Awareness that traditional methods of assessing the risk of adversary attack are inadequate seems to be growing. One example is this SRA press release from last month referring to Parnell, Smith, and Moxley’s work. Another example is this DHS announcement.
The problem of assessing the risk of adversary attack is rooted in part in two key principles of conflict and risk identified by Michael Handel in War, Strategy, and Intelligence. The first principle is the reciprocal nature of conflict:
… the reciprocal nature of all action in war means that attempts to grasp its complexities through a static, unilaterally based concept will never succeed…. a realistic approach must consider how one’s adversary interprets the war as well. Thus, perceiving the nature of a war is a reciprocal and dialectic process in which it is important to consider how one side’s perspective and actions affect the other side’s actions and reactions.1
The second principle is what Handel refers to as the “paradoxical nature of the calculus of risk”:
Superficially, it is rational to assume that very high risk strategies, whose apparent chances of success are low, are normally unacceptable whereas lower risks would be readily taken. In reality, such assumptions may be less than rational: an attacker can calculate that because attacking at a certain place or time would involve high costs, his adversary would rationally conclude that the probability of choosing this strategy is extremely low. Paradoxically then, option for a high-risk strategy might be less foolhardy than is first assumed.2
He notes as well that
… the idea that something ‘cannot be done’ is one of the main aids to surprise …. Experts tend to forget that most military problems are soluble provided one is willing to pay the price.’ But once someone is prepared to pay a high price, it may be added, his price is actually reduced. This leads to the following paradox: ‘The greater the risk, the less likely it seems to be, and the less risky it actually becomes. Thus, the greater the risk, the smaller it becomes.’3
Reciprocal net assessment (RNA), is designed to address these issues by explicitly modeling (1) the reciprocal and dynamic nature of conflict and (2) differences between the opponent’s perceptions. RNA is based on hypergame analysis, an extension of game theory in which the players are free to perceive different games. That said, an analyst does not need to understand game theory or hypergame analysis to apply RNA; all that is needed is an understanding of these five basic concepts:
- Any player may perceive or misperceive the other players’ options, preferences, and intent;
- What each player perceives or misperceives influences each player’s intent;
- Perceptions are based on information and awareness;
- Perceptions can be manipulated; and
- A player who perceives an opponent’s misperception secures an advantage.
In the coming months and years I am certain we will see other approaches emerge as decision makers and analysts recognize the problem and acknowledge the limitations of existing methods. Until then, analysts and decision makers must be cautious when applying the results of more traditional risk assessment methods.
Dr. Mark Mateski is the founder of Red Team Journal.