Taquechel, Lewis extend work on quantifying deterrence, incorporate cognitive biases

Continuing their collaboration that began in 2009 at the Naval Postgraduate School Center for Homeland Defense and Security, and extending their previous work on quantifying deterrence published in the Journal of Homeland Security Affairs in 2012, master’s alumnus Eric Taquechel and former CHDS Executive Director Ted Lewis recently published their fifth collaborative article in support of risk management advancement in the September 2016 HSAJ edition, “More Options for Quantifying Deterrence and Reducing Critical Infrastructure Risk: Cognitive Biases.”

The overall goal of this new research was to explain and recommend an approach to support decisions on whether to publicize information about Critical Infrastructure and Key Resources (CIKR) security investments intended to deter attacks, or whether to obfuscate those investments, by considering what the authors called “cognitive biases.”

To accomplish this goal, this paper challenged a central assumption underpinning their 2012 work on quantifying deterrence. That work had assumed Expected Utility Theory (EUT), which holds that people make decisions consistently across how decision space and options are “framed”, applied to the expected utility functions supporting their deterrence quantification methodology. Therefore, their notional deterrence quantification results and risk reduction results assumed adversary decision making would be influenced by EUT.

For the 2016 work, while keeping intact the basic framework of the deterrence quantification approach from 2012, Taquechel and Lewis incorporated insights from Nobel Prize-winning psychologists Daniel Kahneman and Amos Tversky. Kahneman and Tversky showed experimentally that people often make decisions inconsistently depending on changes in frame, in contravention to the tenets of EUT. More specifically, they discovered that people perceived risk differently when prospective outcomes were presented as losses relative to a “reference point”, rather than presented as gains beyond that reference point. They created Prospect Theory (PT) to capture their findings.

Kahneman and Tversky also discovered a phenomenon they dubbed the “certainty effect.” This meant that their subjects generally preferred certain outcomes than probabilistic outcomes. When presented with gains, subjects preferred a certain smaller gain to a larger but probabilistic gain. However, when presented with losses, subjects preferred probabilistic larger losses to certain smaller losses, thus reversing the certainty effect and yielding the term “reflection effect”. Therefore “risk aversion” dominated for gains and “risk-seeking” dominated for losses.

Therefore, Taquechel and Lewis modified their deterrence quantification approach to incorporate lessons learned from Kahneman/Tversky’s experiments, and showed how resultant CIKR risk might change in response to CIKR protection/deterrence investments, in ways that differed from changes assuming EUT. This achieved the incorporation of one type of “cognitive bias” into quantitative deterrence analysis. Also, this resonated with the DHS Risk Lexicon definition of “social amplification of risk” as a “field of study that seeks to systematically link the technical assessment of risk with sociological perspectives of risk perception and risk-related behavior.”

The authors also explored whether information incompletion could influence the quantification of deterrence and resulting CIKR risk, incorporating a second flavor of “cognitive bias.” Different authors in the deterrence theory literature suggest different things: some suggest deterrence is most effective when both parties share a common estimate of the other’s intentions; others suggest ambiguity might actually enhance deterrence.

With this in mind, Taquechel and Lewis proposed a heuristic for analyzing outcomes of deterrence games under conditions of incomplete information. In this case, the attacker would play a different “game” than the defender, since the attacker might create proxies for defender deterrence investments at the CIKR in the game, whereas the defender knew their true investments. They introduced the term “organizational obfuscation bias” to represent attacker bias as influenced by conditions of incomplete information. They also proposed business rules for how to quantify deterrence and create deterrence portfolios under such conditions.

Taquechel and Lewis additionally proposed new definitions of “prospects.” This fit two purposes: (1) to accommodate the possibility that an adversary could prefer the theoretical “equilibrium solution” to a CIKR attack deterrence game and desire an attack on a specific infrastructure with certainty, or rather prefer an “intent ratio” reflecting the outcomes of all possible attack options; and (2) to differentiate prospects of outcomes in game theoretical circumstances from prospects of outcomes not in such circumstances.

The pair their updated methodology in a case study using notional Port Security Grant funding as investments to deter attacks on maritime CIKR, and presented findings and implications for CIKR risk practitioners. The original inspiration for incorporation of PT principles into deterrence quantification was inspired by research from Taquechel’s master’s thesis as CHDS, which itself was inspired by a single reading in Dr. Anders Strindberg’s Unconventional Threat to Homeland Security course. Taquechel’s thesis concluded with Chilton’s claim that “our deterrence strategic and operations need to take our potential opponent’s risk taking propensity into account.” With this and their 2012 research, Taquechel and Lewis consider that claim from a complementary perspective – risk analysis should take deterrence considerations into account.