When Terrorism Risk Is ‘Above 50%’, What Does a National Threat Level Require—and of Whom?

Geoffrey Chen

When Numbers Start Making Decisions · Season Five, “Things That Have Not Happened Yet” · Article 11

1. PROBABLE does not mean an attack is imminent

On 5 August 2024, the Australian Security Intelligence Organisation raised the National Terrorism Threat Level from POSSIBLE to PROBABLE. The published definition is a greater than 50% chance of an onshore attack or attack planning in the next twelve months. ASIO: National Terrorism Threat Level

ASIO also stated that it did not have intelligence about a current plan and was not predicting an imminent attack. As of August 2026, the Australian Government’s current public page still records PROBABLE. Australian National Security: Current National Terrorism Threat Level

“Above 50%” can easily be heard as a claim that every person faces a greater-than-even chance of terrorism, or that a particular attack is more likely than not. The real proposition concerns a national area, a twelve-month period and the combined event “attack or attack planning”. It is not an individual probability, a place forecast or the chance that a successful attack will occur.

The number is a strategic warning tool. Its authority is determined by how it enters intelligence, policing, protective security and public behaviour.

2. Fifty per cent is not a directly counted frequency

Weather and flood analysis can draw on repeated measurements. National security deals with rare, adaptive events produced by opponents who conceal their actions. ASIO’s National Threat Assessment Centre integrates intelligence and uses structured analytical techniques to test and contest assumptions.

The probability is therefore not calculated from hundreds of directly comparable annual trials. It is an assessment formed from intelligence, intent, capability, social conditions, investigation and professional judgement. Much of the underlying material cannot be published without endangering sources or operations.

Secrecy can be justified while creating a review problem. The public cannot reproduce the calculation, and oversight bodies can inspect it only in protected settings. Authority must come from a constrained analytical procedure, a defined time period and an accountable institution—not merely from an unverifiable percentage.

The risk is also changed by action. More investigation can reveal more planning and make the visible risk rise. Disruption can cause the attack never to occur. Opponents adapt when protective measures change. Security probability is formed within strategic interaction, not passively observed in nature.

3. What does the level actually trigger?

The national level provides a common picture for government, critical infrastructure, police, business and the public. It can prompt organisations to review security plans, staffing, access controls, training and information sharing and to use official crowded-places guidance.

It should not automatically cancel an event, investigate an individual or impose restrictions on a community. Those actions need location, target information, specific intelligence and legal authority. A school, venue or employer that connects PROBABLE to a measure must still show that the response is proportionate to its own circumstances.

Official advice asks the public to remain aware, report concerning behaviour and understand responses such as Escape. Hide. Tell. It does not ask people to abandon ordinary life. A warning that keeps society in permanent, undifferentiated fear can damage trust and social cohesion, which themselves shape the security environment.

The level should calibrate preparation rather than manufacture a continuous state of emergency.

4. “Above 50%” is still a coarse description

A level can remain stable while the assessment within it rises. Moving above PROBABLE to EXPECTED would usually imply more specific and immediate intelligence conditions. PROBABLE may therefore contain a wide range of risk temperature and trend.

Replacing 50% with a more precise percentage would not solve the problem. Security analysis also concerns actor, capability, target, preparation time, detectability and consequence. A low-complexity lone-actor event with little warning differs from an organised mass-casualty plan.

Public categories must be simple enough to communicate. That simplicity erases detail. The appropriate supplement is a public narrative about the trends driving the level, what the level does not imply and what different actors should do. ASIO’s explanation in 2024 was important precisely because a label should not speak alone.

The national level also cannot localise risk. It gives a background assessment for Australia, not a comparative ranking of every city, venue or event. Protective-security decisions still need site characteristics, current information and the consequences of disruption. Treating the national category as though it were a local forecast can misallocate resources: a low-profile service may adopt intrusive controls with little benefit while a genuinely exposed site relies on the same generic checklist. Shared language is useful only when it leaves room for more specific assessment.

5. Both directions of error matter

Underestimating threat can leave institutions unprepared for irreversible harm. Overestimating it can sustain costly measures, infringe rights, stigmatise groups and cause warning fatigue. Both errors are real.

A false alarm is difficult to identify after the fact. If a plot is abandoned because protection increased, does the absence of attack show overestimation or successful prevention? If investigation discovers more planning, does higher assessed risk show a worse environment or better visibility? Counting attacks alone would punish effective prevention.

Internal assessment should therefore retain disrupted activity, changes in intent and capability, confidence across scenarios, action costs and unintended effects. The public may receive one level; analysts cannot allow that level to replace the analysis.

Distribution must also be audited. Suspicious-behaviour reporting and searches may fall disproportionately on religious, ethnic or political communities. A national probability cannot lower the evidence standard for coercion against one person. Individual measures require specific facts, law and independent oversight.

6. Review, duration and exit conditions

“Next twelve months” requires continuous reassessment rather than permanent renewal. ASIO should raise or lower the level as evidence changes and publish as much non-classified reasoning as possible. A long period without change also deserves periodic explanation.

Intelligence oversight, Parliament and courts review different elements: analytical process and powers, policy and resources, and legal measures against individuals. The impossibility of publishing all intelligence does not remove external constraint.

Every special measure introduced because of the level also needs its own exit. Additional screening, deployment or data collection should not continue indefinitely merely because the national label remains PROBABLE. Each requires a purpose, review date and end condition.

If measures cause wrongful detention, discrimination or misuse of data, remedies must reach the affected person. A probability can explain preparation; it cannot erase rights.

7. The threat level participates in the future it describes

Threat forms among intent, social conflict, online communication, intelligence visibility, policing and public response. Publishing the level changes resources, protection and adversary behaviour. It does not simply reproduce an external object in a word.

No analyst knows every plot, but the institution must create an actionable assessment. That creates the possibility of authority without public understanding. The answer is not pretending secrecy can disappear. It is attaching the authority to a named body, limited purpose, time window and oversight.

The official who exercises force must still state legal authority and reasons. Pointing only to PROBABLE is not enough.

Conclusion: a national level can raise preparation, not lower individual proof

Australia should retain a public National Terrorism Threat Level. PROBABLE, properly defined as national, twelve-month, attack-or-planning risk above 50%, supplies a necessary common assessment.

The level should remain accompanied by non-classified narrative, trends and practical advice and be periodically reviewed. It can raise institutional preparation and attention. It cannot automatically authorise coercion against a person or group; those actions require independent legal thresholds and scrutiny.

Above 50% does not make the future known. It asks the state to prepare more seriously and to constrain itself more seriously: not to project collective probability onto individuals and not to convert a temporary warning into power without an exit.

Primary sources

Discover more from Geoffrey Chen

Subscribe to get the latest posts sent to your email.