The Government Accountability Office (GAO) recently issued a report about using risk management techniques to help decision makers prioritize decisions for homeland security. GAO pointed out that although the Department of Homeland Security (DHS) uses risk assessment for specific programs, DHS “has not comprehensively implemented a risk management approach across the department as a whole.” Acknowledging that doing so would be a difficult task, GAO nonetheless concluded that without a comprehensive approach to risk, DHS would not be able to “identify the threats that can and should be offset by limited resources” or to “assure the Congress or the public that federal funding is targeting the most critical risks.”

Understandably, in light of 9/11, the American public wants to be protected against further terrorist attacks. And certainly one of the primary responsibilities of the federal government is to provide for the common defense. But the hard truth is that providing absolute and perfect defense against any and all potential terrorist attacks is impossible. So rather than trying to do everything while doing nothing well, DHS must make decisions about what to protect and, perhaps more importantly, what not to protect. That means we must learn to live with risk.

Determining risk is not an exact science. There will also be some level of subjectivity, because everyone has his own value system. This was most apparent in the initial reaction to how DHS distributed grants for homeland security programs last summer. Arguing that risk was spread across the nation, the $747 million Urban Areas Security Initiative allocated less money to Washington, D.C. and New York than it had the previous year. Even though New York would receive the lion’s share of funding, this decision nonetheless drew sharp criticism from New York politicians. New York Representative Carolyn Maloney, chairman of the House Democratic Task Force on Homeland Security, called New York “the nation’s top terrorist target.” Senator Charles Schumer declared that there was something “dramatically wrong” with thinking “that Georgia peanut farmers are more at risk than the Empire State Building.” But just because New York and Washington, D.C. were the two cities attacked on September 11, 2001 does not necessarily mean that they are the most likely targets. Such logic assumes that the past is a reliable predictor of the future. Yet the lesson of 9/11 is that terrorism is unpredictable.

A better approach than defending against the last attack (via hijacked airlines used as missiles) at the last targets (New York and Washington, D.C.) is to focus on those threats which pose the most catastrophic consequences and against which cost–effective defenses can be deployed or developed. For example, an airliner attacked by a shoulder–fired missile would not result in the same loss of life as the September 11 attacks, but the terror spread by such an attack could be just as profound by potentially shutting down commercial airline travel with subsequent ripple effects throughout the economy. That is one of the reasons the DHS’s counter–MANPADS (man–portable air defense systems) program is adapting high–tech military countermeasures for commercial airline use.

But it is impossible to erect effective defenses against all catastrophic attacks. For example, the DHS’s Domestic Nuclear Detection Office (DNDO) is tasked with defending against terrorist use of a nuclear device. Yet the reality is that trying to find a nuclear warhead that could be anywhere in the United States amounts to a needle–in–the–haystack endeavor. This does not mean that DNDO’s efforts are unimportant, but the expectation that an effective defense against nuclear terrorism can be built must be tempered with a healthy dose of realism. There is general agreement that the best way to reduce the threat is to deal with it at its most likely source, which is why the cooperative threat reduction (CTR) program to secure Russia’s “loose nukes” is so important.

The paradox of homeland security is that the government must make every effort to reduce risk by building defenses against terrorist attacks, but doing so creates a Maginot line, because eventually a determined terrorist will find a way to circumvent defenses and security measures—which is exactly what the 9/11 hijackers did. Ultimately, the greatest risk is that posed by U.S. foreign policy. The longer we refuse to recognize that U.S. interventionist policies—especially in the Muslim world—are a root cause of the virulent anti–Americanism that is the basis for terrorism, it won’t matter how well DHS is able to assess and manage risk.