A January 2017 Pew survey showed that Americans rate terrorism as the top priority for the Trump administration and Congress. They put the issue ahead of the economy, education, jobs and health care costs.

For the past 12 years as Director of the National Consortium for the Study of Terrorism and Responses to Terrorism, I have worked with colleagues to improve understanding of terrorism by studying its causes and consequences. One of our largest and most extensive projects has involved compiling all terrorist attacks worldwide since 1970 into the Global Terrorism Database (GTD).

Based on this work, six issues stand out to me as major challenges for developing effective policy on countering terrorism.

#1: Terrorism is rare

For most places and times, terrorism is an incredibly rare event.

In many recent years, the United States has experienced fewer than 25 terrorist attacks. At the same time, there are about 13,000 homicides and 360,000 robberies every year in the United States. In recent years, worldwide traffic accidents have claimed the lives of roughly 100 times more people than those killed by terrorists.

Even important groups like al-Qaida have committed relatively few attacks. The GTD shows al-Qaida has been responsible for only 59 attacks over its entire lifespan and only five attacks since 2008. The fact that terrorism is so rare means that we have limited ability to do statistical analysis and reach general policy conclusions.

#2: Mass attacks are rarer still

While terrorism is rare, mass casualty attacks are even rarer.

Over half of all terrorist attacks in the GTD since 1970 included no fatalities. The GTD identifies only 17 attacks from around the world that claimed more than 300 lives. Of the more than 156,000 terrorist attacks in the GTD, the coordinated attack of 9/11, which took the lives of nearly 3,000 people, is still the deadliest attack in modern history.

Apart from 9/11 no attack on the U.S. homeland in half a century has claimed the lives of more than 200 people. The closest was the 168 victims of the Oklahoma City bombing in 1995, orchestrated by Timothy McVeigh.

Because a few deadly but highly unusual attacks attract so much concern, terrorism policies tend to be based on extremely rare and unusual events rather than the thousands of more common but less spectacular ones. In my opinion, policies based on extreme outliers can have serious and perhaps unforeseen implications.

#3. Prevention is improving

A growing number of terrorist attacks — especially in the United States and Western Europe — are being foiled as plots. This is obviously good news in terms of protecting citizens and saving lives. Another consequence is that policymakers have diminishing information on the actual seriousness of threats because the attackers are being stopped before their plans are actualized.

#4. Terrorist groups are not all alike

Terrorist organizations are extremely diverse which makes generalizations even more difficult.

When most people think of terrorist groups an image comes to mind of some well-organized and highly-publicized entity like the Islamic State or al Shabaab. In reality, it’s hard to generalize about terrorist groups. On one extreme are individuals who have no recognized links to a terrorist organization — so-called lone wolves. On the other end of the spectrum are highly organized groups that persist over time, have a well-defined chain of command and a stable leadership. In between are loosely connected small groups as well as shadowy networks — for example, Neo Nazis or radical Islamists. All of these disparate entities are typically in a state of flux. Change is constant; stability rare.

Of the more than 2,300 unique terrorist organizations identified in the GTD since 1970, nearly 70 percent had a life span of less than a year. Terrorist organizations are a bit like business startups: Most are gone within the first year of operation. It is one thing to respond to a well-organized group, with clear leadership, a chain of command and an identifiable membership. But responses are much more complicated when there is no central organization, no identifiable leader or only an ill-defined group of individuals with varying connections and commitments undergoing constant change.

#5. Assigning responsibility is tough

Attributing responsibility for a terrorist attack is often ambiguous or impossible.

Data from the GTD shows that no terrorist group can be assigned responsibility in nearly 60 percent of the thousands of attacks that occurred worldwide since 1970. Attacks may be launched by loners who are working more or less independently of any specific group. In other cases, more than one group may claim the attack. Or a group may claim responsibility when in reality it had no connection to the attack, or a group may claim incorrectly that another group was accountable.

Analysts may simply never have enough information to reach a conclusion or to distinguish between competing accounts. Following a terrorist attack, governments are under enormous pressure to identify the guilty party and offer a swift response. But how can officials punish wrongdoers and deter others from engaging in terrorist attacks when they never know for sure who the culprit is?

#6: We’re still developing strategy

Finally, while researchers are making great progress in developing a framework for the scientific study of terrorism, the study of counter terrorism is still in its infancy. While it is difficult to get an accurate grasp of terrorist threats, it is even harder to evaluate the strategies used by governments to counter terrorism. Governments are extremely secretive about their counter terrorism policies and strategies. And certainly there is nothing close to a worldwide database on counter terrorism strategies and their effectiveness.

Making better policy

The terrorist threat in the United States is episodic, sporadic and inconsistent. Too often policies react to fear rather than real threat estimates. For example, there is no empirical evidence to support President Trump’s recent decision to ban citizens of six majority-Muslim countries from travel to the U.S. in the name of preventing terrorist infiltration. Trump’s executive order of March 2017 would halt travel from Iran, Libya, Somalia, Syria and Yemen. But no one from these countries has been involved in a fatal terrorist attack in the United States since 9/11.

What’s more, these policies are hard to undo. For example, the USA Patriot Act, passed in the chaotic aftermath of 9/11, was designed to “deter and punish terrorist acts,” but was quickly expanded by law enforcement officials to prosecute drug offenses and other non-terrorist crimes. Such an expansion raises concerns about privacy and the power of the federal government.