In the wake of the tragic shootings in Paris in January, French police and intelligence agencies were asked to explain why known militants – including one who had visited an al-Qaeda affiliate in Yemen several years ago – were not subject to intense surveillance before they launched a terrorist attack at the offices of a French satirical weekly. The answer is fairly simple, if less than satisfying: it costs a lot of money to do so.

A perhaps somewhat high estimate is that the full-scale surveillance of an individual for a year costs about $A8 million. The costs of watching even 125 people in that way would add up to $A1 billion – a sum that is fully one-third of the FBI counterterrorism budget and exceeds the counterterrorism budgets of the AFP and ASIO. To put that situation in some context, French police believed that, among prisoners alone, 200 would "merit attention" and 95 would be "dangerous" once released.

Nor is malpractice evident in the fact that the surveillance of some terrorist suspects is relaxed over time. Very often, would-be terrorists lose their enthusiasm for the enterprise. As terrorism specialist Professor John Horgan has pointed out, walking away from terrorism is a common phenomenon. It is not that they necessarily abandon their radical views, but that they abandon violence as a means of expressing them.

Policing agencies must therefore pick and choose carefully. At any one time, there could easily be thousands of plausible candidates for scrutiny, and many of them may well seem to be more threatening those who actually committed terrorist mayhem in Paris. Under the influence of what might be called "the 9/11 Commission syndrome", in which all terrorism leads are supposed to be followed up on, government agencies chase more than 5000 "threats" in the United States every day. The vast majority of this activity leads, of course, to nothing, and the massive enterprise is often called "ghost chasing" in the FBI, an agency that may have pursued well over 10 million leads since 2001. The enterprise leads to only a very small number of productive investigations – there are only 100 or so arrests on terrorism charges in the US each year, and most of these are of would-be terrorists who are either trivial or at most aspirational. In addition, there will be a considerable number – thousands or even tens of thousands – who are deemed suspicious enough to watch. At that point, budgetary considerations must necessarily come into play. Investigators can afford to give only a few the full surveillance treatment.

When something like the French tragedy happens, policing and intelligence agencies are urged to work even harder to ferret out potential terrorists amid us – in other words, to heap even more hay onto the haystack. That is certainly an understandable reaction, but it almost never comes associated with even the barest elements of a rounded analysis. This should begin not with the perennial question: "Are we safer?" but rather with one almost never asked: "How safe are we?"

On average, one or two people have perished per year since 2001 at the hands of Islamist terrorists in the US and in France, less than that in Canada and Australia, and a bit more in Britain. Under present circumstances, then, the annual likelihood a citizen in those countries will be killed by a terrorist is one in millions. In Australia, it is less than one in eight million even when the Bali attacks are factored into the calculation. Whatever the fears of police and security services, terrorism, looked at rather coldly, has not resulted in many deaths.

The question then becomes, as risk analyst Howard Kunreuther put it shortly after the September 11 attacks: "How much should we be willing to pay for a small reduction in probabilities that are already extremely low?"

In seeking to answer that key question, it should be kept in mind that terrorism often exacts considerable political, economic, emotional and psychic damage that might not be inflicted by other hazards, natural and unnatural. Moreover, it is worth considering that terrorism in the developed world might suddenly increase in frequency and intensity. However, this would be a sharp reversal of current patterns, and the terrorist surge would have to be massive to change the basic calculus.

Standard risk-analytic techniques have long been developed to deal with issues like this in a clear, understandable and systematic manner, supplying decision-makers with a coherent perspective on the relevant parameters and how they interact. Our risk and cost-benefit analyses have shown air marshals to be a waste of money, full-body scanners to be marginal at best, hardened cockpit doors to be extremely cost-effective, and hardening of most buildings and bridges becomes cost-effective only if the threat level is exceedingly high.

Applied here, risk-analytic techniques suggest that, for the FBI's counterterrorism budget to be justified, its efforts would need to deter, disrupt or protect against six major car bombings a year, or more than one attack like the one against the London transport system in 2005 every two years. The question then becomes: is it likely to have done so?

Whatever in the end is decided about the value of the FBI's counterterrorism efforts, they are certainly far closer to being cost-effective than many other security measures. The yearly cost for the US Transport Security Administration's Federal Air Marshal Service is about $US1.2 billion and so is the cost of its body scanner technology. Together, these aviation security measures are nearly as costly as the FBI's counterterrorism efforts, but their risk reduction is negligible. Moreover, they only deal with specific threats associated with hijacking and body-borne bombs on aircraft. If this is the comparison, the FBI expenditures look pretty good: they deal with all terrorism threats, almost certainly do reduce the terrorism threat, and can be rapidly deployed or redeployed as threats emerge or evolve.

As with crime, perfect safety is impossible, a rather obvious point that is nonetheless often neglected. Funds directed at a hazard that kills few might sometimes be more productively directed at one that kills many.

Professor Mark Stewart is a civil engineer and risk analyst at the University of Newcastle. Professor John Mueller is a political scientist at Ohio State University and a senior fellow at the Cato Institute. They wrote Terror, Security, and Money: Balancing the Risks, Benefits, and Costs of Homeland Security and the forthcoming Chasing Ghosts: The Costly Quest to Counter Terrorists in the United States.