Why Terror Alert Codes Never Made Sense

By Bruce Schneier
CNN
January 28, 2011

The Department of Homeland Security is getting rid of the color-coded threat level system. It was introduced after 9/11, and was supposed to tell you how likely a terrorist attack might be. Except that it never did.

Attacks happened more often when the level was yellow ("significant risk") than when it was orange ("high risk"). And the one time it was red ("severe risk"), nothing happened. It's never been blue or green, the two least dangerous levels.

The system has been at yellow for the past four years, and before then the changes seemed more timed to political events than actual terrorist threats. Not that any of this matters. We all ignored the levels because they didn't tell us anything useful.

The problem is that the color-coded threat levels were vague and long-term, and didn't correspond to useful actions people can take. Compare the color-coded threat levels with the U.S. military's DEFCON system. At each DEFCON level, there are specific actions people have to take: The real details of those actions are secret, but at DEFCON 3 -- I'm making this up -- you might call everyone back from leave, at another you fuel all the bombers, at another you arm the bombs, and so on.

Knowing the current DEFCON level is important for those in the military, because it dictates what actions you should be taking. What am I supposed to do when the terrorist threat level is yellow? Or orange? I have no idea.

And no one else did, either. Were there plane trips you delayed when the level was orange that you made when it was yellow? Did any company base business decisions on it? Do we think the president consulted the level every morning?

Consider hurricane warnings. Hurricanes are short-term events, and it's obvious when the danger is imminent and when it's over.

People can do useful things in response to a hurricane warning -- board up their windows, stay in the basement, evacuate -- and there is a discrete period when their lives are markedly different; there is utility in the higher alert mode, even if nothing comes of it.

Compare people's reactions to hurricane threats with their reactions to earthquake threats.

According to scientists, California could experience a huge earthquake sometime in the next 200 years. Even though the magnitude of the disaster will be enormous, people can't stay alert for two centuries.

The news seems to have generated the same levels of short-term fear and long-term apathy in Californians that the terrorist threat level system does. It's human nature; people simply can't be vigilant indefinitely, and if a stimulus is constant, people learn to ignore it.

Any alert system that instills a vague feeling of dread or panic, without giving people anything to do in response, is ineffective. And a terrorist threat level that warns of a "significant risk of terrorist attacks" -- that's what yellow is -- for years is ignored.

The DHS could have lowered the level to something more reasonable, but that would have been politically impossible. If there were a terrorist attack and the threat level had been blue or green, the DHS would have been blamed for not warning us. Keeping the level high might increase the general dread among some people and cause sniggering among others, but it helps protect the jobs of those charged with keeping us safe from terrorism.

So good riddance to the color-coded terrorist alert system, that relic of our immediate post-9/11 panic. It never did serve any security purpose. And it will be much easier for us to accept that we are, and have been for a while, at a "low risk of terrorist attacks" -- threat level green -- when no politician has to risk his job by formally admitting it.

earlier essay: Schneier-Ranum Face-Off on Whitelisting and Blacklisting
later essay: Detecting Cheaters
categories: National Security Policy, Terrorism
back to Essays and Op Eds

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..