The bomber who shut down Times Square last December reportedly found instructions online and read Inspire, al-Qaida’s digital magazine. One of the men who opened fire on a free-speech event three years ago in Texas had been in contact with terrorists abroad using Twitter and Surespot, an encrypted messaging application.

Terrorist groups are thriving online — recruiting followers, disseminating propaganda, planning attacks. While lawmakers are looking at the dangers that lurk on the internet, from Russian interference to Facebook data scrapes, they should be paying more attention to countering terrorism in the digital realm.

“Today, we face a serious and persistent terror threat that, according to my assessment, will not diminish anytime soon,” Homeland Security Secretary Kirstjen Nielsen said before the Senate Judiciary Committee in January. “Changes in technology have made it easier for adversaries to plot attacks in general, to inspire and radicalize new followers, and to recruit beyond borders.”

If anything, she undersold the risks. Social media allows terrorist groups to reach followers instantly, at little to no cost, anywhere in the world. And encrypted messaging applications provide virtually unbreakable cryptography for private communications.

Widespread terrorist propaganda means that, even in the absence of direct contact between terrorist groups and would-be recruits, individuals can still be inspired to carry out deadly attacks.

Watch: Zuckerberg Says His Own Data Was Breached

There are no easy answers. But a recent Bipartisan Policy Center report outlines steps that would help address this threat.

Any intervention to deal with terrorism could have a ripple effect. Compelling tech companies to remove content or prohibiting citizens from encoding their messages to protect them from surveillance could run afoul of constitutionally protected rights to free speech and privacy. And forcing companies to redesign their products to facilitate law enforcement and intelligence activities could drive users away.

That’s why policymakers must think creatively to empower counterterrorism officials. Rather than try to completely cut off terrorists’ ability to operate online, we should aim to mount a “layered” defense. As the 9/11 Commission explained in the context of transportation security, a “layered security system” recognizes that “no single security system is foolproof.” Instead, the various layers must support one another.

Such an approach would seek to make each stage at which terrorists exploit the digital realm less hospitable to their operations. For example, it would become increasingly difficult for terrorist groups to post and repost content, for vulnerable individuals to conduct searches and view extremist content, and for terrorists to attract recruits.

We should move forward now with measures that can help law enforcement and counterterrorism officials. On encryption, short of making companies decrypt upon demand, Congress could devote resources to government agencies for “lawful hacking” of terrorist devices and for work on legal mechanisms to access and analyze cloud backups and communications metadata.

While the current political environment is not hospitable to legislative action on encryption, policymakers can develop options now for future legislative action should the environment improve.

In the meantime, leading technology companies are bringing their skills to the challenge of uprooting terrorists’ presence on social media. One promising tool, pioneered by Google’s Jigsaw ideas lab, redirects viewers away from radicalizing material and toward user-created, deradicalizing content that similar people have found persuasive.

Voluntary efforts by social media companies to suspend accounts and remove extremist messages have helped check the spread of propaganda. These types of actions remain the most promising avenue for progress against terrorist messages on social media. With new artificial intelligence and machine-learning tools, social media platforms can now take down previously identified terrorist content much faster than human moderators.

Since government can’t do everything, it has to work cooperatively. That means encouraging companies to direct more resources toward removing extremist messages, developing new automated tools and sharing those technologies across the industry. It also means providing the greatest possible transparency about those efforts’ effectiveness.

While policymakers can and should give counterterrorism professionals more tools, social media and encrypted communications are but one channel through which violent extremists transmit their ideas.

In other words, the layers don’t end there. To prevail against terrorism in the longer term, we must embed our digital counterterrorism policies in a larger strategy that seeks to discredit extremist ideologies.