Governments use specialist powers, people and resources to prevent threats, detect incidents, respond and support recovery.
Domestic measures are actions within a country. A public agency coordinates transport operators, emergency services and security specialists during an incident. Their combined response can protect passengers and restore services in ways an individual traveller cannot.
For terrorism, domestic measures can include investigating credible threats, border and site security, lawful action against dangerous conduct, and public preparedness. Rehabilitation supports people in moving away from extremist violence, and community support can help that process. Border checks alone cannot stop an influence that reaches a local person online.
For cyber threats, governments can set security requirements, develop specialist response teams, raise awareness and coordinate protection of essential systems. Prevention and detection need recovery plans and tested backups, because no defence removes every risk. A backup is a saved copy used to restore data or a system. Testing it in a drill, or practice exercise, can show whether recovery works under those conditions. Restoring an organisation's own copy does not delete information already copied elsewhere.
Measures require funding, skilled staff and coordination. Checks can create delays, while monitoring and information collection raise questions about privacy, fair treatment and oversight: checks on how powers are used. Judge whether measures address the threat and what evidence shows their effects; an announcement, arrest or quiet period alone does not prove that all risk has ended.
Worked example: Preparing a public service to recover
A government agency requires public service operators to maintain recovery plans and brings their staff together for an exercise. One operator restores a test system successfully; another finds that its backup cannot be used and repairs it. The exercise takes staff time and public funding.
- The requirement and coordinated exercise use government authority and resources to improve domestic preparedness.
- The failed backup identifies a weakness that might otherwise remain unnoticed. Repairing it is a useful response to the finding.
- The successful test is evidence about that system under the exercise conditions. It is not proof that every future incident will be handled without disruption.
- Staff time and funding are costs. Further checks should examine whether identified weaknesses stay fixed and recovery works when needed.
Watch out for this
More security reports always mean that the country's security measures have failed.
Reports can increase because more threats occur, because people notice and report more, or both. Check the quality of detection, the action taken and actual harms before judging effectiveness.
Check your understanding
After a public awareness campaign, an agency receives more reports of suspicious messages. No other evidence is given. What is the most defensible conclusion?
- The increase could reflect better reporting, more suspicious activity or both; the count alone cannot settle effectiveness.
- The campaign definitely caused more cyberattacks.
- All cyber threats have been removed because people are reporting them.