A security risk management (SRM) framework is a useful tool for measuring and scoring the effectiveness of a government’s counterterrorism (CT) campaign. SRM frameworks are widely applied in homeland security to assess impacts and mitigation measures along a spectrum of catastrophic risks, ranging from natural hazards, pandemics, climate change and economic crises, to the societal impact of artificial intelligence. These SRM frameworks, however, are not being applied in the CT realm. This research note aims to demonstrate how SRM can provide an analytical framework for policymakers to use to lower terrorism risk to a targeted country.
Defining Terrorist Warfare
There is a lack of consensus in the counterterrorism discipline as to what constitutes terrorism, especially with regard to objectives and targeting. I define terrorism as a tactic of irregular military warfare by sub-national groups or lone actors that is distinguished from regular military warfare waged between adversary countries’ conventional forces. Terrorists, as the weaker force, engage in an unequal type of asymmetric warfare against stronger countries’ military and law enforcement forces. Perpetrated by subnational groups or lone actors, terrorism involves premeditated politically or religiously motivated violent attacks against any citizens of a state, whether unarmed civilians or combatant militaries and law enforcement. Its objective is to cause mass fatalities (if possible) and physical destruction to coercively influence their targeted governments to give in to their demands. Unlike paramilitary guerrilla forces, terrorist groups are incapable of overthrowing their adversaries’ governments by directly engaging their military forces in battle. Instead, they inflict discriminate or indiscriminate destruction against their intended victims in the hope of coercing governments to change policy in their interests. Finally, it is possible for some terrorist groups to become more powerful and transition into paramilitary forces, as was the case with the Palestinian Hamas, the Lebanese Hizballah, the Colombian FARC, the Afghanistan Taliban, the Somalian Al Shabab, the Nigerian Boco Haram, and others.
Applying a Security Risk Management Framework to Counterterrorism Campaigns
The SRM framework represents a more useful methodological model for measuring and scoring the overall effectiveness of governments’ CT campaigns than other frameworks which tend to examine them only partially and not based on scored metrics of effectiveness. Unlike other approaches, the SRM framework assesses the magnitude of the threat of terrorism, the vulnerability of a country’s population and critical infrastructure to being attacked, the human and the physical and financial consequences of such attacks. It then scores the overall level of risk presented by the terrorist insurgency and governments risk tolerance for terrorism. Finally, it prioritizes how governments accept the consequences of the terrorist risk challenging them, and then prioritizing the risk mitigation measures required to terminate the insurgency militarily, peacefully, or through a mix of the two approaches, to reduce the terrorist threat to what are considered low or negligible levels.
To assess how a SRM framework can be applied to a government’s CT campaign, the first requirement is to define risk. Within the context of international security, risk is the likelihood of occurrence of a threatening event or series of events that can adversely affect the security of a country, its population and critical infrastructure, or other entities. Risk, in general, implies uncertainty that a threat might be imminent and its consequences.
The second requirement is to explain the components of risk. In the case of CT, risk is a function of the interaction between the threat posed by a terrorist group or lone actor (such as intent, a history of attacks, warfare capability, attack mode, local presence, and likely targets), the targets’ vulnerabilities (such as their criticality, ease of access, their lack of defense, and their lack of forward deterrence to prevent the attackers), and the consequences of an attack (the extent of human fatalities and injuries, physical damage, financial and legal liabilities, and a perception that the government is weak and incapable of defending the population from terrorist attacks).
Scoring Overall Terrorism Risk
Once the threat, vulnerabilities, and consequences of terrorist attacks are assessed, a 5-point scale can be utilized to score the likelihood and magnitude of the overall security risk a terrorist insurgency presents to its targeted government. The likelihood of terrorist attacks is measured by their frequency rate, with the magnitude measured by the severity of their lethal impact.
The 5-point scale is scored in Table 1:
- 1 – Very unlikely; negligible impact
- 2 – Unlikely; minor impact
- 3 – Possible; moderate impact
- 4 – Likely; significant impact
- 5 – Very likely; severe impact
Table 1
With the maximum level of very likely threat and severity impact score of overall terrorism risk set at 5, and the very unlikely and negligible impact risk score set at 1, the scoring scale of overall risk ranges between 1 and 5. For example, if the threat of being attacked is high, but the threatened target’s vulnerability is hardened and difficult for a threat actor to attack, then the consequence of being attacked will be minor or negligible. If the overall threat is high, and the impact of being attacked is severe, the overall risk score will be set at 5.
Continuous monitoring of the terrorist risks facing a country is required, as it will result in a comprehensive and dynamic risk accountability and due diligence by those tasked with assessing the overall terrorist risks in all its dimensions.
Risk Tolerance
Once the overall terrorism risk score is derived, the next step is to assess how it impacts the government’s and the society’s capacity to function effectively. At this point, the government’s level of risk tolerance to the terrorism risk can be calculated by establishing a threshold for how much damage impact from the assessed risk is considered acceptable or unacceptable. For instance, 20 annual fatalities and $100 million in physical damages caused by terrorist attacks might be considered acceptable by a government to maintain current counterterrorism measures, while 100+ annual fatalities and $500+ million in damages could be considered unacceptable and requiring militarily harsher or other types of counterterrorism measures.
To assess and score a government’s risk tolerance (RT) level to the terrorist risk targeting it, a 5-scale scoring system is presented in Table 2:
Table 2
| Government Counterterrorism Campaign
|
Overall Risk Score – 1 (Negligible), 3 (Low), 5 (High) | Assessment of Government’s Risk Tolerance Level – 1 (Negligible/Acceptable), 3 (Medium/Moderately Acceptable), 5 (High/Unacceptable) | Country’s Risk Tolerance Level Score
1 (Negligible/Acceptable), 3 (Medium/Moderately Acceptable), 5 (High/Unacceptable) |
| Country X |
As the terrorist risk is dynamically evolving, it is necessary to continuously reassess the level of risk tolerance to ensure it reflects the changing magnitude and character of the terrorist risk.
Prioritizing the Mitigation of Terrorism Risks
Once the terrorism tolerance level risk score is determined it will enable the targeted government to prioritize the allocation of counterterrorism mitigation measures, based on what are determined to be a cost-benefit/return-on-investment (ROI) calculation to achieve the end state, in the best case scenario, of reducing the overall risk of terrorism to a low or negligible level.
There are three types of security risk mitigation: strategic, operational, and tactical. Strategic risk mitigation involves government level mitigation strategies and policies, such as national counterterrorism strategies. Operational risk mitigation involves counterterrorism plans and programs by government departments, as well as military, law enforcement, and emergency management agencies. Tactical risk mitigation consists of practical defensive and offensive response measures. Of the 15 risk mitigation measures, 1-9 consist of military, law enforcement and intelligence measures, such as interventions by military, law enforcement, and intelligence agencies, emergency operations, hardening border controls, surveillance and arrests of individuals with a possible nexus to terrorism. Risk mitigation measures numbering 10 to 15 are non-miliary-based conciliatory measures, such as addressing and attempting to resolve a conflict’s underlying causes, countering radicalization into violent extremism, and entering into peace negotiations, when appropriate, with the terrorist insurgents.
The prioritization and description of risk mitigation measures required to lower the overall risk of terrorism to a negligible level are provided in Table 3. The following scoring scale is proposed:
1 – 14: Highly Ineffective
15 – 29: Ineffective
30 – 44: Moderately Effective
45 – 59: Effective
60 – 75: Highly Effective
Table 3
| Risk Mitigation Measures | Descriptive Assessment of Government’s Implementation of Risk Mitigation Measures | Scoring of Government’s Effectiveness in Applying Risk Mitigation Measures (1 – 5 Scale, with 1 (Negligible), 3 (Moderate), and 5 (Highly Successful) | |
| 1 | Harden Security of Potential Targets | ||
| 2 | Arrest or Kill Terrorist Leaders, Managers, & Operatives | ||
| 3 | Reduce Frequency/ Lethality of Terrorist Attacks | ||
| 4 | Penetrate Terrorist Group with Informers | ||
| 5 | Disrupt and Reduce Terrorists Recruitment of New Members | ||
| 6 | Promote Terrorist Defections | ||
| 7 | Reduce Terrorists’ Funding Sources | ||
| 8 | Reduce Terrorists’ Sources of External Support | ||
| 9 | Reduce Territory Under Terrorists Control (Including Safe Havens) | ||
| 10 | Counter Terrorists Extremist Narrative | ||
| 11 | Address Conflict’s Root Causes | ||
| 12 | Formulate Political Reforms to Address Terrorists Demands (if Considered Legitimate) | ||
| 13 | Influence Terrorist Adversary to Compromise by Proposing Peace Negotiations | ||
| 14 | Promote Deradicalization & Disengagement from Terrorism | ||
| 15 | Promote Reintegration of Former Terrorists Into Civil Society | ||
| Assessing the Implementation of CT Campaign’s Risk Mitigation Measures’ Total Scores | 15 – 75 |
Scoring the Measures of Effectiveness in Mitigating Overall Terrorism Risk
Once the government’s 15 counterterrorism campaign’s risk mitigation measures are implemented, whether comprehensively or partially, as presented in Table 3, it will be possible to measure and score their effectiveness in lowering the overall terrorism risk to low or negligible levels. The following scoring scale is proposed:
1 – 14: Highly Ineffective
15 – 29: Ineffective
30 – 44: Moderately Effective
45 – 59: Effective
60 – 75: Highly Effective
This is presented in Table 4.
Table 4
| Risk Mitigation Measures | Assessment of Government’s Implementation of Risk Mitigation Measures | Scoring of Government’s Risk Mitigation Measures (1 – 5 Scale), with 1 (Negligible), 3 (Moderate), and 5 (Highly Successful) | |
| 1 | Hardening Security of Potential Targets | ||
| 2 | Arresting or Killing Terrorist Leaders, Managers, & Operatives | ||
| 3 | Reducing Frequency/Lethality of Terrorist Attacks | ||
| 4 | Penetrating Terrorist Group with Informers | ||
| 5 | Preventing Recruitment of New Terrorist Members | ||
| 6 | Causing Defections of Terrorist Members | ||
| 7 | Reducing Terrorists’ Funding Sources | ||
| 8 | Reducing Terrorists’ Sources of External Support | ||
| 9 | Reducing Territory Under Terrorists Control | ||
| 10 | Countering Terrorists Extremist Narrative | ||
| 11 | Addressing and Resolving the Conflict’s Root Causes | ||
| 12 | Formulating Political Reforms to Address Terrorists Demands (if Considered Legitimate) | ||
| 13 | Influencing Terrorist Adversary to Compromise by Proposing Peace Negotiations | ||
| 14 | Promoting Deradicalization & Disengagement from Terrorism | ||
| 15 | Promoting Reintegration of Former Terrorists into Civil Society | ||
| Total CT MoE Scores | 15 – 75 |
Applying the SRM Framework to Selected Case Studies
In the final application of the SRM framework, the findings from the previous four tables are correlated to assess the effectiveness of a government’s counterterrorism campaigns. As part of the research note, Table 5 presents an illustrative assessment and scoring of effectiveness in a government’s counterterrorism campaign for three countries threats: Britain and the Irish Republican Army, the United States and the Taliban, and Israel and Hamas along two periods and Israel and far-right wing Jewish terrorism since 2020. The Israeli counterterrorism campaign against Hamas is divided into two phases: pre-October 7, 2023, when Hamas conducted its devastating cross-border attack against Israel, and post-October 8, 2023, when Israel retaliated against Hamas’s cross-border attack. The case of the Israeli CT campaign’s response to the insurgency by the far-right wing Jewish terrorists in the West Bank against neighboring Palestinian towns and villages, which has escalated since 2022, has become a major terrorist risk against the neighboring Palestinians and the Israeli state.
Note that the CT effectiveness scores presented in Table 5 are generated for illustrative purposes by the article’s author to demonstrate how the SRM framework can be operationalized. Other subject matter experts might generate different CT campaign effectiveness scores.
Table 5
| Country CT Campaign & Insurgency | Insurgency Timeframe | Overall Risk Score at Height of Insurgency | Government Risk Tolerance Level at Height of Insurgency | Risk Mitigation Measures Effectiveness Score | CT Outcomes & Scores |
| Britain & IRA Insurgency | Late 1960s
– 1998 |
4 | 5 | 75 | The IRA insurgency was resolved in April 1998 with the Good Friday Agreement between the British Government and the IRA and Sinn Fein, its political front. It resulted in the peaceful reintegration of the IRA and Sinn Fein into the Northern Ireland political system. Since then, the peace agreement has led to a peaceful and stable Northern Ireland within the United Kingdom. The overall CT effectiveness score is 75 (Highly Effective). |
| United States & Taliban Insurgency | 9/2001 –
August 2021
|
5 | 5 | 7 | In August 2021, the U.S.-led counterterrorism campaign in Afghanistan failed as its supported local government and its military and law enforcement forces were overthrown by the Taliban. With the U.S. military forces withdrawing from Afghanistan, since then the country has been ruled by the Taliban. The overall CT risk score is 7 (Highly Ineffective). |
| Israel & Hamas Insurgency (Gaza Strip) I | 2014 –
October 7, 2023 |
5 | 3 | 7 | From the inconclusively ended July-August 2014 Israel–Hamas War, Israel’s counterterrorism campaign relied on a mix of military and political measures. These included shooting down Hamas’s firing missiles into the country, occasional Israeli special forces interventions in Gaza, as well as agreeing to transfer hundreds of millions of dollars of funds from Qatar to Hamas in the hope that Hamas would limit its military warfare against Israel. Instead, Hamas spent several years building an extensive series of underground tunnels and planning an ambitious cross-border surprise attack on October 7, 2023, catching Israeli military forces off-guard. It caused the most catastrophically military defeat in Israel’s history, with some 1,200 fatalities, including the hostage taking of an estimated 250 Israelis. This military catastrophe was caused by the absence of the application of an appropriate SRM framework to assess the security situation along the Gaza border. Israeli security planners had discounted Hamas’s high threat level, the high vulnerability level to being attacked, and little concern for the high consequence impacts. With a high tolerance score vis-à-vis the potential for a major Hamas attack and low risk mitigation measures score to lower the overall risk, Israel’s overall CT campaign against Hamas is scored at 7 (Highly Ineffective). |
| Israel & Hamas Insurgency Gaza Strip II | October 8,
2023 – mid-2026 |
5 | 5 | 44 | Since October 8, 2023, Israel responded with a massive military campaign that killed an estimated 22,000 Hamas fighters (including those of Palestinian Islamic Jihad), with about 10,000-20,000 Hamas fighters remaining, as well as assassinating most of Hamas’s top military and political leaders. With Israel controlling an estimated 60 percent of Gaza’s territory by mid-2026, only an estimated 25 percent of the underground tunnels were destroyed. An estimated 40,000+ Palestinian civilians were killed in the fighting, with many killed as collateral damage when Hamas fighters were using them as human hostages. Israel damaged Hamas’s heaviest weapons, such as rockets and mortars, and weapons manufacturing capabilities. Israel controls an estimated 80 percent of Gaza’s territory. With a U.S.-led Board of Peace overseeing the post-war transition in Gaza, as of mid-2026 Hamas had not agreed to demilitarize. Israel succeeded in substantially lowering the overall security risk presented by Hamas’s insurgency by degrading its military warfare capability (risk mitigation measures 1-9), giving it an effectiveness military-based CT score of 44. However, the Israeli government demonstrated no interest in resolving the conflict with Hamas along the remaining six security risk mitigation measures, giving it a non-military CT score of “0”. The overall CT campaign effectiveness is scored at 44 (Moderately Effective). |
| Israel & Far-Right Wing Jewish Terrorism in West Bank | 2022 – 2026 | 1 | 1 | 14 | Since 2020, when Itamar Ben Gvir was appointed as Minister of National Security in the Likud-led Israeli coalition government, terrorist-type violence by militant Israeli settlers in the West Bank against Palestinians from neighboring Palestinian towns and villages exponentially surged in terms of frequency and severity of incidents, with the perpetrators operating in what are considered near-total immunity from prosecution. The Israeli government regards it as low risk and its risk tolerance level is high. In terms of risk mitigation measures, in 2024, the Israeli Defense Minister cancelled administration detention for Israeli suspects of terrorist incidents in the West Bank, while maintaining it for Palestiians suspects. In other incidents, Israel Defense Force (IDF) soldiers and General Security Service (GSS – Shin Bet) intelligence operatives have not actively intervened to stop the militant Jewish settler attackers or to conduct intelligence operations to surveil and preemptively arrest them. Reportedly, a majority of cases involving those suspected of engaging in terrorist acts against the local Palestinians are closed without indictment. In assessing the Israeli government’s response to the far-right wing Jewish terrorism in the West Bank, its regard for the overall security risk level is 1 (Very Unlikely; Negligible Impact), its risk tolerance level is 5 (Negligible/Acceptable), and its overall CT campaign’s effectiveness is scored at 14 (Highly Ineffective).
|
Conclusion
This research note has attempted to demonstrate that applying a comprehensively structured security risk management (SRM) framework provides a proactive approach to identifying, assessing, and scoring the effectiveness of measures by targeted governments to resolve a terrorist insurgency at the strategic, operational, and tactical levels. With quantitative assessments of the overall risk and risk tolerance, and prioritized allocation of measures to lower overall terrorist risk, this framework attempts to continuously enable high impact risks to be forecast and addressed in a cost-benefit/return-on-investment (RoI) manner to safeguard societies that are challenged by terrorist insurgencies. When they succeed, as in the case of Britain and the IRA, their societies are safeguarded, but in the cases of Israel’s counterterrorism campaigns against Hamas and the far-right wing Jewish terrorists in the West Bank, their societies bear the brunt of protracted insurgencies, while in the worst case scenario, such as the United States in Afghanistan, the government will be defeated by the terrorist forces.
