*David L. Banks*

*Professor, Institute of Statistics and Decision Sciences*

*Duke University, Durham, North Carolina*

*Steven Anderson*

*Director, Office of Biostatistics and Epidemiology*

*Center for Biologics Evaluation and Research*

*U.S. Food and Drug Administration, Rockville, Maryland*

*Abstract:* Federal agencies have finite resources. Even for critical purposes related to counterterrorism, resources must be allocated in the most effective ways possible. Statistical risk analysis can help by accounting for uncertainties in the costs and benefits of particular efforts, and game theory can help by accounting for the fact that terrorists adapt their attacks in response to homeland defense initiatives. This paper describes a procedure that uses risk analysis to generate random payoff matrices for game theory solution, and then pools the solutions from multiple realizations of the payoff matrix to estimate the probability that a given play is optimal with respect to one of several criteria. The strategy is illustrated for risk management in the context of a simplified model of the threat of smallpox attack.

The U.S. government wishes to invest its resources as wisely as possible in defense. Each wasted dollar diverts money that could be used to harden crucial vulnerabilities, prevents investment in future economic growth, and increases taxpayer burden. This is a classic conflict situation; a good strategy for the player with fewer resources is to leverage disproportionate resource investment by its wealthy opponent. That strategy rarely wins, but it makes the conflict sufficiently debilitating that the wealthy opponent may be forced to consider significant compromises.

Game theory is a traditional method for choosing resource investments in conflict situations. The standard approach requires strong assumptions about the availability of mutual information and the rationality of both opponents. Empirical research by many people (e.g., Kahneman and Tversky, 1972) shows that these assumptions fail in practice, leading to the development of modified theories with weaker assumptions or the use of prior probabilities in the spirit of Bayesian decision theory.

This paper considers both traditional game theory (minimax solution for a two-person zero-sum game in normal form) and also a minimum expected loss criterion appropriate for extensive-form games with prior probabilities. However, we emphasize that for terrorism, the zero-sum model is at best an approximation; the valuation of the wins and the losses is likely to differ between the opponents.

Game theory requires numerical measures of payoffs (or losses) that correspond to particular sets of decisions. In practice, those payoffs are rarely known. Statistical risk analysis allows experts to determine reasonable probability distributions for the random payoffs. This paper shows how risk analysis can support game theory solutions, and how Monte Carlo methods provide insight into the optimal game theory solutions in the presence of uncertainty about payoffs.

Our methodology is demonstrated in the context of risk management for a potential terrorist attack using the smallpox virus. The analysis we present here is a simplified version that aims at methodological explanation rather than analysis or justification of specific healthcare policies. As a tabletop exercise, the primary aim is only to provide a blueprint for a more rigorous statistical risk analysis. The underlying assumptions, modeling methods used here, and any results or discussion of the modeling are based on preliminary and unvalidated data and do not represent the opinion of the FDA, the Department of Health and Human Services or any branch of the U.S. government.

NOTE: Reprinted, with permission, from *Statistical Methods in Counterterrorism: Game Theory, Modeling, Syndromic Surveillance, and Biometric Authenticationon*. G. Wilson, and D. Olwell (eds.), Springer, 2006. pp. 9-22.

Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.

Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 103

Appendix F
Combining Game Theory and Risk Analysis in
Counterterrorism: A Smallpox Example
David L. Banks
Professor, Institute of Statistics and Decision Sciences
Duke University, Durham, North Carolina
Steven Anderson
Director, Office of Biostatistics and Epidemiology
Center for Biologics Evaluation and Research
U.S. Food and Drug Administration, Rockville, Maryland
Abstract: Federal agencies have finite resources. Even for requires strong assumptions about the availability of mutual
critical purposes related to counterterrorism, resources must information and the rationality of both opponents. Empiri-
be allocated in the most effective ways possible. Statistical cal research by many people (e.g., Kahneman and Tversky,
risk analysis can help by accounting for uncertainties in the 1972) shows that these assumptions fail in practice, leading
costs and benefits of particular efforts, and game theory can to the development of modified theories with weaker as-
help by accounting for the fact that terrorists adapt their sumptions or the use of prior probabilities in the spirit of
attacks in response to homeland defense initiatives. This Bayesian decision theory.
paper describes a procedure that uses risk analysis to gener- This paper considers both traditional game theory (mini-
ate random payoff matrices for game theory solution, and max solution for a two-person zero-sum game in normal
then pools the solutions from multiple realizations of the form) and also a minimum expected loss criterion appropri-
payoff matrix to estimate the probability that a given play is ate for extensive-form games with prior probabilities. How-
optimal with respect to one of several criteria. The strategy is ever, we emphasize that for terrorism, the zero-sum model is
illustrated for risk management in the context of a simplified at best an approximation; the valuation of the wins and the
model of the threat of smallpox attack. losses is likely to differ between the opponents.
Game theory requires numerical measures of payoffs
(or losses) that correspond to particular sets of decisions.
1. INTRODUCTION
In practice, those payoffs are rarely known. Statistical risk
The U.S. government wishes to invest its resources as analysis allows experts to determine reasonable probability
wisely as possible in defense. Each wasted dollar diverts distributions for the random payoffs. This paper shows
money that could be used to harden crucial vulnerabilities, how risk analysis can support game theory solutions, and
prevents investment in future economic growth, and in- how Monte Carlo methods provide insight into the optimal
creases taxpayer burden. This is a classic conflict situation; game theory solutions in the presence of uncertainty about
a good strategy for the player with fewer resources is to payoffs.
leverage disproportionate resource investment by its wealthy Our methodology is demonstrated in the context of
opponent. That strategy rarely wins, but it makes the conflict risk management for a potential terrorist attack using the
sufficiently debilitating that the wealthy opponent may be smallpox virus. The analysis we present here is a simpli-
forced to consider significant compromises. fied version that aims at methodological explanation rather
Game theory is a traditional method for choosing resource than analysis or justification of specific healthcare policies.
investments in conflict situations. The standard approach As a tabletop exercise, the primary aim is only to provide
a blueprint for a more rigorous statistical risk analysis.
The underlying assumptions, modeling methods used here,
and any results or discussion of the modeling are based on
NOTE: Reprinted, with permission, from Statistical Methods in Coun-
preliminary and unvalidated data and do not represent the
terterrorism: Game Theory, Modeling, Syndromic Sureillance, and Bio-
opinion of the FDA, the Department of Health and Human
metric Authenticationon. G. Wilson, and D. Olwell (eds.), Springer, 2006.
Services or any branch of the U.S. government.
pp. 9-22.
0

OCR for page 103

0 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT
2. GAME THEORY FOR SMALLPOX already entailed) may be known, but the total cost in each
cell is a random variable. These random variables are not
The smallpox debate in the United States has focused
independent, since components of the total cost are common
upon three kinds of attack and four kinds of defense. The
to multiple cells. Thus it is appropriate to regard the entire
three attack scenarios suppose that there might be:
game theory table as a multivariate random variable whose
joint distribution is required for a satisfactory analysis that
• no smallpox attack
propagates uncertainty in the costs through to uncertainty
• a lone terrorist attack on a small area (similar to the
about best play.
likely scenario for the anthrax letters)
Classical game theory (cf. Myerson 1991, Chapter 3)
• a coordinated terrorist attack upon multiple population
determines the optimal strategies for the antagonists via the
centers.
minimax theorem. This theorem asserts that for any two-
person cost matrix in a strictly competitive game (which
The four defense scenarios that have been publicly con-
is the situation for our example), there is an equilibrium
sidered by United States agency officials are:
strategy such that neither player can improve their expected
payoff by adopting a different attack or defense. This equilib-
• stockpile smallpox vaccine
rium strategy may be a pure strategy, in which case optimal
• stockpile vaccine and develop biosurveillance capabilities
play is a specific attack-defense pair. This happens when the
• stockpile vaccine, develop biosurveillance, and inocu-
attack that maximizes the minimum damage and the defense
late key personnel
that minimizes the maximum damage coincide in the same
• provide mass vaccination to non-immunocompromised
cell. Otherwise, the solution is a mixed strategy, in which
citizens in advance.
case the antagonists pick attacks and defenses according to
a probability distribution that must be calculated from the
Although there are many refinements that can be considered
cost matrix. There may be multiple equilibria that achieve
for both the attack and the defense scenarios, these represent
the same expected payoff, and for large matrices it can be
the possibilities discussed in the public meetings held in May
difficult to solve the game.
and June 2002 (McKenna, 2002).
Alternatively, one can use Bayesian decision theory to
Suppose that analysts used game theory as one tool to
solve the game. Here a player puts a probability distribution
evaluate potential defense strategies. Then the three kinds of
over the actions of the opponent, and then chooses their own
attack and four kinds of defense determine a classic normal-
action so as to minimize the expected cost (cf. Myerson 1991,
form payoff matrix for the game [see Table 1].
Chapter 2). Essentially, one just multiplies the cost in each
The Cij entries are the costs (or payoffs) associated with
row by the corresponding probability, sums these by row, and
each combination of attack and defense, and we have used
picks the defense with the smallest sum. This formulation is
abbreviated row and column labels to identify the defenses
easier to solve, but it requires one to know or approximate
and attacks, respectively, as described before.
the opponent’s probability distribution and it does not take
For each of the 12 attack-defense combinations, there is
full account of the mutual strategic aspects of adversarial
an associated cost. These costs may include dollars, human
games (i.e., the assigned probabilities need not correspond
lives, time, and other resources. For our calculation, all of
to any kind of “if I do this then he’ll do that” reasoning).
these costs are monetized, according to principles detailed
Bayesian methods are often used in extensive-form games,
in Section 3. And the monetized value of a human life is set
where players make their choices over time, conditional on
to $750,000, following the Department of Transportation’s
the actions of their opponent.
human capital model that estimates value from average lost
In developing our analysis of the smallpox example we
productivity (non-market approaches tend to give larger
make two assumptions about time. First, we use only the
values).
information available by June 1, 2002; subsequent informa-
Note that there is very large uncertainty in the Cij values.
tion on the emerging program costs is not included. This
Portions of the cost (e.g., those associated with expenses
keeps the analysis faithful in spirit to the decision problem
actually faced by U.S. government policy makers in the
spring of 2002 (their initial plan was universal vaccination,
TABLE 1 Attack-Defense Cost Matrix but ultimately they chose the third scenario with stockpiling,
biosurveillance, and very limited vaccination of some first
No Attack Single Attack Multiple Attack
responders). Second, all of the estimated cost forecasts run
Stockpile Vaccine C11 C12 C13
to October 1, 2007. The likelihood of changing geopolitical
Biosurveillance C21 C22 C23
Key Personnel C31 C32 C33 circumstances makes it unrealistic to attempt cost estimates
Everyone C41 C42 C43
beyond that fiscal year.

OCR for page 103

0
APPENDIX F
3. RISK ANALYSIS FOR SMALLPOX arise in multiple cells, introducing statistical dependency
among the entries. (That is, if a given random payoff matrix
Statistical risk analysis is used to estimate the probability
assumes an unusually large cost for stockpiling in one cell
of undesirable situations and their associated costs. In the
of the random table, then the same high value should appear
same way that it is used in engineering (e.g., for assessing
in all other cells in which stockpiling occurs.)
nuclear reactor safety; cf. Speed, 1985) or the insurance
industry (e.g., for estimating the financial costs associated
3.1 Cell (1,1): Stockpile Vaccine/No Attack Scenario
with earthquakes in a specific area; cf. Brillinger, 1993), this
paper uses risk analysis to estimate the costs associated with
Consider the problem of trying to estimate the costs
different kinds of smallpox attack/defense combinations.
associated with the (1,1) cell of the payoff matrix, which
Risk analysis involves careful discussions with domain
corresponds to no smallpox attack and the stockpiling of
experts and structured elicitation of their judgments about
vaccine. This estimate involves combining costs with very
probabilities and costs. For smallpox planning, this requires
different levels of uncertainty.
input from physicians, public health experts, mathematical
At the conceptual level, the cost C11 is the sum of four
epidemiologists, economists, emergency response adminis-
terms:
trators, government accountants, and other kinds of experts.
C11 = ETdry + ETAvent + ETAcamb + VIG + PHIS,
We have not conducted the in-depth elicitation from multiple
experts in each area that is needed for a fully rigorous risk
where ETdry and ETAvent are the costs of efficacy and safety
analysis; however, we have discussed the cost issues with
testing for the Dryvax and Aventis vaccines, respectively;
representatives from each area, and we believe that the esti-
ETAcamb is the cost of new vaccine production and testing
mates in this section are sufficiently reasonable to illustrate,
from Acambis; VIG is the cost of producing sufficient doses
qualitatively, the case for combining statistical risk analysis
of vaccinia immune globulin to treat adverse reactions and
with game theory for threat management in the context of
possible exposures; and PHIS is the cost of establishing
terrorism.
the public healthcare infrastructure needed to manage this
Expert opinion was typically elicited in the following
stockpiling effort.
way. Each expert was given a written document with back-
There is no uncertainty about ETAcamb; the contract fixes
ground on smallpox epidemiology and a short description of
this cost at $512 million. But there is substantial uncertainty
the attacks and defenses considered in this paper. The expert
about ETdry and ETAvent since these entail clinical trials and
often had questions; these were discussed orally with one of
may require follow-on studies; based on discussions with
the authors and, to the extent possible, resolved on the basis
experts, we believe these costs may be realistically modeled
of the best available information. Then the expert was asked
as independent uniform random variables, each ranging
to provide a point estimate of the relevant cost or outcome
between $2 and $5 million. There is also large uncertainty
and the range in which that value would be expected to fall
about the cost for producing and testing sufficient doses of
in 95% of similar realizations of the future. If these values
VIG to be prepared for a smallpox attack; our discussions
disagreed with those from other experts, then the expert was
suggest this is qualitatively described by a normal random
told of the discrepancy and invited to alter their opinion.
variable with mean $100 million and a standard deviation
Based on point estimate and the range, the authors and the
of $20 million. And there is great uncertainty about PHIS
expert chose a distribution function with those parameters
(which includes production of bifurcated inoculation nee-
which also respected real-world requirements for positiv-
dles, training, storage costs, shipment readiness costs, etc.);
ity, integer values, known skew, or other properties. As the
based on the five-year operating budget of other government
last step in the interview, the expert was given access to all
offices with analogous missions, we assume this cost is
the other expert opinions obtained to that point and asked
normally distributed with mean $940 million and standard
if there were any that seemed questionable; this led to in
deviation $100 million.
one case to an expert being recontacted and a subsequent
revision of the elicitation. But it should be emphasized that
3.2 Cell (2,1): Biosurveillance/No Attack Scenario
these interviews were intended to be short, and did not use
the full range of probes, challenges, and checks that are part
Biosurveillance programs are being piloted in several
of serious elicitation work.
major metropolitan areas. These programs track data, on
The next three subsections describe the risk analysis as-
a daily basis, from emergency room admission records in
sumptions used to develop the random costs for the first three
order to quickly discover clusters of disease symptoms that
cells (C11, C21, C31) in the game theory payoff matrix. Details
suggest bioterrorist attack. Our cost estimates are based
for developing the costs in the other cells are available from
upon discussions with the scientists working in the Boston
the authors. These assumptions are intended to be representa-
area (cf. Ross et al., 2002) and with the Pittsburgh team that
tive, realistic, and plausible, but additional input by experts
developed monitoring procedures for the Salt Lake City
could surely improve upon them. Many of the same costs
Olympic games.

OCR for page 103

0 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT
distributed between 400,000 and 600,000 (this reflects un-
The cost C21 includes the cost C11 since this defense
certainty about how many personnel would be designated
strategy uses both stockpiling of vaccine and increased bio-
as “key”). The IM is tied to units of 25,000 people, since
surveillance. Thus
this is a one-time cost and represents the number of people
C21 = C11 + PHIB + PHM + NFA · FA that a single nurse might reasonably inoculate and maintain
records upon in a year. Using salary tables, we approximate
this cost as a normal random variable with mean $60,000 and
where PHIB is the cost of the public health infrastructure
standard deviation $10,000.
needed for biosurveillance, including the data input require-
The probability of an adverse event is taken from An-
ments and software; PHM is the cost of a public health
derson (2002), which is based upon Lane et al. (1970); the
monitoring center, presumably at the Centers for Disease
point estimate for all adverse events is .293, but since there
Control, that reviews the biosurveillance information on
is considerable variation and new vaccines are coming into
a daily basis; NFA is the number of false alarms from the
production, we have been conservative about our uncertainty
biosurveillance system over five years of operation; and FA
and assumed that the probability of an adverse event is uni-
is the cost of a false alarm.
formly distributed between .15 and .45. Of course, most of
For this exercise, we assume that PHIB is normally dis-
these events will be quite minor (such as local soreness) and
tributed with mean $900 million and standard deviation $100
would not entail any real economic costs.
million (for a five-year funding horizon); this is exclusive of
The AEC is extremely difficult to estimate. For purposes
the storage, training, and other infrastructure costs in PHIS,
of calculation, we have taken the value of a human life to
and it includes the cost of hospital nursing-staff time to en-
be $2.86 million (the amount used by the National Highway
ter daily reports on emergency room patients with a range
Transportation Safety Administration in cost-benefit analy-
of disease symptoms (not just those related to smallpox).
ses of safety equipment). But most of the events involve no
PHM is modeled as a normal random variable with mean
cost, or perhaps a missed day of work that has little mea-
$20 million and standard deviation $4 million (this standard
surable impact on productivity. After several calculations
deviation was proposed by a federal administrator, and may
and consultations, this analysis assumes that AEC can be
understate the real uncertainty).
approximated as a gamma random variable with mean $40
False alarms are a major problem for monitoring systems;
and standard deviation $100 (this distribution has a long
it is difficult to distinguish natural contagious processes from
right tail).
terrorist attacks. We expect about one false alarm per month
over five years in a national system of adequate sensitivity,
and thus FA is taken to be a Poisson random variable with
4. ANALYSIS
mean 60. The cost for a single false alarm is modeled as a
The statistical risk analysis used in Section 3, albeit
normal random variable with mean $500,000 and standard
crude, shows how expert judgment can generate the random
deviation $100,000.
payoff matrices. The values in the cells of such tables are
not independent, since many of the cost components are
3.3 Cell (3,1): Key Personnel/No Attack Scenario
shared between cells. In fact, it is appropriate to view the
table as a matrix-valued random variable with a complex
One option, among several possible policies that have
joint distribution.
been discussed, is for the United States to inoculate about
Random tables from this joint distribution can be gener-
500,000 key personnel, most of whom would be first-
ated by simulation. For each table, one can apply either the
responders in major cities (i.e., emergency room staff, police,
minimax criterion to determine an optimal strategy in the
and public health investigators who would be used to trace
sense of von Neumann and Morgenstern (1944), or a mini-
people who have come in contact with carriers). If chosen,
mum expected loss criterion to determine an optimal solution
this number is sufficiently large that severe adverse reactions
in the sense of Bayesian decision theory (cf. Myerson, 1991,
become a statistical certainty.
Chapter 2). By doing this repeatedly, for many different
The cost of this scenario subsumes the cost C21 of the
random tables, one can estimate the proportion of time that
previous scenario, and thus
each defense strategy is superior.
C31 = C21 + (NKP × IM/25000) + (PAE × NKP × AEC) Additionally, it seems appropriate to track not just the
number of times a defense strategy is optimal, but also
weight this count by some measure of the difference between
where NKP is the number of key personnel; IM is the cost
the costs of the game under competing defenses. For exam-
of the time and resources needed to inoculate 25,000 key
ple, if two defenses yield game payoffs that differ only by an
personnel and monitor them for adverse events; PAE is the
insignificant amount, it seems unrealistic to give no credit to
probability of an adverse event; and AEC is the average cost
the second-best strategy. For this reason we also use a scor-
of one adverse event. We assume that NKP is uniformly

OCR for page 103

0
APPENDIX F
ing algorithm in which the score a strategy receives depends formation that does the minimax criterion. The analyst needs
upon how well-separated it is from the optimal strategy. to know the probabilities of a successful smallpox attack
Specifically, suppose that defense strategy i has value Vi conditional on the U.S. selecting each of the four possible
on a given table. Then the score Si that strategy i receives defenses. This is difficult to determine, but we illustrate how
is one can do a small sensitivity analysis that explores a range
of probabilities for smallpox attack.
Si = 1 - Vi /{max Vj} Table 2 shows a set of probabilities that we treat as the
baseline case. We believe it accords with a prudently cau-
and this ensures that strategies are weighted to reflect the tious estimate of the threat of a smallpox attack. To interpret
magnitude of the monetized savings that accrue from using Table 2, it says that if the United States were to only stockpile
them. The final rating of the strategies is obtained by averag- vaccine, then the probability of no smallpox attack is .95,
ing their scores from many random tables. the probability of a single attack is .04, and the probability
of multiple attacks is .01. Similarly, one reads the attack
probabilities for other defenses across the row. All rows
4.1 Minimax Criterion
must sum to one.
We performed the simulation experiment described above The minimum expected loss criterion multiplies the prob-
100 times and compared the four defense strategies in terms abilities in each row of Table 2 by the corresponding costs in
of the minimax criterion. Although one could certainly do the same row of Table 1, and then sums across the columns.
more runs, we believe that the approximations in the cost The criterion selects the defense that has the smallest sum.
modeling are so uncertain that additional simulation would As with the minimax criterion, one can simulate many
only generate spurious accuracy. payoff tables and then apply the minimum expected loss
Among the 100 runs, we found that the Stockpile strategy criterion to each. In 100 repetitions, Stockpile won 96 times,
won 9 times, the Biosurveillance strategy won 24 times, the Biosurveillance won 2 times, and Vaccinate Everyone won
Key Personnel strategy won 26 times, and the Vaccinate twice. The scores showed roughly the same pattern, strongly
Everyone strategy won 41 times. This lack of a clear winner favoring the Stockpile defense.
may be, at some intuitive level, the cause of the widely dif- We now consider two alternative sets of probabilities,
ferent views that have been expressed in the public debate shown in Table 3 and Table 4. Table 3 is more pessimis-
on preparing for a smallpox attack. tic, and has larger attack probabilities. Table 4 is more
If one uses scores, the results are even more ambiguous. optimistic, and has smaller attack probabilities. A serious
The average score for the four defense strategies ranged sensitivity analysis would investigate many more tables,
between .191 and .326, indicating that the expected perfor- but our purpose is illustration and we doubt that the quality
mances were, on average, quite similar. of the assessments that underlie the cost matrix can warrant
From a public policy standpoint, this may be a fortunate further detail.
result. It indicates that in terms of the minimax criterion, any For Table 3, 100 simulation runs found that Stockpile
decision is about equally defensible. This gives managers won 15 times, Biosurveillance won 29 times, Key Person-
flexibility to incorporate their own judgment and to respond nel won 40 times, and Vaccinate Everyone won 16 times. In
to extrascientific considerations. contrast, for Table 4, the Stockpile strategy won 100 times
in 100 runs.
The scores for Table 3 ranged from 18.2 to 38.8, which
4.2 Minimum Expected Loss Criterion
are quite similar. In contrast, for Table 4 nearly all the weight
The minimax criterion may not be realistic for the game of the score was on the Stockpile defense. These results
theory situation presented by the threat of smallpox. In par- show that the optimal strategy is sensitive to the choice of
ticular, the normal-form game assumes that both players are probabilities used in the analysis. Determining those prob-
ignorant of the decision made by their opponent until com-
mitted to a course of action. For the smallpox threat, there has
been a vigorous public discussion on what preparations the
United States should make. Terrorists know what the United TABLE 2 Baseline Probabilities of Attack Given
States has decided to do, and presumably this will affect Different Defenses
their choice of attack. Therefore the extensive-form version
No Attack Single Attack Multiple Attack
of game theory seems preferable. This form can be thought
of as a decision tree, in which players alternate their moves. Stockpile Vaccine 0.95 0.04 0.01
Biosurveillance 0.96 0.035 0.005
At each stage, the player can use probabilistic assessments
Key Personnel 0.96 0.039 0.001
about the likely future play of the opponent. Everyone 0.99 0.005 0.005
The minimum expected loss criterion requires more in-

OCR for page 103

0 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT
TABLE 3 Pessimistic Probabilities of Attack Given viously, is not adequate to support public policy
Different Defenses formulation.
No Attack Single Attack Multiple Attack
Nonetheless, despite these limitations, the methodology
Stockpile Vaccine 0.70 0.20 0.10
has attractive features. First, it is easy to improve the quality
Biosurveillance 0.80 0.15 0.05
of the result through better risk analysis. Second, it auto-
Key Personnel 0.85 0.10 0.05
matically raises issues that have regularly emerged in policy
Everyone 0.90 0.05 0.05
discussions. And third, it captures facets of the problem that
are not amenable to either game theory or risk analysis on
their own, because classical risk analysis is not used in ad-
TABLE 4 Optimistic Probabilities of Attack Given
versarial situations and because classical game theory does
Different Defenses
not use random costs.
No Attack Single Attack Multiple Attack
Stockpile Vaccine 0.98 0.01 0.01
NOTES: BACKGROUND ON SMALLPOX
Biosurveillance 0.99 0.005 0.005
Key Personnel 0.99 0.005 0.005
Although the probability that the smallpox virus (Variola
Everyone 0.999 0.0005 0.0005
major) might be used against the U.S. is thought to be small,
the public health and economic impact of even a limited
release would be tremendous. Any serious attack would
abilities requires input from the intelligence community and probably force mass vaccination programs, causing addi-
the judgment of senior policy-makers. tional loss of life due to adverse reactions. Other economic
consequences could easily be comparable to those of the
attacks of September 11, 2001.
5. CONCLUSIONS
A smallpox attack could potentially be initiated through
This paper has outlined an approach combining statistical infected humans or through an aerosol (Henderson et al.,
risk analysis with game theory in order to evaluate defense 1999). In 12-14 days after natural exposure patients experi-
strategies that have been considered for the threat of small- ence fever, malaise, body aches, and a body rash (Fenner et
pox. We believe that this approach may offer a useful way al., 1988). During the symptomatic stages of the disease the
of structuring generic problems in resource investment for patient can have vesicles in the mouth, throat, and nose that
counterterrorism. rupture to spread the virus during a cough or sneeze.
The analysis in this paper is incomplete: Person-to-person spread usually occurs through inhala-
tion of virus-containing droplets or from close contact with
1. We have focused upon smallpox, because the problem an infected person. As the disease progresses the rash spreads
has been framed rather narrowly and quite definitively to the head and extremities and evolves into painful, scarring
by public discussion. But a proper game theory analy- vesicles and pustules. Smallpox has a mortality rate of ap-
sis would not artificially restrict the options of the ter- proximately 30%, based on data from the 1960s and 1970s
rorists, and should consider other attacks, such as truck (Henderson, 1999).
bombs, chemical weapons, other diseases, and so forth Various mathematical models of smallpox spread ex-
(which would get difficult, but there may be ways to ist and have been used to forecast the number of people
approximate). It can be completely misleading to seek infected under different exposure conditions and different
a local solution, as we have done. public health responses (cf. Kaplan, Craft, and Wein, 2002;
2. Similarly, we have not fully treated the options of Meltzer et al., 2001). There is considerable variation in the
the defenders. For example, heavy investment in predictions from these models, partly because of differing
intelligence sources is a strategy that protects against assumptions about the success of the “ring vaccination” strat-
many different kinds of attacks, and might well be egy that has been planned by the Centers for Disease Control
the superior solution in a less local formulation of the (2002), and this is reflected in the public debate on the value
problem. of preemptive inoculation versus wait-and-see preparation.
3. We have not considered constraints on the resources However, the models are in essential agreement that a major
of the terrorists. The terrorists have limited resources determinant of the size of the epidemic is the number of
and can invest in a portfolio of different kinds of at- people who are exposed in the first attack or attacks.
tacks. Symmetrically, the U.S. can invest in a portfolio The current vaccine consists of live vaccinia or cowpox
of defenses. This aspect of the problem is not ad- virus and is effective at preventing the disease. Also, vac-
dressed—we assume that both parties can fund any of cination can be performed within the first 2 to 4 days post
the choices without sacrificing other goals. exposure to reduce the severity or prevent the occurrence of
4. The risk analysis presented here, as discussed pre- the disease (Henderson, 1999).

OCR for page 103

0
APPENDIX F
But vaccination is not without risk; the major complica- further test the safety and efficacy of the new vaccine (cf.
tions are serious infections and skin disease such as progres- Rosenthal et al., 2001).
sive vaccinia, eczema vaccinatum, generalized vaccinia, and
encephalitis. Approximately 12 people per million have se-
REFERENCES
vere adverse reactions that require extensive hospitalization,
Anderson, S. (2002). “A risk-benefit assessment of smallpox and smallpox
and about one-third of these die—vaccinia immune globulin
vaccination,” Technical Report, Office of Biostatistics and Epidemiol-
(VIG) is the recommended therapy for all of these reactions
ogy, Center for Biologics Evaluation and Research, U.S. Food and Drug
except encephalitis. Using data from Lane et al. (1970), we Administration, Rockville, MD, 2002.
estimate that 1 in 71,429 people suffer postvaccinial enceph- Brillinger, D.R. (1993). “Earthquake risk and insurance,” EniroMetrics,
alitis, 1 in 588,235 suffer progressive vaccinia, 1 in 22,727 4, 1-21.
Centers for Disease Control, (2002). Smallpox response plan and guidelines
suffer eczema vaccinatum, and 1 in 3,623 suffer generalized
(Version .0), www.bt.cdc.gov/agent/smallpox/response-plan/index.
vaccinia. Additionally, 1 in 1,656 people suffer accidental
asp.
infection (usually to the eye) and 1 in 3,289 suffer some other Cohen, J. (2001). “Smallpox vaccinations: How much protection remains?”
kind of mild adverse event, typically requiring a person to Science, 294, 985.
miss a few days of work. (Other studies give somewhat dif- Enserink, M. (2002). “New cache eases shortage worries,” Science, 296
(April 5) 25-26.
ferent numbers; cf. Neff et al., 1967a, 1967b). People who
Fenner, F., Henderson, D.A., Arita, I., Jezek, Z., Ladnyi, I.D. (1988). Small-
have previously been successfully vaccinated for smallpox
pox and Its Eradication, World Health Organization, Geneva.
are less likely to have adverse reactions, and people who are Frey, S.E., Couch, R.B, Tacket, C.O., Treanor, J.J., Wolff, M., Newman,
immunocompromised (e.g., transplant patients, those with F.K. Atmar, R.L., Edelman, R., Nolan, C.M., Belshe, R.B. (2002).
AIDS) are at greater risk for adverse reactions (cf. Centers “Clinical responses to undiluted and diluted smallpox vaccine,” New
England Journal of Medicine, 346:17, 1265-1274.
for Disease Control, 2002, Guide B, parts 3, 5, and 6).
Halloran, M.E., Haber, M., Longini, I.M, Jr., and Struchiner, C.J. (1991).
Because the risk of smallpox waned in the 1960s, vac-
“Direct and indirect effects in vaccine efficacy and effectiveness,”
cination of the U.S. population was discontinued in 1972. It American Journal of Epidemiology, 133, 323-331.
is believed that the effectiveness of a smallpox vaccination Henderson, D.A. (1999). “Smallpox: Clinical and epidemiological fea-
diminishes after about 7 years, but residual resistance persists tures,” Emerging Infectious Diseases, 5, 537-539.
Henderson, D.A., Ingelsby, T.V., Bartlett, J.G., Ascher, M.S., Eitzen,
even decades later. It has been suggested that people who
E., Jahrling, P.B., Hauer, J., Layton, M., McDade, J., Osterholm,
were vaccinated before 1972 may be substantially protected
M.T., O’Toole, T., Parker, G., Perl, T., Russel, P.K., and Tonat, K.
against death, if not strongly protected against contracting (1999). “Smallpox as a biological weapon—Medical and public health
the disease (cf. Cohen, 2001). management,” Journal of the American Medical Association, 281:22,
The U.S. currently has about 15 million doses of the 2127-2137.
Kahnemann, D., and Tversky, A. (1972). “Subjective probability: A judg-
Wyeth Dryvax smallpox vaccine available. The vaccine
ment of representativeness,” Cognitie Psychology, 3, 430-454.
was made by scarification of calves with the New York City
Kaplan, E., Craft, D.L., and Wein, W.M. (2002). “Emergency response to
Board of Health strain and fluid containing the vaccinia virus a smallpox attack: The case for mass vaccination,” Proceedings of the
was harvested by scraping (Rosenthal et al., 2001). Recent National Academy of Sciences, 99, 5237-5240.
clinical trials on the efficacy of diluted vaccine indicate that Lane, M.J., Ruben, F.L., Neff, J.M., and Millar, J.D. (1970). “Complica-
tions of smallpox vaccination, 1968: Results of ten statewide surveys,”
both the five-fold and ten-fold dilutions of Dryvax achieve
Journal of Infectious Diseases, 122, 303-309.
a take rate (i.e., a blister forms at the inoculation site, which
McKenna, M.A.J. (2002). “No mass smallpox vaccinations, panel recom-
is believed to be a reliable indicator of immunization) of at mends,” Atlanta Journal-Constitution, June 21, p. 1.
least 95%, so the available vaccine could be administered Meltzer, M.I., Damon, I., LeDuc, J.W., and Millar, J.D. (2001). “Modeling
to as many as 150 million people should the need arise (cf. potential responses to smallpox as a bioterrorist weapon,” Emerging
Infectious Diseases, 7, 201-208.
Frey et al., 2002; NIAID, 2002).
Myerson, R.B. (1991). Game Theory: Analysis of Conflict, Harvard Univer-
The disclosure by the pharmaceutical company Aventis
sity Press, Cambridge, MA, 1991.
(Enserink, 2002) of the existence in storage of 80 to 90 mil- NIAID. (2002). “NIAID study results support diluting smallpox vaccine
lion doses of smallpox vaccine that were produced more stockpile to stretch supply,” NIAID News, March 28. National Institute
than 30 years ago has added to the current stockpile. Testing of Allergy and Infectious Diseases, www.niaid.nih.gov/newsroom/
releases/smallpox.htm.
is being done on the efficacy of the Aventis vaccine stock,
Neff, J.M., Lane, J., Pert, J.P., et al. (1967). “Complications of smallpox vac-
including whether it, too, could be diluted if needed.
cination, I: National survey in the United States, 1963,” New England
Contracts to make new batches of smallpox vaccine us- Journal of Medicine, 276, 1-8.
ing cell culture techniques have been awarded to Acambis. Neff, J.M., Levine, R.H., Lane, J.M., et al. (1967). “Complications of
The CDC amended a previous contract with Acambis in smallpox vaccination, United States, 1963, II: Results obtained from
four statewide surveys,” Pediatrics, 39, 16-923.
September 2001 to ensure production of 54 million doses
Rosenthal, S.R., Merchilinsky, M., Kleppinger, C., and Goldenthal, K.L.
by late 2002. Another contract for the production of an ad-
(2001). “Developing new smallpox vaccines,” Emerging Infectious
ditional 155 million doses was awarded to Acambis in late Diseases, 7, 920-926.
November 2001, and the total cost of these contracts is $512 Ross, L., Kleinman, K., Dashevsky, I., Adams, C., Kludt, P., DeMaria, A.,
million. After production, additional time may be needed to Jr., and Platt, R. (2002). “Use of automated ambulatory-care encounter

OCR for page 103

0 DEPARTMENT OF HOMELAND SECURITY BIOTERRORISM RISK ASSESSMENT
records for detection of acute illness clusters, including potential bioter- Treaster, J.B., (2002). “The race to predict terror’s costs,” New York Times,
rorism events,” Emerging Infectious Diseases, 8, 753-760. Sept. 1, section 3, p. 1.
Speed, T.P. (1985). “Probabilistic risk assessment in the nuclear industry: von Neumann, J., and Morgenstern, O. (1944). Theory of Games and Eco-
WASH-1400 and Beyond,” in Proceedings of the Berkeley Conference nomic Behaior, Princeton University Press, Princeton NJ.
in Honor of Jerzy Neyman and Jack Kiefer, Vol. 2, L. LeCam and R.
Olshen, eds., Wadsworth, Pacific Grove, CA, pp.~173-200.