How probabilistic risk assessment can mislead terrorism risk analysis. Risk Analysis 31:196–204

Traditional probabilistic risk assessment (PRA), of the type originally developed for engi-neered systems, is still proposed for terrorism risk analysis. We show that such PRA appli-cations are unjustified in general. The capacity of terrorists to seek and use information and to actively research different attack options before deciding what to do raises unique fea-tures of terrorism risk assessment that are not adequately addressed by conventional PRA for natural and engineered systems—in part because decisions based on such PRA estimates do not adequately hedge against the different probabilities that attackers may eventually act upon. These probabilities may differ from the defender’s (even if the defender’s experts are thoroughly trained, well calibrated, unbiased probability assessors) because they may be con-ditioned on different information. We illustrate the fundamental differences between PRA and terrorism risk analysis, and suggest use of robust decision analysis for risk management when attackers may know more about some attack options than we do