• Sipping on my last espresso doppio in Milan before heading back to the states… Italy is truly my favorite vacation place… #
• Wow… getting home from Milan really sucked… I mean, it was truly awful… travel to the US from Europe is really a pain these days… #
• After Friday, I will be taking a four month break from traveling… traveling anywhere, especially to DC, is such a drag on time and energy #
• USAirways lost my son's stroller… guess who had to carry his squirmy 25lb body for 2 hours on the hot, overcrowded customs line at PHL? #
• Whoah… there is some sort of debate thing happening on my Facebook wall… should I intervene? What should I do? #
• One of yesterday's speakers had a heart attack right before she was going to answer a colleague's question… I hope she is all right now… #

Powered by Twitter Tools

Send article as PDF to

Note: this post will probably only be of interest to people charged with teaching SRA 311 within the Penn State system or students wanting to understand why I am doing the things I am doing.

The other day I had the luxury of reviewing the written course evaluations for my Fall 2007 SRA 311 course (the first offering at PSU).  I would say overall the people filling out the survey enjoyed the course (which, I admit was only about 60% of the class, and thus biased toward those students who actually came).  However, there were a few (largely welcome) criticisms that caused me to think about how I am handling things this semester.  In particular, the students wanted more structure throughout the course, desired more focused and reasonable in-class activities, and some desired a greater coverage of risk management.  After careful reflection and discussion with my colleague Dr. Dave Mudgett (who is also teaching SRA 311 this semester), I am tempted to revise my approach for the Spring 2009 offering of SRA 311.  In particular:

• Rather than divide the topics into three parts (fundamentals, risk assessment, and risk management), divide it into two parts (risk assessment and risk management).  The first part will span 7-8 weeks (14-16 lectures beginning with week 2), and will cover the mathematics of risk and techniques for actually reasoning toward judgments of likelihood for threat and vulnerability.  The second part will get into the details of risk management (6-7 weeks, or 12-14 lectures), to include more technical details of what options there are for risk reduction, how to go about assessing benefit, etc.
• I will have in-class problem-based learning activities on alternating Tuesdays, immediately following the quizzes and a very brief lecture.  The PBL activity will be similar to the homework assignment due that same week on the following Thursday.  I will begin this this coming Tuesday with a short exercise looking to identify the sources of uncertainty present in a given risk analysis problem.
• To address concerns that my topics are too oriented toward government-level problems and no private concerns, I will do my best to give a wide range of examples and exercises spanning all types of problems under the umbrella of security risk analysis.  For this, I will appeal to study guides and textbooks on information security, physical security, and other books geared to the generic security professional.
• Many of the reviews commented favorable and unfavorably on my critical article review assignments from both procedural and pedagogical standpoints.  While I have already addresses procedural concerns, I have not yet implemented any changes to my seemingly random approach for selecting CAR assignment articles.  First I must clarify – we do CARs to improve students’ ability to think critically about things they read (a skill necessary for credible analysis).  As of now, each semester I will choose a modern theme with which to base most or all of the CAR articles, thus using each assignment as to present alternative points of view with respect to some on going contentious issue.  This semester I will use the CARs to introduce the debate between proponents of quantitative versus qualitative analysis.  That way I can introduce this debate without having to spend much class time on it.
• And as for the books – I have students read to ensure that (1) are familiar with classic titles on risk analysis, and (2) to provide historical context for risk analysis (e.g., Against the Gods) and some differing perspectives on other topics of risk (e.g., risk communication, risk intelligence, etc.).  Most students thought the books were a good idea, though many did not.  On this issue I do not yield, and in fact, encourage all other SRA instructors to do something similar.

I hope this summary of my thoughts/reflections/etc. is helpful for understanding how and what I am doing in class and why I am doing it.  By getting it on e-paper it was surely helpful for me.

Send article as PDF to

I recently came across a hard-copy of an email I sent to a colleague sometime back in 2004 while I was an ASME Federal Fellow to the Department of Homeland Security.  If my memory serves me correctly, I sent this email in January 2004, or about midway through my tenure in DHS’s Information Analysis and Infrastructure Protection (IAIP) directorate.  Basically, the question was not how to estimate the psychological impact associated with a terrorist attack, but rather what psychological impact means.  After all, definitions precede measurement.  As a reminder, this note was written over 4 years ago when I was less enlightened, or rather, just 6 months after leaving my job as an aerospace structural engineer focused solely on designing the structural subsystems for scientific, non-defense-related spacecraft.  Nonetheless, I felt that posting it here might inspire similar thoughts entertained by others or perhaps even prompt discussion.

A recent lecture in my Political Analysis course [PUAF 620 at the University of Maryland] inspired me to think about “psychological impact” as a form of consequences.  The lecture was on special interest groups, their causes, and the consequences of their existence.  One theory is that special interest groups are created to protect and preserve the rights of its constituency (either natural rights or rights/benefits bestowed on the group from previous legislation).  A special interest group will form (or mobilize) to protect its interests if it feels its rights are being threatened.

Based on what I learned during this lecture, I propose the following definition for psychological impact: “psychological impact is the degree to which an individual or group of individuals perceive they have been deprived of their rights.”

Let’s think about this – if several department stores scattered across the nation are targeted for a coordinated attack [a very common scenario that has provided the basis for numerous thought experiments], following an attack people will feel that their freedom to shop a department stores has been taken away from them.  Similarly, in the wake of September 11, many Americans felt deprived of their freedom to travel by air.  One can come up with a host of other examples.

It is also interesting to consider the collateral economic impacts.  Perhaps coordinated attacks on several department stores will prevent people from shopping anywhere such stores are located.  One might argue that the downstream impact of this behavior could propagate throughout the entire retail industry.  On the flip side, the inability (and unwillingness) to travel by air following 9/11 attacks did not impact the entire transportation industry.  Rather, people who would otherwise fly opted to travel by trains and automobiles.

So how does one assess psychological impact?  For any attack scenario, one must identify how a successful attack might threaten perceived rights and freedoms.  To do this, we must first understand what rights the public thinks it has.  In the two examples above, the focus was on either freedom to shop and freedom to travel.  To prioritize scenarios based on potential psychological impact, we must order all these freedoms according to their perceived importance to the affected public.  This can be done at the national, regional, state, local, sector, etc. level.  Doing so will facilitate cost-benefit tradeoffs (in the descriptive sense).  Proposed countermeasures must demonstrate a tradeoff between the freedoms such policies protect versus the rights they appear to take away.  In the case of the Patriot Act, freedom to live without terrorism is enhanced in exchange for a weakened right to privacy [was there a positive ROI here?].

It would also be interesting to explore how the economy might respond to any perceived loss of freedom.  For example, a perceived loss of freedom to shop will keep people from spending money.  [how does percieved deprivations of freedom correspond to economic impact?]

Now that I had four years to sit on this, I still think that the proposed definition for psychological impact has merit despite the fact that it essentially equates psychology to perceptions, and does not consider such things as PTSD.  But before I or anyone else accepts this definition, more thought is needed on whether it is complete and all encompassing, whether it precisely articulates what we care about, to what degree such a measure is redundant with respect to other measures of loss (economic impact is a function of societal behaviors), and how such impact can be assessed with confidence.   Even now, 5 years after DHS opened its doors, I am sure any answer to the question of measuring psychological impact would be of interest to DHS risk analysts.

I can finally throw the hard-copy of this email out now that it is posted to my blog.  Just another step toward a purely paperless life…

Send article as PDF to