A counter-terrorism system has to succeed before, during and after an attack.
Before an attack, the job is to identify threats early, reduce opportunities for harm and make communities harder to destabilise. During an attack, the priority shifts to saving life, stopping ongoing danger, restoring command and giving the public clear instructions. Afterward, the task changes again: investigate, support victims, restore essential functions, prevent communal fracture and learn enough from the event to improve the next response.
Singapore therefore does not treat counter-terrorism as the responsibility of one agency. Intelligence, policing, emergency medical response, firefighting and rescue, border control, protective security, communications, community preparedness and recovery sit in different institutional lanes. The Home Team framework, SGSecure movement and wider Whole-of-Government system connect those lanes when the threat crosses them.
Quick answer: what are the four major layers?
- Intelligence and prevention: detect radicalisation, hostile networks, foreign-linked threats and emerging attack preparation early enough for lawful intervention.
- Protection and preparedness: strengthen buildings, events, transport nodes, public awareness and institutional readiness so an attack is harder to carry out and less damaging if attempted.
- Response: stop immediate danger, rescue casualties, provide emergency medical care, secure the scene, communicate with the public and coordinate agencies.
- Recovery: support victims, restore services, investigate, counter rumours, preserve social cohesion and improve future preparedness.
The important design principle is that the system changes mode as the threat changes. Intelligence should not try to become ambulance dispatch. Emergency responders should not become intelligence agencies. Each part works best when its own job is clear and the handoffs are rehearsed.
1. Intelligence works upstream of the visible emergency
Singapore’s Internal Security Department publicly identifies terrorism and violent extremism as one of the threats to the country’s internal stability and sovereignty.
The intelligence problem is future-oriented. A person may not yet have carried out an attack but may be moving through a dangerous trajectory: radicalisation, contact with extremist material or networks, target selection, acquisition of capability or preparation for violence.
Preventive security exists because waiting for a completed attack would make intelligence strategically useless. The public-facing legal route can include investigation, preventive measures under the Internal Security Act where the statutory conditions are met, or ordinary criminal processes where offences have been committed.
2. Prevention is not the same thing as prediction
No intelligence system can know every future attack with certainty. Threat assessment works with incomplete information, competing explanations and changing intent.
The goal is therefore not perfect prediction. It is reducing the probability that a dangerous trajectory can proceed unnoticed until the final moment.
This distinction matters because a strong security system must act on credible risk without pretending uncertainty has disappeared.
3. Protective security tries to make attractive targets harder to exploit
Counter-terrorism is not only about identifying attackers. It is also about how buildings, events, infrastructure and organisations prepare for a hostile act.
Protective security can include access control, emergency procedures, trained staff, evacuation planning, communications, physical-security design and the ability to recognise suspicious activity early.
The public value is resilience rather than invulnerability. No building can be made immune to every threat. A good protection system reduces easy opportunities, speeds recognition and limits consequences.
4. Event security is a coordination problem before it becomes a response problem
Large gatherings concentrate people, movement and attention. Organisers therefore need to understand not only the programme but the operating environment: entrances, exits, crowd flow, emergency access, communications and escalation routes.
Police permit and major-event notification frameworks are part of the wider safety architecture because they give authorities advance visibility of events that may require public-order or security coordination.
The best emergency response begins with design choices made before the first participant arrives.
5. SGSecure gives the public a defined role without turning citizens into security officers
SGSecure is Singapore’s community response to terrorism. MHA’s current 2026 description frames the movement around three core actions: Stay Alert, Stay United, Stay Strong.
That division is deliberate. Staying alert supports prevention and personal safety. Staying united protects social cohesion during and after an attack. Staying strong concerns the ability of the community to recover rather than remain psychologically fractured by fear.
The public role is observation, preparedness, first response within personal capability and social resilience. Coercive powers, intelligence assessment and tactical response remain with trained authorities.
6. The 2026 SGSecure campaign shifts from awareness toward action
MHA launched the 2026 SGSecure campaign, “Play Your Role”, in March 2026. The stated aim is to move beyond simple awareness and encourage people to acquire practical knowledge and skills that help them respond appropriately to terrorism-related emergencies.
This reflects a mature preparedness model. Awareness without action can still leave people frozen during a crisis. Action without clear guidance can create additional danger.
Preparedness therefore means knowing a small number of correct actions well enough to use them under stress.
7. Run, Hide, Tell gives the public a simple response hierarchy
SGSecure’s current advice for a firearms or weapons attack uses the public guidance “Run, Hide, Tell”.
The logic is intentionally simple. Move away from danger if a safe route exists. If escape is not possible, hide and reduce exposure. Inform authorities when it is safe to do so and provide useful factual information.
This is not tactical training. It is civilian survival guidance designed for people who may have seconds to make a decision.
8. Emergency medical response begins while the threat picture is still changing
A terrorism incident can create penetrating trauma, blast injuries, burns, smoke exposure, panic-related medical emergencies and large numbers of casualties.
SCDF’s emergency medical and rescue role therefore becomes central as soon as responders can operate safely. Police and security agencies address the ongoing threat and scene security; SCDF performs rescue, firefighting and emergency medical care within the coordinated response.
One scene can therefore contain several command problems at once: stop the threat, save life, move casualties, protect responders and preserve enough order for the system to function.
9. Public warning has to reach people who are not watching the same channel
During a major emergency, some people will be outdoors, some underground, some at work, some asleep and some visiting Singapore. A single communications channel cannot reach everyone reliably.
Singapore therefore uses layered public communications: the Public Warning System, free-to-air radio and television, official social-media channels, SGSecure and the emerging SG Alert cell-broadcast system.
Redundancy is deliberate. Emergency communications should survive individual channel failure, congestion or lack of attention.
10. SG Alert adds a location-aware mass emergency channel
SCDF’s 2026 SG Alert system uses cell broadcast to send emergency messages to compatible mobile phones in Singapore without requiring users to download an application or use mobile data.
The system is designed for emergencies such as major fires, chemical or terror incidents and can send an alert island-wide or to a specified geographic area. Messages are intended to tell people what happened, which locations are affected and what protective action to take.
The operational gain is speed and reach. A warning becomes useful only when it arrives before the recipient’s next unsafe decision.
11. Rumour control is part of crisis response
Terrorism is designed to create effects beyond the immediate physical attack. Rumours, manipulated images, false casualty numbers and communal blame can expand fear faster than verified information.
SGSecure’s public advice therefore tells people not to speculate or spread rumours. Official communications need to update the public quickly enough to remain credible while still preserving accuracy and operational security.
Information discipline is part of resilience because panic can become a second emergency.
12. Social cohesion is a security capability after an attack
An ideologically motivated attack can be intended to provoke retaliation, suspicion or communal division.
This is why “Stay United” is not soft language appended after the operational response. Preventing communities from turning on one another reduces the attacker’s strategic effect.
Interfaith networks, community leaders, schools, workplaces and public institutions all become part of the recovery architecture when trust is under pressure.
13. Recovery begins before the incident is fully over
Even while emergency teams are still operating, other parts of Government may already be planning hospital capacity, family information, transport diversions, business continuity, public communications and psychosocial support.
This overlap is necessary because recovery cannot wait until every investigative question is resolved.
A city needs to restore safe movement, essential services and public confidence while the criminal and security investigation continues separately.
14. Investigation and recovery run on different clocks
An attack scene can remain important evidence long after ordinary life needs to resume nearby.
Police and security investigators need to preserve evidence, identify offenders and reconstruct the event. Transport agencies, building managers and businesses need to restore safe operations.
The system therefore has to create controlled handoffs: preserve what must remain evidence while releasing areas and services that can safely return to use.
15. Hospitals receive a casualty flow, not one isolated patient
A mass-casualty incident can place several emergency departments under pressure at once. Ambulance distribution, hospital capacity and triage therefore become network problems rather than a simple question of taking every casualty to the nearest hospital.
Emergency medical coordination seeks to distribute patients according to urgency, capability and available capacity while maintaining care for ordinary emergencies occurring elsewhere.
The healthcare system has to absorb the shock without allowing one incident to disable all routine emergency care.
16. Exercises are how coordination is tested before lives depend on it
Multi-agency exercises allow organisations to test communications, command, evacuation, emergency medical response, public information and infrastructure resilience without waiting for a real attack.
The important output is not a perfect scripted performance. It is the discovery of broken handoffs, unclear ownership, missing information and unrealistic assumptions while there is still time to fix them.
Preparedness improves when exercises generate changes, not merely photographs.
17. A worked example: attack at a crowded public venue
Imagine a serious attack begins at a crowded venue.
Members of the public move away from danger or shelter appropriately and report useful information. Police respond to the immediate threat and secure the area. SCDF treats and evacuates casualties when safe to do so. Command centres build a common picture. Public alerts may direct people away from affected areas. Hospitals prepare for casualty arrival. Transport and venue operators implement emergency procedures.
Once immediate danger is contained, the investigative, recovery and community-cohesion layers continue. The incident changes mode; the national response does not simply stop.
18. A worked example: credible plot disrupted before attack
Now imagine authorities identify a credible dangerous trajectory before an attack occurs.
The immediate objective may be preventive intervention rather than emergency casualty response. Security agencies assess the threat and act through lawful preventive or criminal routes as appropriate. Protective security at possible targets may be adjusted. Community messaging may or may not be needed depending on the public risk.
The best counter-terrorism success can therefore be almost invisible: the emergency never becomes visible because the threat was stopped upstream.
19. Common misconceptions
Misconception: Counter-terrorism is only an ISD job.
No. intelligence is one layer; Police, SCDF, border agencies, public institutions, operators and communities have different responsibilities.
Misconception: Preparedness means predicting the exact attack.
No. preparedness builds systems that remain useful across several plausible emergencies.
Misconception: Community readiness means citizens should confront suspected terrorists.
No. the public role is vigilance, safe action, reporting and appropriate first response—not replacing trained security personnel.
Misconception: Recovery begins only after every investigation ends.
No. recovery and investigation often run concurrently with carefully controlled boundaries.
Misconception: Social cohesion is unrelated to security.
No. preventing fear and communal retaliation from spreading can deny terrorism one of its intended effects.
20. The deeper idea: resilience is the ability to change mode without losing the system
A terrorism incident tries to overload ordinary institutions with an extraordinary shock.
Singapore’s preparedness architecture works by giving each institution a clear job and then connecting them across time. Intelligence works before the visible emergency. Protective security reduces vulnerability. Police and SCDF manage the immediate event. Hospitals absorb casualties. Public-warning systems guide behaviour. Communities protect trust. investigators reconstruct the attack. Recovery systems restore ordinary life.
The system succeeds when it can move through those modes without confusion about ownership and without allowing one attack to become a prolonged failure of public confidence.
That is the real meaning of preparedness: not knowing exactly what will happen, but knowing how Singapore will keep functioning when something severe does.