum; (2) the 25th percentile, 

denoted by 25%; (3) the 50th percentile (i.e., the median), denoted by 50%; (4) the 75th

percentile, denoted by 75%; (5) the maximum; (6) the mean; and (7) the standard 

deviation. The minimum and the maximum define the range of values for the results of 

the Monte Carlo simulation. The 50th percentile and the mean are measures of central 

tendency. The 25th and 75th percentiles define the interquartile range, a range that 

includes the middle 50 percent of the observations. The interquartile range is also a crude 

measure of central tendency. The standard deviation measures the variability of the 

results of the Monte Carlo simulation. The values reported for LCCBC, LCCAlt, and 

PVNS are all in thousands of 2003 dollars. 

Table 4-2 Summary Statistics Due to Changes in All of the Variables

Statistical Measure 

Economic 

Measure Minimum 25 % 50 % 75 % Maximum Mean Standard 

Deviation 

LCCBC 4 344.264 5 090.509 6 007.620 7 196.295 9 022.518 6 216.082 1 300.610 

LCCAlt 4 012.033 4 648.762 5 319.521 6 157.292 7 428.776 5 450.631 925.923 

PVNS 45.546 438.144 707.783 1 049.742 1 884.364 765.451 396.182 

SIR 1.055 1.718 2.196 2.864 6.144 2.357 0.827 

AIRR 0.042 0.063 0.073 0.085 0.118 0.074 0.014 

Table 4-2 summarizes the results of the Monte Carlo simulation. A close 

examination of Table 4-2 reveals several interesting outcomes. First, the range of 

values—the difference between the minimum and maximum—is very wide. For 

example, the minimum value of life-cycle costs for the Base Case (LCCBC) is 

approximately $4.3 million, whereas the maximum is approximately $9.0 million. Lifecycle costs for the Proposed Alternative (LCCAlt) range from slightly more than $4.0 

million to almost $7.5 million. Second, the computed value of the mean equals or 

exceeds the computed value of the median for each of the economic measures. This is 

because a small number of very large observations are pulling up the computed value of 

the mean. Finally, the computed values of the mean of each of the five economic 

 renovation costs, and the probability and severity of an attack. See Chapman, Applications of Life-Cycle 

Cost Analysis to Homeland Security Issues in Constructed Facilities, pp. 41-68. 
46 

measures are higher than the corresponding baseline value. This is due to a small number 

of very large observations. 

Life-cycle cost results of the sensitivity analysis are shown graphically in Figure 

4-1. The life-cycle costs of the Base Case are compared to those of the Proposed 

Alternative, LCCAlt. The results of the Monte Carlo simulation produced 1 000 

observations of LCCBC and 1 000 observations of LCCAlt. These observations were used 

to produce the two traces shown in Figure 4-1. The figure was constructed by first 

sorting the values of LCCBC and LCCAlt from smallest to largest. The resultant 

cumulative distribution function was then plotted. The vertical axis records the 

probability that the economic measure—LCCBC or LCCAlt—is less than or equal to a 

specified value. The values recorded on the horizontal axis cover the range of values 

encountered during the Monte Carlo simulation. 

Figure 4-1 Life-Cycle Costs for Each Alternative in Thousands of Dollars Due to 

Changes in All of the Variables 

In analyzing Figure 4-1, it is useful to keep in mind that the values of LCCBC and 

LCCAlt from the baseline analysis were $5 937K and $5 255K, respectively. 

Comparisons between Figure 4-1 and Table 4-2 are also helpful in interpreting the results 

of the Monte Carlo simulation. First, notice that the life-cycle cost trace of the Proposed 

Alternative in Figure 4-1 always remains to the left of the life-cycle cost trace of the Base 

Case. Thus, for any given probability (e.g., 0.40), the life-cycle cost of the Proposed 

Alternative ($5 000K) is less than the life-cycle cost of the Base Case ($5 600K). 

Similarly, for any given life-cycle cost (e.g., $5 000K), the probability of being less than 

or equal to that cost is higher for the Proposed Alternative (0.40) than for the Base Case 

(0.23). Second, the horizontal distance between the Proposed Alternative and the Base 

Case gets larger as the cumulative probability moves from 0.00 to 1.00. This translates 

into a wider range of life-cycle costs for the Base Case (i.e., maximum minus minimum); 

0.00

0.10

0.20

0.30

0.40

0.50

0.60

0.70

0.80

0.90

1.00

4,000 4,500 5,000 5,500 6,000 6,500 7,000 7,500 8,000 8,500 9,000

Life-Cycle Costs in Thousands of Dollars

Cumulative Probability

Alternative

Base Case
47 

it is reflected in the higher standard deviation for the Base Case recorded in the last 

column of Table 4-2. Figure 4-1 clearly demonstrates that the Proposed Alternative is the 

most cost-effective renovation strategy. 

Both the baseline and sensitivity analyses demonstrate that the Proposed 

Alternative results in lower life-cycle costs and is hence the more cost-effective choice. 

The additional economic measures shown in Exhibit 4-1 and Table 4-2 underscore the 

superior performance of the Proposed Alternative. 

4.3 The Need for a Detailed Cost-Accounting Framework 

The cost categories defined in Equations (4.1) through (4.6) provide the basis for 

calculating life-cycle costs. The flexibility of the life-cycle cost method, however, 

enables us to go beyond the generic cost categories represented in these equations. The 

result is a more focused representation of costs, referred to as the detailed cost-accounting 

framework. The objective of producing this framework is to promote better decision 

making by identifying unambiguously who bears which costs, how costs are allocated 

among several widely-accepted budget categories, how costs are allocated among key 

building components, and how costs are allocated among the three mitigation strategies. 

A detailed cost-accounting framework is needed because costs affect stakeholders in 

different ways. Thus, knowing who bears which costs leads to a better understanding of 

stakeholder perspectives and helps create mutually beneficial solutions. Finally, the costaccounting framework promotes a detailed, consistent breakdown of life-cycle costs so 

that a clear picture emerges of the cost differences between competing alternatives. 

The description of the cost-accounting framework given here employs a projectoriented approach. Such an approach is instructive since most construction activity is 

summarized on a project basis. This approach also helps to link the methodology to the 

software product. A project could be the construction of a new building, industrial 

facility, or infrastructure. A project could also be the renovation of an existing 

constructed facility. 

Costs are classified along four dimensions within the detailed cost-accounting 

framework: (1) bearer of costs; (2) budget category; (3) building/facility component; and 

(4) mitigation strategy. To differentiate these costs from the generic cost categories, they 

are referred to as cost types and cost items. Each dimension contains a collection of cost 

types. The cost types are used as placeholders for summarizing and reporting aggregated 

cost information. Each cost type is a collection of cost items. Each cost item has a 

unique set of identifiers that places it within the cost-accounting framework. Each 

dimension captures the full spectrum of costs (i.e., all costs summed across each 

dimension add up to the same total). A schematic representation of the cost-accounting 

framework is given in Figure 4-2. Within Figure 4-2, each of the four dimensions of 

costs is listed within a box. Beneath each box are listed the cost types associated with 

that cost dimension. 
48 

Figure 4-2 Overview of the Cost-Accounting Framework: Dimensions and Cost 

Types 

The first dimension, Bearer of Costs, covers all stakeholder groups. A 

stakeholder group is defined as any collection of organizations or individuals directly 

affected by the project (e.g., by construction or risk mitigation activities or by disasterrelated losses). The first dimension, Bearer of Costs, has three cost types based on who 

bears the costs. The three cost types are: (1) Owner/Manager; (2) Occupant/User; and (3) 

Third Party. Owner/Manager costs are all costs incurred by the project’s owner or agent. 

These costs include but are not limited to design costs, capital investment costs, and 

selected types of repairs to the constructed facility. Occupant/User costs accrue to the 

direct users of the project. Occupant/User costs frequently include operations and 

maintenance costs and selected types of repairs not covered by the project’s owner or 

agent. Occupant/User costs can also include delay costs and business interruption costs 

due to temporary closures for repair and reconstruction activities. Third-Party costs are 

all costs incurred by entities who are neither the project’s owner or agent nor direct users 

of the project. One example of a Third-Party cost is the lost sales for a business 

establishment whose customer access has been impeded (e.g., due to a road closure 

during construction/reconstruction). Another example is damage to the environment 

from a construction process that pollutes the water, land, or atmosphere. 

The second dimension, Budget Category, has three cost types based on which 

category of the budget the funds come from. These cost types are: (1) Capital 

Investment; (2) O&M (Operations and Maintenance); and (3) Other. These cost types 

correspond to widely used budget categories for private and public sector cost 

accounting. It is important to note that the dollar amounts accruing to all three cost types 

are inclusive of any expected losses. In the context of the previous section, Capital 

Investment costs accrue to the investment cost category and O&M and Other costs accrue 

to the non-investment cost category. NIST Handbook 135 is especially helpful in 

Bearer of 

Costs 

Owner/Manager 

Occupant/User 

Third Party 

Budget 

Category 

Capital 

Investment 

O&M 

Other 

Building/ 

Facility 

Component

Building/Facility 

Elements

Building/Facility 

Site Work

Non-Elemental 

Mitigation 

Strategy 

Engineering 

Alternatives 

Management 

Practices 

Financial 

Mechanisms
49 

determining how to allocate cost items among Capital Investment and O&M.99 All 

acquisition costs, including costs related to planning, design, purchase, and construction, 

are investment-related costs and fall under the Capital Investment cost type. Residual 

values (resale, salvage, or disposal costs) and capital replacement costs are also 

investment-related costs. Capital replacement costs are usually incurred when replacing 

major systems or components and are paid from capital funds. Cost items falling under 

the O&M cost type include energy and water costs, maintenance and repair costs, minor 

replacements related to maintenance and repair, and insurance premiums paid by owners 

and/or occupants to reduce their risk exposure. O&M costs are usually paid from an 

annual operating budget, not from capital funds. Other costs are non-capital costs that 

cannot be attributed to the O&M cost type. An example of an Other/Third-Party cost is 

damage to the environment stemming from the project. 

The third dimension, Building/Facility Component, has three cost types. These 

cost types are: (1) Building/Facility Elements; (2) Building/Facility Site work; and (3) 

Non-Elemental. The first two cost types are associated with the elemental classification 

UNIFORMAT II.100 Elements are an integral part of any construction project; they are 

often referred to as component systems or assemblies. Each element performs a given 

function regardless of the materials used, design specified, or method of construction 

employed. Non-Elemental costs are all costs that cannot be attributed to specific 

functional elements of the project. An example of a Non-Elemental/Capital/Owner cost 

is the purchase of a right-of-way, or easement. 

The fourth dimension, Mitigation Strategy, has three cost types. The three cost 

types correspond to the three risk mitigation strategies described in Chapter 2; they are: 

(1) Engineering Alternatives; (2) Management Practices; and (3) Financial Mechanisms. 

Chapter 2 provides an in-depth discussion of the three mitigation strategies, as well as 

examples of generic cost items falling under each of the three mitigation strategies. 

Examples of specific cost items employed in the case study are: (1) capital costs 

associated with either the basic or enhanced renovation, which are allocated to 

Engineering Alternatives, and (2) increases in commuting costs for local residents due to 

the change in the traffic pattern resulting from the Proposed Alternative, which are 

allocated to Management Practices. 

The previous discussion serves to highlight some of the differences in perspective 

between public sector and private sector decision makers. A private sector decision 

maker may not be concerned with costs that are external to their firm. This perspective 

has a significant impact on what is included and what is excluded in the Third Party and 

Other cost types. Generally, this is in contrast to the public sector decision maker who 

must assess all costs to whomsoever they accrue. In the case of homeland security 

activities, however, the private sector perspective is often more in line with the public 

sector’s perspective. Natural hazards, industrial accidents, and terrorist acts that occur 

infrequently, but whose consequences are devastating, highlight the importance of 

 

99 Fuller, Sieglinde K., and Petersen, Stephen R. Life-Cycle Costing Manual for the Federal Energy 

Management Program. NIST Handbook 135 (Gaithersburg, MD: National Institute of Standards and 

Technology, 1996). 

100 ASTM International. “Standard Classification for Building Elements and Related Site Work—

UNIFORMAT II,” E 1557, Annual Book of ASTM Standards: 2002. Vol. 04.11. West Conshohocken, 

PA: ASTM International. 
50 

including Third Party and Other cost types in the private sector’s life-cycle cost calculus. 

Including these costs also helps to identify areas for public policy analysis (e.g., the role 

of financial incentives), bringing private sector and public sector perspectives into closer 

alignment. 

The case study introduced earlier employs the cost accounting framework to 

demonstrate how it promotes better decision-making. The cost-accounting framework, as 

employed in the case study, illustrates how costs affect stakeholders in different ways. 

This leads to a better understanding of stakeholder perspectives and helps create mutually 

beneficial solutions. Finally, the cost-accounting framework promotes a detailed, 

consistent breakdown of life-cycle costs so that a clear picture emerges of the cost 

differences between competing alternatives. 

Table 4-3 summarizes the results of the baseline analysis for the Base Case and 

the Proposed Alternative. All costs reported in Table 4-3 are life-cycle costs. Since 

Table 4-3 includes all input and event-related costs, it represents a complete picture of the 

baseline analysis. 

The Life-Cycle Cost for the Base Case of $5 937 608 equals the sum of the cost 

items listed under each Cost Classification (i.e., $5 937 608 = $3 297 962 + $1 971 941 + 

$667 705 = $1 168 484 + $4 081 892 + $687 233 = $2 826 402 + $155 626 + $2 955 581 

= $3 873 520 + $2 064 088). Thus, whether we look at costs from the Bearer 

perspective, from the Budget Category perspective, by Component, or by Mitigation 

Strategy, all costs are included and classified accordingly.

Life-cycle costs for the Proposed Alternative are calculated in exactly the same 

manner as for the Base Case. The Life-Cycle Cost for the Proposed Alternative is 

$5 254 903. Note that this cost is less than the Life-Cycle Cost of the Base Case. This is 

because the Proposed Alternative includes a number of features that produce future cost 

savings. These cost savings partially offset the increased Capital Investment costs for the 

Proposed Alternative. As a general rule, whenever the potential for a spillover benefit 

exists (e.g., improved indoor air quality), consider incorporating it into the risk mitigation 

plan and evaluating its impact on life-cycle cost. 

Reference to Table 4-3 demonstrates that the Proposed Alternative is the most 

cost-effective choice, since it results in the lowest life-cycle cost (i.e., $5 254 903 versus 

$5 937 608). Table 4-3 also provides a concise snapshot of how the Base Case and the 

Proposed Alternative affect different stakeholder groups. Note that Occupant/User and 

Third Party costs are higher for the Base Case, whereas Owner/Manager costs are higher 

for the Proposed Alternative. Understanding who bears which costs is an essential 

component of the risk mitigation plan. In this case, two of the sets of “Bearer” costs 

(Owner/Manager and Occupant/User) are borne by the same “parent company.” If one 

were to “drill down” on Third Party costs, we would find that the bulk of these costs are 

borne by the data center’s customers. Thus, as we exploit information from the cost 

accounting framework, additional strengths of the Proposed Alternative emerge. 

This chapter presents a decision methodology which enables the reader to conduct 

a comprehensive economic evaluation of alternative risk mitigation plans. Chapter 5 

describes a proposed software product designed specifically to implement the decision 

methodology. 
51 

Table 4-3 Summary of Life-Cycle Costs for the Data Center Case Study

D e cision Crite rion/ 

Cost Type

Base Case 

(in $)

Propose d 

Alte rnative (in $)

Life-Cycle Cost 5 937 608 5 254 903

Be are r: O wner/Manager 3 297 962 3 472 413

O ccupant/User 1 971 941 1 505 989

Third Party 667 705 276 501

Cate gory: Capital Investment 1 168 484 1 771 858

O&M 4 081 892 3 200 685

O ther 687 233 282 359

Component: Building/Facility Elements 2 826 402 3 028 991

Building/Facility Site W ork 155 626 246 355

N on-Elemental 2 955 581 1 979 557

Strate gy: Engineering Alternatives 3 873 520 3 509 327

Management Practices 2 064 088 1 745 576

Financial Mechanisms 0 0

Cost 

Classification
52 
53 

5 Proposed Software Product for Implementing the Decision 

Methodology 

The proposed software product, being developed by the Office of Applied 

Economics (OAE), is designed to implement the decision methodology described in 

Chapter 4. The software product supports the fourth stage of the economic evaluation—

the presentation and analysis of the measures of economic performance in a form that 

clearly details the important assumptions underlying the economic evaluation and the 

implications of these assumptions for the study’s conclusions. The software product will 

provide decision support to building owners and managers who would like to protect 

their facilities and occupants in a cost-effective manner. It will allow building owners 

and managers to make comparisons among several alternative risk mitigation measures 

under different user-defined disaster scenarios. 

The user-friendly software will systematically prompt the user to enter 

information about the costs and timing of implementing protective measures, with the 

costs disaggregated by Bearer, Budget Category, Building Component, and Mitigation 

Strategy. Embedded in the software will be the decision rules, which will take into 

account the life-cycle costs, the cost implications of the different alternatives, and any 

relevant financial incentives of the alternatives. 

The economic evaluation of the alternative risk mitigation strategies will also 

depend on the probabilities that the user assigns to the various event outcomes. The 

software will allow the user to enter parameters for hazards and risk, including the 

probability of occurrence, and the type and magnitude of damage and losses. 

The software product has two analysis options: (1) baseline analysis and (2) 

sensitivity analysis. These analysis options link directly to four key features of the 

software product. These features are concerned with: (1) the cost-accounting framework; 

(2) the “Cost Summary” window of the software product; (3) selected data inputs; and (4) 

selected output reports. These features are described in Section 5.1 through 5.4. 

The finalized version of the proposed software product (version 2.0) is scheduled 

for public release in March 2006. Prior to the release of version 2.0 in March 2006, OAE 

will make available for public release a beta version (September 2004) and version 1.0 

(March 2005) of the software product. Readers interested in obtaining the software are 

encouraged to visit the OAE cost-effectiveness tool (CET) status line at 

http://www.bfrl.nist.gov/oae/software/cet.html. The status line will provide up-to-date 

information on the software development effort and instructions for downloading the 

software. Readers who download and use the software are encouraged to contact OAE 

with comments. Additional information on the features associated with each public 

release—the beta version, version 1.0, and version 2.0—is presented in Section 5.5, 

where the software’s analysis features are linked to its rollout schedule. 

5.1 How the Software Links to the Cost-Accounting Framework 

The software product employs the same cost-accounting framework as described 

in Section 4.3 and illustrated in Figure 4-2 and Table 4-3. As the user of the software 

product inputs data on each cost item, each cost item is classified according to its Bearer, 

Budget Category, Building Component, and Mitigation Strategy. The input screens, Cost 
54 

Summary window, and output reports for the baseline analysis option of the software 

product are all identical in their use of the cost-accounting framework. The sensitivity 

analysis option of the software product employs the same cost-accounting framework. 

This promotes a close coupling between the sensitivity analysis and the baseline analysis. 

The “roll ups” to the cost types and cost classifications for individual cost items are 

identical to those used in the baseline analysis. Thus, any changes in life-cycle cost are 

traceable to variations in input variables about their baseline values. Such an approach 

promotes in-depth analyses via the “drill down” feature described later in this chapter. 

5.2 Cost Summary Window and Main Menu 

The Cost Summary window is displayed whenever a new project is started or an 

existing project file is opened. When a project is created, the Cost Summary window is 

blank. Figure 5-1 is an example of the Cost Summary window display when starting a 

new project. As the user enters data into the software, the Cost Summary window 

displays the current value of life-cycle costs for each cost type and alternative being 

analyzed. It is recommended that the user keep the Cost Summary window open while 

working in the software. If the user wishes to close the window, it can be reopened at 

any time. 

Figure 5-1 Cost Summary Window When Starting a New Project 
55 

The software is designed to analyze up to four alternatives (see Figure 5-1). The 

Cost Summary window allows the user to specify both the cost types and the alternatives 

to be included in the economic evaluation. These “choices” are represented in Figure 5-1 

by the “cost type” buttons and the “alternative” buttons. 

A tree on the left-hand side of the Cost Summary window serves as the Main 

Menu to the software. The tree contains three top-level nodes: Project, Analysis, and 

Reports.

101

5.3 Project Information 

The items listed under the Project node allow the user to enter project 

information, define alternatives, and manage cost-related information. Clicking the 

Description option on the Main Menu opens the Project Description window. Here the 

user can enter project information such as name, description, base year, length of the 

study period, and the discount rate. Figure 5-2 displays the Project Description window 

for the data center case study. The Alternatives option allows the addition and deletion of 

project alternatives as well as entry of information about the alternatives. 

Figure 5-2 Project Description Window for the Data Center Case Study 

 

101 Software features are highlighted through the use of italics font. 
56 

Cost-related input screens for the software product are of two basic types: (1) 

input costs and (2) event-related costs. The user accesses these screens by selecting the 

Costs or Events options on the Main Menu.102 

5.3.1 Input Costs 

Clicking the Costs option opens the costs portion of the Edit Costs/Events 

window. The events portion of the Edit Cost/Events window is grayed out, indicating 

that it is inactive. This screen manages the creation, deletion, and editing of input costs. 

Upon entering the Edit Costs/Events window, the user selects the alternative for which 

cost information is to be reviewed or input. Once the alternative is selected, the Edit 

Costs/Events window displays all cost items associated with that alternative. Figure 5-3 

is an example of the Edit Costs/Events window for the Base Case. Notice that the input 

costs are listed in alphabetical order according to their Budget Category—Investment, 

O&M, and Other. In this case, some costs are hidden, but can be viewed by scrolling 

down the list. 

Highlighting and clicking the selected cost item opens the appropriate Cost 

Information window. This “edit” feature allows the user to review and, if desired, 

modify any previously recorded information for the cost item of interest. Figure 5-4 is an 

example of the Capital Investment Cost Information window for the data center case 

study. Figure 5-4 displays information on the Basic Renovation cost item, which is 

associated with the Base Case. Figure 5-5 is an example of the Other Cost Information 

window for the Change in Traffic Pattern cost item for the Proposed Alternative. Note 

that Figures 5-4 and 5-5 include a Classification Information group box which specifies 

how each cost item fits into the cost-accounting framework. 

The Edit Costs/Events window is the means through which new cost items are 

created. The creation of a new cost item is accomplished by selecting the appropriate 

Budget Category cost type—Capital Investment, O&M, or Other—from the Select Action

group box. The software then opens the Cost Information window associated with the 

selected cost type. The Cost Information windows allow the user to name the cost item, 

generate a cost estimate via separate entries for quantity and unit cost, and specify the 

timing of cash flows and any escalation rates that need to be applied (see Figures 5-4 and 

5-5). 

 

102 Unless otherwise noted, all software features described in Sections 5.3 and 5.4 will be operational in the 

beta version scheduled for release in September 2004. 
57 

Figure 5-3 Edit Costs/Events Window for the Data Center Case Study: Input 

Costs for the Base Case 

Figure 5-4 Capital Investment Cost Information Window for the Data Center 

Case Study: Basic Renovation 
58 

Figure 5-5 Other Cost Information Window for the Data Center Case Study: 

Change in Traffic Pattern for the Proposed Alternative 

5.3.2 Event-Related Costs 

Clicking the Events option opens the events portion of the Edit Costs/Events 

window. The costs portion of the Edit Costs/Events window is grayed out, indicating that 

it is inactive. Recall that in Figure 5-3, the costs portion of the Edit Costs/Events window 

was active and the events portion was grayed out. Clicking the Events option just 

switches the active and inactive portions of Figure 5-3. This screen manages the creation, 

deletion, and editing of event-related costs. Upon entering the Edit Costs/Events 

window, the user selects the alternative for which event-related information is to be 

reviewed or input. Once the alternative is selected, the screen displays all events 

associated with that alternative. 

Highlighting and clicking the selected event opens the Event Information 

window. This feature allows the user to review and, if desired, modify any previously 

recorded information for the event of interest. The Edit Costs/Events window is the 

means through which new events are created. The creation of a new event is 

accomplished by selecting Create New from the Select Action group box. The software 

then opens the Event Information window. The Event Information window allows the 

user to name the event, provide a brief description of the event, enter the dates of first and 

last occurrence, and edit event-related outcomes. Figure 5-6 is an example of the Event 

Information window for the Cyber Attack scenario for the Base Case. Reference to 

Figure 5-6 shows that this Cyber Attack scenario covers the first 10 years of the study 

period. A second Cyber Attack scenario covers years 11 through 25. Two time periods 

are used because cyber crime is on the rise and although new countermeasures are being 

produced regularly, hackers are becoming more adept at finding and exploiting 

weaknesses in countermeasures software. 
59 

Figure 5-6 Event Information Window for the Data Center Case Study: 

Description of the Cyber Attack Scenario for the Base Case 

Associated with each event is a set of outcomes. Information on event-related 

outcomes is accessed via the Edit Outcomes/Outcome Costs window. This screen is 

reached by clicking the Edit Outcomes option in the Event Information window (see 

Figure 5-6). Clicking the Edit Outcomes option opens the outcomes portion of the Edit 

Outcomes/Outcome Costs window. Figure 5-7 is an example of the Edit 

Outcomes/Outcome Costs window for the first Cyber Attack scenario for the Base Case. 

This screen manages the creation, deletion, and editing of outcomes. The Edit 

Outcomes/Outcome Costs window displays all outcomes associated with the event of 

interest. The event/outcome costs portion of the Edit Outcomes/Outcome Costs window 

is grayed out, indicating that it is inactive. 

Highlighting and clicking the selected outcome opens the appropriate Outcome 

Information window. This feature allows the user to review and, if desired, modify any 

previously recorded information for the outcome of interest. The Edit Outcomes window 

is the means through which new outcomes are created. The creation of a new outcome is 

accomplished by selecting Create New from the Select Action group box. The software 

then opens the Outcome Information window. The Outcome Information window allows 

the user to name the outcome, provide a brief description of the outcome, assign a 

probability of occurrence for the outcome,103 update the sum of all outcome probabilities 

for the event of interest, and edit outcome-related cost items. Figure 5-8 is an example of 

the Outcome Information window; it provides a brief description of the outcome and an 

outcome probability for the first Cyber Attack scenario for the Base Case. 

 

103 Outcome probabilities are a byproduct of the risk assessment (see Section 3.1). 
60 

Figure 5-7 Edit Outcomes/Outcome Costs window for the Data Center Case 

Study: Base Case Cyber Attack Outcomes 

Figure 5-8 Outcome Information Window for the Data Center Case Study: 

Probability Information for the Base Case Cyber Attack Scenario 
61 

Associated with each outcome is a set of event-related cost items. Information on 

event-related cost items is accessed by clicking the Edit Cost Items option of the 

Outcome Information Window (see Figure 5-8), which opens the event/outcome/cost 

portion of the Edit Outcomes/Outcome Costs window. The event/outcome portion of the 

Edit Outcomes/Outcome Costs window is grayed out, indicating that it is inactive. Recall 

that in Figure 5-7, the event/outcome/cost portion of the Edit Outcomes/Outcome Costs 

was grayed out. Clicking the Edit Cost Items option just switches the active and inactive 

portions of Figure 5-7. This screen manages the creation, deletion, and editing of eventrelated cost items. The Edit Outcomes/Outcome Costs window displays all event-related 

cost items associated with the outcome of interest. 

Highlighting and clicking the selected event-related cost item opens the 

appropriate Event/Outcome Cost Information window. This feature allows the user to 

review and, if desired, modify any previously recorded information for the event-related 

cost item of interest. The Edit Outcomes/Outcome Costs window is the means through 

which new event-related cost items are created. The creation of a new event-related cost 

item is accomplished by selecting the appropriate Budget Category cost type—Capital 

Investment, O&M, or Other—from the Select Action group box. The software then opens 

the Event/Outcome Cost Information window. The Event/Outcome Cost Information 

window allows the user to name the event-related cost item, generate a cost estimate via 

separate entries for quantity and unit cost, and specify any escalation rates that need to be 

applied. Figure 5-9 is an example of the Event/Outcome Cost Information window for 

the Base Case. Figure 5-9 records information on the Identity Theft cost item for the first 

Cyber Attack scenario. Note that Figure 5-9 includes a Classification Information group 

box which specifies how each event-related cost item fits into the cost-accounting 

framework. 

Figure 5-9 Event/Outcome Cost Information Window for the Data Center Case 

Study: Identity Theft Cost Item for the Base Case Cyber Attack 

Scenario 
62 

5.3.3 Alternative-Specific Feature: The Edit Costs/Events Group Box 

The software also enables the user to access the Edit Costs/Events window by 

clicking the Edit button in the Edit Costs/Events group box at the top of the Cost 

Summary window (see Figure 5-1). Since each alternative has a specific Edit button, 

when that button is clicked the Edit Costs/Events window opens with a display of all 

costs and all events associated with the alternative in the selected column of the Edit 

Costs/Events group box. This feature helps the user edit cost and event information very 

efficiently when the focus is on a single alternative. 

5.4 Output Reports 

The software product’s output reports are designed to help the user “drill down” 

on how individual cost items are distributed across Bearer, Budget Category, Building 

Component, and Mitigation Strategy. The software product drills down according to the 

Budget Category. This approach gives users a snapshot of all of the costs entering the 

analysis, expressed in present value terms, which “roll up” into the life-cycle costs 

recorded in the Cost Summary window. Figure 4-1 and Table 4-2 are indicative of 

selected sets of output reports from the sensitivity analysis option that will be included in 

version 2.0 of the software product. Figure 4-1 is a standard output from the software 

product whenever a Monte Carlo simulation is performed. The user will also have the 

option to obtain additional graphical reports for economic measures other than life-cycle 

cost. Tabular summaries for Monte Carlo simulations (see Table 4-2) will also be 

available to the user of the software product. These summaries may be based on changes 

in a single variable, such as the discount rate, or a collection of variables varied in 

combination. 

Figure 5-10 reproduces the Cost Summary window for the data center case study. 

Comparisons between Figure 5-10 and Table 4-3 highlight how the cost-accounting 

framework is implemented within the software product. With the exception of the Main 

Menu options, editing/screening options for the alternatives under analysis, and some 

descriptive information, Table 4-3 is identical to the Cost Summary window. Both Table 

4-3 and the Cost Summary window of the software product employ the cost-accounting 

framework, express costs in present value terms, and support the calculation of additional 

economic measures. The software product is designed to help the user “drill down” on 

individual cost items. For example, whenever probabilistic sensitivity analyses are being 

performed, the software product drills down according to a probabilistic version of the 

Cost Summary window (see Table 4-3 and Figure 5-10). This feature involves a twostage analysis. The first stage drills down from life-cycle cost (see Table 4-2) to the 

individual cost categories and cost types. The second stage drills down to the individual 

cost items to determine how they contribute to variations in life-cycle cost. This 

approach gives users a snapshot of all of the costs entering the analysis, expressed in 

present value terms, which “roll up” into the life-cycle costs recorded in the Cost 

Summary window.104

 

104 For an in-depth discussion of this approach, see Chapman, Applications of Life-Cycle Cost Analysis to 

Homeland Security Issues in Constructed Facilities, pp. 60-68. 
63 

Figure 5-10 Cost Summary Window for the Data Center Case Study 

5.5 Analysis Features and Software Rollout 

The analysis features and the schedule for the software rollout are tightly coupled. 

Although the software product has two basic analysis features—baseline analysis and 

sensitivity analysis—they differ significantly in how they are implemented within the 

software. 

Recall that in the baseline analysis all data elements (e.g., cost items) entering into 

the calculations are fixed (see Section 4.1.1). The baseline analysis includes both input 

costs and event-related costs. Thus, the baseline analysis is a complete analysis in all 

respects but one; it does not address the effects of uncertainty. For example, although the 

baseline analysis includes event-related costs, the probabilities of any event-related 

outcomes are fixed. Whereas these probabilities are estimated based on the best available 

data, there is uncertainty associated with these estimates. In summary, the baseline 

analysis produces a complete set of results, including expected values of losses stemming 

from event-related costs. 

Given that all data elements are fixed in value, the baseline analysis is the more 

straightforward of the two analysis features. The alpha version of the software product 

will enable software evaluators to input the data needed to perform a comprehensive 

baseline analysis. The alpha version of the software will include the full range of project 

information options (see Section 5.3). The alpha version will also include a selected set 

of report options (see Section 5.4). The alpha version of the software product is not 

scheduled for public release. The alpha version will be tested as part of a collaborative 
64 

effort between NIST and the Wharton Risk Management and Decision Processes Center. 

Production of the beta version will incorporate comments from Wharton and augment the 

alpha version by including a limited sensitivity analysis capability. 

Sensitivity analysis measures the impact on project outcomes of changing the 

values of one or more key data elements about which there is uncertainty. Sensitivity 

analysis may be divided into two polar cases: (1) deterministic and (2) probabilistic. 

Deterministic sensitivity analyses are the more straight forward of the two. In a 

deterministic sensitivity analysis, a small set of key data elements are varied either singly 

or in combination. Settings for the key data elements are designed to bracket the baseline 

value for that element. A common strategy is to posit minimum and maximum values 

which span the expected range of values for the data element. The beta version of the 

software product, scheduled for public release in September 2004, will include the ability 

to systematically vary any combination of data elements and measure their impact on 

economic measures of performance (e.g., life-cycle costs). 

Version 1.0 of the software product is scheduled for public release in March 2005. 

Version 1.0 will draw on extensive testing of the beta version. The version 1.0 software 

product will produce the types of analysis results that provide decision makers with the 

basis for generating a risk mitigation plan. Version 1.0 of the software product will also 

include help files to assist users. 

In a probabilistic sensitivity analysis, a small set of key input variables is varied 

either singly or in combination according to an experimental design. In most cases, 

probabilistic sensitivity analyses are based on Monte Carlo techniques, or some other 

form of simulation. The major advantage of probabilistic sensitivity analysis is that it 

permits the effects of uncertainty to be rigorously analyzed. For example, not only the 

expected value of each economic measure of performance can be computed but also the 

variability of that value. In addition, probabilistic levels of significance can be attached 

to the computed values of each economic measure of performance. 

Version 2.0 of the software product is scheduled for public release in March 2006; 

it will enable users to conduct rigorous probabilistic sensitivity analyses under a wide 

variety of user-defined input scenarios. Version 2.0 will expand version 1.0 capabilities 

by including a financial risk module, which makes use of Monte Carlo techniques. This 

will enable users to conduct a rigorous, probabilistic financial risk assessment of 

alternative mitigation strategies. Version 2.0 will use Monte Carlo techniques to produce 

risk profiles for economic measures of performance. For example, a risk profile for the 

present value of net savings (PVNS) measure would record the probability of PVNS 

being less than zero or some other specified target value. Recall that PVNS greater than 

or equal to zero is a requirement for a risk mitigation plan to be cost-effective. Version 

2.0 will draw on extensive testing of the version 1.0 software product and incorporate 

suggestions from version 1.0 users. Version 2.0 will include a users manual. Economists 

from OAE will also develop a training module for the software product. 

To complement the previous chapter’s discussion of life-cycle cost analysis’ 

application to homeland security considerations and this chapter’s description of the 

proposed software product, Chapter 6 outlines the theoretical foundations of the 

protective investment optimization problem. These foundations illustrate how the factors 

and costs affect the optimal level of investment in building protection. 
65 

6 Additional Considerations of Risk Mitigation Decisions 

The previous two chapters describe the economic evaluation approaches to 

choosing among alternative risk mitigation plans to protect constructed facilities and the 

implementation of these approaches. The application of life-cycle costing and the related 

metrics are affected by different types of constructed facilities. The makeup of a 

constructed facility affects decisions about how much to spend on risk mitigation and the 

allocation of these expenditures within the constructed facility. In the sections that 

follow, several types of constructed facilities are presented, along with intuitive 

discussions of the basis for choosing the levels and allocations of protective expenditures, 

both among buildings and among the three risk mitigation strategies described in Chapter 

2. 

In the first section, we give an overview of decision making when the constructed 

facility is a single structure. In Section 6.2, we present the basis for organization-wide 

expenditure levels and allocations. Organization-wide decision-making applies to 

constructed facilities that are collocated, such as in campus settings. These collocated 

structures may be interconnected or independent. Organization-wide decision-making 

also applies to geographically distributed structures. In the third and final section, we 

discuss some social welfare implications of risk mitigation to protect constructed 

facilities. 

6.1 Decision Making for a Single Building 

For the case of a single building structure, decision makers must choose the total 

level of expenditures to protect the building, their allocation among engineering 

alternatives, management practices, and financial mechanisms, and their allocation in 

each period of the time frame of interest. Several theoretical treatments for allocating 

expenditures among the three risk mitigation strategies over time in the single-building 

case are presented in Appendix D. These analytical models produce optimality 

conditions for outlays for each of the three types of strategies based on marginal costs, 

marginal benefits, and budget constraints. 

The first model assumes that only engineering alternatives requiring capital 

investments in the initial period are available. The second model adds the possibility of 

management practices to the mix of potential countermeasures. The third includes two 

financial mechanisms, insurance and subsidies, as potential strategies. The fourth and 

final model allows for capital investments in engineering alternatives in more than one 

period. 

The approach briefly described in this section and elaborated on in Appendix D 

shares several commonalities with the life-cycle cost analysis presented in Chapter 4, but 

presents some key differences. First, the investments and expenditures in life-cycle cost 

analysis are variegated. Investments in HVAC equipment are distinct from investments in 

laminated safety glass. Management practices dollars spent to hire security personnel are 

differentiated from dollars spent to conduct periodic employee emergency evacuation 

drills. With life-cycle costing, it is possible to distinguish dollars expended for different 

financial mechanisms, such as premiums for insurance policies versus payment for a 

leasing option on an alternative commercial building. For each of these types of 
66 

mitigation strategies, different levels of costs and expected reductions in losses are 

associated with each specific risk mitigation strategy. In the current approach, expanded 

on in Appendix D, there is no such distinction. Each dollar invested in engineering 

alternatives is homogeneous and not differentiated by type of investment. Each dollar 

spent to implement risk mitigation management practices is not distinguished by practice. 

Similarly, each dollar spent on financial mechanisms is treated as homogeneous, with no 

differentiation (with reference to the previous example) between a $50 000 annual 

insurance premium and a $50 000 lease option. The effect on costs and expected 

reduction in losses depends not on the nature and purpose of the investment or 

expenditure, but on the dollar amount of each. The simplification is necessary to ensure 

the models’ tractability. In spite of the abstraction, the optimality conditions derived in 

Appendix D provide some insight into the question of how much to invest or spend on 

risk mitigation in each period. 

A second difference between the life-cycle cost approach of Chapter 4 and this 

section (and Appendix D) is that the set of risk mitigation choices available to the 

building owner or manager in the life-cycle cost approach of Chapter 4 are discrete 

combinations of mitigation strategies: referring to Table 3-1, for example, a hypothetical 

Combination A could be the group of engineering alternatives, management practices, 

and financial mechanisms E2, E3, M2, and F3. A hypothetical Combination B could be 

the group including E1, E2, M5, F1, and F2. The life-cycle cost analysis helps the 

building owner or manager choose the most cost-effective combination of mitigation 

strategies from a finite, user-defined set. In this section and in Appendix D, the decision 

facing building owners and managers is not which combination of strategies is cost 

effective, but how much to invest. The simplification is one of the consequences of the 

removal of the dimension of type of investment in engineering alternatives. 

In spite of these differences, the approaches described in Chapter 4 and in 

Appendix D are mutually consistent. They both break costs down by strategy: 

engineering alternative, management practice, and financial mechanism; and by category: 

capital investment, operations and maintenance, and other. They are both based on the 

minimization of life-cycle costs of investments and expenditures. 

6.2 Organization-Wide Decision Making 

An organization may own more than one structure or facility and require an 

approach to allocating protective resources among these facilities. These multiple 

buildings may be in a single location (such as in a campus-like setting) or they may be 

located throughout the country. For organizations with multiple structures, the model 

must be able to address both the question of how much to invest in each period as well as 

how much to allocate among the buildings and locations. Whether these structures are 

sited in close proximity to each other or scattered across several geographic areas affects 

this investment decision. 

6.2.1 Collocated Structures or Campuses 

Buildings in a campus-like setting or in close proximity to each other can, in some 

circumstances, be treated as a single building. In other situations, their differences 
67 

require individualized assessment of and response to the threats, vulnerabilities, and risks 

that they face. The difference in treatment depends on the degree of interdependence 

among the collocated structures. 

6.2.1.1 Collocated, Interconnected Structures 

Buildings in a campus can be treated as a single building if they face similar 

probability of and vulnerability to attack. Such similarities may arise if the buildings 

share a common entrance and perimeter, for example. They may be physically connected 

through above-ground walkways or underground tunnels. Admission to one building 

may convey access to all other buildings. They may have interdependent electrical, 

telecommunications, HVAC, or other systems. For collocated structures, an attack on 

one building, for example, a conventional explosion, may damage nearby buildings, such 

as through the initial blast, shrapnel, or follow-on fires, simply due to physical 

proximity.105

For buildings that are interconnected and have no restrictions on access among 

them, the rational building owner or manager would allocate protective resources among 

them to maximize the lowest degree of invulnerability among the buildings. The decision 

rule is based on a constrained maximin-type optimization, where the objective is to 

maximize the minimum level of protection among the interconnected buildings within the 

given budgetary constraints. This optimization recognizes that all the buildings in the 

campus are only as secure as the weakest point among these buildings.106 If building 

owners and managers were to ignore the accessibility issue and instead concentrate 

resources on a higher-occupancy building while leaving an interconnected, but 

unoccupied, building less protected, then potential terrorists could exploit the less 

protected building’s vulnerability, nullifying the resources devoted to the high-occupancy 

structure. When there are interdependent outcomes among buildings, overprotecting one 

structure without commensurate allocations in others in the collection of buildings is 

inefficient. 

6.2.1.2 Collocated, Independent Structures 

Structures that are collocated, but not interconnected, may not all face the same 

probability, vulnerability, or consequences of a terrorist attack. A structure, for example, 

that houses critical units of the organization or facilities may experience a greater 

probability of attack. A building located on the perimeter of the campus rather than the 

interior may be more vulnerable to explosive attacks due to a smaller setback distance 

from a public road. A structure that houses hazardous contents, such as toxic chemicals 

or radioactive material, may be leveraged by potential terrorists into more widespread 

destruction. Some structures are more valuable to an organization, such as those with 

higher occupancy, house mission-critical elements or the leadership of the organization, 

 

105 An example of collateral effects are the attacks on the twin towers of the World Trade Center, which 

destroyed seven buildings and one bridge, severely damaged seven additional buildings, and moderately 

damaged 15 other buildings (Hartwig, “The Long Shadow of September 11,” p. 7). 

106 The concept is analogous to the notion that the degree of protection conveyed by a dike is determined by 

its lowest point. 
68 

or contain more costly physical contents, so that the consequences of their loss would be 

greater. 

In these situations, protective resources should be allocated to equalize the 

marginal increase in benefits (i.e., the marginal reduction in costs and losses) across the 

buildings from each additional dollar of protective investment. The crucial difference is 

in the expected loss variable. The probability distribution of losses is now no longer 

solely based on the protected building. The value of neighboring buildings belonging to 

the same owner are included. The effect of including these buildings is to increase the 

marginal benefit from protecting one of the buildings. With the single building case, 

investment only reduced the expected losses to the owner from that one building. When 

the owner owns multiple buildings in close proximity to each other, investment reduces 

losses to the protected building as well as the owner’s other nearby buildings. The 

proximity of the other buildings owned by the same group increases the life-cycle cost 

minimizing level of protective investment as a reduction in the expected loss.107

6.2.2 Geographically Distributed Structures 

6.2.2.1 Geographically Distributed, Interconnected Structures 

For some firms, buildings may exhibit interdependencies in spite of geographic 

separation. Telecommunications or data hubs are examples of such buildings. Physical 

damage or cyber terrorism at these facilities could adversely impact operations and 

business continuity at locations across a wider geographic space. In this case, the optimal 

allocation would be similar to the interconnected structures case. Cyber terrorism would 

be defended according to a maximin optimization. For protection against physical 

damage, building owners and managers should consider the consequences to all locations 

of damage to that particular facility when allocating protective resources. 

6.2.2.2 Geographically Distributed, Independent Structures 

For buildings that are located across a wider geographic area and not in close 

proximity to each other, the optimization principle is similar to the case of the collocated 

but not interconnected buildings. If the buildings belonging to an organization are sited 

throughout a region or country, so that their physical security and vulnerability are not 

interdependent,108 then the organization should allocate its risk mitigation resources 

among its locations so that the marginal reduction in costs from each additional dollar of 

protective investment is equal across all facilities. More heavily occupied buildings or 

 

107 In the single building case, protecting a building also reduces the expected losses (if an attack occurs) to 

other buildings whether they share an owner or not. This reduction in losses to other owners’ buildings, 

however, was not included (“internalized”) in the “benefits” of the protective investment that affect the 

single-building owner’s decision about protection. The key difference in the case of collocated, but 

independent, structures is that the owner now considers the effects of other buildings, because his 

ownership of them means that he would bear the consequences of their destruction. The benefits of 

protecting one building includes the reduction in expected losses to the owner’s other buildings in the 

cluster. 

108 Implicit in the assumption that spatial separation implies lack of interdependence is an abstraction from 

cyber threats, the consequences of which are not constrained by physical distance. 
69 

buildings in higher risk cities would receive more protective resources than low risk or 

low value facilities, because the marginal reduction in life-cycle cost due to each dollar of 

protective investment would be greater in these areas. 

6.3 Social Welfare Considerations 

The presumption in Sections 6.1 and 6.2 is that the building owner and manager 

consider only the benefits and costs that accrue to themselves when making risk 

mitigation decisions. These decisions, however, may convey benefits or costs to other 

parties and have broad social welfare implications. 

The optimizing agent can be the building owner and manager, or it can be society. 

Some issues are more appropriately modeled according to one, and some according to the 

other. Insurance, for example, matters to the building owner and manager. For society, 

however, premiums and claims merely represent redistribution of assets between insurers 

and policyholders. 

To take another example, economic spillovers of building protection to the 

owners of neighboring buildings do not enter into the building owner’s problem, because 

the costs and benefits do not accrue to the decision maker. These spillovers, such as an 

increase or a decrease to the probability that they will be attacked, accrue to other parties, 

such as occupants and users, and neighbors. The presence of spillovers leads to 

distortions—the incentives of the decisions makers are not aligned with the costs and 

benefits that will accrue to society overall. There may be unintended consequences of 

deterrence if some buildings are protected, but other buildings are not. If terrorists avoid 

buildings that are observably protected in favor of nearby buildings that are not obviously 

protected, then the protection level of surrounding buildings increases the probability of a 

terrorist attack. These spillover effects are illustrated using a simple example in 

Appendix E. 

There are several possible approaches to addressing societal aspects of risk 

mitigation decisions. Regulations, such as building codes and standards, play a key role 

in bringing social consequences into the choices of private decision makers. Trade 

associations and other coordinating agencies can also shape the way private decision 

makers consider the broader impacts of their actions. 
70 
71 

7 Summary and Suggestions for Further Research 

7.1 Summary 

The September 11th attacks on the World Trade Center and the Pentagon and the 

subsequent dispersion of anthrax through the postal system have changed the way many 

in the United States approach security and safety. Future attacks could result in harm to 

the occupants of constructed facilities and bystanders; physical damage to constructed 

facilities; business interruptions; and financial losses. These realities have led to changes 

in the way key decision makers think about the design, location, construction, 

management, and renovation of constructed facilities. Owners and managers of 

constructed facilities are confronted with the challenge of responding in a financially 

responsible manner to the potential for future terrorist attacks. This report provides the 

economic foundations for producing a cost-effective risk mitigation plan which satisfies 

the objective of safeguarding assets in a financially responsible manner. 

This report presents a three-step protocol for developing a cost-effective risk 

mitigation plan for constructed facilities. This protocol helps decision makers determine 

the vulnerability of their facility to damages from low-probability, high-consequence 

events; identifies engineering, management, and financial strategies for abating the risk 

of damages; and uses standardized economic evaluation methods to select the most costeffective combination of risk mitigation strategies to protect their facility. By using these 

economic evaluation methods, the owners and managers of constructed facilities can 

reduce the life-cycle costs associated with low-probability, high-consequence events. 

The development of a cost-effective risk mitigation plan is facilitated through the 

use of economic tools—evaluation methods and software for implementing these 

methods. This report addresses that need through the development of a decision 

methodology covering step three of the protocol—the economic evaluation of alternative 

risk mitigation strategies—and a proposed software product for implementing the 

decision methodology. 

The decision methodology is based on the life-cycle cost method. The decision 

methodology covers how to apply the evaluation methods and interpret the results. This 

method is supported by a voluntary industry standard, ASTM E 917. Three other 

evaluation methods—present value of net savings, savings-to-investment ratio, and 

adjusted internal rate of return—are also supported by voluntary industry standards. The 

four evaluation methods are designed to cover a wide spectrum of investment decisions. 

The decision methodology builds on the life-cycle cost method by employing two 

types of analysis—baseline analysis and sensitivity analysis—and a cost-accounting 

framework. The baseline analysis is designed to give a frame of reference for the 

sensitivity analysis. The baseline analysis results in a rank ordering of the alternative 

combinations of risk mitigation strategies in terms of their life-cycle costs. The 

sensitivity analysis augments the baseline analysis by assessing the impacts that 

uncertainty for selected sets of input data has on life-cycle costs. The sensitivity analysis 

enables the decision maker to generate risk profiles for each alternative combination of 

risk mitigation strategies. Together the baseline analysis and the sensitivity analysis 

provide the information needed to identify the most cost-effective risk mitigation plan. 

The cost-accounting framework complements the baseline and sensitivity analyses by 
72 

identifying unambiguously who bears which costs, how costs are allocated among several 

widely-accepted budget categories, and how costs are allocated among key building 

components and the three types of risk mitigation strategies. 

Implementation of the decision methodology, however, is accomplished through 

application of the proposed software product. Although the public release of the finalized 

version of the software product is scheduled for March 2006, a beta version will be 

released in September 2004. Version 1.0 is scheduled for public release in March 2005. 

The software product will significantly reduce the time and effort required for users to 

implement the third step of the protocol—evaluate the life-cycle cost implications of the 

alternative combinations of risk mitigation strategies. The software will guide the user 

through a structured set of input screens, so that complex investment alternatives can be 

systematically input, analyzed, and saved for purposes of documentation. 

The report also includes discussions and descriptive materials on a variety of 

homeland security-related issues. These sections of the report provide guidance and 

insights for readers interested in learning more about ways in which economic analysis 

contributes to protecting constructed facilities against natural hazards and terrorist acts 

that occur infrequently, but result in devastating damages. 

7.2 Suggestions for Further Research 

The background work for this report uncovered additional areas of research that 

might be of value to government agencies and private-sector organizations concerned 

with homeland security-related issues. These areas of research are concerned with: (1) 

how decision makers process information associated with low-probability, highconsequence events; (2) the role of financial incentives in promoting the adoption of costeffective risk mitigation plans; (3) the construction of scenarios for modeling sequential 

investment decisions; and (4) evaluations based on multiattribute decision analysis. 

7.2.1 Decision-Making Under Uncertainty 

Protecting against low-probability, high-consequence events such as terrorist acts 

and other natural and man-made hazards complicates the capital asset decision-making 

process. Additional research on decision-making under uncertainty is needed to provide 

a better understanding of how decision makers responsible for constructed facilities 

respond to the way information is provided to them, how they process this information, 

and how they perceive extremely low probabilities. Two additional research topics 

involving decision-making under uncertainty are how decision makers react to situations 

involving interdependent security (i.e., cases where one facility owner’s actions serve to 

raise or lower the risks of another owner’s constructed facility) and how they assess the 

merits of adopting new technologies (i.e., innovative products and services) as risk 

mitigation measures. 

7.2.2 Financial Incentives 

Financial incentives are a means for bringing about a socially desired outcome 

when there are externalities associated with investments in risk mitigation strategies. 
73 

Additional research is needed on the opportunities and challenges for utilizing financial 

incentives to encourage owners and managers to better protect their facilities from 

extreme events such as natural disasters, technological accidents, and terrorism. Such 

research could examine specific financial incentives that may have short-run and longterm benefits in reducing future losses from extreme events. For example, research 

summarizing the factors leading to the successful implementation of mitigation measures 

in recent years would be helpful in the design of any new incentive programs. Another 

priority for research is an investigation of the challenges and opportunities for 

implementing financial incentives through strategies that involve public-private 

partnerships. 

7.2.3 Sequential Investment Decisions 

Many investment decisions are sequential in nature. The data center case study 

summarized in Section 4.2.6 included sequential elements related to capital 

replacements.109 However, additional research on scenario construction is needed to 

better capture the sequential nature of decision making in a life-cycle cost context. 

Because the sequence in which investment decisions are made impacts not only capital 

costs but O&M and other costs as well, research on scenario construction would help the 

users of the software product to identify those investment sequences which have the most 

favorable impact on life-cycle cost. Research on scenario construction would also help 

decision makers assess the merits of adopting new technologies. As a new technology 

enters the market place, there is a period during which potential adopters are learning 

about its true characteristics. Adoption decisions are especially challenging if the new 

technology is going through an improvement cycle. Improvement cycles tend to have a 

double-edged effect on adoption: a direct effect, stimulating greater use; and an indirect 

effect, whereby expectations of future advances lead to the postponement of adoption. 

Research on scenario construction would provide guidance to the decision maker on how 

to use the software product to assess the merits of the new technology. This guidance 

would enable the decision maker to keep their investment options open while collecting 

additional information on the performance characteristics of the new technology. 

7.2.4 Multiattribute Decision Analysis 

Many investment alternatives differ in characteristics that decision makers 

consider important but that are not readily expressed in monetary terms. Because the 

standardized evaluation methods employed in this report consider only monetary benefits 

and monetary costs associated with alternative investment choices, their application does 

not reflect the importance of these non-financial characteristics to the decision maker. 

When non-financial characteristics are important, decision makers need a method that 

accounts for these characteristics (also called attributes) when choosing among 

 

109 For an in-depth description of the data center case study, see Chapman, Applications of Life-Cycle Cost 

Analysis to Homeland Security Issues in Constructed Facilities, pp. 21-68. 
74 

alternative investments. A class of methods that can accommodate non-monetary benefits 

and costs is multiattribute decision analysis.110

The analytical hierarchy process (AHP) is one of a set of multiattribute decision 

analysis methods that considers non-financial characteristics in addition to common 

economic evaluation measures when evaluating project alternatives. The AHP has 

several important strengths: (1) it is well-known and well-reviewed in the literature; (2) it 

includes an efficient attribute weighting process; (3) it incorporates hierarchical 

descriptions of attributes; (4) its use is facilitated by available software; and (5) it has 

been accepted by ASTM as a standard practice for investments related to buildings and 

building systems.111

The AHP and its associated software represent a powerful and versatile 

management tool. How to apply this management tool most productively to homeland 

security-related issues requires additional research on how decision makers view nonfinancial outcomes associated with low-probability, high-consequence events. 

 

110 For more information on multiattribute decision analysis, see Norris, Gregory A., and Marshall, Harold 

E. Multiattribute Decision Analysis Method for Evaluating Buildings and Building Systems. NISTIR 5663 

(Gaithersburg, MD: National Institute of Standards and Technology, 1995). 

111 ASTM International. “Standard Practice for Applying Analytical Hierarchy Process (AHP) to 

Multiattribute Decision Analysis of Investments Related to Buildings and Building Systems,” E 1765, 

Annual Book of ASTM Standards: 2002. Vol. 04.12. West Conshohocken, PA: ASTM International. 
75 

Appendix A: A Nation at Risk 

Human losses from the events of September 11th were 2 749 fatalities at the 

World Trade Center site,112 189 fatalities at the Pentagon, and 44 passengers and crew 

fatalities at the Pennsylvania plane crash site. In addition, numerous individuals at these 

locations sustained serious injuries. In the weeks following the September 11th attacks, 

the spread of inhalation anthrax through the postal system caused the deaths of five 

individuals among the confirmed cases of the disease, as well as expenditures of almost 

$1 billion to test for, remediate, and prevent anthrax contamination.113

The total costs of the September 11th and anthrax dispersion events are difficult to 

quantify. In addition to the loss of life, these terrorist attacks strained public 

consciousness, disrupted the conduct of business and finance, destroyed infrastructure 

and property, undermined several industries (such as travel and tourism), and prompted 

military actions. Estimated insured property losses from the September 11th attacks 

exceed $20 billion, which is over 20 times greater than the second most costly terrorist 

attack, the 1993 IRA bombing near London’s Natwest Tower. The insured property and 

infrastructure losses from September 11th are over 150 times those due to the 1995 

bombing of the Alfred P. Murrah Building in Oklahoma City. If life, liability, and 

worker’s compensation insurance are included, all insured losses from the September 11th

attacks exceed $40.2 billion. This amount is twice the insured losses from Hurricane 

Andrew in 1992, the second most costly disaster in the world.114

A.1 Constructed Facilities at Risk 

To appreciate the potential losses that could arise from terrorist attacks, we need 

an inventory of facilities that might be at risk. Constructed facilities at risk include 

infrastructure, non-residential buildings, and industrial facilities. Infrastructure includes 

transportation, water resource management, and energy delivery facilities. Example of 

nonresidential buildings are offices, education, and mercantile buildings. Industrial 

facilities include oil refining, chemical manufacturing, and power plants. Table A-1 

presents a detailed classification of constructed facilities that could be considered at risk 

of terrorist attack.115

The value of these facilities can be measured by their replacement cost, their 

contents, or the value of the services and use that they provide. Other facilities have 

historic or symbolic value; loss or damage to these facilities may impose substantial 

cultural, psychic, or emotional costs on the populace. 

 

112 Lipton, “New York Settles on a Number That Defines Tragedy,” p. B7. 113 Gugliotta and White, “Tests Clear Home, Mail of Anthrax Victim,” p. A1. 114 Hartwig, “The Long Shadow of September 11,” pp. 13, 14, 17, 20 and 21. 115 This report focuses on the building protection decisions facing owners and managers of non-residential 

facilities. Although they have not been targets in the United States, residential buildings, especially highrise structures located in larger cities, could be potential targets. The analysis developed in this report can 

be applied to residential buildings. 
76 

Table A-1 Proposed Classification of Constructed Facilities 

Infrastructure 

 Transportation 

 Bridges 

 Roads/Highways 

 Railroads 

 Canals/Waterways 

 Transshipment Facilities 

 Airports 

 Rail Stations 

 Marine Facilities 

 Communications 

 Water Resources Management 

 Dams and Reservoirs 

 Levees and Locks 

 Water Treatment 

 Water and Waste Water Treatment 

 Potable Water Distribution 

 Energy Delivery 

 Electricity 

 Natural Gas 

 Oil 

Non-residential Buildings 

 Office 

 Education 

 Health Care 

 Mercantile and Service 

 Other 

Industrial Facilities 

 Oil Refining and Storage 

 Oil and Natural Gas Production 

 Chemical Manufacturing 

 Metals Refining/Manufacturing 

 Consumer Products Manufacturing 

 Pharmaceuticals Manufacturing 

 Electronics Manufacturing 

 Electricity Generating Power Plants 

 Coal-Fired 

 Hydroelectric 

 Nuclear 

 Other 

 Pulp and Paper Manufacturing 

 Other Manufacturing 

 Automotive 

 Aircraft 

 Miscellaneous Equipment and Components 
77 

Table A-2 describes the stock of critical infrastructure and assets in the United 

States. Assets include the nation’s telecommunications infrastructure, energy production 

and generation, and passenger and freight transportation networks. These assets provide 

services critical to the smooth functioning of the U.S. economy and society. Disruptions 

to the performance of these assets have the potential to quickly transmit from the site of 

disruption throughout the nation. Domestic energy production and raw materials 

processing facilities account for substantial capacity. 

Table A-2 Critical Infrastructure and Assets in the United States: 2003 

 

Infrastructure Type Number Units116

2 800 Power plants

Electricity 130 million Households and institutions served 

3.6 trillion kWh consumed (2001) 

104 Commercial plants Nuclear Power Plants 20 % U.S. electrical generation capacity 

300 000 Producing sites

4 000 Off-shore platforms 

Over 600 Natural gas processing plants 

153 Refineries 

Over 1 400 Product terminals 

Oil and Natural Gas 

7 500 Bulk stations 

Chemical Industry & Hazardous Materials 66 000 Plants

3.2 (2.0) billion Kilometers (Miles) of cable Telecommunications 20 000 Physical facilities 

Aviation 5 000 Public airports 

193 080 (120 000) Kilometers (Miles) of major railroads 

40 % Of inner city freight 

Passenger Rail and Railroads 20 million Inner city resident use annually 

45 million Passengers on trains and subways 

operated by local transit authorities 

Highways, Trucking, and Busing 590 000 Highway bridges 

Pipelines 3.2 (2.0) million Kilometers (Miles) of pipelines 

Maritime 300 Inland or coastal ports 

Mass transit 500 Major urban public transit operators 

Dams 80 000 Dams

Source: The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, White 

House, February 2003. 

 

116 Common units in parentheses. All conversions based on Grimes, T. L., Suiter, R. C., and Williams, 

Juana. S. Specifications, Tolerances, and Other Technical Requirements for Weighing and Measuring 

Devices. NIST Handbook 44 2003 ED (Gaithersburg, MD: National Institute of Standards and Technology, 

2003), Appendix C. 
78 

The value of commercial real estate in the United States is an estimated $10.6 

trillion. Of this amount, $5.5 trillion, or 52 %, represents the replacement cost of 

structures, $3.7 trillion (35 %) represents equipment and software, and $1.4 trillion 

(13 %) represents inventory.117 

Table A-3 shows the stock of nonresidential buildings in the United States. In 

1998 to 1999, non-residential buildings numbered almost 4.9 million, encompassing 

nearly 7.5 billion square meters (over 80 billion square feet). 

Table A-3 Constructed Facilities at Risk: 1998, 1999118

Building 

Characteristics Office Education Health Care 

Mercantile 

/Service Industrial Other All 

Number of Buildings 

(thousands) 739 327 127 1 145 227 2 319 4 884 

Building Floorspace 

(million m2

) 1 119 804 271 1 281 1 193 2 781 7 449 

Building Floorspace 

(million ft2

) 12 044 8 651 2 918 13 786 12 836 29 939 80 174 

Average Building 

Floorspace (m2) 1 514 2 459 2 134 1 119 5 256 1 199 1 525 

Average Building 

Floorspace (ft2

) 16 298 26 456 22 976 12 040 56 546 12 910 16 416 

Sources: U.S. Department of Energy’s CBECS (1999). Industrial building data from U.S. Department of 

Energy’s MECS (1998). 

Commercial real estate debt is another measure of the importance of the 

commercial building stock to the U.S. economy. At the end of 2000, this debt totaled 

$8.2 trillion, with 85 % in real estate and mortgage loans, 13 % industrial loans, and 2 % 

in lease receivables.119 Commercial real estate debt links the real estate sector with the 

U.S. (and international) financial system. Any realized losses to financed real estate has 

the potential to be transmitted to the financial sector. Losses that are covered by 

insurance policies also potentially affect the financial system, such as in the aftermath of 

the September 11th attacks, the losses of which fell heavily on the insurance and 

reinsurance sectors. Commercial real estate debt is therefore a dimension by which the 

entire financial system is exposed to terrorism threats. Because of the pervasive 

influence of the financial sector on all other aspects of the economy, the potential for a 

disaster to transmit throughout the economy is considerable. 

A.2 Risks, Hazards, and Consequences 

The risks to the nation’s homeland security can be decomposed into three 

elements: threat, vulnerability, and consequences. Threats refer to impending dangers. 

The threats to a nation’s homeland security come from many sources and hazards. These 

threats may be realized both inside and outside the nation’s borders. Threats may come 

 

117 Hartwig, “The Long Shadow of September 11,” p. 36. 118 The number of office, education, health care, mercantile/service, and other buildings is based on 1999 

data. The number of industrial buildings is based on 1998 data. 

119 Hartwig, “The Long Shadow of September 11,” p. 37. 
79 

from physical attacks through the ground, the sky, or the air. The hazards which threaten 

a nation’s constructed facilities may come in several forms: explosive, radiological, 

biological, or chemical. 

Vulnerability refers to its susceptibility to experiencing such threats or suffering 

losses from attacks. The vulnerability of a constructed facility depends on several 

factors, as well. Among these factors are location, access, structural design, system 

components and configuration, construction materials, and surveillance and security 

measures. A facility’s vulnerability may vary from threat to threat and hazard to hazard. 

Consequences are the negative outcomes due to realized threats. Potential damage from 

terrorist attacks may occur in the form of casualties, structural damage, loss of property 

and contents, and loss of use or business interruptions. 

The risks facing different facilities will depend on several factors. Some 

researchers have attempted to develop psychological models to identify these factors, 

understand the decision process, and predict terrorist target selection.120 Drake121

examines the motives behind terrorist choices and actions. He also identifies the 

associated strategies and tactics that underlie the terrorist target selection process. Enders 

and Sandler122 present an economic model of target selection, based on terrorist resources 

and the “relative prices” of different modes of attack. Plausible factors that they identify 

include location of a facility, its profile or symbolic significance, its occupants and 

tenants, and its vulnerability. Kunreuther and Heal123 discuss the sets of challenges 

associated with interdependencies. They present a game theoretic model in which the 

interdependence of security between the two firms means that if one firm does not invest, 

then the payoffs from any investment that the other firm makes are completely negated. 

They show that the incentive for a firm to invest in mitigation and protection decreases if 

others who can contaminate it decide not to allocate funds for mitigation. 

Terrorist threats can take many forms. While smaller-scale attack scenarios, such 

as abduction or assassination, are possible, the typical characterization of these terrorist 

threats is chemical, biological, radiological, and explosive (CBRE). Each of these four 

types of attacks are capable of indiscriminately inflicting massive casualties, physical 

damage, and psychological trauma among large populations and localities. 

Building owners and managers may also recognize the dual effect that protecting 

buildings from terrorism hazards has on protection against other types of hazards. Some 

of the other types of hazards that can be considered include natural hazards (such as 

earthquakes, tornadoes, winter weather, wildfires, floods, hurricanes), industrial 

 

120 Weaver, Ransom, Silverman, Barry, Shin, Hogeun, and Dubois, Rick. “Modeling and Simulating 

Terrorist Decision-making: A ‘Performance Moderator Function’ Approach to Generating Virtual 

Opponents,” Proceedings of the Tenth Conference on Computer Generated Forces and Behavioral 

Representation, Norfolk, VA, May 15-17, 2001, pp. 39-44. Johns, Michael and Silverman, Barry. “How 

Emotions and Personality Effect the Utility of Alternative Decisions: A Terrorist Target Selection Case 

Study,” Proceedings of the Tenth Conference on Computer Generated Forces and Behavioral 

Representation, Norfolk, VA, May 15-17, 2001, pp. 55-64. 121 Drake, Terrorists’ Target Selection, pp. 35-72 and pp. 175-182. 122 Enders, Walter, Sandler, Todd, and Cauley, Jon. “UN Conventions, Technology and Retaliation in the 

Fight against Terrorism: An Econometric Evaluation,” Terrorism and Political Violence, Vol. 2, No. 1, 

Spring 1990, pp. 83-105. 

123 Kunreuther, Howard and Heal, Geoffrey. “Interdependent Security,” Journal of Risk and Uncertainty,

Vol. 26, No. 2-3, March-May 2003, pp. 231-249. 
80 

accidents, sabotage (such as by disgruntled employees, protestors, or others), crimes such 

as theft or arson, espionage, cyber attack, and conventional war. Structural 

improvements, such as in design or materials, that fortify a building against high 

explosives, for example, may also protect the building from strong winds or other natural 

hazards. 

A.2.1 A Classification of Hazards 

When considering the effects of strategies designed to mitigate the risk of terrorist 

and other hazards to constructed facilities, the focus lies on reductions in losses if a 

building suffers a disaster. However, protective measures may also affect other aspects 

of a disaster in ways that ultimately affect its consequences for the building owner and 

manager, occupants, and other parties. A classification method based on the 

responsiveness of various aspects of hazardous events to protective measures helps 

illustrate and clarify the overall effectiveness of mitigation measures on hazards, beyond 

their direct effect on limiting damage. 

This classification is determined by the degree to which three aspects of a hazard 

respond to the risk mitigation measures that the building owners and managers 

implement. Three dimensions of the hazardous event are: (1) the probability that a 

hazardous event will occur; (2) the type of hazardous event that may occur; and (3) the 

shift in the risk of the hazardous event to other parties. 

A.2.2 Three Dimensions of Hazards 

 The responsiveness of the probability that an event will occur to risk mitigation 

measures is straightforward. The likelihood of an event ranges from completely 

unresponsive to building protection, such as natural hazards, to completely responsive, 

such as terrorism. 

 Similarly, for the second aspect of hazardous events, the responsiveness of the 

type of event that occurs can range from completely unresponsive to risk mitigation 

measures, such as severity of a hurricane or even type of natural hazard (earthquake vs. 

flooding vs. tornado), to completely responsive, such as terrorist choice of mode or scale 

of attack. 

Finally, a building owner’s risk mitigation choices may lead to a shift in risk to 

other parties. This third characteristic is partially related to the first aspect concerning the 

probability of a hazardous event’s occurrence. For some hazardous events, a reduction or 

increase in the probability of a hazardous event in response to a facility’s protection 

choices may lead to an increase or reduction, respectively, in the risk faced by other 

facilities that are similar or nearby. Shifts in risk toward other similar124 facilities could 

occur if attackers, observing the protective measures taken at the facility, were to view 

these targets as substitutes for the protected facility. Shift in risk away from nearby 

facilities may occur if the attackers are deterred by protection in place. If an attack on a 

nearby target is deterred, the risk to neighboring facilities may be reduced because of the 

 

124 Similarity of alternate targets implies that an attack on the alternate target would accomplish the same 

objectives as an attack on the initial target. 
81 

lower likelihood that they will suffer collateral damage.125 The risk-shifting dimension of 

building protection is based on the potential deterrent effect of protective measures. 

Deterrence, in turn, depends in part on the availability of information about building 

protection to potential attackers. If protective measures are implemented without the 

knowledge of outsiders, then the deterrent effect, and the potential effect of risk shifting, 

may not be in play. 

A.2.3 Examples and Illustrations 

Table A-4 and Figure A-1 are two ways of illustrating this classification scheme. 

Table A-4 conveys a qualitative representation of the responsiveness that the different 

types of hazards have to mitigation, while Figure A-1 is a spatial representation. The 

hazards can be classified by the degree and extent of their responsiveness to building 

protection. The classification helps us predict what types of hazards will be affected by 

mitigation strategies and how they will be affected. 

 

Table A-4 Responsiveness Classification of Hazards 

Responsiveness of Characteristic to Mitigation 

Type of Hazard Probability of 

an Event 

Type of 

Event 

Risk Shifting to 

Other Parties 

Purpose 

and Intent?

Natural Hazard Low/None Low/None Low/None No 

Accident Moderate 

(Prevention) 

Moderate 

(Avoidance) Low/None No 

Sabotage 

High 

(Deterrence, 

detection) 

High 

(Deterrence) Low to Moderate Yes 

Terrorism 

High 

(Deterrence, 

detection) 

High 

(Deterrence) High Yes 

In Figure A-1, hazards located in the nine rightmost cubes, for example, can be 

deterred by building protection. Hazards located in the nine cubes that make up the top 

layer of the figure will vary by type, depending on building protection choices. Several 

hazards are considered to demonstrate this classification scheme. 

 

125 The collapse of the twin towers of the World Trade Center from the September 11th attacks provides an 

example of the potential for extensive collateral damage. Although these two buildings were targeted and 

attacked, a total of seven buildings and one bridge were destroyed, seven more buildings suffered severe 

damage, and an additional 15 buildings suffered moderate damage (Hartwig, “The Long Shadow of 

September 11,” p. 7). 
82 

Figure A-1 Classification of Hazards by Responsiveness to Mitigation 

A.2.3.1 Natural Hazards 

For natural hazards, the likelihood of an event is completely unresponsive to 

protection measures. Natural hazard events are not purposive. The probability of their 

occurrence is not affected by any mitigation measures that building owners and managers 

put in place. The type of event that occurs, such as earthquake vs. hurricane, or level 3 

vs. level 5 hurricane, is also not affected by building protection. Furthermore, 

implementing effective mitigation reduces the building’s risk and vulnerability to natural 

hazards, for both the building owner or manager and for society as a whole, so that no 

risk shifting occurs. Any reduction in risk due to a building owner or manager’s choices 

about building protection does not lead to an increase in risk to other parties, and is 

therefore an absolute reduction of the social risk. Natural hazards are represented by the 

diagonally striped cube in Figure A-1. In general, this cube represents an event whose 

Low Moderate High

Probability of an Event 

Risk 

Shifting Low 

High 

Moderate 

Type of Event 

 Low Moderate Hi

gh 

Natural 

Hazard 

Terrorism 

Accident

Sabotage
83 

probability, variety, and shifts in risk are minimally affected by the building’s mitigation 

measures. In the case of a hurricane, for example, mitigation measures at one facility do 

not affect the probability that a hurricane will hit it, nor will it affect the severity of the 

hurricane, nor will it cause the hurricane to move to an unprotected facility. 

A.2.3.2 Accidents 

Accidents, represented by the shaded cube, share some similarities with natural 

hazards. Accidents are not purposive, and mitigation can limit their negative 

consequences. In addition to reducing the severity of damage, preemptive mitigation 

measures or safeguards can prevent or reduce the likelihood of accidents. The likelihood 

of accidents is therefore classified as moderately responsive. Mitigation may affect the 

type of accident that can occur, if the safeguards are more focused on preventing one kind 

of accident (such as a chemical spill) than another. Therefore, the responsiveness of type 

of accident event to mitigation is also considered “moderate.” Because accidents do not 

involve strategic behavior, in the sense that an accident does not “choose” the most 

vulnerable target, the reduction in probability of an accident occurring at one facility will 

not lead to an increased probability at another facility. The risk will not shift. As with 

natural hazards, a reduction in risk to the building owner is absolute and also represents a 

commensurate reduction in risk to society. 

A.2.3.3 Sabotage 

Sabotage, denoted by the checkerboard cube, is another type of hazard that 

owners of commercial office buildings, industrial facilities, and infrastructure face. 

Sabotage is purposive and can be prevented or deterred through mitigation, so the 

probability of sabotage is highly responsive to protective measures. The type of mischief 

that a saboteur chooses may also be affected by protective measures, if the saboteur 

identifies and exploits the weaknesses at a facility. To what extent the risk of sabotage 

shifts to other parties if a building owner implements protective measures depends on the 

motives of the saboteur. For sabotage by a disgruntled employee, for example, the risk 

may not shift if damaging another party would not satisfy the need of that employee (for 

revenge against the employer, for example). In the case of sabotage by protestors, 

however, the risk may shift to other, softer buildings or facilities possessing the attributes 

that the protesters find objectionable. For this reason, the responsiveness of risk shifting 

to other parties due to building protection is considered low to moderate, although it is 

represented as “low” in Figure A-1. 

A.2.3.4 Terrorism 

The case of terrorism, represented by the horizontally striped cube, is the extreme 

case, in which both the consequences and the probability of an event are affected by the 

mitigation choices of the building owner or manager. Effective mitigation may lower the 

probability of a terrorist event through increased deterrence and detection. Mitigation 

may also lead terrorists to abandon one mode of attack (such as a car bomb) for another 

(such as a rocket-propelled grenade). But unlike natural hazards and industrial accidents, 
84 

terrorism involves the possibility of strategic behavior. Terrorists can make decisions 

about whether, where, when, and how to attack based on the mitigation decisions of 

building owners and managers. Terrorists who are intent on causing harm may observe 

mitigation and protection measures at the preferred target. The terrorists may look for a 

substitute target that is more vulnerable (i.e., a “softer” target) rather than attack its 

preferred target and accept a lower likelihood of causing damage, devote more resources 

to the attack, choose an alternate mode of attack, or face a higher chance of detection. 

With protective measures, the risk from the terrorist hazard shifts from the protected 

facility to less protected facilities. Although the building owner or manager who 

implements risk mitigation measures has reduced that building’s exposure to terrorist 

risk, these risk mitigation measures may leave overall terrorist risk unchanged, so that 

society as a whole is not necessarily safer from terrorist attack. 
85 

Appendix B: Process for Identifying and Classifying Benefits and Costs 

This appendix outlines a three-step process for identifying and classifying benefits 

and costs. First, information was solicited from members of the Office of Applied 

Economics cost-effectiveness project team. This information was used to develop 

candidate lists of key stakeholder126 classes (e.g., building owners) and general types of 

benefits and costs. Second, the lists were refined and organized into a suite of 

“classification” hierarchies. Third, the classification hierarchies were presented to the 

members of the Steering Committee, a cross section of subject matter experts from 

industry and government who provide advice and guidance to the cost-effectiveness 

project team. Following the Steering Committee meeting, additional comments on the 

hierarchies were solicited from both the Steering Committee and the project team. These 

interactions were used to finalize the classification hierarchies presented in this appendix 

and to outline a “priority setting” procedure that facilitates the collection of the types of 

data needed to generate the year-by-year estimates used as inputs to the economic 

evaluation methods presented in Chapter 4. 

B.1 Identification of Key Stakeholders 

Because individual stakeholders are affected in different ways by homeland 

security investment decisions, it is useful to first identify classes of individual 

stakeholders and then classify them into stakeholder groups. By developing a 

classification hierarchy of stakeholders, we are better able to understand and identify

both potential opportunities (i.e., real or perceived benefits and cost savings accruing to 

that stakeholder) and potential barriers (i.e., real or perceived costs and benefit reductions 

borne by that stakeholder) to the use of the mitigation strategies described in this report. 

Since individual stakeholder classes evaluate the benefits and costs of the 

mitigation strategies purely from their “stakeholder” viewpoint, it is important to reflect 

not only that viewpoint, but the viewpoints of aggregations of stakeholder classes (i.e., a 

single stakeholder group or a collection of stakeholder groups) and all stakeholder groups 

as well. The viewpoint of the individual stakeholder is important because they make the 

decision of whether or not to utilize a particular mitigation strategy. Examples of 

individual stakeholder classes are building owners, engineering consultants, and trade 

associations. A single stakeholder group is a special aggregation of individual 

stakeholders classified according to a common theme. An example of a stakeholder 

group is construction and associated support services. This stakeholder group contains 

five classes of individual stakeholders: construction workers, general contractors, 

specialty trade contractors, trade associations, and wholesale/retail trade/supply. A 

collection of stakeholder groups is important because an individual stakeholder class may 

be a key player in several stakeholder groups. The overall picture (i.e., all stakeholder 

groups) is important because it reflects the benefits and costs of the mitigation strategies 

to society. The government’s approach to homeland security is undertaken from 

 

126 Stakeholders are organizations or individuals directly affected by mitigation activities or disaster-related 

losses. 
86 

society’s frame of reference. Thus, it includes all benefits and costs to whomsoever they 

accrue. 

Table B-1 is a hierarchy of stakeholders; it lists stakeholder groups with their 

corresponding classes of individual stakeholders. It shows how the stakeholder groups 

are formed. The eight stakeholder groups are listed in a bold-italics typeface. The 

classes of individual stakeholders are listed in alphabetical order beneath each 

stakeholder group. 

Table B-2 is a hierarchy of customers. Throughout this report, we make a 

distinction between stakeholders and customers. Customers are the intended users of the 

economic tools (i.e., economic evaluation methods and software for implementing those 

methods); they are either directly or indirectly empowered to decide which combination 

of mitigation strategies to employ. Therefore, customers are a subset of stakeholders. 

Table B-2 shows how customer groups are formed. In Table B-2, the eight customer 

groups are listed in a bold-italics typeface. The classes of individual customers are listed 

in alphabetical order beneath each customer group. 

The methodology described in this report encompasses all stakeholder groups. 

However, if analyses from the perspective of a single stakeholder or stakeholder group 

were desired, Table B-1 could be used to structure these analyses (see Section B.4). In 

such cases, Table B-1 may be used to select which class (classes) of individual 

stakeholders is (are) appropriate. 

B.2 Classification of Benefits and Cost Savings Derived from the Use of 

Mitigation Strategies 

Stakeholders and customers of the software tool choose among alternative 

combinations of mitigation strategies because they anticipate receiving, in present value 

terms, benefits or cost savings in excess of the costs or benefit reductions associated with 

these choices. Table B-3 provides a framework for one side of the stakeholder/customer 

investment decision problem: namely, how to identify homeland security-related benefits 

and cost savings from society’s frame of reference (i.e., across all stakeholder groups). 

Table B-3 is organized as a three-tiered hierarchy. It is the culmination of the 

Office of Applied Economics cost-effectiveness project team’s efforts to produce a 

consensus on a comprehensive list of homeland security-related benefits and cost savings. 

The first tier of the hierarchy lists generic types of benefits and cost savings. The 

three first tier elements—financial incentives, cost savings, and other benefits—are in 

white font against a black background. 

 The second tier lists specific types of benefits and cost savings associated with its 

“parent” first tier element. Note that the first tier elements are subdivided into event 

related costs and non-event related costs. These first-tier subheadings are shown in 

italics. For example, for cost savings, its second tier event-related elements include 

reduced damages and fewer fatalities, illnesses, and injuries. 

 The third tier lists specific types of benefits and cost savings associated with its 

“parent” second tier element. For example, for tax advantages, its third tier elements 

include forgiveness of sales tax, investment tax credits, and reduced assessments.
87 

Table B-1 Hierarchy of Stakeholders by Groups and Classes of Individual Stakeholders 

Owners, Managers, and Developers 

• Buildings (Private Sector, Public Sector Civilian, Public Sector Military)

• Industrial Facilities • Infrastructure (Private Sector, Public Sector Civilian, Public Sector Military)

Construction and Associated Support Services 

• Construction Workers • General Contractors • Specialty Trade Contractors • Trade Associations • Wholesale/Retail Trade/Supply 

Codes, Standards, and Support Services 

• Building/Industrial Facility/Infrastructure Owners • Building/Industrial Facility/Infrastructure Permitting and Inspection • Code Officials • Code Organizations • Construction Products/Equipment Manufacturers • Professional Societies • Product Certification Services • Product Evaluation Services • Research Organizations • Standards Organizations • Trade Associations 

Manufacturing Interest Groups 

• Construction Products/Equipment Manufacturers • Customer Service Operations • Product/Equipment/Software Designers • Product/Equipment/Software Innovators • Product/Equipment/Software Marketing, Sales, and Distribution 

Services 

• Professional Societies • Research Organizations • Testing Laboratories 

• Testing Services • Trade Associations 

Government Programs and Support Groups 

• Elected Officials • Disaster Assistance • Emergency Preparedness • Emergency Response • Financial Planning • Policy Makers • Regulators: Nuclear Regulatory Commissio

• Investigators: NTSB, National Construct• Specialized Federal, State, and Local Pro

Professional Services 

• Architects • Designers • Engineering Consultants (Asset Evaluation

Electrical Engineers, Fire Protection EngineeSecurity Consultants, Structural Engineers)

• Financial Institutions • Insurance Companies: Direct and Reinsu

• Real Estate Services • Warranty Companies 

Research and Policy Analysis Groups 

• Financial Institutions • Insurance Companies: Direct and Reinsu• Research Organizations 

Other 

• Customers/Users • Occupants/Tenants/Employees/Visitors • Special Interest Groups • Third Parties
88 

Table B-2 Hierarchy of Customers by Groups and Individual Customers Civilian Government Operations 

• Federal 

3⁄4 Architect of the Capitol 3⁄4 DOD 3⁄4 DOE 3⁄4 Federal Facilities Council 3⁄4 GSA 3⁄4 Interagency Security Committee 3⁄4 Justice Department 3⁄4 State Department: Overseas Building Operations 3⁄4 Transportation Department 3⁄4 Treasury Department 

• State and Local 

3⁄4 Education: K-12, Colleges, Universities, and Vocational 

3⁄4 Office 3⁄4 Public Assembly 3⁄4 Public Order and Safety: Courthouses, Fire Stations, Police 

Stations 

3⁄4 State and Local Departments of Transportation 

Military Installations 

• Domestic and Overseas • DTRA 

Government Policy 

• Department of Commerce 

3⁄4 Economic Development Administration 3⁄4 Economics and Statistics Administration 

• Department of Homeland Security 

3⁄4 FEMA 3⁄4 National Infrastructure Protection Center 

• Department of Justice: FBI • White House: Executive Office of the President 

3⁄4 Domestic Policy Council 3⁄4 Office of Homeland Security 3⁄4 Office of Science and Technology Policy 

Private Sector Operations 

• Owners • Managers • Developers 

Professional Societies/Trade Associations 

• AACE International • ASME International • CERF • CII • NIBS • SAVE International • TISP 

Other Research Organizations 

• ASME International • ASTM International • CERF • CII 

• ISO • National Labs • NIBS • Universities with Construction Managem• Wharton Risk Management and Decision 

Codes, Standards, and Support Services 

• Code Organizations • Standards Organizations 

Professional Services 

• Architects • Designers • Engineering Consultants (Asset Evaluation

Electrical Engineers, Fire Protection EngineeSecurity Consultants, Structural Engineers)
89 

Table B-3 Classification of Benefits and Cost Savings Derived from the Use of Mitigation Strategie

Financial Incentives Event Related

Lower Deductibles

 Non-Event Related

Cost-Sharing ArrangementsFederal Funding for Critical AssetsReduced Insurance PremiumsLower Financing CostsPreferred DesignationTax Advantages

Accelerated DepreciationExpensing Capital InvestmentsForgiveness of Sales TaxInvestment Tax CreditsReduced AssessmentsSet AsidesTax Deductions

Cost Savings Event Related

Fewer Fatalities, Illnesses, and InjuriesReduced DamagesReduced Down Time

 Non-Event Related

More Efficient Systems

Energy ConservationEnhanced ControlImproved Indoor Air Quality

Reduced O&M Costs

Other Benefits Event Related

Potential for Addressing Multiple HazardsReduced Liability (Due to Use of Best Practices)Less Likely Target: Building and Vicinity

 Non-Event Related

Better Able to Attract Tenants

Higher Occupancy RateIncreased Rental IncomeMore Marketable

Higher Employee Retention (Due to Reduced Labor Turnover)Improved Public Relations (Due to Stewardship Issues)Increased Productivity (Due to More Efficient Systems)Increased Resale Value/Faster Property Turnover

Rental Premium
90 

It is important to recognize that the benefits and cost savings listed in Table B-3 

might accrue to any individual stakeholder (i.e., they are aggregated according to society’s 

frame of reference). Thus, Table B-3 is structured from “society’s” frame of reference rather 

than from the perspective of a single stakeholder or stakeholder group. The main purpose of 

Table B-3 is to illustrate how the government approaches the social “benefits” side of the 

alternative mitigation strategies. Specifically, BFRL used this table to identify the data 

needed to measure these “broader” impacts. From the government’s point of view, Table B3 identifies the potential “benefits” data links. However, if the focus is on an individual 

stakeholder or stakeholder group, it will be necessary to develop a cross-reference between 

the generic types of benefits and cost savings listed in Table B-3 and the stakeholder groups 

listed in Table B-1. This cross-reference is the subject of Section B.4. 

A potential benefit from building protection is economic spillovers. Some 

improvements, such as structural retrofits, modernized heating and ventilation systems, and 

increased perimeter security, may improve the performance of a building in ways other than 

reducing damage from terrorist threats. A building ventilation system with a larger fresh air 

shaft, more filtering and air circulation, and floor-by-floor air handling units, for example, 

may be intended to reduce vulnerability to chemical or biological contamination. However, 

it may lead to superior overall air quality, which has been linked to increased worker 

productivity.127 Studies have also linked thermal controls to modest productivity 

improvement.128 Government agencies have also reported anecdotal evidence of spillovers: 

tighter perimeter access following the September 11th attacks due to broad security concerns 

has had the additional effect of reducing the number of petty theft and vehicle vandalism 

incidents. 

 There is potential asymmetry, however, in the bearers of the upgrade costs and the 

beneficiaries of the economic spillovers. If the building owners provide the outlays for the 

improvements, but the spillover benefits accrue entirely to tenants and visitors, then financial 

incentive for improvements will not exist, and the level of investment in improvements 

would be sub-optimal. Benefits such as labor productivity improvements and crime 

reduction typically accrue to building tenants and occupants, rather than owners. In cases 

where the building owner and the building occupant are distinct from each other, these 

benefits are spillovers, which must be appropriable by building owners in order for these 

spillovers to be incentives. This linkage of incentives can occur through increased leasing 

rates to tenants. Another avenue of appropriation is in higher property value of fortified 

buildings. Whether or not the building owner is also the building occupant, a rise in the 

property value that reflects the investments in structural improvements is another financial 

incentive in its own right. Intuitively, property values would respond to risk mitigation that 

is embodied in the structure or system, such as hardening of the building shell, in contrast to 

un-embedded mitigation, such as security personnel-based patrolling measures. 

 

127 Fisk, William J. “Health and Productivity Gains from Better Indoor Environments and Their Relationship 

with Building Energy Efficiency,” Annual Review of Energy and the Environment, Vol. 25, 2000, pp. 537-566. 128 Lomonaco, Carol and Miller, Dennis. “Comfort and Control in the Workplace,” ASHRAE Journal, Vol. 39, 

No. 9, September 1997, pp. 50-56. 
91 

B.3 Classification of Costs and Benefit Reductions Associated with Risks or the Use 

of the Mitigation Strategies 

Costs are at the heart of any decision to select among the key mitigation strategies. 

Costs are incurred at several points in the life cycle of a typical constructed facility. These 

costs and benefit reductions are summarized in Table B-4, which is organized as a threetiered hierarchy. 

Because Table B-3 and Table B-4 are used to measure the “benefits” and “costs” 

sides of the mitigation strategies, the end product of these classification hierarchies is a 

collection of economic data. In the case of homeland security-related costs and benefit 

reductions, the depth of the hierarchy (i.e., the number of tiers) is equal to three. In principle, 

the depth of these data-related classification hierarchies could be equal to one, to two, to 

three, or to some number greater than three. The rule governing the depth of the hierarchy is 

how far down in the hierarchy one must go until all lowest level elements in the hierarchy are 

indicative of economic data. For homeland security-related costs and benefit reductions, 

three tiers were considered adequate. 

The first tier of the hierarchy in Table B-4 lists generic types of costs and benefit 

reductions. The three first tier elements—capital investment, operations, and maintenance, 

and other—are listed in white font against a black background. 

The second tier lists specific types of costs and benefit reductions associated with its 

“parent” first-tier element. Note that the first-tier elements are subdivided into event-related 

costs and non-event related costs. These first-tier subheadings are shown in italics. For 

capital investment, its second-tier event related elements include expected damages; its 

second-tier, non-event related elements include first costs and new technology introduction 

costs. 

New-technology introduction costs merit a closer examination. Ehlen and 

Marshall129 define new-technology introduction costs as those costs covering the activities 

that bring the material/product from the research laboratory to full field implementation. 

New-technology introduction costs include the extra time and labor to design, test, monitor, 

and use the new technology. These costs are documented under the third tier of the 

classification hierarchy. Ehlen’s and Marshall’s research on new-technology introduction 

costs has a bearing on homeland security applications because they demonstrate that newtechnology introduction costs disappear once the designer is satisfied with the technology’s 

performance and service life, the technology enters full implementation, and its application 

has become routine. 

 

129 Ehlen, Mark A., and Marshall, Harold E. The Economics of New-Technology Materials: A Case Study of 

FRP Bridge Decking. NISTIR 5864 (Gaithersburg, MD: National Institute of Standards and Technology, 1996). 
92 

Table B-4 Classification of Costs and Benefit Reductions Associated with Risks or the Use of Mitigatio

Capital Investment Event Related

Expected Damages

 Non-Event Related

Conversion CostsDecommissioningFirst CostsFuture UpgradesMajor ReplacementsNew Technology Introduction Costs

Increased Costs of Adapting New Construction Technologies, ProPractices to Industry UseIncreased Risk Exposure and Uncertainty Due to Construction witProducts, Equipment, or Practices

R&D for Product Development and TestingSite ProtectionSpecial Security Features

O&M Event Related

Business Interruptions

 Non-Event Related

Equipment Maintenance and RepairInsurance PremiumsIT SecuritySite SecuritySite UtilitiesSpecialized Training

Other Event Related

Denial of ServiceFatalitiesLegal LiabilityNon-Fatal Illnesses and Injuries

 Non-Event Related

Cost Burdens on Users/Producers/CustomersCosts of New Standards DevelopmentMarketing, Advertising, and Distribution Costs for New Technologies, Products, Equipment, or PracticesReduced FunctionalityTransshipment Cost
93 

B.4 How Benefits and Costs Accrue to Stakeholders 

In Sections B.2 and B.3, homeland security related benefits and costs were 

identified from society’s frame of reference. Thus, it includes all benefits and costs to 

whomsoever they accrue. Although this is the traditional approach for public-sector 

economic studies, it is too broad for most stakeholder groups. This is because most 

stakeholder groups want to evaluate the benefits and costs accruing to them for choices 

among the key mitigation strategies. In addition, the traditional approach employed in 

public-sector studies complicates the data collection effort. Basically, the higher the level 

of abstraction, the more difficult it becomes to define data “categories” and collect the 

types of economic data that lead to meaningful results. To address this “complicating” 

factor, this study develops two cross-references between stakeholder groups and: (1) 

benefits and cost savings and (2) costs and benefit reductions. The two cross-references 

are presented as Table B-5 and Table B-6. Table B-5 lists key types of benefits and cost 

savings by stakeholder group; Table B-6 lists key types of costs and benefit reductions by 

stakeholder group. 

 The two cross-references serve three purposes. First, they define in an 

unambiguous manner all of the potential data categories from which to collect economic 

data. In fact, each data category may be specified as a unique combination of stakeholder 

group and type of benefit or type of cost. Second, the cross-references promote a 

priority-setting process for identifying what specific types of data to collect and where to 

collect them. For example, if we know that four stakeholder groups—building owners, 

managers, and developers, construction and associated support services, professional 

services, and other—are beneficiaries of increased resale value (see the cells beneath the 

“stakeholder group” column headings in Table B-5 with check marks (9)), then we can 

focus our “resale value” data collection effort on these four stakeholder groups. Thus, the 

data collection strategy, stated in its simplest terms, is to limit the data collection effort to 

those cells of Table B-5 and Table B-6 with check marks (9). This priority-setting 

approach to data collection is employed in this report. Finally, the cross-references 

provide the means through which an individual stakeholder/customer or 

stakeholder/customer group may evaluate the pros and cons of choosing among 

combinations of mitigation strategies. Thus, the cross-references both simplify the 

presentation of material in this report and provide the framework for identifying key data 

elements and for specifying a data collection strategy for individual 

customers/stakeholders. 

An expanded discussion of the third purpose of the cross-references is used to 

illustrate how to apply the decision methodology presented in Chapter 4. This illustration 

is best understood by considering a specific stakeholder group, say building owners, 

managers, and developers. If building owners, managers, and developers are choosing 

among the key mitigation strategies, they need to know if the life-cycle cost over the 

proposed study period of a given combination of mitigation strategies is less than that of 

maintaining the status quo. 

The first step in this “decision problem” is to identify the types of benefits and the 

types of costs. The “benefits” accruing to and the “costs” borne by building owners, 

managers, and developers are recorded in the first “stakeholder group” column of Tables 

B-5 and B-6, respectively. Reference to Table B-5 shows that building owners, 
94 

managers, and developers benefit from all 19 types of benefits and cost savings. 

Examples of specific types of benefits and cost savings accruing to building owners, 

managers, and developers are lower financing costs, reduced damages, and increased 

resale value. 

Reference to Table B-6 shows that building owners, managers, and developers 

bear 23 of the 26 types of costs. The costs not incurred by building owners, managers, 

and developers are associated with R&D for product development and testing, new 

standards development, and marketing, advertising, and distribution costs for new 

technologies. 

The second step is to compile a list of the types of benefits and the types of costs 

for which data are available and are relevant. The goal of the second step is to identify 

those data that will allow meaningful comparisons—based on life-cycle cost 

considerations—between the combinations of mitigation strategies being considered. 

The third step is to collect the economic data. The economic data collected in the 

third step are used to support a life-cycle cost analysis of the combinations of mitigation 

strategies being considered. 

Finally, evaluate the economic performance of each combination of mitigation 

strategies being considered. This is done by calculating the life-cycle cost for each 

combination of mitigation strategies and selecting the one that minimizes the life-cycle 

cost over the proposed study period. 

The same procedure can be used for an individual stakeholder/customer class. 

First, select the individual stakeholder class. Then, refer to Tables B-1 and B-2 to 

identify the appropriate stakeholder group(s). Finally, follow the procedure just 

described to determine how to choose among combinations of mitigation strategies. 
95 

Table B-5 Types of Benefits (or Cost Savings) Classified by Stakeholder Group 

Stakeholder Group 

Type of 

Benefit or 

Cost Saving 

Owners, 

Managers, 

& 

Developers 

Construction & 

Associated 

Support Services 

Codes, 

Standards, & 

Support Services 

Manufacturing 

Interest Group 

Gov’t. 

Programs & 

Support 

Groups 

Professional 

Services 

R

Financial incentives 

Cost-Sharing Arrangements 

9 9 9 9 

Fed. Funding for Critical Assets 

9 9 

InsuranceBased Incentives130

9 9 9 

Lower Financing Costs 

9 9 9 9 

Preferred Designation 

9 9 9 9 

Tax Advantages 9 9 9 

Cost Savings 

Fewer Fatalities, Illnesses, & Injuries 

9 9 

Reduced Damages 

9 9 

Reduced Down Time 

9 9 

More Efficient Systems 

9 9 9 9 

130 Insurance-based incentives include reduced insurance premiums and lower deductibles. 
96 

Table B-5 Types of Benefits (or Cost Savings) Classified by Stakeholder Group (continued) 

Stakeholder Group 

Type of 

Benefit or 

Cost Saving 

Owners, 

Managers,& 

Developers 

Construction & 

Associated 

Support Services 

Codes, 

Standards, & 

Support Services 

Manufacturing 

Interest Group 

Gov’t. 

Programs & 

Support 

Groups 

Professional 

Services 

R

Other Benefits 

Potential for Addressing Multiple Hazards 

9 9 9 9 

Reduced Liability 

9 9 9 

Better Able to Attract Tenants 

9 9 

Higher Employee Retention 

9 

Improved Public Relations 

9 

Increased Productivity 

9 

Increased Resale Value/Faster Property 

9 9 9 

Less Attractive Target: Building & Vicinity 

9 9 

Rental Premium 9 9 
97 

Table B-6 Types of Costs (or Benefit Reductions) Classified by Stakeholder Group 

Stakeholder Group 

Type of Cost or 

Benefit 

Reduction 

Owners, 

Managers,& 

Developers 

Construction 

& Associated 

Support Services 

Codes, 

Standards, & 

Support Services 

Manufacturing 

Interest Group 

Gov’t. 

Programs & 

Support 

Groups 

Professional 

Services 

R

Capital Investment 

Expected Damages 

9 9 9 9 9 9 

Conversion Costs 9 9 9 9Decommissioning 9 9 9 9First Costs 9 9 9 9 9Future Upgrades 9 9 9 9 9Major Replacements 

9 9 9 9

New Technology Introduction Costs 

9 9 9 9 9 

R&D for Product Development & Testing 

9 9

Site Protection 9 9Special Security Features 

9 9 9

O&M 

Business Interruptions 

9 9 9 

Equipment Maintenance & Repair 

9 9

IT Security 9 9 9 Site Security 9 9 Site Utilities 9 Specialized Training 

9 9 9
98 

Table B-6 Types of Costs (or Benefit Reductions) Classified by Stakeholder Group (continued) 

Stake Holder Group 

Type of Cost 

or Benefit 

Reduction 

Owners, 

Managers,& 

Developers 

Construction & 

Associated 

Support Services 

Codes, 

Standards, & 

Support Services 

Manufacturing 

Interest Group 

Gov’t. 

Programs & 

Support 

Groups 

Professional 

Services 

R

Other 

Denial of Service 

9 9 

Fatalities 9 9 Legal Liability 9 9 9 9 9Insurance Premiums 

9 9

Non-Fatal Illnesses & Injuries 

9 9 

Cost Burdens on Users / Producers / Customers 

9 9 9 9 9 

Costs of New Standards Development 

9 9 9 

Marketing, Advertising, & Distribution Costs for New Technologies, Products, Equipment, or Practices 

9 

Reduced Functionality 

9 

Transshipment Costs 

9 9 9 
99 

Appendix C: A Note on Calculating the Savings-to-Investment Ratio 

 In Section 4.2.3, we noted that the use of the savings-to-investment ratio (SIR) is 

inappropriate whenever PVI'j ≤ PVI'0 , where the subscript j refers to alternative Aj, and 

the subscript 0 refers to the base case, and the apostrophe ( ' ) indicates that expected 

losses are included in all present value (PV) expressions. This appendix provides the 

mathematical foundations for calculating the SIR and interpreting the results of that 

calculation. All derivations presented in this appendix are based on the life-cycle cost 

(LCC) method. Section 4.2.1, where the LCC method was described, demonstrated that 

alternative Aj was economically preferred to the base case if, and only if, LCCj < LCC0. 

Alternatively, the derivations presented in this appendix could be based on the present 

value net savings (PVNS) method. Both the LCC and PVNS methods lead to the same 

conclusions because, by definition (see Equation (4.11)), if PVNSj:0 > 0, then LCCj < 

LCC0. 

 Given that alternative Aj is economically preferred to the base case, we derive 

conditions for calculating the SIR and a decision rule for interpreting the results. If 

LCCj < LCC0 (C.1) 

then through reference to Equation (4.9), and upon simplification 

PVC'j + PVI'j < PVC'0 + PVI'0 (C.2) 

which implies 

PVI'j - PVI'0 < PVC'0 - PVC'j (C.3) 

which, through reference to Equations (4.12) and (4.13), yields 

PVIIj:0 < PVS j:0 (C.4) 

If 

PVIIj:0 > 0 (C.5) 

or, equivalently, 

PVI'j > PVI'0, (C.6) 

then 

:0

:0

1 j

j

PVS

PVII

< , (C.7) 

which, through reference to Equation (4.14), produces the decision rule 
100 

SIRj:0 > 1 (C.8) 

Thus, whenever PVIIj:0 > 0, a necessary condition for alternative Aj to be economically 

preferred to the base case is SIRj:0 > 1. This decision rule was stated in Section 4.2.3. 

If 

PVIIj:0 ≤ 0 (C.9) 

then three possibilities occur. These possibilities are analyzed as Case 1, Case 2, and Case 3. 

Case 1: PVIIj:0 = 0

In this case, SIRj:0 is undefined because the denominator is zero. 

Case 2: PVIIj:0 < 0 and PVSj:0 > 0

Assume Expression (C.1) holds, then by virtue of Expression (C.4) the following 

inequality holds: 

PVIIj:0 < 0 < PVSj:0 (C.10) 

which implies 

:0

:0

1 0 j

j

PVS

PVII

> > (C.11) 

or, equivalently 

SIRj:0 < 0 (C.12) 

Although a negative SIR seems counter-intuitive, Case 2 is easily explained. Since 

PVSj:0 > 0 and PVIIj:0 < 0, alternative Aj produces greater savings at a lower investment 

cost than the base case. Hence, alternative Aj is economically preferred to the base case. 

Case 3: PVIIj:0 < 0 and PVSj:0 ≤ 0

Assume Expression (C.1) holds, then by virtue of Expression (C.4) the following 

inequality holds: 

PVIIj:0 < PVSj:0 ≤ 0 (C.13) 

which implies 
101 

:0

:0

1 0 j

j

PVS

PVII

> ≥ (C.14) 

or, equivalently 

0 ≤ SIRj:0 < 1 (C.15) 

An economic interpretation of Expression (C.15) is whenever both savings and 

the change in the present value of investment costs are negative, in order for Aj to be 

economically preferred to the base case, its reductions in PVII must be greater than the 

corresponding reductions in savings. Intuitively, negative values of PVII are a desirable 

outcome whereas negative savings are not. 

The material presented in this appendix demonstrates that whenever Expression 

(C.1) holds (i.e. alternative Aj is economically preferred to the base case) any value of the 

SIR could result. Only if PVIIj:0 > 0 does a concise decision rule result; namely, choose 

alternative Aj whenever SIRj:0 > 1. 

The complications imposed by Cases 1, 2, and 3 provide a rationale for why it is 

inappropriate to use the SIR as a decision criterion whenever PVIIj:0 ≤ 0. Use instead, 

LCC and/or PVNS. Both LCC and PVNS produce unambiguous results for the three 

cases examined in this appendix. 

If the value of the SIR is computed by hand, in a spreadsheet, or through the use 

of any software package, and if either Case 2 or Case 3 occurs, then values less than 1 

will result for which alternative Aj is economically preferred to the base case (i.e. PVNSj:0

> 0). If Case 1 results, then a value for the SIR can not be calculated due to an attempted 

division by zero. Thus, if any type of software package is used to calculate the value of 

the SIR, some warning message needs to be generated whenever PVIIj:0 ≤ 0, to alert the 

software user that the values of LCC and PVNS are the relevant decision criteria, and not 

the value of the SIR. 
102 
103 

Appendix D: Theoretical Foundations of Risk Mitigation Decisions 

The decisions about how much to spend on protecting constructed facilities and 

their occupants from terrorist risks and natural hazards, and what types of measures are 

appropriate, are some issues facing building owners and managers. The life-cycle cost 

approach and the software implementation that were presented in Chapters 4 and 5 are 

tools to support this decision-making process. The question of how much to spend for 

the case of a single building described in Section 6.1, however, merits additional 

theoretical treatment. 

The theoretical approach in this appendix breaks the expenditure decision into its 

components. It illustrates, through the use of four models, how the different factors that 

affect the choice of strategy interrelate, and how those interrelationships determine the 

level of expenditure associated with the lowest life-cycle cost. Although the four models 

are based on a life-cycle cost approach, this theoretical approach simplifies the life-cycle 

cost analysis in Chapter 4. The theoretical models here evaluate only the optimal level of 

investments in engineering alternatives, expenditures in management practices, and 

insurance coverage. The models in this appendix assume each dollar of investment in 

engineering alternatives is the same in terms of its effect on costs and losses, whether it is 

used, for example, to upgrade an HVAC system or to install laminated glass. In the 

analysis in Chapter 4, the different types of engineering alternatives are treated 

differently, so that even if their investment cost is the same, the effect on other costs 

(such as O&M) and expected losses may not be. The models in this appendix also 

include elaboration of the expected losses component of life-cycle cost. 

In these models, building owners and managers choose investment and 

expenditure in risk mitigation based on constrained optimization. There is considerable 

empirical evidence that decision-makers have systematic biases and utilize simplified 

decision rules in making choices about investment in protective measures.131 The 

challenge is to develop prescriptions so that they come closer to making decisions using 

normative models of choice such as constrained optimization. Subject to budget 

constraints, the objective is for building owners and managers to choose engineering 

alternatives, management practices, and financial mechanisms that minimize life-cycle 

costs, including expected losses from terror threats. Engineering alternatives involve 

both physical investment as well as non-investment expenditures, such as O&M and 

other costs. Protective investments are capital resources that building owners and 

managers allocate to mitigate the risk that terrorism or natural hazards pose to their 

facilities. Investments refer to durable, capital goods, such as building structural 

components, building systems and subsystems, land, and machinery and mechanical 

equipment. Examples include HVAC systems, structural retrofits, and closed-circuit 

television cameras and monitors.132 Budgetary outlays to operate and maintain 

 

131 Kunreuther, Howard. “Protective Decisions: Fear or Prudence,” Chapter 15, Wharton on Making 

Decisions, edited by Stephen Hoch and Howard Kunreuther (New York: John Wiley & Sons, Inc., 2001), 

pp. 259-272. 

132 Protective investments do not include expenditures for protection. Unlike investments, protective 

expenditures do not retain value beyond the point when the expenditure is made. Examples of protective 

expenditures are additional security patrols hired, the value of employee labor hours devoted to training and 

drills, and resources devoted to developing emergency plans and procedures. 
104 

engineering alternatives and to implement management practices and financial 

mechanisms, on the other hand, are considered expenditures. 

The models presented in this appendix examine the decisions that building owners 

and managers can make to protect a single building. The sections that follow include the 

descriptions, assumptions, and results of the models. Model 1, in Section D.1, is the case 

where building owners and managers choose the level of investment in engineering 

alternatives during the initial period. This model illustrates which factors affect the level 

of protective investment that results in the lowest life-cycle cost. Section D.2 presents 

Model 2, which extends Model 1 to include decisions about expenditures to implement 

management practices in each period. Model 3, in Section D.3, further extends Model 2 

by adding financial mechanisms. Building owners and managers can choose how much 

insurance to purchase in every period and can receive a proportional subsidy for the 

investments in the engineering alternatives. Model 4, presented in Section D.4, 

generalizes Model 3 to allow for investments in engineering alternatives in more than one 

period. In all models, it is assumed that there are no interdependencies between 

individuals and the probabilities are not affected by the decisions of others.133 Model 4 is 

a cumulation of Model 1, Model 2, and Model 3. Model 4 can be presented 

independently of the first three. But, each of the first three models is presented in order 

to highlight the factors which determine each type of mitigation strategy: engineering 

alternatives, management practices, and financial mechanisms. 

D.1 Model 1: Choosing Engineering Alternatives for Risk Mitigation 

The optimal level of investment in engineering alternatives will be based on 

minimization of life-cycle costs, taking into consideration the reductions in losses if 

terrorism or natural hazards occur. The costs include any increases in O&M or other 

costs. Even though the building owner or manager makes only one investment (here in 

period 0) to protect the building, the life-cycle cost approach is appropriate as the costs 

and benefits associated with the one-time investment accrue over the duration of the 

study period. 

In Model 1, the building owner or manager chooses how much to invest in 

engineering alternatives to minimize the life-cycle cost. This decision is made in period 

0, given the initial conditions and budget constraint. This level of investment in 

engineering alternatives is denoted I0. Equations (D.1) through (D.4) describe the 

optimization problem for the basic model over the study period, which lasts from period 

0 to period T: 

 

133 Because they are optimizations for building owners and managers, rather than society as a whole, the 

models abstract from risk mitigation externalities associated with the probability of attack in each period. 

Negative externalities due to investments in risk mitigation arise from changes in the relative price that the 

terrorist “pays” to inflict a given level of damage to a target. Positive externalities from risk mitigation 

measures occur when terrorists do not observe the protection level of individual buildings but know the 

probability that buildings in a neighborhood (or other level of locality) are protected (Ayres and Levitt, 

“Measuring Positive Externalities from Unobservable Victim Precaution,” pp. 47-59). Inclusion in an 

analytical model is left as an area of future research. 
105 

{ }0

0

0

( ) min

(1 )

T

tt t

t I t

OM O E L I = d

⎧ ⎫ + + ⎨ ⎬ +

⎩ ⎭ + ∑ (D.1)134

subject to: 

1 K 0 − ≥ (D.2) 

KK I 0 10 − = − (D.3)135

0 0

C I ≤ B (D.4) 

where: 

I0 is the investment in engineering alternatives in period 0; the price of each unit of 

protection, PI, is normalized to one dollar, so I0 represents the gross flow (in 

dollars) of engineering alternatives in period 0. I0 is the sum of expenditures across 

all three building cost components (building/facility elements, building/facility site 

work, and non-elemental components). 

d is the (constant) discount rate, where d∈ [0,1].

K−1 is the initial or inherited stock of building protection, measured in dollars. 

K0 is the dollar value of cumulative building protection up to time 0: KIK 00 1 = + − . 

For all periods beyond time 0, the level of the building protection capital stock 

equals K0: Kt =K0 for t=1,...,T. 

0

C B is the period 0 capital budget allocation, in dollars, for investments in engineering 

alternatives. 

OMt is the dollar cost of operations and maintenance in period t for all building 

components. OMt depends on the stock of building protection capital in each 

period. For generality, no assumption is made here about the exact relationship 

between the value of OMt and the level of protective capital. This relationship 

between these costs and the level of protective investment is ambiguous. Actual 

O&M costs for specific protective measures depend on the nature of the measures 

themselves, rather than the amount of investment required to implement them. In 

other words, two different protection measures which require the same level of 

initial investment may incur O&M costs differently. One may consume energy 

 

134 Assume for simplicity that each possible level of investment during period 0 is an unique alternative. 

The building owner or manager chooses I0 from the set of N+1 alternatives {Ij0}, where j=0,...,N and the 

alternatives are sorted in increasing order of initial investment.

135 This model abstracts from physical depreciation of the stock of protective capital in each period. 

Depreciation refers to physical depreciation of capital, not depreciation for tax purposes. Physical 

depreciation occurs when each unit of capital deteriorates and becomes less productive with use or over 

time. A constant rate of depreciation means that, during each period, a constant proportion of the capital 

stock wears out and cannot be used for protection. One example of this type of depreciation is the effect of 

weathering on a concrete bollard placed at the building’s exterior. This weathering may gradually reduce 

the effectiveness of the bollard each period. The effect in each period would be very small. 
106 

resources daily but will not need to be maintained during the study period, while the 

other may require frequent maintenance. The actual cost of the maintenance, the 

frequency with which it must be incurred, and its timing will all depend on the type 

of system that is installed. 

Ot represents other dollar costs in period t for all building components. This variable 

captures the direct costs of the investment other than initial investment and O&M 

costs. These other costs depend on the stock of protective physical capital, 

although, as with OMt, the functional form of this relationship is not specified. 

Intuitively, other costs depend on cumulative net investment in protective measures 

from time 0 to time T. Examples of other costs include the cost of disposing the 

protective investment at the end of its expected life (positive cost) or salvage value 

(negative cost) of the protective equipment at the end of the study period. 

E(Lt) is the expected loss due to all hazards (terrorist attacks and natural disasters) in each 

period, measured in dollars.136 A decomposition of this variable is below. 

Equations (D.2) and (D.3) together describe the stock of capital invested in 

engineering alternatives during period 0. Equation (D.2) is the non-negativity condition 

for the initial stock of protective capital. Equation (D.3) shows that the change in the 

stock of protective capital during period 0 equals the level of protective investment made 

during period 0. Equation (D.4) is the budget constraint during period 0. 

Equation (D.5) is an augmented expression for expected loss from both terrorist 

 attacks and natural disasters: 

0

0

( | ) (| )

( | ) g( | )

( ) ()( | ) ()( | )

() ()

L

h

tt t

L

a

tt t

h a

t t tt t tt

h a

t t

E L h lf l h dl

E L a l l a dl

EL ph EL h pa EL a

EL EL

=

=

= +

= +

∫

∫ (D.5) 

For the first equation in Equation (D.5), describing expected loss if a natural hazard 

occurs, 

l is a random variable representing values that can be taken by Lt. l can range 

from 0 to L , where L represents the total value of the buildings, including 

the property itself, occupants, contents, and use; and 

 

136 It is assumed that the probability of natural hazards and terrorist events are independent, so that terrorists 

will not base decisions on when to implement an attack on disastrous weather conditions. It is also 

assumed that if more than one type of hazard occurs in each period, the damage and losses resulting from 

each are independent of the damage and losses from the others. Without this assumption, the aggregation 

of expected losses from each of the hazard types would double-count losses. That is, ( ) | ( ) tt t pa h pa =

and ( ) () | tt t ph a ph = . 
107 

(| ) t f l h is the probability distribution function of losses conditional on a natural 

hazard occurring during period t. The function is assumed to be continuous 

over the range [0, ] L for all t = 0,...,T. 

For the second equation in Equation (D.5), describing expected loss if a terrorist attack 

occurs, 

(| ) t gla is the probability distribution function of losses conditional on a terrorist 

attack occurring during period t. The function is assumed to be continuous 

over the range [0, ] L for all t = 0,...,T. 

The final equation in Equation (D.5) describes ( ) a E Lt , the expected loss from both 

natural and terrorist hazards during period t, where: 

( )t p h is the probability of at least one incident involving a natural hazard 

occurring in the building’s vicinity during period t; building owners and 

managers take this probability as given, based on historical geological and 

meteorological data; and 

( )t p a is the probability of an attempted terrorist attack in the vicinity during 

period t. 

Expected loss from an attack is determined by two components: (1) the 

probability that an attack will be attempted on the structure (or neighboring structures); 

and (2) the probability distribution of losses if an attack occurs. It is assumed that the 

effectiveness of protective measures increases with the level of investment in these 

measures. The deterrent effect of protective measures is captured as a reduction in the 

probability of an attack, p(at). The reduction in damage due to a terrorist attack is 

captured as a reduction in the expected losses conditional on an attack, ( |) a EL a t t . 

We assume that the probability of attack in each time period depends on the stock 

of protective capital in each period, K0.

137 The stock of protective capital in a building 

lowers the probability of attack. The likelihood of an attack may fall due to improved 

detection of security breaches or measures that isolate the effects. Protective measures 

may deter terrorists from choosing a building as its target if the terrorists know of these 

measures. The deterrent and detection effects of protection are captured as a negative 

relationship between the total level of protection and the probability of an attack. 

Because K0 is the sum of inherited protective capital and investment during period 0, 

there is a negative relationship between the level of investment in protection and the 

probability of an attack. Equation (D.6) characterizes these relationships: 

 

137 In the absence of investment beyond period 0, the stock of protective capital in each period equals K0: 

Kt = K0 for t = 0,...,T. 
108 

0

0

( ) 0

( ) 0

t

t

p a

K

p a

I

∂

<

∂

∂

<

∂

 (D.6) 

The probability of attack is also affected by exogenous factors. Some factors are 

related to the ongoing war on terror. The more effectively the United States military and 

intelligence communities can detect terrorist personnel, movements, activities, and 

resources, for example, the lower the probability of an attack at any point in time. The 

war on terror may affect the integrity of terrorist organizational hierarchies and result in 

the capture of terrorist personnel. The geopolitical climate and the level of anti-United 

States sentiment abroad affect the probability that a building will be attacked. More 

pervasive anti-American sentiment abroad may contribute to terrorist recruitment and 

motivation. It may also contribute to the resources available to terrorists to plan and 

execute attacks. These factors do not depend on the level of protective capital in a 

constructed facility. 

The level of protective capital affects ( | ) t gla , the probability distribution of 

losses, which in turn affects expected losses. The probability distribution of losses also 

depends on the total value of the building at the time of attack, which includes its 

occupants, the value of the structure, the value of its contents, and the value of its use and 

mission.138 

The level of realized loss in period t, a Lt , ranges in value from zero to L , total 

loss. It is assumed that any attempted attack will be costly and some loss will occur.139 

Thus, the probability that the building will suffer losses in excess of 0 is 100 percent: 

( > 0 | t ) = 1 a p Lt a . This assumption does not imply that the probability of no damage is 

zero, however. No damage would occur if the building is not attacked, so the probability 

that the building suffers no damage, ) 1− ( > 0 a p Lt , equals the probability of no attack, 

1 ( ) − p at . 

The maximum loss level, L , is a function of the maximum occupancy (including 

visitors) and the value of the structure, contents, use, and mission. The conditional 

probability that an attack against the building occurs in period t and causes losses in 

excess of L is zero: ( > | t ) = 0 a p Lt L a . 

 

138 By assumption, the value of the building structure, its use, and its mission are constant during each 

period. In other words, there is no seasonality during each period in these characteristics of a structure. 

This assumption represents an abstraction from visitor or occupancy fluctuations, such as might be found at 

tourism-related facilities. 

139 The attempt of a gunman to charge into the U.S. Capitol on July 24, 1998 is one example. Although no 

members of Congress were physically harmed, two Capitol police officers were killed and one bystander 

wounded. Note that the probability of different outcomes of an attack are not framed according to 

“success” or “failure.” The success or failure of an attack is a judgment by the attackers of the outcome of 

the attack relative to their objectives. An attack deemed unsuccessful by the attackers may nevertheless 

inflict casualties or damage. From the perspective of the building owner or manager, the only relevant 

outcome is the actual damage sustained, not whether the attackers perceive the outcome as a success or a 

failure. 
109 

The exceedance probability curves in Figures D-1 and D-2 are the complements 

of cumulative distribution functions and are represented mathematically by 1− F l( ) 140. 

For each level of loss, l, the exceedance probability at time t is the probability of realizing 

a loss greater than l: ( ) a

t p L l > . The probability of suffering losses in excess of l

conditional on an attack at time t is represented by ( | ) a

t t p L la > . This conditional 

exceedance probability depends on several factors: the total value of the facility; the total 

level of investment in protection up to time t; the level of protection of nearby buildings; 

and the mode of attack. 

Figure D-1 shows how the total value of a facility affects the exceedance 

probability of losses. If the total value of the facility increases from * L to L′ , then the 

exceedance probability curve shifts out from EP* to EP' , since the probability of 

damage in excess of * L is no longer zero. For a given level of loss, l, the probability of 

exceeding that level increases from p * to ' p . Figure D-2 shows how the level of 

protection affects the exceedance probability curve. When a building owner or manager 

invests in engineering alternatives in period 0 and increases the stock of protective capital 

from K-1 = Klow to K0 = Khigh, the conditional probability of exceeding every level of loss 

will fall from EP-1 to EP0. If an attack occurs, the probability that the facility will suffer 

losses of at least l falls from 1 p− to 0 p .While a higher level of protective investments 

reduces the expected level of losses, this reduction will be smaller with every dollar of 

spending on protection. The same relationships are true for the overall, accumulated 

level of protection, K0. Equation (D.7) formalizes these relationships: 

2

2

0 0

2

2

0 0

() () 0, 0

() () 0, 0

a a

t t

a a

t t

EL EL

I I

EL EL

K K

∂ ∂

< >

∂ ∂

∂ ∂

< >

∂ ∂

 (D.7) 

The conditional probability of realizing a given loss will also be affected by the 

level of protection in neighboring buildings, depending on the standoff distance and the 

delivery method of the terrorist attack. The more effectively a building can withstand a 

blast, for example, the less likely that occupants of adjacent buildings will suffer injuries 

due to flying glass and other debris. 

 

140 For a brief discussion of exceedance probability curves, see Danzig, D. van. “Economic Decision 

Problems for Flood Prevention,” Econometrica, Vol. 24 No. 3, July 1956, pp. 276-287. 
110 

Figure D-1 Change in Exceedance Probability in Response to Increase in Total 

Value of the Facility 

Figure D-2 Change in Exceedance Probability in Response to Increase in Level of 

Protective Capital 

1

 Loss (in $)

Probability that Realized Loss Exceeds Each Given Level of Loss

EP*

EP'

p *

p′

* 0 l L L′

0

1

 Loss (in $)

Probability that Realized Loss Exceeds Given Level of Loss

EP0

EP-1

l L

1 p−

0 p

0

l

0
111 

 

The optimal level of investment in engineering alternatives satisfies the condition 

in Equation (D.8)141: 

00 0

2 3

0

( )

1

(1 )

tt t T

t

t

OM O E L

II I

d

λ λ =

∂ ∂∂

∂∂ ∂

⎧ ⎫ + + ⎪ ⎪

− ++= ⎨ ⎬

+ ⎪ ⎪ ⎩ ⎭

∑ (D.8) 

According to Equation (D.8), the optimal level of investment in engineering alternatives 

depends on the present discounted value of the marginal benefits over the study period 

from each additional dollar invested in engineering alternatives in period 0, the unit cost 

of that protection (i.e., one dollar), and the Lagrange multiplier, λ3. λ3 represents the 

marginal value, or “shadow price,” of the resource. The building owner would be willing 

to pay up to λ3 for each additional dollar increase in the budget for engineering 

alternatives. If the budget constraint does not bind, then this willingness to pay for each 

dollar increase in the budget would be 0, and investment in engineering alternatives 

would proceed until the present discounted value of the life-cycle marginal benefits from 

each additional dollar of investment equals 1. Note the negative sign in Equation (D.8). 

Because OMt , E L( )t , and Ot are measured as costs, marginal benefits are represented 

as marginal reductions in those costs. Note that Equation (D.8) is the optimization 

condition only from the perspective of the owner or manager of a specific building. It 

does not address interdependencies with other buildings or include externalities 

associated with investments and expenditures on engineering alternatives. Social 

considerations of risk mitigation are discussed briefly in Chapter 6 and in greater detail in 

Appendix E. 

If the budget constraint is binding (i.e., the level of investment that would satisfy 

the optimization without the budget constraint exceeds the constrained optimum), then 

the building owner and manager should invest until the present discounted value of lifecycle marginal benefits from each additional dollar of investment equals the marginal 

cost of investment (one dollar) net of the unit cost of increasing the budget, λ3. 

D.2 Model 2: Choosing Engineering Alternatives and Management Practices for 

Risk Mitigation 

A second type of risk mitigation strategy, discussed in Chapter 2, is based on 

management practices. Model 2 combines management practices with Model 1, so that 

building owners and managers can both invest in engineering alternatives in period 0 and 

adopt management practices in all periods to reduce losses from terrorism. The 

optimization illustrates the conditions that affect the levels of expenditures on 

 

141 This condition is derived by setting up the Model 1 Lagrangian, L1, as: 

( )

1 0 1 1 2 0 1 0 30 0 (1 )

0

[ ][ ] tt t

t

T

OM O E L C

d t

I λλ λ K KK I B I + +

− − + =

L =+ + + − − + − ∑ and deriving first-order 

conditions. Equation (D.8) and all other first-order conditions are denominated in dollar currency units. 
112 

management practices and investment in engineering alternatives that result in the lowest 

life-cycle cost. Model 2 addresses the interaction effects between these two types of risk 

mitigation strategies. The interaction effects may be synergistic, compensating, or 

negating. 

Equation (D.9) is the objective function of the engineering alternativemanagement practice model: 

{ } 0 0

0 , ,..., 0

( ) min T (1 )

T

tt t t

t IM M t

OM O E L M I = d

⎧ ⎫ ++ + ⎨ ⎬ +

⎩ ⎭ + ∑ (D.9) 

subject to the conditions given in Equations (D.2) and (D.3). Two additional constraints 

apply: 

0 0

C I ≤ B (D.10) 

and 

 for all 0,..., . Op Mt t ≤ = B tT (D.11) 

The variables I0, OMt, Ot, E(Lt), 0

C B , d, and t are interpreted as they were in 

Model 1. Mt represents the level of expenditure (in dollars) to implement management 

practices to reduce terrorist risk in period t. Op Bt is the operating budget allocation for 

period t. Equation (D.10) describes the capital budget constraint for the initial period, 

when the building owner and manager make their decisions about how much to invest in 

engineering alternatives. Equation (D.11) describes the operating budget constraint 

during each period. This budget constraint affects the allocation of resources to the 

implementation of management practices in each period. 

The optimal levels of investment in engineering alternatives and expenditures to 

implement management practices satisfy the conditions in Equations (D.12) and 

(D.13)142: 

00 0

2 3

0

( )

1

(1 )

tt t T

t

t

OM O E L

II I

d μ μ =

∂ ∂∂

∂∂ ∂

⎧ ⎫ + + ⎪ ⎪

− ++= ⎨ ⎬

+ ⎪ ⎪ ⎩ ⎭

∑ (D.12) 

and 

 

142 This condition is derived by setting up the Model 2 Lagrangian, L2, as: 

( )

2 0 1 1 2 0 1 0 30 0 4 (1 )

0 0

[ ] [ ] [ ], tt t t

t

T T

OM O E L M C Op

tt t d t t

I μμ μ μ K KK I B I B M ++ +

− − + = =

L =+ + + − − + − + − ∑ ∑

and deriving first-order conditions. 
113 

4

( )

1

(1 ) (1 )

tt t

tt t

t t t

OM O E L

MM M

d d μ

∂ ∂∂

+ + ∂∂ ∂

− +=

+ +

 for t=0,...,T. (D.13) 

Equation (D.12) describes the conditions for the optimal level of investment in 

engineering alternatives in period 0. The benefits and costs of investment in engineering 

alternatives during period 0 last throughout the study period due to the assumption of no 

depreciation. Therefore, Equation (D.12) is a summation of these effects over the entire 

study period. Its interpretation mirrors that for Equation (D.8). 

Equation (D.13) describes the optimization conditions for expenditures on 

management practices. The optimal level of expenditure on management practices in 

each period is the level where the (present discounted value) of marginal expenditure in 

that period exactly equals the (present discounted value) of marginal benefit (negative 

marginal cost) of that expenditure, in addition to the shadow price of the operating 

budget. Unlike engineering alternatives, expenditures on management practices in each 

period only affect the costs and benefits during that same period. 

D.3 Model 3: Choosing Engineering Alternatives, Management Practices, and 

Financial Mechanisms for Risk Mitigation 

Model 3 includes the final type of risk mitigation measure available to building 

owners and managers: financial mechanisms. These mechanisms include insurance and 

participation in government cost sharing arrangements. It builds on Model 2, so that 

building owners and managers choose the optimal combination of investment in 

engineering alternatives, expenditures on management practices, and reliance on financial 

mechanisms in an overall risk mitigation plan to minimize life-cycle costs of terrorism 

and other hazards. The financial mechanisms considered in Model 3 are proportional 

subsidies for investments in engineering alternatives and the purchase of insurance. 

Building owners and managers choose how much to invest in engineering 

alternatives in period 0 in light of the subsidy, how much to spend on management 

practices in each period, and how much insurance to purchase in each period. Equation 

(D.14) is the objective function for Model 3: 

00 0

0 { ; ,..., ; ,..., } 0

() () min (1 ) T T (1 )

T

t t t t t tt

t IM MC C t

OM O E L M E C q C I

d

α =

⎧ ⎫ ++ + − + ⎨ ⎬ − +

⎩ ⎭ + ∑ (D.14) 

subject to Equations (D.2) and (D.3). Two additional constraints are: 

0 0 (1 ) C − ≤ α I B (D.15) 

and 

 for all 0,..., . Op Mt tt t +≤ = qC B t T (D.16) 

The familiar variables are interpreted as before. In addition, 
114 

 

α is the proportion of the investment in protective measures borne by the government 

through an investment subsidy, i.e., α ∈ [0,1]. 

E(Ct) is the expected insurance claim paid to building owners for insured losses from all 

hazards during period t. 

Ct is the number of units of insurance for all hazards that the building owner purchases 

in each period.143 

qt is the insurance premium rate per monetary unit of insurance paid in each period, 

and qt ∈ [0,1]. The total insurance premium payment in period t is qtCt.

144 In 

theory, actuarially fair insurance is priced according to risk: the price of each dollar 

of insurance equals the probability of losing that dollar. This price is a function of 

the risk mitigation adopted to protect the insured assets.145

Equation (D.15) is the period 0 budget constraint for investment. The building 

owner’s share of investment in engineering alternatives cannot exceed 0

c B . Equation 

(D.16) is the budget constraint for each period in the study period for management 

practices and financial mechanisms. Expenditures to implement management practices 

and to maintain insurance policies must not exceed each period’s operating budget, Op Bt . 

If the building owner purchases actuarially fair insurance, then the insurance 

premium in each period will equal the expected value of losses. Protective investment 

affects insurance in two ways. It reduces the insurance premium per dollar of coverage, 

qt, by deterring or detecting breaches, thereby lowering the probability of attack. 

Because the premium is assumed to be actuarially fair, the insurance premium will fall 

with higher protective investment (assuming no interdependencies). Because insurance is 

actuarially fair, however, the net effect of protection on insurance premium payments and 

on expected claims is zero—any reduction in one will be exactly offset by a reduction in 

the other. The second way protective investment affects insurance is through the 

reduction in (conditional) expected losses due to their protective function. This reduction 

in losses would reduce the amount of coverage purchased in models where the amount of 

insurance is a choice variable. 

Model 3 includes a proportional government subsidy for investment in 

engineering alternatives. A government may provide a subsidy if it believes that the 

marketplace does not adequately value the social benefits of disaster mitigation measures 

 

143 It would be straightforward to show that, if the building owner were risk averse and the price per unit of 

insurance were actuarially fair, then the building owner would fully insure. Model 3 assumes the 

deductible is zero. In the presence of a deductible greater than zero, the analysis would require 

specification of a functional form for the owner’s utility. 

144 Actuarially fair insurance is priced so that the insurance premium rate, qt, equals the probability of losing 

each insured dollar in period t. That is, if a person faces a 20 % probability of losing $100, then the 

actuarially fair insurance premium amount against that loss is (0.20)(100)=$20, where qt, the price per 

dollar of insurance in each period, is 20 cents. The probability of loss in each period is a composite of the 

probabilities of terrorist and natural hazards. If qt is the probability that the building owner or manager will 

suffer a loss of Ct during period t, then the expected claim, E(Ct), will exactly equal the total premium 

payment, qtCt. 145 In reality, insurance is priced higher than the actuarial premium to reflect administrative costs. 
115 

for constructed facilities. The fixed proportion, [0,1] α ∈ , represents the percentage of 

the total amount of investment in engineering alternatives that the government will bear. 

The optimality condition for choosing investment I0 in Model 3 is similar to 

Equation (D.12) for Model 2. Written as Equation (D.17), the condition takes the 

form146: 

00 0

2 3

0

( )

(1 ) 1 (1 )

tt t T

t t

OM O E L

II I

d

ν αν α =

∂ ∂∂

+ + ∂∂ ∂

⎧ ⎫

⎪ ⎪

− + + − =− ⎨ ⎬

+ ⎪ ⎪ ⎩ ⎭

∑ (D.17) 

and 

4

( )

1

(1 ) (1 )

tt t

tt t

t t t

OM O E L

MM M

d d

ν

+ +

∂ ∂∂

∂∂ ∂

− +=

+ +

 for t=0,...,T. (D.18) 

The allocation of the period 0 budget for investment in engineering alternatives 

must satisfy Equation (D.17). The left-hand side of Equation (D.17) is the marginal 

benefit of each additional dollar of investment in engineering alternatives over the life 

cycle. With the negative sign, it is written as the marginal reduction in cost. The 

reduction in costs could be in the form of lower maintenance or disposal costs, a lower 

probability of attack, or less severe consequences from an attack. The right-hand side of 

the equation is the cost of each dollar of investment in period 0 that the building owner or 

manager bears. 1−α represents the cost of each unit of investment in engineering 

alternatives paid for by the building owner, since government cost-sharing defrays a fixed 

proportion α of the investment. The life-cycle cost minimizing level of investment must 

satisfy this equality. 

Equation (D.18) is the condition for optimal expenditure on management 

practices. It says that the present discounted value of the marginal cost (negative benefit) 

in each period must equal the difference between the (present discounted) price of each 

dollar of expenditure on management practices, and the shadow price of each dollar 

increase in the budget for management practices. 

Insurance drops out of the optimization. This result is a consequence of the risk 

neutrality of building owners and managers implicit in optimizing based on cost, rather 

than utility, and the actuarially fair pricing of the insurance. Because the expected claim, 

E(Ct), is exactly offset by the premium payment, qtCt, and because premium payments 

 

146 This condition is derived by setting up the Model 3 Lagrangian, L3, as: 

() ()

3 0 11 2 0 1 0 (1 ) (1 )

0 0

30 0 4

0

(1 ) [ ]

[ (1 ) ] [ ],

t t t t t tt

t t

T T

OM O E L M E C q C

d d t t

T

C Op

t t t tt

t

I K KK I

B I B M qC

α νν

ν αν

++ − +

− − + + = =

=

=− + + + + − −

+ −− + − −

∑ ∑

∑

L 

deriving first-order conditions, and simplifying. 
116 

are paid from the same budget as management practices, insurance falls out of the model. 

The building owner and manager would produce more savings by devoting the operating 

budget, Op Bt , to management practices, which directly affect the expected losses from 

hazardous events. This result is driven by key assumptions of the model: the building 

owner’s risk neutrality, actuarially fair pricing of the insurance, and the financial ability 

of the owner organization to survive the costs of an extreme event. In reality, these 

assumptions generally do not hold in the private sector, and building owners and 

managers generally choose to purchase insurance. 

D.4 Model 4: Choosing Multi-period Engineering Alternatives, Management 

Practices, and Financial Mechanisms for Risk Mitigation 

Models 1, 2, and 3 assume that investments in engineering alternatives are only 

undertaken during the initial period. Limited annual capital facilities budgets, however, 

may drive decisions to introduce investments in engineering alternatives over multiple 

periods. The level of building protection achieved through a one-time investment is 

constrained by period 0 budgetary resources, which may not be sufficient to address all of 

the vulnerabilities identified during the risk assessment process. Model 4 extends Model 

3 to allow for investments in periods of the study other than the initial period. 

The objective function for Model 4 is represented as Equation (D.19): 

00 0 { ,..., ; ,..., ; ,..., } 0

(1 ) ( ) ( ) min T TT (1 )

T

t t t t t t tt

t I IM MC C t

I OM O E L M E C q C

d

α

=

⎧ ⎫ − + ++ + − + ⎨ ⎬ ⎩ ⎭ + ∑ (D.19) 

subject to the following constraints (in addition to Equation (D.2)): 

 

1 for 0,..., KK I t T tt t −= = − (D.20) 

(1 ) for 0,..., C

t t −≤ = α I Bt T (D.21) 

 for 0,..., Op Mt tt t +≤ = qC B t T (D.22) 

The interpretations of all but a few of the variables are the same as they were in 

Model 3. In addition, 

It is the investment spent on engineering alternatives in period t for t=0,...,T. 

Kt is the accumulated capital investment in engineering alternatives up to 

period t: 1

0

.

t

t s

s

KK I −

=

= +∑

Equations (D.20), (D.21), and (D.22) are similar to Equations (D.3), (D.15), and (D.16). 

They are the multi-period analogues to the capital accumulation, capital budget 

constraints, and operating budget constraints. 
117 

Building owners and managers will choose the life-cycle cost-minimizing 

combination of investment in engineering alternatives, expenditures to implement 

management practices, and insurance coverage in each period of the study period.147

The optimization conditions for investment in each period are: 

** *

2* 3* *

*

( )

1 (1 ) (1 ) (1 )

tt t

tt t

t t t

T

t t t

OM O E L

II I

d d

α

ο αο =

∂ ∂∂

+ + ∂∂ ∂

⎧ ⎫

⎪ ⎪ − − + +− = ⎨ ⎬

+ ⎪ ⎪ ⎩ ⎭

∑ +

 for t*=0,...,T (D.23) 

and 

4

( )

1

(1 ) (1 )

tt t

tt t

t t t

OM O E L

MM M

o

d d

+ +

∂ ∂∂

∂∂ ∂

− +=

+ +

for t=0,...,T. (D.24) 

Equation (D.24) and the insurance result are as they were in Model 3. Equation 

(D.23), the condition for investment in engineering alternatives, however, differs. The 

modified optimization condition for investment says that the present value of investment 

outlays in year t* must equal the present value of the marginal increase in benefits over 

the remaining years of the study period plus (1 ) −α times the shadow value of an 

incremental increase in the capital budget plus the change per period in the shadow value 

of each additional unit of investment. 

The approaches captured in Models 1 through 4 are intended to illustrate the 

determinants of optimal allocation of investment and expenditure resources on 

engineering alternatives, management practices, and financial mechanisms over time. 

We present them to offer some insight into the bases for these allocations while 

recognizing that these models are difficult to execute in practice. In addition, the 

simplifications of homogenous engineering alternatives and homogenous management 

practices in these models limit their applicability for building owners and managers who 

seek specific guidance about such allocations. But, the methodology described in 

Chapter 4 and the software implementation described in Chapter 5, offer more tangible 

guidance for these decisions. 

 

147 The Lagrangian for Model 4, L4, is: 

(1 ) ( ) ( )

4 11 2 1 (1 )

0 0

3 4

0 0

[ ]

[ (1 ) ] [ ].

t t t t t t tt

t

T T

I OM O E L M E C q C

tt t t d t t

T T

C Op

t t t t t t tt

t t

K KK I

B I B M qC

α ο ο

ο αο

− + ++ + − +

− − + = =

= =

= + + −−

+ −− + − −

∑ ∑

∑ ∑

L 
118 
119 

Appendix E: Substitution Implications of Risk Mitigation Activities 

In Section 6.3, we briefly described the social welfare considerations of a building 

owner’s risk mitigation decisions. This appendix illustrates one specific aspect of the 

social welfare implications of such decisions. 

Mitigation measures may carry a negative externality if protection in one building 

leads to an increase in likelihood of an attack on other (less protected) targets. Under 

certain conditions, unobservable protective measures could reduce the probability of an 

attempt, both on the protected building and nearby buildings as well. Ayres and Levitt 

have shown that, in contrast to observed risk mitigation, unobserved protection may have 

positive externalities.148 However, these protections may not be adopted voluntarily by 

individuals unless there is a concern for social welfare. 

One consequence of observable defensive measures is to increase the perceived 

relative costs to terrorists of some modes of attack compared to others. Hardening 

structures and enforcing access restrictions may make buildings more difficult to 

penetrate, causing terrorists to forgo bombing, for example, in favor of abduction or 

assassination, when human targets are outside the fortified structure. Enders and 

Sandler149 show that the fortifications and enhanced security measures at U.S embassies 

in 1976, 1985, and 1986 led to a reduction in the number of attacks against U.S. and U.K. 

interests, for example, but led to an increase in assassinations, threats, and skyjackings. 

They also show that the introduction of metal detectors at airports reduced skyjackings 

and threats, but these reductions were accompanied by an increase in the incidence of 

assassinations and kidnappings, from which metal detectors provided no protection. 

Drake150 identifies another type of substitution as a consequence of risk 

mitigation. Observable risk mitigation practices may also lead to substitution away from 

the protected structure to a less protected, “softer,” target. In the case of a building with 

security and fortification measures that are observable, a potential terrorist may believe 

that attacking the building carries a higher probability of detection or lower likely level of 

damage. Observable precautions may therefore reduce the desirability of a target and the 

probability of attack. But the effect of these protective measures may spill over in a 

negative way onto less fortified buildings if the risk of terrorist attack is shifted to these 

other buildings. If these other buildings are not owned by the same party, this shift in 

probability of attack represents a negative externality to the original building’s 

fortification measures. 

While the decision problem is examined here from the perspective of the building 

owner rather than society as a whole, terrorist behavior and building owners’ incentives 

may lead to deviations from optimal social outcomes.151 Whether these deviations are 

positive or negative depends on the ability of potential attackers to discern the levels of 

fortification and protection of each possible target. 

Figure E-1 illustrates the case of two targets, Building X and Building Y, which 

the terrorists see as perfect substitutes for each other. Each axis in Figure E-1 measures 

 

148 Ayres and Levitt, “Measuring Positive Externalities from Unobservable Victim Precaution,” pp. 47-59. 149 Enders and Sandler, “The Effectiveness of Antiterrorism Policies,” pp. 834-842. 150 Drake, Terrorists’ Target Selection, pp. 116-118. 151 In all discussions of the social welfare implications of protecting constructed facilities from attack, it is 

assumed that the benefits, or costs to terrorists, are not included in social welfare. 
120 

the dollar amount of damage to each building. Suppose further that the satisfaction that 

the terrorist would derive from causing damage to one target versus the other is traded off 

at a constant rate. This assumption is represented in Figure E-1 by the linear and parallel 

indifference curves, U0, U1, and U2. Each indifference curve represents the combination 

of damage to Building X and Building Y that yields a constant level of satisfaction to the 

terrorist. Because terrorists are more satisfied with more damage to the targets, moving 

away from the origin represents increases in satisfaction. U0, therefore, represents a 

higher level of satisfaction to the terrorist than U1, which, in turn, represents a higher 

level of satisfaction than U2. 

Attacking each target is costly to the terrorist. Costs may include resources for 

advanced surveillance, logistical preparations, manpower, and materials. The probability 

and disutility of capture, if measured in dollars, can also be considered a cost to the 

terrorist. These costs represent the price that must be paid in an attack on each target. 

These prices of attacking Building X and Building Y, PX and PY, respectively, combined 

with the finite resources that the terrorist can devote to an attack, yields an initial budget 

constraint, B0. The slope of this constraint, -PX/PY, represents the amount of damage to 

Building Y that the terrorist must trade off to cause one unit of damage to Building X. 

As it is drawn, B0 represents the combinations of damage to Buildings X and Y that the 

terrorist can “afford” to inflict. If the terrorist devotes all of the resources to attacking 

Building X, then it can inflict the amount of damage associated with point E0. If, on the 

other hand, the terrorist devotes all of the resources to attacking Building Y, then it can 

inflict the amount of damage associated with point E1.

Figure E-1 Building Protection and Substitution Toward Soft Targets 

E2

E1 

Damage 

to 

Building

X ($) 

Damage 

to 

Building

Y ($) 

E0

U2 

U1 

U0 

B0

B1 
121 

When B0 is the terrorist budget constraint and the terrorist views Building X and 

Building Y as substitutable targets according to the indifference curves in Figure E-1, the 

terrorist will choose to devote all resources to attacking Building X. At this equilibrium, 

represented by point E0, the terrorist would experience U0, the maximum attainable level 

of satisfaction for the available budget. If the terrorist devoted all resources to attacking 

Building Y, the most satisfaction that could be attained would be U1, which is less than 

U0. The terrorist can afford any intermediate combination of damage to Buildings X and 

Y along B0, but these combinations all bring less satisfaction to the terrorist than U0, the 

level from using all resources to attack Building X. Allocating terrorist resources to 

attacking Building X therefore results in the greatest satisfaction that the terrorist can 

achieve with his available budget, B0. For the terrorist to achieve any higher level of 

satisfaction would require additional resources. 

Suppose that the owners and managers of Building X were to implement 

protective measures. Now, the terrorist would have to devote more resources to attacking 

Building X to achieve a given level of damage. The increase in resources may be 

necessary, for example, to pursue additional reconnaissance to circumvent the protective 

measures. They may also represent an increased probability of detection and capture. 

The protective measures have the effect of increasing the price that terrorists would have 

to “pay” to cause a given level of damage to Building X. If Building Y does not change 

its level of protection and if the terrorist’s resources do not change, then this increase in 

price of damaging Building X causes a rotation in the budget constraint from B0 to B1. 

After Building X installs protection, if the terrorist were to use all his resources to attack 

Building X, the maximum damage that he could inflict is represented by point E2 and the 

maximum satisfaction that he could attain is U2. If the terrorist instead used the resources 

to attack Building Y, on the other hand, then he would be able to inflict damage 

corresponding to point E1, and derive higher satisfaction, because U1 > U2. If the owners 

and managers of Building Y do not increase its protection, the terrorist will perceive it as 

a softer target than Building X, and switch its attack accordingly. 

Table E-1 describes the outcomes and consequences for Building X, Building Y, 

and social welfare in the cases with and without fortification of Building X for the prices 

and preferences illustrated in Figure E-1. If Building X is not protected, then the terrorist 

will target it and inflict damage of E0. If Building X is fortified, then the owners and 

managers of Building X achieve their goal of protecting Building X: it avoids an attack 

and suffers no damage. If Building X is unprotected, Building Y will not be targeted for 

attack. With Building X better protected, however, Building Y will be attacked and 

suffer damage of E1. The fortunes of the building’s respective owners shift dramatically 

between the two scenarios. For society as a whole, however, the change in consequences 

is less dramatic. With E1 < E0, society is better off with the protective measures for 

Building X. 

Table E-1 Level of Damage Due to Terrorist Attack 

 

Without Building X Fortification With Building X Fortification 

Building X E0 0 

Building Y 0 E1

Society E0 E1
122 

This simple example illustrates the consequences that the fortification of one 

facility can have on other facilities. In this example, society as a whole is better off with 

Building X’s protective measures, because society has avoided E0 worth of damage and 

instead lost a lesser amount, E1. There is, however, a transfer within society, as Building 

Y bears the risk that Building X did before the latter implemented its protective 

measures. 

There is a tipping point in the relative prices of attacking one building over the 

other, beyond which the terrorist will switch targets. If the owners and managers of 

Building X implement mitigation measures that increase the relative price of an attack on 

Building X, but not sufficiently to increase the relative price past the tipping point, then 

the terrorist will still prefer to attack Building X. The higher price, while not sufficient to 

change terrorist choice of target, may still lead to a lower level of damage, but it will not 

lead to a complete transfer of risk within society to Building Y. At the tipping point, the 

terrorist will be indifferent between attacking either building, or both. That is, the tipping 

point in relative prices occurs when the slope of the budget constraint just equals the 

slope of the indifference curve at a given utility level so that the budget constraint and the 

indifference curve are coincident. If the relative prices are at the tipping point, then the 

terrorists would be as satisfied to attack one as the other, or some combination of both. 

Therefore, not all protective measures will lead to a complete shift in terrorism risk to 

another building. The shift in risk will be complete only when the budget constraint 

rotates past the indifference curve. 
123 

Appendix F: Glossary of Terms 

Most of the economic terms listed herein are taken form ASTM Standard E 

833.152 ASTM E 833 covers terminology related to the economic evaluation of building 

construction. The definitions contained in ASTM E 833 are under the jurisdiction of 

ASTM Committee E06 on Performance of Building Constructions. 

This glossary contains a number of terms that are not contained in ASTM E 833. 

These terms were either defined through reference to a source document or were defined 

by the authors. If the term is derived via a source document, then a reference is given. If 

the authors defined the term, it is designated with an obelisk in bold font (†). Unless 

otherwise noted, all remaining terms are taken from ASTM E 833. 

adjusted internal rate of return (AIRR)—the compound rate of interest that, when 

used to discount the terminal value of costs and benefits of a project over a given 

study period, will make the costs equal the benefits when cash flows are reinvested at 

a specified rate (Syn. financial management rate of return (FMRR)). 

annual value—a uniform annual amount equivalent to the project costs or benefits taking 

into account the time value of money throughout the study period (Syn. annual worth, 

equivalent uniform annual value). 

annual worth—See annual value. 

arithmetic mean153—in statistics, of a finite set of n numbers is defined as their sum 

divided by n (Syn. mean). 

base date—See base time. 

base time—the date to which all future and past benefits and costs are converted when a 

present value method is used (usually the beginning of the study period) (Syn. base 

date). 

benefit-cost analysis—a method of evaluating projects or investments by comparing the 

present value or annual value of expected benefits to the present value or annual value 

of expected costs. 

benefit-cost ratio—See benefit-to-cost ratio.

benefit-to-cost ratio (BCR)—benefits divided by costs, where both are discounted to a 

present value or equivalent uniform annual value (Syn. benefit-cost ratio). 

building decision—a decision regarding the design, financing, engineering, construction, 

management, or operation of a building. 

building economics—the application of economic analysis to the design, financing, 

engineering, construction, management, operation, ownership, or disposition of 

buildings. 

building system—an aggregation or assemblage of items joined in regular interaction or 

interdependence in buildings or building construction. 

capital cost—the costs of acquiring, substantially improving, expanding, changing the 

functional use of, or replacing a building or building system. 

 

152 ASTM International. “Standard Terminology of Building Economics,” E 833, Annual Book of ASTM 

Standards: 2002. Vol. 04.11. West Conshohocken, PA: ASTM International. 

153 Encyclopedia Britannica. 15th Edition. Vol. VI, p. 735 (Chicago, IL: Encyclopedia Britannica Inc., 

1974). 
124 

cash flow—the stream of monetary (dollar) values—costs and benefits—resulting from a 

project investment. 

constant dollars—dollars of uniform purchasing power exclusive of general inflation or 

deflation (Syn. real dollars). Discussion—Constant dollars are tied to a reference year. 

constructed facilities (†)—permanent structures, including infrastructure, buildings, and 

industrial facilities (see Table A-1). 

cost analysis—subdividing the project estimate into component parts to find and 

compare their relationship to previously established historical costs. 

cost effective—the condition whereby the present value benefits (savings) of an 

investment exceeds its present value costs. 

current dollars—dollars of purchasing power in which actual prices are stated, including 

inflation or deflation. 

Discussion—In the absence of inflation or deflation, current dollars equal constant dollars. 

decision analysis—a technique for making economic decisions in an uncertain 

environment that allows a decision maker to include alternative outcomes, risk 

attitudes, or subjective impressions about uncertain events in an evaluation of 

investments. 

disaster mitigation (†)—measures, procedures, and strategies designed to reduce either 

the likelihood or consequences of a disaster. 

discounting—a technique for converting cash flows that occur over time to equivalent 

amounts at a common time. 

discount rate—the rate of interest reflecting the investor’s time value of money, used to 

determine discount factors for converting benefits and costs occurring at different 

times to a base time. 

Discussion—The discount rate may be expressed as nominal or real. 

discount factor—a multiplicative number (calculated from a discount formula for a 

given discount rate and interest period) that is used to convert costs and benefits 

occurring at different times to a common time. 

discounted payback period—the time required for the cumulative benefits from an 

investment to pay back the investment cost and other accrued costs considering the 

time value of money. 

economic evaluation methods—a set of economic analysis techniques that consider all 

relevant costs associated with a project investment during its study period, comprising 

such techniques as life-cycle cost, benefit-to-cost ratio, savings-to-investment ratio, 

internal rate of return, and net savings. 

endogenous (†)—the state of a variable whose value in a system or model is determined 

simultaneously with other variables within the system or model. 

engineering alternatives (†)—technical options in the construction or renovation of 

constructed facilities, their systems, or their subsystems to reduce the likelihood or 

consequences of disasters; types of engineering alternatives include designs, 

materials, components. 

equivalent uniform annual value—See annual value. 
125 

exogenous (†)—the state of a variable whose value in a system or model is fixed, taken 

as given, or determined outside of the system or model. 

financial incentives (†)—monetary rewards or penalties for disaster mitigation choices; 

rewards or penalties may arise from market responses or government policies. 

externality154—the discrepancy between private and social costs or private and social 

benefits. 

Discussion—The key aspect of externalities is interdependence without compensation. Some 

individual or firm benefits without paying, or it causes others to have higher costs without 

compensation. 

financial management rate of return (FMRR)—See adjusted internal rate of return. 

first cost—costs incurred in placing a building or building subsystem into service, 

including, but not limited to, costs of planning, design, engineering, site acquisition 

and preparation, construction, purchase, installation, property taxes and interest 

during the construction period, and construction-related fees (Syn. initial investment 

cost, initial cost). 

future value—the value of a benefit or cost at some point in the future, considering the 

time value of money (Syn. future worth). 

future worth—see future value. 

geometric mean155—in statistics, of a finite set of values, the nth root of the product of 

the values, in which n is the number of values. 

incremental cost (benefit)—the additional cost (benefit) resulting from an increase in 

the investment in a building project (Syn. marginal cost (benefit))

inflation—a rise in the general price level, usually expressed as a percentage rate. 

initial cost—See first cost. 

initial investment cost—See first cost. 

internal rate of return (IRR)—the compound rate of interest that, when used to 

discount study period costs and benefits of a project, will make the two equal. 

investment cost—first cost and later expenditures which have substantial and enduring 

value (generally more than one year) for upgrading, expanding, or changing the 

functional use of a building or building subsystem. 

life cycle—See study period. 

life-cycle cost (LCC) method—a technique of economic evaluation that sums over a 

given study period the costs of initial investment (less resale value), replacements, 

operation (including energy use) and maintenance of an investment decision 

(expressed in present or annual value terms). 

maintenance cost (†)—the total labor, material, and other related costs incurred in 

conducting corrective and preventative maintenance on a building, or on its systems 

and components, or on both. 

management practices (†)—organizational or workforce-related procedures or policies 

intended to reduce the likelihood or consequences of disasters. 

marginal cost (benefit)—See incremental cost (benefit). 

 

154 Greenwald, Douglas. The McGraw-Hill Dictionary of Modern Economics: A Handbook of Terms and 

Organizations (New York, NY: McGraw-Hill Book Company, 1973). 155 Encyclopedia Britannica. 15th Edition. Vol. IV, p. 479. 
126 

market discount rate—See nominal discount rate. 

minimum acceptable rate of return (MARR)—the minimum percentage return 

required for an investment to be economically acceptable. 

mean—See arithmetic mean. 

median156—in statistics, a value in an ordered set of quantities above and below which 

falls an equal number of quantities. 

net benefits (savings)—the difference between the benefits and the costs—where both 

are discounted to present or annual value dollars. 

nominal discount rate—the rate of interest reflecting the time value of money stemming 

both from inflation and the real earning power of money over time (Syn. market 

discount rate). 

Discussion—This is the discount rate used in discount formulas or in selecting discount factors 

when future benefits and costs are expressed in current dollars. 

operating cost—the expenses incurred during the normal operation of a building or a 

building system or component, including labor, materials, utilities, and other related 

costs. 

opportunity cost of capital—the rate of return available on the next best available 

investment of comparable risk. 

optimization157—the process of searching for the best value that can be realized or 

attained. 

present value—the value of a benefit or cost found by discounting future cash flows to 

the base time (Syn. present worth). 

present worth—See present value. 

rate of return—the percentage yield on an investment per unit time. 

real discount rate—the rate of interest reflecting that portion of the time value of money 

related to the real earning power of money over time. 

Discussion—This is the discount rate used in discount formulas or in selecting discount factors 

when future benefits and costs are expressed in constant dollars. 

real dollars—See constant dollars. 

replacement cost—building component replacement and related costs, included in the 

capital budget, that are expected to be incurred during the study period. 

resale value—the monetary sum expected from the disposal of an asset at the end of its 

economic life, its useful life, or at the end of the study period. 

retrofit—the modification of an existing building or facility to include new systems or 

components. 

risk analysis—the body of theory and practice that has evolved to help decision makers 

assess their risk exposures and risk attitudes so that the investment that is best for 

them is selected. 

Discussion—This definition is restricted to the types of analyses described in ASTM Building 

Economics Standards, and is not necessarily consistent with how the term is used in reference to 

analyses in such areas as environment or health. 

risk attitude—the willingness of decision makers to take chances or gamble on 

investments of uncertain outcome. 

 

156 Encyclopedia Britannica. 15th Edition. Vol. VI, p. 744. 157 Gass, Saul I., and Harris, Carl M. Encyclopedia of Operations Research and Management Science

(Boston, MA: Kluwer Academic Publishers, 2001). 
127 

Discussion—Risk attitudes are generally classified as risk averse, risk neutral, or risk taking. Risk 

averse decision makers would prefer a sure cash payment to a risky venture with known expected 

value greater than the sure cash payment. Risk neutral decision makers act on the basis of 

expected monetary value. They would be indifferent between a sure cash payment and a risky 

venture with expected value equal to the sure cash payment, and would therefore accept a fair 

gamble. Risk takers prefer a risky venture with known expected value to a sure cash payment 

equal to the expected value. 

risk averse (RA)—See risk attitude. 

risk exposure—the probability of investing in a project whose economic outcome is 

different from what is desired (the target) or what is expected. 

risk mitigation (†)—the actions or decisions designed to reduce the financial and 

nonpecuniary risk from uncertain events. 

risk neutral (RN)—See risk attitude.

risk taking (RT)—See risk attitude. 

salvage value—the value of an asset, assigned for tax computation purposes, that is 

expected to remain at the end of the depreciation period. 

savings-to-investment ratio (SIR)—either the ratio of present value savings to present 

value investment costs, or the ratio of annual value savings to annual value 

investment costs. 

sensitivity analysis—a test of the outcome of an analysis by altering one or more 

parameters from (an) initially assumed value(s). 

study period—the length of time over which an investment is analyzed (Syn. life cycle, 

time horizon). 

sunk cost—a cost that has already been incurred and which should not be considered in 

making a new investment decision. 

terrorism (†)—intentional actions of an individual or group of individuals designed to 

instill widespread fear and anxiety among a population through the use of violence 

and destruction of property. 

time horizon—See study period. 

time value of money—the time-dependent value of money stemming both from changes 

in the purchasing power of money (that is, inflation or deflation), and from the real 

earning potential of alternative investments over time. 

uncertainty—lack of certain, deterministic, values for the variable inputs used in an 

economic analysis of a building or building system. 

useful life—the period of time over which an investment is considered to meet its 

original objective. 
128 
129 

References 

ASTM International. “Standard Classification for Building Elements and Related Site 

Work—UNIFORMAT II,” E 1557, Annual Book of ASTM Standards: 2002. Vol. 

04.11. West Conshohocken, PA: ASTM International. 

ASTM International. “Standard Guide for Selecting Economic Methods for Evaluating 

Investments in Buildings and Building Systems,” E 1185, Annual Book of ASTM 

Standards: 2002. Vol. 04.11. West Conshohocken, PA: ASTM International. 

ASTM International. “Standard Guide for Summarizing the Economic Impacts of 

Building Related Projects,” E2204, Annual Book of ASTM Standards: 2002. Vol. 

4.12. West Conshohocken, PA: ASTM International. 

ASTM International. “Standard Practice for Applying Analytical Hierarchy Process 

(AHP) to Multiattribute Decision Analysis of Investments Related to Buildings and 

Building Systems,” E 1765, Annual Book of ASTM Standards: 2002. Vol. 04.12. 

West Conshohocken, PA: ASTM International. 

ASTM International. “Standard Practice for Measuring Benefit-to-Cost and Savings-toInvestment Ratios for Investments in Buildings and Building Systems,” E 964, 

Annual Book of ASTM Standards: 2002. Vol. 04.11. West Conshohocken, PA: 

ASTM International. 

ASTM International. “Standard Practice for Measuring Internal Rate of Return and 

Adjusted Internal Rate of Return for Investments in Buildings and Building Systems,” 

E 1057, Annual Book of ASTM Standards: 2002. Vol. 04.11. West Conshohocken, 

PA: ASTM International. 

ASTM International. “Standard Practice for Measuring Life-Cycle Costs of Buildings 

and Building Systems,” E 917, Annual Book of ASTM Standards: 2002. Vol. 04.11. 

West Conshohocken, PA: ASTM International. 

ASTM International. “Standard Practice for Measuring Net Benefits for Investments in 

Buildings and Building Systems,” E 1074, Annual Book of ASTM Standards: 2002. 

Vol. 04.11. West Conshohocken, PA: ASTM International. 

ASTM International. “Standard Terminology of Building Economics,” E 833, Annual 

Book of ASTM Standards: 2002. Vol. 04.11. West Conshohocken, PA: ASTM 

International. 

ASTM International. ASTM Standards on Building Economics (West Conshohocken, 

PA: ASTM International, 1999). 
130 

Ayres, Ian, and Levitt, Steven D. “Measuring Positive Externalities from Unobservable 

Victim Precaution: An Empirical Analysis of Lojack,” Quarterly Journal of 

Economics, Vol. 113, No. 2, February 1998, pp. 43-77. 

Betterley, Richard S. “The Terrorism Coverage Market: Hope for Coverage in a Difficult 

Market,” The Betterley Report, April 2002. 

Bouabid, Jawhar. “HAZUS-MH and Technological Hazards,” November 2002, 

http://www.fema.gov/hazus/zip/dl_tech.zip. 

Bradshaw, III, Joel C. “Protecting Personnel at Risk: DOD Writes Anti-Terrorism 

Standards to Protect People in Buildings,” AMPTIAC Quarterly, Vol. 6, No. 4, 

February 2003, pp. 11-15. 

Chapman, Robert E. Applications of Life-Cycle Cost Analysis to Homeland Security 

Issues in Constructed Facilities: A Case Study. NISTIR 7025 (Gaithersburg, MD: 

National Institute of Standards and Technology, 2003). 

Chapman, Robert E. and Fuller, Sieglinde K. Benefits and Costs of Research: Two Case 

Studies in Building Technology. NISTIR 5840 (Gaithersburg, MD: National Institute 

of Standards and Technology, 1996). 

Chapman, Robert E., Gass, Saul I., Filliben, James J., and Harris, Carl M. Evaluating 

Emergency Management Models and Data Bases: A Suggested Approach. NISTIR 

88-3826 (Gaithersburg, MD: National Institute of Standards and Technology, 1989). 

Danzig, D. van. “Economic Decision Problems for Flood Prevention,” Econometrica, 

Vol. 24, No. 3, July 1956, pp. 276-287. 

Drake, C.J.M. Terrorists’ Target Selection (London: Macmillan Press, Ltd, 1998). 

Ehlen, Mark A. and Marshall, Harold E. The Economics of New-Technology Materials: A 

Case Study of FRP Bridge Decking. NISTIR 5864 (Gaithersburg, MD: National 

Institute of Standards and Technology, 1996). 

Encyclopedia Britannica. 15th Edition. Vol. VI, p. 735 (Chicago, IL: Encyclopedia 

Britannica Inc., 1974). 

Enders, Walter and Sandler, Todd. “The Effectiveness of Antiterrorism Policies: A 

Vector-Autoregression-Intervention Analysis,” American Political Science Review, 

Vol. 87, No. 4, December 1993, pp. 829-844. 

Enders, Walter, Sandler, Todd, and Cauley, Jon. “UN Conventions, Technology and 

Retaliation in the Fight against Terrorism: An Econometric Evaluation,” Terrorism 

and Political Violence, Vol. 2, No. 1, Spring 1990, pp. 83-105. 
131 

Executive Office of the President. The National Strategy for the Physical Protection of 

Critical Infrastructures and Key Assets (Washington, DC: The White House, 2003). 

Executive Office of the President. OMB Circular A-94 (Washington, DC: Office of 

Management and Budget, 1992). 

Federal Emergency Management Agency. Bringing the Plan to Life: Implementing the 

Hazard Mitigation Plan. FEMA 386-4. (Washington, DC: Federal Emergency 

Management Agency, August 2003). 

Federal Emergency Management Agency. Developing The Mitigation Plan; Identifying 

Mitigation Actions and Implementing Strategies. FEMA 386-3. (Washington, DC: 

Federal Emergency Management Agency, April 2003). 

Federal Emergency Management Agency. Insurance, Finance, and Regulation Primer 

for Terrorism Risk Management in Buildings. FEMA 429 (Washington, DC: Federal 

Emergency Management Agency, December 2003). 

Federal Emergency Management Agency. Integrating Human-Caused Hazards Into 

Mitigation Planning. FEMA 386-7 (Washington, DC: Federal Emergency 

Management Agency, September 2003). 

Federal Emergency Management Agency. Primer for Design of Commercial Buildings 

to Mitigate Terrorist Attacks. FEMA 427 (Washington, DC: Federal Emergency 

Management Agency, December 2003). 

Federal Emergency Management Agency. Primer to Design Safe School Projects in 

Case of Terrorist Attacks. FEMA 428 (Washington, DC: Federal Emergency 

Management Agency, December 2003). 

Federal Emergency Management Agency. Reference Manual to Mitigate Potential 

Terrorist Attacks Against Buildings. FEMA 426 (Washington, DC: Federal 

Emergency Management Agency, December 2003). 

Federal Emergency Management Agency. Understanding Your Risks: Identifying 

Hazards And Estimating Losses. FEMA 386-2 (Washington, DC: Federal Emergency 

Management Agency, August 2001). 

Federal Employees News Digest, “Employees Fighting Transfer to New Building,” Vol. 

53, No. 14, October 27, 2003, p. 5. 

Fisk, William J. “Health and Productivity Gains from Better Indoor Environments and 

Their Relationship with Building Energy Efficiency,” Annual Review of Energy and 

the Environment, Vol. 25, 2000, pp. 537-566. 
132 

Fuller, Sieglinde K. and Petersen, Stephen R. Life-Cycle Costing Manual for the Federal 

Energy Management Program. NIST Handbook 135 (Gaithersburg, MD: National 

Institute of Standards and Technology, 1996). 

Gass, Saul I. and Harris, Carl M. Encyclopedia of Operations Research and 

Management Science (Boston, MA: Kluwer Academic Publishers, 2001). 

Greenwald, Douglas. The McGraw-Hill Dictionary of Modern Economics: A Handbook 

of Terms and Organizations (New York, NY: McGraw-Hill Book Company, 1973). 

Grimes, T. L., Suiter, R. C., and Williams, Juana. S. Specifications, Tolerances, and 

Other Technical Requirements for Weighing and Measuring Devices. NIST 

Handbook 44 2003 ED (Gaithersburg, MD: National Institute of Standards and 

Technology, 2003). 

Gugliotta, Guy and White, Ben. “Tests Clear Home, Mail of Anthrax Victim,” 

Washington Post, November 24, 2001, p. A1. 

Hartwig, Robert. “The Long Shadow of September 11: Terrorism and Its Impacts on 

Insurance and Reinsurance Markets,” July 2002, 

http://server.iii.org/yy_obj_data/binary/687221_1_0/sept11.pdf. 

Hays, Constance L. “As Important as the Corporate Disaster Plan Is How Fast the 

Employees Carry It Out,” New York Times, September 12, 2001, p. C10. 

Hunter, Regina L. “Risk Assessment Method—Property Analysis and Ranking Tool: 

Risk Analysis Software for the GSA Property Manager,” mimeo, Sandia National 

Laboratories, 2001. 

Jaffee, Dwight and Russell, Thomas. “Extreme Events and the Market for Terrorism 

Insurance,” Fisher Center for Real Estate and Urban Economics, Working Paper 02-

282, April 2002. 

Johns, Michael and Silverman, Barry. “How Emotions and Personality Effect the Utility 

of Alternative Decisions: A Terrorist Target Selection Case Study,” Proceedings of 

the Tenth Conference on Computer Generated Forces and Behavioral 

Representation, Norfolk, VA, May 15-17, 2001, pp. 55-64. 

Keohane, Nathaniel and Zeckhauser, Richard. “The Ecology of Terror Defense,” 

Journal of Risk and Uncertainty, Vol. 26, Nos. 2-3, March-May 2003, pp. 201-229. 

Kollar, John J. “Terrorism Insurance Coverage in the Aftermath of September 11th,” A 

Public Statement by the Extreme Events Committee of the American Academy of 

Actuaries, April 17, 2002. 
133 

Koprowski, Gene. “Soft Targets,” Homeland Defense Journal, Vol. 1, No. 1, April 2003, 

pp. 34-37. 

Kowalski, Wlayslaw Jan. Immune Building Systems Technology (New York: McGrawHill, 2003). 

Kunreuther, Howard. “Protective Decisions: Fear or Prudence,” Chapter 15, Wharton on 

Making Decisions, edited by Stephen Hoch and Howard Kunreuther (New York: John 

Wiley & Sons, Inc., 2001), pp. 259-272. 

Kunreuther, Howard and Heal, Geoffrey. “Interdependent Security,” Journal of Risk and 

Uncertainty, Vol. 26, Nos. 2-3, March-May 2003, pp. 231-249. 

Kunreuther, Howard, Meszaros, Jacqueline, Hogarth, Robin, and Spranca, Mark. 

“Ambiguity and Underwriter Decision Processes,” Journal of Economic Behavior & 

Organization, Vol. 26, No. 3, May 1995, pp. 337-352. 

Kunreuther, Howard, Michel-Kerjan, Erwann, and Porter, Beverly. “Assessing, 

Managing and Financing Extreme Events: Dealing with Terrorism,” NBER Working 

Paper, No. 10179, December 2003. 

Lewis, Bernard T. and Payant, Richard P. The Facility Manager’s Emergency 

Preparedness Handbook (New York: AMACOM Books, 2003). 

Lipton, Eric. “New York Settles on a Number That Defines Tragedy: 2,749 Dead in 

Trade Center Attack,” New York Times, January 23, 2004, p. B7. 

Lomonaco, Carol and Miller, Dennis. “Comfort and Control in the Workplace,” ASHRAE 

Journal, Vol. 39, No. 9, September 1997, pp. 50-56. 

Marshall, Harold E. Choosing Economic Evaluation Methods—Part III in the 

Audiovisual Series on Least-Cost Energy Decisions for Buildings (Gaithersburg, MD: 

National Institute of Standards and Technology, 1995). 

Marshall, Harold E. Least-Cost Energy Decisions for Buildings—Part II: Uncertainty 

and Risk Video Training Workbook. NISTIR 5178 (Gaithersburg, MD: National 

Institute of Standards and Technology, 1993). 

Marshall, Harold E. Least-Cost Energy Decisions for Buildings—Part III: Choosing 

Economic Evaluation Methods Video Training Workbook. NISTIR 5604 

(Gaithersburg, MD: National Institute of Standards and Technology, 1995). 

Marshall, Harold E. Techniques for Treating Uncertainty and Risk in the Economic 

Evaluation of Building Investments. NIST Special Publication 757 (Gaithersburg, 

MD: National Institute of Standards and Technology, 1988). 
134 

Marshall, Harold E. Uncertainty and Risk—Part II in the Audiovisual Series on LeastCost Energy Decisions for Buildings (Gaithersburg, MD: National Institute of 

Standards and Technology, 1992). 

Moss, Michael and Bagli, Charles V. “Instincts to Flee Competed with Instructions to 

Remain,” New York Times, September 13, 2001, p. A6. 

National Institute of Justice. Crisis Information Management Software (CIMS) Feature 

Comparison Report, NCJ 197065, October 2002, Special Report, 

http://www.ojp.usdoj.gov/nij/pubs-sum/197065.htm. 

Norris, Gregory A. and Marshall, Harold E. Multiattribute Decision Analysis Method for 

Evaluating Buildings and Building Systems. NISTIR 5663 (Gaithersburg, MD: 

National Institute of Standards and Technology, 1995). 

Owen, David D. and R.S. Means Engineering Staff. Building Security: Strategies & 

Costs (Kingston, MA: Construction Publishers & Consultants, 2003). 

Paté-Cornell, Elisabeth and Guikema, Seth. “Probabilistic Modeling of Terrorist Threats: 

A Systems Approach to Setting Priorities Among Countermeasures,” Military 

Operations Research, Vol. 7, No. 4, 2002, pp. 5-23. 

Ruegg, Rosalie T. and Marshall, Harold E. Building Economics: Theory and Practice, 

(New York: Chapman and Hall, 1990). 

Schaad, Werner. “Terrorism—dealing with the new spectre,” Swiss Re Focus Report,

2002. 

Tobin, L. Thomas. “California Case Study: Examples of Incentives to Encourage 

Earthquake Resistant Communities,” presented at the Wharton School, Economic 

Incentives for Building Safer Communities Wharton Risk Management and Decision 

Processes Center Roundtable, June 11, 2002. 

U.S. Census Bureau. Value of Construction Put in Place, Series C30, 

http://www.census.gov/const/c30/tab102.txt. 

U.S. Department of Defense. DoD Minimum Antiterrorism Standards for Buildings, UFC 

4-010-01, July 31, 2002. 

U.S. Department of Energy. Commercial Buildings Energy Consumption Survey, 1999. 

U.S. Department of Energy. Manufacturing Energy Consumption Survey, 1998. 

U.S. General Accounting Office. “Terrorism Insurance: Rising Uninsured Exposure to 

Attacks Heightens Potential Economic Vulnerabilities,” Testimony of Richard J. 
135 

Hillman Before the Subcommittee on Oversight and Investigations, Committee on 

Financial Services, House of Representatives, February 27, 2002. 

U.S. Postal Service. 2001 Comprehensive Statement on Postal Operations, 2001. 

Von Neumann, John and Morgenstern, Oskar. Theory of Games and Economic Behavior

(Princeton, New Jersey: Princeton University Press, 1953).

Weaver, Ransom, Silverman, Barry, Shin, Hogeun, and Dubois, Rick. “Modeling and 

Simulating Terrorist Decision-making: A ‘Performance Moderator Function’ 

Approach to Generating Virtual Opponents,” Proceedings of the Tenth Conference on 

Computer Generated Forces and Behavioral Representation, Norfolk, VA, May 15-

17, 2001, pp. 39-44. 

Zilinskas, Raymond A. Biological Warfare (Boulder, CO: Lynne Rienner Publishers, 

Inc., 2000).