Thanks to the Penn State Engineering Library, I now have pristine scanned copies of two classic literature reviews focused on psychological deterrents to nuclear theft. These are:
Meguire, P. G. and Kramer, J. J. (1976). “Psychological Deterrents to Nuclear Theft: A Preliminary Literature Review and Bibliography.” NSBIR 76-1007, prepared for the Defense Nuclear Agency by the Law Enforcement Standards Laboratory, National Bureau of Standards [Scribd link]
A review of the unclassified literature dealing with psychological deterrents was conducted for the Defense Nuclear Agency (DNA). Its purpose was to identify techniques that might be useful in the DNA’s Forced-Entry Deterrent Systems (FEDS) Program for psychologically deterring nuclear weapon theft. The review indicates that while human psychological processes (sensory, perceptual and cognitive) can be manipulated by various means, definitive empirical data are lacking which relate directly to deterring nuclear weapon theft. Behavioral impact research should be undertaken by DNA to (1) ascertain the deterrence values of the many techniques identified and (2) test the hypotheses implicit in the FEDS concept.
Lapinsky, G. W. and Goodman, C. (1980). “Psychological Deterrents to Nuclear Theft: An Updated Literature Review and Bibliography.” NSBIR 80-1038, prepared for the Defense Nuclear Agency by the Law Enforcement Standards Laboratory, National Bureau of Standards [Scribd link]
A review of the unclassified literature dealing with psychological deterrents was conducted for the Defense Nuclear Agency (DNA). The review indicates that while human psychological processes (sensory, perceptual and cognitive) can be manipulated by various means, definitive empirical data are lacking which directly relate to deterring nuclear weapon theft. Behavioral impact research should be undertaken by DNA to ascertain the deterrence values of the many techniques identified.
Today I received a nice set of declassified articles related to US dependence on foreign minerals and associated risks. This was my very first FOIA success, and it took only 263 days to fill! (I made the request to the CIA on 22 Sep 08, and it was filled on 12 Jun 09). The articles include:
Strategic Minerals: Review of the Issues (in the CIA International Economic & Energy Weekly, 27 November 1981) [see Scribd link]
Western Platinum Dependence: A Risk Assessment (CIA Research Paper, January 1985) [see Scribd link]
Russia Increasingly Influential in the Global Diamond Market (date unknown) [see Scribd link]
Critical Minerals: Estimated Import Dependence of Major Free World Industrial Nations [see Scribd link]
I intend to use these products as examples of how some members of the intelligence community do a risk assessment AND how to make a FOIA request. Enjoy!
BTW: CIA makes it very easy to submit FOIA requests - they provide all the instructions on their website. But only if they would accept email requests… presently requests can only be made by mail or fax.
UPDATE: YAN WINS!!! Congratulations to Yan for winning one of the five best student paper awards at EARAM! The letter from the award committee is below:
Your paper entitled ”Toward an Approach to Probabilistic Resilience Analysis of Networked Infrastructure” has been awarded the ”Graduate Student Best Paper Awards” in the 4th Asian Conference on Risk Assessment and Management 2009 which is held in Beijing Normal University of China.
Chairman of the conference Organising Committee: Prof. Peijun Shi (BNU), Prof. Akihiro Tokai (SRA-Japan), Prof. Dongchun Shin (KOSET-Korea), Prof. Chongfu Huang (RAC)
Let’s wish Yan the best as she competes for one of five graduate student “Best Poster” awards (which is worth about $800). (This award would help compensate for her having to spend much of her “vacation” time working on her presentation).
I could not resist posting this to the web… it is approved for public release and all. Wouldn’t it be nice to make some sort of physical board game of this concept for mass distribution in security risk analysis course, or maybe implement it using Web 2.0 technologies? Or perhaps extend the problem domain out to include border security?
Lecture 14 covered the “Risk = Hazard + Outrage” model offered by Peter Sandman. The video can be viewed for free online. I discussed this topic in several older posts to this blog (see here and here).
Unfortunately, the video equipment in my classroom did not quite work well enough to play the video in class as originally planned. So, the students were let go early and asked to watch the video on their own time. Of course, concepts from the video will be on the next quiz (which they were).
Lecture 12 gave the students an opportunity to apply the concepts of probability covered previously in lecture 10. Basically, I developed a spreadsheet with fictional flight information spanning two years. We considered four daily flights from Dulles International Airport (Washington, DC) into State College, PA. For each day spanning two calendar years, I noted whether the flight took off on-time (blank cell), was delayed, or was cancelled (i.e., infinitely delayed). Given this information, I asked the students to calculate such things as the probability of delay, probability of cancellation, probability of cancellation of a particular flight during Winter, and various other examples that tested students’ ability to apply different concepts from probability theory (Bayes’ rules, conditional probability, theorem of total probability, and so on). I also insisted that the students use Miscrosoft Excel for their calculations.
Overall, the exercise went well. Out of 8 problems assigned, many students completed the first five. Unfortunately, I made the largely incorrect assumption that my students were fluent in MS Excel. Next time I run this exercise, I will be sure to be more mindful of what my students actually do know about spreadsheets. Perhaps I will make this lecture into an “applied probability and introduction to Excel” lecture. What I did do was allow the students to finish the assignment at home and turn it in for extra credit during the next class. 4 of 39 students ended up turning something in for extra credit. I wish this figure was higher, but what can I do other than make it mandatory? (which was not an option given all the work students already have to do for me).
Lecture 11 was really not a lecture at all. Instead we had the luxury of hosting recruiters from the National Security Agency. Unfortunately, I was out of town on travel to a conference in New York City (the International Studies Association Annual Convention). But my understanding is that the NSA reps provided a good overview of the agency and career opportunities. This is good since many of our students in IST desire to start their careers in the Intelligence Community, with NSA often being a top choice among the variety of alternative agencies.
Lecture 10 was all about probability theory. I began this lecture by reintroducing the Venn Diagram and sets, and described probability of an event as the fraction of space consumed by the set in a particular Venn Diagram (however defined). I often prefer to teach probability the “geometric way” since I think it makes it easier to explain Bayes’ theorem and the Theorem of Total Probability. Next, I presented the three axioms of probability and associated corollaries (see the Wikipedia entry for more details - it is a good reference for this topic), talked about conditional probability, and proceeded into a geometric derivation of Bayes’ Theorem and the Theorem of Total Probability.
Unfortunately due to a recent coffee mishap, I did not have a suitable computer to use in support of this lecture. So, I delivered my lecture the old-fashioned way (definitely a challenge!) - I used a white board with markers. I think the lecture went ok, but perhaps it was a bit too much for my students to handle given their preparation. But alas, the concepts are important, and over time I will figure out the best way to communicate the concepts to an IST audience.
The book of the day for this lecture was Probability for Risk Managementby Hassett and Stewart (1999, ISBN: 1566983479). This book is a key reference chosen to help future actuaries prepared for their first actuary exam, Exam-P. This book is really good and worthwhile to have on any risk professional’s bookshelf.
I just received a lead on a neat tutorial on risk concepts for personal surveillance protection from my friend at Mercyhurst College, Kris Wheaton. Check it out at this link. I also posted this and what follows as a discussion topic on the SARMA group on LinkedIn.
Notice the manner in which this tutorial defines the term “threat” - a threat is defined as the undesired consequence of an attacker’s actions, not the nature of the actions themselves. Accordingly, risk is then the probability of the threat, which is consistent with accepted practice. Moreover, labeling an outcome a threat implicitly assigns a “value” to the outcome, which in this simple case is simply described as “undesirable.” But isn’t that the nature of security - to lessen the probably of undesirable events, or in this case, threats?
Now this is different from the DHS definition of threat, which puts it as the intent and capability of an attacker. DHS defines threat as the cause, the document linked to above defines it as the consequence all causes considered. Which do you prefer?
But of course, one can argue that intentions and capabilities when directed against a valued asset may result in undesired outcomes. So, does it really matter? That is, if bomb attack = damage, isn’t it equivalent to call both “damage” and “bomb attack” threats? Well, perhaps not if one seeks to define the term risk in terms of threat. In general, risk is defined as a probability distribution on outcomes with associated values. If we equate threat to cause, then threat is just one aspect of the problem. If we equate threat to undesired outcome, then risk is the probability of threat. So which should we use?
To answer this, I appeal to you. What does a threat assessment product typically answer? The ones I participated in sought to define the spectrum of harms (undesired event) of interest to the decision maker, and from these harms backout those potential causes of harm within my problem set. For a terrorist threat assessment considering the nuclear power industry, my threat assessment would identify what can go wrong and how it can happen. No valuation is attached to either outcome (what can go wrong) or cause, either in terms of probability or severity. That is, a threat assessment is purely descriptive.
From this, threat is both - cause and outcome - minus the valuation. I define the pairing of cause and outcome as a “scenario,” and if that scenario is undesirable either in cause or outcome, then it is a threat.
Vulnerability assessment, too, is descriptive in my mind. A vulnerability assessment seeks to identify the weakness that enable different causes to result in different undesired outcomes. Thus, a threat assessment provides a frame with which to do vulnerability assessment. However, vulnerability assessment also provides insights to help identify previously unknown undesired outcomes and causes. I would argue that neither precedes the other, but both should happen concurrently. But of course you got to start somewhere… which would you start with?
Now where does risk analysis fit in? In my view, risk analysis synthesizes the knowledge generated from the threat assessment and vulnerability assessment efforts to prioritize concerns for decision maker attention and providing guidance on what to do about it (i.e., actionable risk analysis). In so doing, risk analysis:
Attempts to describe the likeliness of cause from our knowledge of adversary capabilities and historical record (among other things)
Attempts to describe the likeliness of outcome given cause from our knowledge of system weaknesses, and
Attempts to place value on the outcome beyond just undesirable or not undesirable.
Note how I use the word “describe” and not “quantify.” I did this deliberately - quantification is useful for structuring thought, but perhaps not so much as providing a basis for decision making (particularly in security settings).
In my view, lecture 9 was one of the best so far this semester. We began class with a short (10 minute) quiz covering the assigned readings and topics from lecture 7. The reading for the day was “Performing a Project Pre-Mortem” by Gary Klein (published in the September 2007 issue of Harvard Business Review, pp. 18-19). On the quiz I asked students to describe a process for conducting a pre-mortem analysis. Additionally, I asked the students to described the information used by the author to make his case for the use of pre-mortem analysis (ANSWER: scientific findings and anecdotes). The multiple-choice portion covered such things as cardinality, power sets, cross products, and generalization/specialization. I think it went well.
The book of the day (which I just ordered just before lecture, actually) was a longer piece by Gary Klein entitled The Power of Intuition: How to Use Gut Feelings to Make Better Decisions at Work (2007, ISBN: 978-0385502894). This book was cited by the pre-mortem article, and without knowing much more about it, I assume that this book covers the idea of “prospective hindsight” in greater depth (for more on “prosepective hindsight,” check out this article if you have access to it). If not, the book is still a Gary Klein book, which at the very least suggests that it would be a good and worthwhile read.
The only really teaching I did in this lecture centered on one slide where I showed the following equation for risk:
I used this equation as a basis for reviewing how much we already learned about risk, and to talk about the techniques we learned to assess parts of it. Personally, I was surprised at how much we already covered. The goal for lecture 9 was to talk more about vulnerability analysis, in particular the use of pre-mortem analysis to understand the weaknesses present in a system that might cause undesirable impacts. The backdrop the in-class exercise was campus security. We began by reading a case study on the 2007 Virginia Tech shootings prepared pro bono by my friend Thomas Shreeve of the Intelligence Community Case Methods Program. This case study was used to create a frame of reference for a pre-mortem analysis centered on the same event occurring at Penn State. In particular, I asked each group to articulate an appropriate scenario (pairing of outcome and event) and use this as the basis for brainstorming reasons why this scenario occurred at Penn State. These reasons, if correct, reveal system weaknesses, or rather vulnerabilities, that contribute to the potential for the scenario occurring.
