http://www.govexec.com/features/0807-01/0807-01s3.htm

Sept. 11 was so dramatic and scary that even suggesting that some of the resulting fear is unjustified seems blasphemous. Indeed, the release in July of a new National Intelligence Estimate and its reports of a resurgent al Qaeda served to renew and stoke those fears. But the point is not that terrorists don't exist, or that terrorist attacks won't happen. It's that the pervasive alarm about terrorism obscures the most important question the nation must grapple with: "What level of protection is enough?" Seeking 100 percent security is quixotic. There always will be some risk, but how much can we live with?

This question remains unanswered because the political climate created by alarmists, however well-intentioned, prevents it from being raised. Those who try are quickly punished. Democratic presidential candidate John Kerry said in 2004 that the goal should be to reduce terrorism to the level of organized crime - a nuisance but not "the focus of our lives." The Bush campaign immediately pounced, calling Kerry "unfit to lead," and he never used such rhetoric again.

The question "How much risk can we live with?" cuts to the heart of homeland security because the answer should guide the way government spends money, the primary tool for fighting terrorism. We simply cannot protect everything, and because budget resources are limited, spending security money protecting one asset means leaving another vulnerable. We must spend effectively and strategically. That means employing sound cost-benefit analyses to reduce risk to manageable levels is the only reasonable goal. Industry has a word for this kind of strategic thinking: risk management.