|
||||||||||||||||
|
||||||||||||||||
The following HTML text is provided to enhance online readability. Many aspects of typography translate only awkwardly to HTML. Please use the page image as the authoritative form to ensure accuracy. 7
|
||||||||||||||||
 |
 |
Page 51 |
 |
 |
 |
|
| ||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||
Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 51
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
7
Improving the Department of Homeland Security’s Biological Threat Risk Assessment and Adding Risk Management
[Public Law 107-188:] An Act [t]o improve the ability of the United States to prevent, prepare for, and respond to bioterrorism and other public health emergencies.
—Public Health Security and Bioterrorism Preparedness and Response Act of 2002
THE USE OF PROBABILISTIC EVENT TREES ALONE IS INSUFFICIENT TO MODEL TERRORISM THREATS
Terrorism, especially relatively high-technology bioterrorism, involves intelligent adversaries whose decisions focus on achieving their objectives by responding to the observed and anticipated actions of the opponents. Additionally, the attacker and defender are both limited by technological and resource constraints which influence the choices that they make when committing attacks and arranging defenses. These two aspects are not properly captured by the probabilistic risk assessment adopted by the Department of Homeland Security (DHS) in its Biological Threat Risk Assessment (BTRA) of 2006. Probabilistic risk assessment has its roots in event-tree risk assessments—used to assess failures of engineered systems, purely random hazards, or acts of nature (e.g., storm damage or nuclear reactor accidents).
The excessive complexity of the BTRA assessment of the probability of terrorist decisions is a significant weakness—especially considering that such complexity is not necessary (see Chapter 3). Below, the committee introduces three models in which terrorist decisions are just that, decisions—not prior estimates of probabilities. The models represent different trade-offs and assumptions in addressing the risk management problem, but any of the three approaches would improve the methodology currently used by the BTRA or other simple extensions.
Event trees can help focus attention in cases where uncertainty is high or new defense investment can have maximum impact. Event trees also admit flexible calculation—the event outcomes contain the conditional probabilities obtained from any or all of these sources: expert opinion, mathematical equations, or complex simulations. Event trees model sequential time effects, but in the bioterrorism application assessed here, events may occur in parallel or at unknown times. Since credible data are more available and probabilities are more assessable for some conditional distributions than others, the conditional probability distributions are seldom assessed in the chronological order of the event tree. In the BTRA of 2006, however, probability assessment for each event in the tree was done by requiring a chronological ordering of events, using assumptions about dependence on some of the previous events.
Some events of the BTRA of 2006 represent deliberate decisions made by a terrorist, but such events are modeled as random events. Other events represent defensive choices, but these, too, are modeled as random events. The BTRA of 2006 does not properly model intelligent adversaries. Its probability assessment of terrorist decisions is independent of the potential consequences of the attack. As the attacks of September 11, 2001 (9/11) clearly illustrated, terrorists adapt their means and select targets that have a high probability of attaining the consequences that they hope to achieve.
Consideration of terrorist objectives introduces something entirely new to the BTRA, implying a decision theoretic or game-theoretic perspective (Golany et al., 2007). Both decision theory and game theory (including attacker-defender models using mathematical programming) need to be informed by expertise and judgment. In attacker-defender models and other game-theory applications, a rough symmetry between attacker and defender is assumed; that is, what the defender seeks to minimize, the attacker seeks to maximize. This is supported by evidence that al-Qaeda wants to maximize any damage that the United States would rather minimize (e.g., see the captured “Al Qaeda Training Manual,” [FAS, 2007]), so if the key U.S. consequence for risk in the BTRA is expected fatalities, then for al-Qaeda it is the first choice to maximize (but other terrorists may have different priorities). Note that if the terrorist uses some other objective but the defender still favors minimizing fatalities, this improves the results for the defender.
The overly complex consequence models used by the BTRA of 2006 to assess fatalities at terminal events are another weakness (Chapter 6). For example, the susceptible,
OCR for page 52
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
exposed, infected, and recovered (SEIR) model used to estimate the size of a smallpox epidemic started by a single infected individual accounts for every possible disease-transmission pathway. Because of the large uncertainties throughout the model and the uncertainties in the parameters that describe smallpox transmission, the detail and precision reported by this embellishment are illusory.
SEVERAL METHODS ARE AVAILABLE FOR IMPROVED MODELING OF INTELLIGENT ADVERSARIES
Ultimately, the defending of the United States from terrorist attack boils down to choices of investment to prevent, protect against, respond to, and recover from terrorist attacks. The committee has suggested improvements that, if used to simplify, clarify, streamline, and improve the BTRA, would yield more realism, more accuracy, more transparency, and faster computation; additionally the rankings of bioagents by risk would be more credible than those now produced. The BTRA might then be useful to decision makers for purposes of risk management as well as risk assessment and, most important, for exploring homeland security strategic investment choices.
In an earlier recommendation—see Chapter 3, the subsection entitled “The Approach to Determining the Probabilities of Terrorist Decisions Is Incomplete”—the committee advises DHS to model terrorists as intelligent adversaries. Here the committee reinforces that crucial recommendation and provides alternatives for its accomplishment.
Recommendation: In addition to using event trees, DHS should explore alternative models of terrorists as intelligent adversaries who seek to maximize the achievement of their objectives.
The committee does not underestimate the difficulty in producing a dependable and reliable bioterrorism risk analysis that responds to its 13 recommendations. Three appendixes, D, E, and F, in this report present modeling approaches that can be used with the existing BTRA structure to improve the risk analysis. Table 7.1 evaluates these approaches against the 13 recommendations. None of these approaches alone may be an adequate and complete solution to the problem, and any implementation may present unforeseen difficulties. However, the committee believes that a suitable combination of these approaches, and possibly others, is feasible and will yield a risk analysis that satisfies the demands that this committee sees as necessary.
Red Teaming Can Be Used to Understand Intelligent Adversaries
DHS has experience in exercises. But, for instance, although Top Officials 3 (TOPOFF 3) was the most comprehensive terrorism response exercise ever conducted in the United States,1 it was an exercise in blue (defender) response to attacks scripted in advance. Red teaming can be used for the enhancement of such exercises and for analysis. Red teaming (i.e., terrorist role playing) is a robust and well-understood analysis technique for assessing adversarial risk in complex, dynamic environments. However, red teaming only reveals vulnerabilities and does not directly support decisions about investment trade-offs among different kinds of defenses.
In red-teaming exercises, people are assigned to play the roles of terrorists. It is essential that the adversary’s point of view is pursued when considering adversary actions and reactions. The red team must be immersed in enemy culture, tactics, and beliefs. There may also be an opposing blue team playing the roles of defenders. Each of the adversaries has certain resources, certain information, and certain goals. They play out their scenarios, and results can show how bounded human intelligence, nonstandard thinking, and group dynamics may affect the kinds of attacks that are attempted and the kinds of defenses that are successful. By trying to win the encounter for the adversary, the terrorist (or red) team helps to better elucidate defender responses for each adversary course of action.
In principle, red-teaming exercises can become large and complex, depending on the number of different roles, the degree to which the scenario is unstructured, and the number of independent replications that are completed to assess variability in outcome. Nonetheless, this is a relatively inexpensive way for decision makers to learn what they have overlooked about their opponents. Homeland Security Presidential Directive 10 (The White House, 2004) cites red teaming as a technique for better understanding potential enemy actions, and the committee suggests red teaming to DHS as a useful validation test for scenarios favored by the BTRA. Red teaming is just as applicable in improving risk analyses based on decision trees, optimization, and game theory (Reichart, 1998).
Decision Trees Can Model Bioterrorist Threats
In addition to having event nodes whose random outcomes are determined by a probability distribution, a decision tree has decision nodes, whose outcomes are chosen to maximize (or minimize in the case of the defender) the expected consequence from that node forward. The BTRA event tree could be converted to a “bioterrorist decision tree” with four important changes:
Convert each node representing a terrorist decision into an expected-damage maximizing decision node,
Assess probabilities of outcomes of random events, rather than probability distributions of outcomes,
1
Information on TOPOFF exercises is available at www.dhs.gov/xprepresp/programs/editorial_0896.shtm. Accessed September 19, 2007.
OCR for page 53
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
Eliminate nodes representing frequency of attack and potential for multiple attacks, and
Employ a simple, random-consequence model at each event node in the last stage of the tree.
Called the Bioterrorist Decision Model (BDM), this approach to modeling the scenario presented in the BTRA is developed in Appendix D and briefly described here.
Appendix D presents two figures, Figure D.1 showing the modeling choices made by DHS and Figure D.2 showing alternatives that could be used by the BDM. Using these alternate choices, the Bioterrorist Decision Model can be relatively quickly implemented for bioterrorism risk assessment and risk management because it uses existing techniques (Parnell, 2008), it is a direct modification of the 2006 BTRA event tree, and it uses commercially available, off-the-shelf software. Much of the work done by DHS on segmenting the bioterrorism attack for modeling and on probability assessment and consequence modeling for the BTRA of 2008 can be retained.
The framework represented by the BDM has the potential to resolve all of the major deficiencies that have been identified in the current BTRA. This is a model from the terrorist’s point of view. Because U.S. actions and random events are uncertain to the terrorist, these are modeled as events in the decision tree, but terrorist decisions are modeled as decision nodes. Huge BTRA data demands are mitigated by deleting the two most problematic stages (frequency of attack and multiple attacks) and by using probabilities rather than probability distributions for each outcome of each event. The model improves transparency by using commercially available software with extensive graphic visualization and with built-in features to perform sensitivity analyses. Finally, the model can be modified for use in risk management. After risk management decisions are implemented and the probabilities of the random events are changed conditional on these decisions, BDM can be rerun for recalibration.
Attacker-Defender Optimization Can Unify Risk Management, Risk Assessment, and Resource Allocation
Terrorists cannot afford to invest in developing attacks using every major pathogen. Nor can the United States afford every possible defense. Decision makers on both sides have limited resources and seek to optimize their “payoff” subject to these constraints. Appendix E offers an optimization model that unifies risk management, risk assessment, and resource allocation in what is called a “tri-level, defender-attacker-defender” optimization. After 9/11, U.S. law was changed to allow the U.S. Department of Defense to devote resources to defending the United States within its borders, and the authors of Appendix E2 were asked to convert military “attacker-defender” models in which the United States is the attacker, to “defender-attacker” models in which the United States defends its critical infrastructure from attacks. They have developed more than a hundred such prototypical applications since then, presenting a new one in Appendix E crafted to the exact needs of DHS for bioterrorism.
The three decision stages are these:
DHS commits strategic defense investments, chosen from alternate program portfolios each consisting of a compatible set of defense options, to minimize the maximum expected damage from any attack; these investments are of such magnitude that they are necessarily visible to the attacker;
The attacker, after observing these defense investments, chooses attack alternative(s) to maximize expected damage; and
The defender mitigates damage from the attack(s) with resources already in place as a result of prior strategic investments.
Here, the term damage (to the defender) is used in lieu of, for example, fatalities or other particular consequence.
Using the hypothetical scenario from Chapter 1, one defense option might be to procure 100 million doses of anthrax protective antigen (PA) vaccine, and another to purchase the same number of doses of Russian (STI) live vaccine (see Chapter 5). No defense strategy would include both of these defense options. One attack alternative would be the anthrax attack hypothesized in Chapter 1. Mitigation efforts after this attack would include distributing and using a vaccine, but only if such vaccine has already been put in place by a defense strategy.
This is a very conservative model for the defender because the defender must protect against the worst possible set of attacks. But that is what good management does.
Denote the defense strategy d, the attack alternative a, and the mitigation effort m. A key input is damaged,a, the expected damage if defense strategy d has been followed and terrorist attack alternative a is chosen. This is a BTRA output from its suite of consequence models. Denote another input as mitigated,a,m, and suppose that if defense strategy d has been followed and terrorist attack alternative a has been chosen, then mitigation effort m (enabled by d) is put in full force, and the expected damage is reduced by this amount.
Constraints on capital budget for defensive options in any affordable defense strategy govern defender decisions, as do any synergistic or antagonistic interactions among defense options in any defense strategy portfolio that together dictate what damaged,a results, and any other technological or resource limit on the defender. Similarly, limits on terrorist capital and technology are incorporated directly into the attacker model as conventional optimization constraints. These data are precisely the same as those that the BTRA now presents to subject-matter experts to elicit their opinions
2
Gerald G. Brown, W. Matthew Carlyle, and R. Kevin Wood, Department of Operations Research, Naval Postgraduate School, Monterey, California.
OCR for page 54
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
TABLE 7.1 Evaluation of Risk Analysis Techniques
Committee Recommendation
Biological Threat Risk Assessment (BTRA) of 2006a
Possibly Revised BTRA of 2006a
Bioterrorist Decision Tree (Appendix D)
Optimization Models (Appendix E)
Game Theory (Appendix F)a
The Department of Homeland Security (DHS) should use an explicit risk analysis lexicon for defining each technical term appearing in its reports and presentations.
Does not.
Could be used.
Would be used.
To assess the probabilities of terrorist decisions, DHS should use elicitation techniques and decision-oriented models that explicitly recognize terrorists as intelligent adversaries who observe U.S. defensive preparations and seek to maximize the achievement of their own objectives.
Does not.
Would require new techniques to replace sole reliance on event trees.
Terrorist decision nodes replace event nodes, and decision tree is solved to maximize consequences. Consequences can be solved individually or combined using standard decision analysis techniques.
Probabilities of terrorist actions are outputs of optimization model.
Probabilities of terrorist actions are outputs of game theory models.
The event-tree probability elicitation should be simplified by assessing probabilities instead of probability distributions for the outcomes of each event.
Does not.
Could be greatly simplified.
Would be done. Probability elicitation is used for events in decision tree.
Would be done. Tree methods are used to calculate expected consequences.
Would be done. Tree methods are used in risk estimates for cost table.
Normalization of BTRA risk assessment results obscures information that is essential for risk-informed decision making. BTRA results should not be normalized.
Normalizes risk assessment.
Normalization could be removed.
Not used. Risk assessment would be provided without normalization using cumulative consequence distribution(s).
Not used.
Not used.
Two significant simplifications should be made to the BTRA of 2006 event tree:
DHS should eliminate Stage 1, Frequency of Initiation [of an attack] by Terrorist Group, and Stage 16, Potential for Multiple Attacks; and
DHS should seek opportunities to aggregate some stages of the tree to only those essential to calculate probabilities and consequences with realistic fidelity.
Does not.
Stages 1 and 16 could be deleted resulting in a simplified model.
Would be done. Stages 1 and 16 would not be included. Opportunities for aggregated stages would be pursued.
Stages included are optional. Aggregation of stages is mathematically automated.
Would be done. Tree methods are used in risk estimates for cost table.
Subsequent revision of the BTRA should increase emphasis on risk management. An increased focus on risk management will allow the BTRA to better support the risk-informed decisions that homeland security stakeholders are required to make.
Does not.
Would be extremely difficult owing to model complexity.
Decision trees are routinely used for making resource allocation decisions. Probabilities and consequences would be changed by risk management options.
Primary focus is finding investment portfolio that minimizes expected risk, given that terrorists see these investments before choosing an attack.
This approach currently lacks a portfolio analysis, which is essential for risk management. But it seems likely that this capability could be added, as duopoly problems.
DHS should maintain a high level of transparency in risk assessment models, including a comprehensive, clear mathematical document and a complete description of the sources of all input data. The documentation should be sufficient for scientific peer review.
Does not.
Could be improved.
Built in with normal decision tree tools, including sensitivity analysis. Bayes nets could increase transparency.
Complete mathematical specification is presented with a complete numerical example.
Complete mathematical specification is presented.
OCR for page 55
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
Committee Recommendation
Biological Threat Risk Assessment (BTRA) of 2006a
Possibly Revised BTRA of 2006a
Bioterrorist Decision Tree (Appendix D)
Optimization Models (Appendix E)
Game Theory (Appendix F)a
Subsequent revision of the BTRA should enable a decision support system that can be run quickly to test the implications of new assumptions and new data and provide insights to decision makers and stakeholders to support risk-informed decision making.
Does not.
Would be extremely difficult owing to model complexity.
The removal of unnecessary complexity should allow reasonable run times using complete enumeration or Monte Carlo simulation. Insights are provided with normal decision tree analysis tools.
Responsiveness depends on required level of detail. Insights are provided with mathematical programming techniques.
The computing time is not yet known for this kind of approach, operating on realistically large problems.
The BTRA should be broad enough to encompass a variety of bioterrorism threats while allowing for changing situations and new information. DHS should develop a strategy for the rapid assessment of newly recognized and poorly characterized threats.
Does not.
Could be done as illustrated in Chapter 5.
Could be done as illustrated in Chapter 5.
Could be done as illustrated in Chapter 5.
Could be done as illustrated in Chapter 5.
The susceptible, exposed, infected, and recovered (SEIR) model adopted by DHS is more complex than can be supported by existing data or knowledge. DHS should make its SEIR model as simple as possible consistent with existing knowledge.
Does not.
Could be done.
Would be done.
Would be done.
Would be done.
While human mortality and the magnitude and duration of morbidity should remain the primary focus of DHS bioterrorism risk analysis, DHS should incorporate other measures of societal loss, including the magnitude and duration of first- and second-order economic loss and environmental and agricultural effects.
Does not.
Could be done.
Could be done.
Could be done.
Could be done.
In addition to using event trees, DHS should explore alternative models of terrorists as intelligent adversaries who seek to maximize the achievement of their objectives.
Does not.
Would require new techniques to replace sole reliance on event trees.
Explicitly designed to consider intelligent adversaries.
Explicitly designed to consider intelligent adversaries.
Explicitly designed to consider intelligent adversaries.
The BTRA should not be used as a basis for decision making until the deficiencies noted in this report have been addressed and corrected. DHS should engage an independent, senior technical advisory panel to oversee this task. In its current form, the BTRA should not be used to assess the risk of biological, chemical, or radioactive threats.
Deficiencies are uncorrected.
Analyses for biological, chemical, or radioactive threats would require new techniques for intelligent adversaries to replace sole reliance on event trees.
Biological, chemical, and radioactive threats could be done with different decision trees for each type of threat. Results would be compared based on consequence distribution(s).
Similar models have been demonstrated for biological, chemical, and radioactive threats, especially when defensive preparations are visible to attacker.
The approach described applies to generic threats, not just biological terrorism.
NOTE: This table evaluates the BTRA of 2006, a possibly revised BTRA, and the three techniques discussed in Appendixes D, E, and F of this report in terms of their responsiveness to the recommendations in the report.
aText in italics represents great difficulty in satisfying the objective or inability to satisfy the objective.
OCR for page 56
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
on event probabilities. Here, exactly one defense strategy is chosen, with its defensive option portfolio, but terrorists are allowed to mount fractional attack alternatives, and mitigation efforts may be allocated fractionally within resource limits put in place by a defense strategy. The result is that probabilities emerge as outputs from the optimization, that is, as recommended optimal mixed strategies, rather than posing required, subjective inputs from subject-matter experts.
Appendix E presents a simple illustrative example in detail sufficient for any reader with adequate off-the-shelf modeling and optimization software to repeat the exercise. Appendix E also establishes two key theoretical results that permit the full, 18-stage BTRA model to be solved as a tri-level one. Noting that the first (defense strategy) stage is a linear integer program, because choice of strategy is necessarily binary, but that all subsequent stages feature continuous (i.e., perhaps fractional) decisions, mimicking the BTRA of 2006:
Result 1: Any sequence of contiguous continuous stages of defender decisions, or of attacker decisions, can be collapsed into a single stage; and
Result 2: The order of continuous attacker stages, or continuous defender stages, makes no difference to the optimization, so with no loss in generality all continuous attacker stages from the BTRA can be aggregated into a single, second-stage attacker model, and all continuous defender stages can follow in the third stage.
Beyond this, Appendix E shows how to solve this tri-level optimization model at large scale with conventional methods and off-the-shelf software; that is, there is little need for aggregation or sacrifice of essential fidelity to render a smaller model more amenable to solution.
Further insights arise from these models. For instance, as the nation spends more and more money on better and better defenses, terrorists are forced to optimally spread their efforts among more and more attack alternatives, and the United States responds with increasingly diverse mitigation efforts. This dilution of terrorist effort may bring collateral advantage to the defender and afford more and better opportunities for detection and interdiction. (For example, terrorists, even those committed to suicide attacks, fear capture more than death, so the defenders want to increase the apparent risk of detection, interdiction, and capture.)
These models also lend insight into the utility of secrecy and deception. Although strategic defense investments are assumed to be so large that they cannot effectively be hidden (the committee notes without irony that some current DHS efforts can be profiled quickly on the World Wide Web and in the press, and in more detail via open academic literature), the resulting mitigation capabilities are another thing. If the United States knows how well it can mitigate but the terrorist does not, the United States can use this to its advantage. Some such insights are trivial to observe, while others may take additional analysis with optimization. For instance, suppose that damaged,a (i.e., unmitigated risk) is ordered from worst (largest) to best. That is, an ordinal set of (d,a) pairs is created. If the best (largest) mitigation effort for each (d,a) pair would not change this ordering, then there is little sense in taking extraordinary efforts to secret this. Conversely, substantive mitigation abilities that would change this risk ordering are worth keeping secret. See Appendix E for more suggestions about secrecy and insights on deception.
The optimization introduced by Appendix E bears many resemblances to game theory—in particular, to alternating-play, extensive-form games—and there are deep connections not pursued here. Suffice it to say that the optimization proposed accommodates highly detailed technological constraints and resource limits on the opponents (to the extent that they are known), and the solution method offered is completely new and can actually solve these problems at large scale.
Game Theory Models Can Help with Risk Management
Appendix F describes an analysis that combines game theory and statistical risk analysis in the context of a counterbioterrorism example. It is similar to the approach taken in Appendix E, which uses a linear program to solve the underlying game-theory decision making. The main difference is that the method in Appendix F generates many random payoff matrices for the game-theory problem and estimates the proportion of times that a given decision is optimal, as opposed to solving a single game that uses the expected values of the risk distributions as the entries in the payoff matrix. This has the advantage of not overlooking threats that are nearly equal in terms of expected risk, and it provides managers with a comparative view of different defense options. (Appendix F does not address the resource allocation issue treated in Appendix E, but the optimization developed in Appendix E could be transferred to Appendix F.)
More generally, game theory is useful for analyzing the dynamics between terrorist activity and the reactions of defenders when there are interdependencies and weak links in the system. The key point in this model of interdependent security is that the incentive which an agent has to invest in risk reduction measures depends on how that agent expects the other agents to invest in security. The agent may change the incentive to invest, or not to invest, depending on the investment of others in security. Consequently, there can be a perverse equilibrium in which no one invests in protection, even though all would be better off if they had incurred this cost. This situation does not have the structure of a prisoner’s dilemma game, although it has some similarities (Heal and Kunreuther, 2006). Appendix H develops a more formal model of interdependencies for a two-person game and illustrates situations in which there can be two
OCR for page 57
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
equilibria—both individuals invest or neither of them takes protective action.
To illustrate in the context of a real-world event, consider the destruction of Pan Am Flight 103 in 1988. In Malta, terrorists checked a bag containing a bomb on Malta Airlines, which had minimal security procedures. The bag was transferred in Frankfurt, Germany, to a Pan American feeder line and then loaded onto Pan Am Flight 103 in London’s Heathrow Airport. The transferred piece of luggage was not inspected at either Frankfurt or London, the assumption in each airport being that it was inspected at the point of origin. The bomb was designed to explode above 28,000 feet, a height normally first attained on this route over the Atlantic Ocean. Thus, failures in a peripheral part of the airline network, Malta, compromised the security of a flight leaving from a core hub, London. Terrorists may follow similar behavior with respect to a bioterrorist attack by finding a weak link in the system that could have severe direct and indirect consequences to a much wider population.
The behavior of terrorists is also affected by what their adversaries will do. More specifically, terrorists may respond to security measures by shifting their attention to more vulnerable targets. Keohane and Zeckhauser (2003), Sandler (2005), and Bier et al. (2007) analyze the relationships between the actions of potential victims and the behavior of terrorists. Symmetrically, rather than investing in additional security measures, firms may prefer to move their operations from large cities to less populated areas to reduce the likelihood of an attack. Of course, terrorists may then choose these less protected regions as targets if there is heightened security in the urban areas. Terrorists also may change the nature of their attacks if there are protective measures in place that would make the probability of success of the original option much lower than another course of action (e.g., switching from hijacking to bombing a plane). The impact of endogenous probabilities on the nature of the game-theoretic equilibrium is discussed more fully in Appendix H and in Heal and Kunreuther (2006).
Risk Management Strategies
The three models considered here all treat adversaries as intelligent adversaries that seek to maximize their objectives. Some of the implications are that distributed networks of protection, across different agencies or airlines or firms, may not lead to solutions that are as good as can be obtained with leadership and central direction.
For example, if different defender agents are reluctant to adopt protective measures to reduce the chances of losses from terrorism due to the possibility of contamination from weak links in the system, there may be a role for the private and public sectors to play in addressing this problem. A trade association can play a coordinating role by stipulating that any member must follow certain rules and regulations, including the adoption of security measures. For example, the National Association of Chemical Distributors has developed a code of responsible distribution, mandated third-party auditing of code compliance, and actually terminated membership for noncompliance. Other chemical-infrastructure industry organizations such as the American Chemistry Council, Synthetic Organic Chemical Manufacturers Association, American Petroleum Institute, and National Petrochemical and Refiners Association can also play key roles in this regard.
There may also be a role for governmental standards and regulations coupled with third-party inspections and insurance to enforce these measures. More specifically, third-party inspections coupled with insurance protection can encourage decentralized units in the supply chain to reduce their risks from accidents and disasters. Such a management-based regulatory strategy shifts the focus of decision making from the regulator to individual units that are now required to do their own planning to meet a set of standards or regulations. The combination of third-party inspections in conjunction with private insurance is a powerful combination of two market mechanisms that can convince many units of the advantages of implementing security measures to make their operations more secure. As a result of these units taking action, the remaining ones can be encouraged to comply with the regulations to avoid being caught and fined. This is a form of tipping behavior noted in Appendix H. In other words, without some type of inspection, low-risk units that have adopted risk-reducing measures cannot credibly distinguish themselves from the high-risk ones.
With the delegation of part of the inspection process to the private sector through insurance companies and certified third-party inspectors, a channel would exist through which the low-risk units could speak for themselves. If a unit chose not to be inspected by certified third parties, it would more likely be perceived as high-risk rather than low-risk. If a unit did get inspected and received a seal of approval that it was protecting itself against catastrophic vulnerabilities, the unit would pay a lower insurance premium than that of a unit not undertaking these actions. In this way, the number of audits needed would be reduced because units that had received seals of approval from private third-party inspectors would already be known.
As observed in the safety arena with the National Transportation Safety Board and the U.S. Chemical Safety and Hazard Investigation Board and in the security arena with the 9/11 Commission, an effective system will also independently and publicly investigate when catastrophic failures occur. Investigations examine the root and contributing causes, including the sufficiency of policies, practices, and oversight in the private and public domains. Such future investigations could possibly incorporate a “testing” of the model, or at a minimum provide data about interdependent security.
OCR for page 58
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
THE EXISTING BTRA FRAMEWORK SHOULD NOT BE USED FOR THE RISK ANALYSIS OF BIOLOGICAL, CHEMICAL, OR RADIOACTIVE THREATS
National decision makers and DHS leaders will need to allocate scarce resources to prevent, prepare for, and respond to all types of terrorist attacks. Clearly there is a wide variety of potential terrorist attack alternatives (conventional, biological, chemical, and radioactive3). Each of these attack alternatives has different attack signatures, detection technologies, and mitigation options. While biological agents can, perhaps, be usefully compared (e.g., by considering whether to invest in vaccines for some specific agent rather than others), there is no analogous comparison for non-biological agents. For nonbiological agents, the defense of particular locations or facilities against attack and the preparation of mitigation resources should such an attack occur assume a more important role than in the case of biological attack, in which the biological agent used is a primary consideration. In principle, the committee believes that the most simple, meaningful, and useful way to compare biological agents (e.g., anthrax) to chemical agents (e.g., chlorine) and radioactive threats (e.g., a dirty bomb) is by comparison of the potential consequences given a terrorist attack and, when possible, the likelihood of an attack.
However, throughout this report the committee has noted many weaknesses in risk analysis, modeling of intelligent agents, consequence assessment, and presentation of assessment results that it believes make the BTRA of 2006 problematic even for assessing biological agents, let alone other classes of threats. Because of these weaknesses, the rankings produced by the BTRA of 2006 are likely to be biased or skewed by a magnitude that cannot be assessed. Conventional peer review, or periodic reviews by an independent, senior technical advisory panel would almost surely have revealed these BTRA problems earlier. The committee believes that outside oversight will be crucial to correcting these deficiencies.
Recommendation: The BTRA should not be used as a basis for decision making until the deficiencies noted in this report have been addressed and corrected. DHS should engage an independent, senior technical advisory panel to oversee this task. In its current form, the BTRA should not be used to assess the risk of biological, chemical, or radioactive threats.
INTELLIGENT-ADVERSARY RISK ANALYSIS TECHNIQUES CAN BE USED ON RADIOACTIVE AND CHEMICAL THREATS AS WELL AS ON BIOLOGICAL THREATS
Although the committee has recommended that in its present form the BTRA of 2006 and 2008 not be extended to radioactive and chemical risk, it believes that the intelligent-adversary modeling improvements recommended in this report can be applied. Risk management strategies to protect the U.S. chemical infrastructure are discussed in detail in the National Research Council report Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities (NRC, 2006). Models for anticipating the actions of intelligent adversaries and for optimizing the allocation of defensive resources can be extended across these areas because all involve similar problems of warning, response, and recovery, and the consequences can be measured in the same consequence units, for example, fatalities. The models suggested here can be applied using risk assessment methods developed specifically for radioactive and chemical risks. Probabilities and consequences in the hypothetical biological scenario used in this report with the probabilities and consequences in radioactive and chemical scenarios can then be compared.
These models can then be used to assess the risk reduction (reduction in probability and/or reduction in consequences) for the resources required for risk management options. Risk management options can then be compared by comparing probability and consequence reduction in each of the three threat areas—biological, chemical, and radioactive. Many risk management alternatives (e.g., vaccines for bioagents, radiation sensors for nuclear threats, and chemical sensors for chemical threats) will only affect the primary threat area. In some cases—for example, recovery options and communication systems—risk management options may result in consequence reductions in all threat areas. In other cases, risk management options may only result in the adversary’s shifting or modifying the attack to achieve the same or similar consequences.
Achieving this integrated risk assessment and risk management capability is critical in order for risk-informed decisions to achieve this nation’s national security objectives of reducing the threat of weapons of mass destruction.
REFERENCES
Bier, V., S. Oliveros, and L. Samuelson. 2007. “Choosing What to Protect: Strategic Defense Allocation Against an Unknown Attacker.” Journal of Public Economic Theory 9(4):563-587.
FAS (Federation of American Scientists). 2007. “Al Qaeda Training Manual.” Available at www.fas.org/irp/world/para/aqmanual.pdf. Accessed August 23, 2007.
Golany, B., E.H. Kaplan, A. Marmur, and U.G. Rothblum. 2007. “Nature Plays with Dice—Terrorists Do Not: Allocating Resources to Counter Strategic Versus Probabilistic Risks.” European Journal of Operational Research. In press.
3
The committee uses the term “radioactive” to include both “radiological” (i.e., involving radioactive decay such as in a dirty bomb) and “nuclear” (i.e., involving complete fission as in an atomic bomb). Although these two threats are not identical, the committee believes that its recommendations and suggestions concerning the BTRA methodology used to evaluate the risk of these threats apply to either.
OCR for page 59
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
Heal, G., and H. Kunreuther. 2006. “You Can Only Die Once: Interdependent Security in an Uncertain World.” In The Economic Impacts of Terrorist Attacks, H.W. Richardson, P. Gordon, and J.E. Moore III (eds.). Northampton, Mass.: Edward Elgar.
Keohane, N., and R. Zeckhauser. 2003. “The Ecology of Terror Defense.” Journal of Risk and Uncertainty 26(2-3):201-229.
NRC (National Research Council). 2006. Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities. Washington, D.C.: The National Academies Press.
Parnell, G.S. 2008. “Multi-objective Decision Analysis.” Wiley Handbook of Science and Technology for Homeland Security. John G. Voeller (ed.). Forthcoming.
Reichart, J.F. 1998. “Adversarial Use of Chemical and Biological Weapons.” Joint Forces Quarterly 18(Spring):130-133. Available at www.fax.org/irp/threat/cbw/2218.pdf. Accessed October 23, 2007.
Sandler, T. 2005. “Collective Action and Transnational Terrorism.” The World Economy 26 (6):779-802.
The White House. 2004. Homeland Security Presidential Directive 10 [HSPD-10]: Biodefense for the 21st Century. Available at www.fas.org/irp/offdocs/nspd/hspd-10.html. Accessed January 16, 2008.
OCR for page 60
Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change
This page intentionally left blank.