As demonstrated by the terrorist attacks of September 11, 2001, the United States and other nations face increasingly diffuse threats. Potential adversaries are more likely to strike vulnerable civilian or military targets in nontraditional ways to avoid direct confrontation with our military forces on the battlefield, to try to coerce our government to take some action terrorists desire, or simply to make a statement. Moreover, according to the President's December 2000 national security strategy,such threats are more viable today because of porous borders, rapid technological change, greater information flow, and the destructive power of weapons now within the reach of states, groups, and individuals who may aim to endanger our values, way of life, and the personal security of our citizens. Hostile nations, terrorist groups, and even individuals may target Americans, our institutions, and our infrastructure with weapons of mass destruction—including biological, chemical, radiological, nuclear, or high explosive weapons. Although they would have to overcome significant technical and operational challenges to make and release many chemical or biological agents of a sufficient quality and quantity to kill large numbers of people, it has been tried, as demonstrated by the current incidents of anthrax-laced letters. Previous attempts have been made such as in 1995 when the Aum Shinrikyo group succeeded in killing 12 people and injuring thousands by releasing the nerve agent sarin in the Tokyo subway. Prior to the Aum Shinrikyo attack, in 1984, the Rajneeshee religious cult in Oregon contaminated salad bars in local restaurants with salmonella bacteria to prevent people from voting in a local election. Although no one died, hundreds of people were diagnosed with food-borne illness. A fundamental role of the government under our Constitution is to protect America from both foreign and domestic threats. The government must be able to prevent and deter attacks on our homeland as well as detect impending danger before attacks or incidents occur. Although it may not be possible to detect, prevent, or deter every attack, steps can be taken to manage the risk posed by the threats to homeland security. We have conducted numerous cross-agency reviews of programs to combat terrorism and have made recommendations that the federal government adopt a risk management approach which could be used at the national as well as the state and local level. Efforts by individual federal agencies related to risk management are underway by the Department of Justice (in conjunction with state governments), the FBI, and DOD. However, the results to date have been inconclusive. In September 1999, we recommended that the Department of Justice, specifically the FBI, conduct threat and other assessments at the national level as part of a risk management approach that could be useful nationwide. In response to our report, the FBI agreed to lead two assessments. The first assessment is a report on those chemical and biological agents that may be more likely to be used in the United States by a terrorist group that was not state sponsored (e.g., terrorist groups without access to foreign government stockpiles, production capabilities, or funding). Because of limitations on intelligence, the FBI decided to focus on chemical and biological agents. While not identifying specific terrorist groups, this assessment would still be useful in determining requirements for programs to combat terrorism. The FBI is sponsoring this assessment in conjunction with the Department of Justice's National Institute of Justice and the Technical Support Working Group. This assessment will be provided to state and local governments to help them conduct their own risk management assessments. The Department of Justice had estimated that the final assessment would be published in December 2001. The second assessment is a national-level threat assessment of the terrorist threat in the United States. According to the Department of Justice, the FBI is in the process of conducting this assessment which will encompass domestic terrorism, international terrorism, weapons-of-mass- destruction terrorism, cyber-terrorism, and proliferation of weapons of mass destruction. The report will assess the current threat, the projected threat, emerging threats, and related FBI initiatives. The Department had estimated that this classified assessment would be completed in October 2001. Department of Justice and FBI officials told us that the September 11 terrorist attacks may dictate revisions to these assessments and delay their completion. While we view both of these assessments as positive, the FBI noted that these would be limited to threat assessments only and will not include other important aspects of risk management that we discuss below. In April 1998, we asked the Congress to consider requiring the domestic preparedness program—then run by the DOD—to use a risk management approach in its efforts to prepare state and local governments for terrorist attacks involving weapons of mass destruction. The Department of Justice took over that program in fiscal year 2001, and has worked with the FBI to create a risk management tool for state and local governments.This tool includes a step-by-step methodology for assessing threats, risks, and requirements. It also includes information on how to prioritize programs and to project spending amounts. The information from the assessments will be used to develop statewide domestic preparedness strategic plans. The statewide assessment process includes an initial risk assessment and identification of the most likely scenarios. This risk assessment is the culmination of three other assessments: threat, vulnerabilities, and public health assessments. This design feature enables the program to focus resources on preparing for the most likely scenarios. The Department of Justice plans to use the results of these assessments to drive the allocation of its resources for equipment, training, and exercise programs, consistent with our recommendation. According to Department of Justice officials, these assessments have been completed by four states—Rhode Island, South Carolina, Hawaii, and Utah. In September 2001, we recommended that the DOD take steps to improve its risk management approach in its force protection efforts through better assessments of threats, vulnerabilities, and criticality. Regarding DOD's threat assessments, we recommended that the Department expand its methodology to increase the awareness of the consequences of changing business practices at installations that may create workplace violence situations or new opportunities for individuals not affiliated with the DOD to gain access to installations. We also recommended that installation commanders form threat working groups and personally and actively engage state, local, and federal law enforcement officials to provide threat information from these sources on a regular basis. The Department agreed with these recommendations and stated it would review its methodology to ensure that no threat indicators are overlooked and that it would require installation commanders to establish threat working groups. To improve its vulnerability assessments, we recommended that DOD identify those installations that serve a critical role in support of our national military strategy, and ensure that that they receive a vulnerability assessment. We further recommended that the Department develop a strategy to conduct vulnerability assessments at National Guard installations and develop a mechanism to record and track all vulnerability assessments conducted. DOD agreed with these recommendations and is changing its program standards and procedures to implement these recommendations. Regarding criticality assessments, we recommended that DOD require criticality assessments be done at all installations. DOD agreed with this recommendation and has revised its program standards to require this assessment. Risk management is a systematic, analytical process to consider the likelihood that a threat will harm an asset or individuals and to identify actions that reduce the risk and mitigate the consequences of an attack or event. Risk management principles acknowledge that while risk generally cannot be eliminated, enhancing protection from known or potential threats can reduce it. As described in detail below, a risk management approach can have three elements: assessments of threat, vulnerabilities, and criticality (or relative importance). This general approach is used or endorsed by federal agencies, government commissions, and multi- national corporations. Figure 1 below is a graphical representation of the risk management approach we discuss. A threat assessment is used to evaluate the likelihood of terrorist activity against a given asset. It is a decision support tool that helps to establish and prioritize security-program requirements, planning, and resource allocations. A threat assessment identifies and evaluates each threat on the basis of various factors, including capability, intention, and impact of an attack. Intelligence and law enforcement agencies assess the foreign and domestic terrorist threats to the United States. The U.S. intelligence community—which includes the Central Intelligence Agency, the Defense Intelligence Agency, and the State Department's Bureau of Intelligence and Research, among others—monitors the foreign-origin terrorist threat to the United States. The FBI gathers information and assesses the threat posed by domestic sources of terrorism. Threat information gathered by both the intelligence and law enforcement communities can produce threat assessments for use in national security strategy planning. Several federal government organizations as well as companies in the private sector apply some formal threat assessment process in their programs, or such assessments have been recommended for implementation. For example, DOD uses threat assessments for its antiterrorism program designed to protect military installations. DOD evaluates threats on the basis of several factors, including a terrorist group's intentions, capabilities, and past activities. The assessments provide installation commanders with a list of credible threats that can be used in conjunction with other information (such as the state of the installation's preparedness) to prepare against attack, to recover from the effects of an attack, and to adequately target resources. Similarly, the Interagency Commission on Crime and Security in U.S. Seaports reported that threat assessments would assist seaports in preparing for terrorist threats. The Commission recommended that the federal government establish baseline threat assessments for terrorism at U.S. seaports and, thereafter, conduct these assessments every 3 years. Additionally, a leading multi-national oil company attempts to identify threats in order to decide how to manage risk in a cost-effective manner. Because the company operates overseas, its facilities and operations are exposed to a multitude of threats, including terrorism, political instability, and religious or tribal conflict. In characterizing the threat, the company examines the historical record of security and safety breaches and obtains location-specific threat information from government organizations and other sources. It then evaluates these threats in terms of company assets that represent likely targets. While threat assessments are key decision support tools, it should be recognized that, even if updated often, threat assessments might not adequately capture emerging threats posed by some terrorist groups.