Risk Analysis, Vol. 36, No. 4, 2016

DOI: 10.1111/risa.12318

On the Effectiveness of Security Countermeasures for Critical Infrastructures Kjell Hausken1,∗ and Fei He2

A game-theoretic model is developed where an infrastructure of N targets is protected against terrorism threats. An original threat score is determined by the terrorist’s threat against each target and the government’s inherent protection level and original protection. The final threat score is impacted by the government’s additional protection. We investigate and verify the effectiveness of countermeasures using empirical data and two methods. The first is to estimate the model’s parameter values to minimize the sum of the squared differences between the government’s additional resource investment predicted by the model and the empirical data. The second is to develop a multivariate regression model where the final threat score varies approximately linearly relative to the original threat score, sectors, and threat scenarios, and depends nonlinearly on the additional resource investment. The model and method are offered as tools, and as a way of thinking, to determine optimal resource investments across vulnerable targets subject to terrorism threats. KEY WORDS: Game theory; government; protection; resource allocation; terrorism; threat; threat score

1. INTRODUCTION

The role of game theory has gained increased significance in risk analysis where several players have opposed preferences. Guikema and Aven(1) provide various perspectives for assessing risk from intelligent attacks. The literature can be classified according to system structure, defense measures, and attack tactics and circumstances.(2) In this article, the system structure is a finite number of targets, the defense measure is protection, and attack tactics and circumstances are threats against multiple targets. For structures with multiple elements, Bier et al.(3) show that “if one component is more valuable than another, but has a lower probability of being attacked, then the more vulnerable but less valuable component may be more likely to be attacked, and hence merit greater investment.” Such insights illustrate that it may not be immediately obvious which targets should be more protected than others, since a variety of concerns may pull in different directions to determine resource allocation. Our article accounts broadly for such concerns by modeling target

Resource allocation across targets is essential to protect against terrorism threats. We develop a game where a terrorist provides threats against targets. A government protects the targets and estimates an original threat score for each of them. The government subsequently assesses how to allocate resources into additional protection to reduce the threat score. This conceptualization is relevant from a policy perspective where acceptable threat scores are determined politically. This raises the research question, analyzed in this article, of which factors impact threat scores. 1 Faculty

of Social Sciences, University of Stavanger, Stavanger, Norway. 2 Department of Mechanical and Industrial Engineering, Texas A&M University–Kingsville, Kingsville, TX, USA. ∗ Address correspondence to Kjell Hausken, Faculty of Social Sciences, University of Stavanger, 4036 Stavanger, Norway; tel: +47-51-831632; fax: +47-51-831550; [email protected].

711

C 2014 Society for Risk Analysis 0272-4332/16/0100-0711$22.00/1 

712 valuations linked to resource allocation and unit effort costs. In further related research, Powell(4) analyzes defense allocation across multiple sites before an attacker chooses where to attack; Patterson and Apostolakis(5) rank geographic regions to allow decisionmakers to determine critical locations susceptible to terrorist attacks; Bier et al.(6) allocate resources for defense of targets based on differing mea´ sures of attractiveness; Pate-Cornell and Guikema(7) determine priorities among countermeasures against terrorist threats; Michaud and Apostolakis(8) rank the elements of water-supply networks; Levitin(9) considers defense against intentional attacks; Brown et al.(10) provide interdiction models; attacker– defender models, and defender–attacker–defender models; Reniers and Soudan(11) consider reciprocal security-related prevention investment decisions; and Haimes et al.(12) balance protection with resilience in emergent systems. For research where one player protects or attacks each target in a structure, see Hausken,(13) Kunreuther and Heal,(14) and Zhuang et al.,(15) and for protection and attack of entire structures, see Hausken.(16) In this article, a game-theoretic model between a government and a terrorist is developed. It is often common to consider a sequential game assuming that the defender allocates defenses over a longer time period than the duration of the adversary’s attack planning and execution. A second possibility is a simultaneous move game. A third possibility is a sequential game where the terrorist attacks first, and a government defends thereafter, exemplified by emergency response. See Hausken and Levitin(17) for a review of such games, and Hausken et al.(18) for a comparison of these three types of games. In this article, we analyze the simultaneous move game for the following reasons. We analyze threats, or more specifically a terrorist’s resource allocation into threats against multiple targets, which expresses the relative likelihood that a given target is selected. This stands in contrast to models where a terrorist allocates and deploys resources into actual attacks against one or several targets. An infrastructure may have billions of targets depending on how targets are counted. Some targets (e.g., office buildings, private property) may experience no or negligible threat, whereas other targets (e.g., of high symbolic, human, or economic value) may experience a high threat. Threat assignments are not linked to a terrorist’s attack planning and execution in the same manner as resource allocation into actual attacks. Threat

Hausken and He assignments can be hypothesized by a government before the terrorist exists, or a government may allocate its defense across targets accounting for hypothesized threat assignments across targets. For threat assignment, as opposed to resource deployment into actual attacks, it seems unclear that we can specify whether one player moves first since they adapt to each other without a clear notion of who made the first adaptation. Furthermore, the simultaneous game allows us to solve the game analytically for contest intensities differing from one for each target. Section 2 presents the model. Section 3 solves the model and interprets the solution. Section 4 verifies the model empirically. Section 5 conducts multivariate regression analysis of the empirical data. Section 6 provides concluding remarks. 2. THE MODEL Consider an infrastructure with N targets. Each target i is valued as si by the terrorist and as Si by the government, i = 1, . . . , N. Assume an exogenous threat ti against target i, and original exogenous protection Ti . We define a threat score as a number between 0 and 1 that accounts for threat and vulnerability. Appendix A shows the nomenclature used in the article. We interpret the original threat score of target i using the ratio contest success function,(19,20) i.e., pi =

timi

timi , + (Ti + Di )mi

(1)

where Di is the inherent protection level (see, e.g., Hausken and Zhuang(17) for use of the inherent protection level), and mi ࣙ 0 is the contest intensity, sometimes referred to as a decisiveness parameter, with ∂ pi /∂ti > 0, ∂ pi /∂ Ti < 0.(21) The contest intensity expresses how intensely or decisively the terrorist and government fight to ensure high and low threat scores, respectively. A high mi expresses high intensity where exerting slightly higher effort than one’s opponent is paramount, whereas a low mi expresses low intensity where fighting has low impact. As the threat ti increases relative to the protection Ti +Di , the threat score increases. Equation (1) thus expresses the players’ success in obtaining their objectives, i.e., high threat score for the terrorist and low threat score for the government.3 3 For

Equation (1), common in the rent-seeking literature, see Tullock(20) for the use of m, Skaperdas(19) for axiomatization,

Effectiveness of Security Countermeasures

713

Relative to the original protection Ti +Di , assume that the government has resources Ri , which can be allocated to target i at unit cost (of protection effort) Ai , causing additional protection Qi , where Ai Qi ≤ Ri

(2)

and inducing a decreased final threat score qi =

timi

timi + (Ti + Di + Qi )mi

(3)

where Qi is the government’s strategic decision variable. The unit conversion cost Ai pertains to the organizational efficiency, human competence, technological efficiency and capacity, and natural factors by which the government converts resources Ri (e.g., money), thus impacting the actual protection Qi . We express the terrorist’s and government’s expected utilities after the additional protection Qi as: u=

N 

qi si =

i=1

U=

N 

t mi i=1 i

N N   (1 − qi )Si = i=1

i=1

timi si , + (Ti + Di + Qi )mi

(Ti + Di + Qi )mi Si ,(4) timi + (Ti + Di + Qi )mi

respectively. Although si and Si are target valuations, the multiplication with qi and 1-qi means that the expected utilities can be interpreted as degrees of success for the players in obtaining their objectives, for example, in the sense that the targets can be partly destroyed. An alternative interpretation is that si and Si are expected consequences. Equation (4) expresses for each target i that if the terrorist succeeds (which is with probability qi ), he gets si , and 0 otherwise. Analogously, for each target i, if the government succeeds (which is with probability 1-qi ), it gets Si , and 0 otherwise. The terrorist has resources r, which can be allocated across the N targets to generate a threat ti at unit cost ai against target i, and the government has resources R, which, according to Equation (2), can be allocated as Ai Qi to each of the N targets, i.e., N  i=1

ai ti ≤ r,

N 

Ai Qi ≤ R.

(5)

i=1

Nitzan(22) for a review, Hirshleifer(21) for illustration, and Hausken and Levitin(23) for an application to risk.

The resources R and r can be of all possible kinds, but since R and r are scalars, the resources are joined together to be expressed as single numbers. In the remainder of the article, we assume that the resource constraints in Equations (2) and (5) are binding. First, terrorists are often by nature resource constrained and intent on causing maximum harm. Also, governments are often budget constrained in the sense that limited budgets are allocated at the national level to different areas, and those in charge of each area such as, for example, terrorism protection are often intent on maximum protection irrespective of whether the last invested resources might be better invested in other areas. Second, solving the model without resource constraints means that each player weighs benefits of investments against costs across all targets, which gives an additional strategic choice variable for each player and an equally large new analysis. The two analyses often give qualitatively similar results. See Hausken and Levitin(24) for an example where both analyses are conducted in the same paper. When verifying the model empirically in Section 4, these numbers are monetized as $US. The interpretation of ai is analogous to the interpretation of Ai . That is, organizational, technological, and natural factors impact how the terrorist converts resources into a given threat. The terrorist has N-1 free choice variables t1 , . . . ,tN-1 , where tN follows from Equation (5). Analogously, the government has N-1 free choice variables Q1 , . . . ,QN-1 , where QN follows from Equations (2) and (5). The two agents choose their strategic decision variables independently and simultaneously. We analyze a complete information game, as is common in game theory, where the parameters r, R, Ri , Di , Ti , ai , Ai , si , Si , N, mi , i = 1, . . . , N are common knowledge. In practice, some of these may not be known, but we assume that they can be obtained from public or confidential records, or estimated by experts, or obtained from whistleblowers or through spying, or from former or imprisoned terrorists through interrogation. Assuming common knowledge gives powerful analytical results. Future research can assume that some parameters, e.g., the target valuations si and Si , are probabilistically known, which gives a more complicated analysis. The target values si and Si can have economic, human, and symbolic values, monetized as scalar numbers. The players’ risk attitudes are implicit in si and Si .

714

Hausken and He

3. SOLVING THE MODEL The game theoretic optimization problem is: max u,

t1 ,···,t N−1

max

Q1 ,···,QN−1

U.

(6)

Appendix 2 determines the solution, which is:  mi i W) mi si Aaii/(S /(si r )   mi 2 Ai /(Si W) 1 + a /(s r ) 1/si i i Qi =  mi − Ti − Di , Ai /(Si W) Ai /(Si W) m s i i N ai /(si r )  mi 2 i=1  i W) 1 + Aaii/(S /(si r )

ti = (Ti + Di + Qi ) 

Ai /(Si W) ai /(si r ) mi

i W) mi si Aaii/(S /(si r )   mi 2 i W) 1 + Aaii/(S /(si r ) r =  mi , Ai /(Si W) ai m s i i N ai /(si r )  mi 2 i=1  i W) 1 + Aaii/(S /(si r )

 N Ai (Ti + Di + Qi ) si i=1 Si

(7)

(8)

is the government’s resourcefulness, influenced by the government’s original resource protection Ai (Ti + Di ) summed over all targets, and the government’s additional resource protection Ai Qi summed over all targets. For each target i, the government’s resourcefulness is negatively influenced by its own target valuation Si , since a valuable target is a vulnerability, and positively influenced by the terrorist’s target valuation si , since a valuable target for the terrorist is a strength for the government and the terrorist fights for such a target. Inserting Equation (7) into Equation (4) yields:  mi Ai /(Si W) N  ai /(si r ) u= mi si ,  Ai /(Si W) i=1 1 + ai /(si r ) U=

N  i=1

1+



1 Ai /(Si W) ai /(si r )

mi Si .

Equations (7), (9), and (10) contain the term which expresses how the government and terrorist are “matched against each other” for target i W) i. More specifically, Aaii/(S expresses the ratio of the /(si r ) government’s unit protection cost to resourcefulness i , dimultiplied by the target valuation for target i, SA iW vided by the analogous ratio of the terrorist’s unit attack cost to resources multiplied by target valuation, ai i W) . The government prefers a low ratio Aaii/(S and si r /(si r ) is referred to as advantaged when this ratio is below 1, and conversely for the terrorist. Ai /(Si W) , ai /(si r )

Proposition 1. Assume that Equation (10) is satisfied.

where W=

The second-order conditions are valid when: 1/mi  Ai /(Si W) i −1 > m , ai /(si r ) mi +1 (10) i W) 1/mi (mi − 1)1/mi Aaii/(S < (m + 1) . i /(si r )

(9)

(a) ∂Qi /∂W> 0, ∂Qi /∂Ai < 0, ∂Qi /∂Si > 0. i W) When Aaii/(S < 1, then ∂Qi /∂r> 0 /(si r ) and ∂Qi /∂ai < 0 and∂Qi /∂si > > 0. (b) ∂Qi /∂W> 0, ∂Qi /∂Ai < 0, ∂Qi /∂Si > 0. i W) When Aaii/(S < 1, then ∂Qi /∂r> 0 and /(si r ) ∂Qi /∂ai < 0 and ∂Qi /∂si > 0. i W) > 1. ∂u/∂r> 0, (c) ∂u/∂mi > 0 when Aaii/(S /(si r ) ∂u/∂ai < 0, ∂u/∂si > 0, ∂u/∂W < 0, ∂u/∂Ai > 0, ∂u/∂Si < 0. i W) (d) ∂U/∂mi > 0 when Aai i/(S < 1. ∂U/∂W> 0, /(si r) ∂U/∂Ai < 0, ∂U/∂Si > 0, ∂U/∂r < 0,∂U/∂ai > 0, ∂U/∂si < 0. Proof. Follows from differentiating Equations (7) and (9). For the terrorist, Proposition 1(a) states that the threat ti against target i increases when its resources r and asset valuation si increase, and decreases when its unit cost of effort ai increases. Furthermore, when i W) the terrorist is advantaged with a large ratio Aaii/(S , /(si r ) the terrorist’s threat ti increases when the government’s resourcefulness W and the government’s target valuation Si increase, due to being advantaged and fighting an increasingly resourceful government, and decreases when the government’s unit cost Ai increases, due to being advantaged but unwilling to incur the increasing cost. For the government, Proposition 1(b) states that the additional protection Qi for target i increases when its resourcefulness W and asset valuation Si increase, and decreases when Ai increases. When the

Effectiveness of Security Countermeasures i W) government is advantaged with a low ratio Aaii/(S , /(si r ) Qi increases when r and si increase, and decreases when ai increases. Summing up, a player’s effort increases in his resources and target valuation, and decreases in his unit effort cost. When a player is advantaged, his effort increases in his own resources and target valuation, and decreases in the other player’s unit effort cost. For the terrorist, Proposition 1(c) states that the expected utility u increases when its resources r, asset valuation si , and the government’s unit cost Ai increase, and decreases when its unit cost of effort ai and the government’s resourcefulness W and target valuation Si increase. Furthermore, u increases in the contest intensity mi when the terrorist is advantaged i W) with Aaii/(S > 1. /(si r ) For the government, Proposition 1(d) states that the expected utility U increases when its resourcefulness W, asset valuation Si , and the terrorist’s unit cost ai increase, and decreases when its unit cost of effort Ai and the terrorist’s resources r and target valuation si increase. Finally, U increases in the contest intensity mi when the government is advantaged with Ai /(Si W) < 1. ai /(si r ) Summing up, a player’s expected utility increases in his resources, target valuation, and the other player’s unit effort cost, and decreases in the other player’s resources, target valuation, and his own unit effort cost. An advantaged player prefers a large contest intensity.

4. VERIFYING THE MODEL WITH EMPIRICS We use data received from the Wisconsin Department of Military Affairs, shown in the six left columns (to the left of the vertical solid line) in Table I, with N = 25 targets, Sector Se and Threat scenario Ts (just one threat scenario at each sector) for each target i, additional resource investment Ai Qi , original threat score pi , and final threat score qi . The original and final threat scores were generated by an assessment tool that was developed from a subject matter expert’s evaluation of a combination of threat, vulnerability, and consequence. The original threat score was produced from an assessment before the grant was issued. The final threat score was from an assessment after the grant was issued. The data assume just one threat scenario, the most plausible one, at each sector. Model results are shown to the right of the vertical solid line.

715 Although r, R, Ri , Di , Ti , ai , Ai , si , Si , N, mi , i = 1, . . . , N are common knowledge for the players when they play the game, they need to be estimated by us as researchers to apply the analytical solution in Section 3. Our starting point is Ai Qi , pi , qi , which is empirically known in Table I (provided by the Wisconsin Department of Military Affairs). To estimate the remaining parameters, we proceed as follows. Our estimation is as simple and straightforward as possible, intended to be illustrative but also to provide a tool for similar analyses. First, we eliminate tim from Equations (1) and (3) (Appendix C), which gives:  1/mi pi ) Ai Qi qpii(1− (1−qi ) (11) Ai Ti + Ai Di = 1/mi .  pi ) 1 − qpii(1− (1−qi ) Inserting W in Equation (8) into Q in Equation (7) and rearranging gives: Si Ai Qi = si

  N N  si  si Ai Qi + (Ai Ti + Ai Di ) Si Si i=1 i=1

⎛

⎞m

Ai /(Si W) i ⎠ ai /(si r ) ⎛ ⎛ ⎞m ⎞2 Ai /(Si W) i ⎝1+⎝ ⎠ ⎠ ai /(si r ) − (Ai Ti + Ai Di ). (12) ×

Ai /(Si W) mi mi si N ai /(si r )

2 i=1 Ai /(Si W) mi 1+ ai /(si r ) mi si ⎝

Inserting Equation (11) into Equation (12) and rearranging terms gives:  mi i W) mi si Aaii/(S /(si r )   mi 2 i W) 1 + Aaii/(S /(si r ) Ai Qi (M) =  mi Ai /(Si W) m s i i N ai /(si r )  mi 2 i=1  Ai /(Si W) 1 + ai /(si r )  

si N AQ qi (1 − pi ) 1/mi Si  Si i i × 1− 1/mi ,  pi (1 − qi ) si qi (1− pi ) i=1 1 − pi (1−qi ) (13) where (M) in brackets on the left-hand side refers to the resource investment predicted by the model, and Ai Qi on the right-hand side refers to the resource investment provided by the data in Table I. For N equivalent targets, and assuming that both players

716

Hausken and He Table I. The Empirical Data and Estimated Parameters for the 25 Targets

Ta

Se

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

Ha Ha Ha Ha G Ha Tr W W C G Ha G W W C W Ha Ha Ha C W Tr W W

Ts

E E E E E E EH B B E E E E B B E B E E E E B H B B

Ai Qi

pi

qi

Ai Ti + Ai Di

σ Ai /W ai /r

Ai Qi (M)

ai ti (M)†

78.74* 238.53* 82.65* 82.65* 142.65* 9.62 39.9 40 43 50 83.82 129.2 130.86 148.6 150 160.55 174.49 184.59 184.59 195.32 198 250.31 415 430 485

0.5538 0.5331 0.5105 0.4944 0.4531 0.5362 0.4508 0.4455 0.4455 0.4028 0.4449 0.432 0.4889 0.4528 0.5041 0.4028 0.463 0.473 0.4622 0.432 0.4302 0.4423 0.3928 0.4455 0.4795

0.432 0.4455 0.4302 0.4028 0.3928 0.4428 0.4302 0.3928 0.3928 0.3755 0.3928 0.3928 0.4123 0.3928 0.4423 0.3628 0.4028 0.432 0.4028 0.3928 0.3755 0.3857 0.3857 0.432 0.4455

124.613 566.391 216.751 183.762 508.206 21.153 457.622 165.319 177.718 410.712 350.794 735.354 360.001 532.335 532.370 869.636 626.057 1024.960 673.163 1111.693 774.480 951.283 13688.980 7629.902 3307.739

0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.02 0.2 0.1 0.02

150.49 348.91 112.62 126.57 154.33 14.84 15.79 38.46 41.35 26.78 79.79 95.30 172.20 160.07 162.76 123.50 187.52 139.04 196.07 144.08 198.99 257.38 435.48 486.81 306.13

5.50 18.31 6.59 6.21 13.25 0.72 9.47 4.08 4.38 8.75 8.61 16.61 10.64 13.85 13.90 19.86 16.29 23.28 17.38 25.12 19.47 24.17 2824.89 811.67 72.28

Notes: Ta = Target, Se = Sector (Ha = Hazardous materials, G = Government, Tr = Transportation, W = Water, C = Commercial), Ts = Threat scenario (E = Explosive device (large vehicle borne/cargo size), EH = Explosive device (human carried/backpack size), B = Biological attack (toxin), H = Hostile takeover, kidnapping, hi/sky-jacking). Ai Qi is expressed in thousands of $US. The star * in the column for Ai Qi for targets 1–5 means that Ai Qi was estimated by regression analysis of the data of targets 6–25, which gives Qi Ai = exp (39.08qi − 25.18 pi + 0.0034 · Ps + 0.041 · Pt ) for i = 1, . . . ,5. †, when Ai = ai .

treat and value all targets equivalently, Equation (13) simplifies to Ai Qi (M) = Ai Qi with the same value for all targets. The lack of data from the Wisconsin Office about parameter values prevents verifying the model unless we make two assumptions. These two assumptions do not impact how players play the complete information game, but impact how we verify the game. First, we assume Si = CAi Qi , where C is a constant, which means that the government’s valuation for target i is proportional to the government’s resource investment for target i. This assumption seems reasonable since the government usually does not invest substantially to protect targets of low value, and usually does not leave highly valued targets unprotected. Second, we assume si = σ Si , which means a fixed proportionality parameter σ between the two players’ target valuations si and Si . This assumption seems reasonable since a certain valuation by one

player can usually be expected to be reflected in a certain valuation by the other player. These two assumptions may be replaced with other assumptions in order to verify the model with alternative data availability. Inserting the two assumptions into Equation . (13) implies 25 unknown mi and 25 unknown Aaii/W /r We choose these 50 unknown values to minimize the sum of the following squared differences, i.e.: SSD =

N 

(Ai Qi (M) − Ai Qi )2 ,

(14)

i=1

where Ai Qi (M) is the government’s additional resource investment given by the model’s solution in Equation (14) and Ai Qi is given empirically by Table I. Appendix D shows that lim Ai Qi (M) = N

Si

si i=1 Si Ai Qi N i=1 si

mi →0

, which simplifies to lim Ai Qi (M) = mi →0

Ai Qi when si = σ CAi Qi . For simplicity, we assume

Effectiveness of Security Countermeasures mi = 1 for i = 1, . . . , 25 which gives Ai Ti + Ai Di determined by Equation (11) shown in the fourth column from the right in Table I. For computer to take tractability, we allow the 25 unknowns Aaii/W /r three values, 0.02, 0.1, and 0.2, reasoning that the government’s resourcefulness W may well be 50 times larger than the terrorist’s resources r when ai = Ai and si = Si . The sum of the squared differences has (SSD) in Equation (14) is minimized when Aaii/W /r the values shown in the third column from the right in Table I, i.e., 0.2 for target 23, 0.1 for target 24, and 0.02 for all other targets. The government’s resource investment Ai Qi (M) determined by Equation (13) is shown in the second column from the right, and the terrorist’s resource investment ai ti (M) = , using Equations (7) (Ai Ti + Ai Di + Ai Qi (M)) Aaii/W /r and (13) and assuming ai = Ai , is shown in the rightmost column. Target 23 has the third largest resource investment (Ai Qi = 485), but negligible improvement in threat score (pi -qi = 0.0071). This causes very large Ai Ti + Ai Di from Equation (11), large Ai /W = 0.2, large Ai Qi (M) from Equation (13), and ai /r very large ai ti (M). Target 7 has the third lowest pi qi = 0.0206, which also causes high Ai Ti + Ai Di and the second lowest Ai Qi (M). Target 1 has the highest decrease in threat score (pi -qi = 0.1218) and reasonably low Ai Qi . This causes a comparably higher predicted Ai Qi (M). A similar logic applies for target 2, which has the fourth highest pi -qi = 0.0876 and high Ai Qi , causing the third highest Ai Qi (M). With more complete empirical data for the target valuations si and Si , for the unit costs ai and Ai , for the government’s resourcefulness W and the terrorist’s , and for the origresources r, which determines Aaii/W /r inal resource protection Ai (Ti + Di ), Equation (7) can be used directly to predict the government’s and terrorist’s strategically chosen resource investments Ai Qi (M) and ai ti (M).

717 the final threat score q, the additional resource investment AQ, the sector, and the threat scenario. The final threat score is positively correlated with the original threat score (e.g., row 2, column 1), and is U-shaped in the additional resource investment (e.g., row 2, column 3). The final threat score depends to a low degree on sector (e.g., row 2, column 4) and threat scenario (e.g., row 2, column 5). The sector depends linearly on the threat scenario (row 4, column 5). The threat scenario is approximately positively linear, and correlated with the sector (row 5, column 4). More specifically, the original threat score p varies horizontally in column 1 and vertically in row 1. The final threat score q varies horizontally in column 2 and vertically in row 2. The government’s additional resource investment AQ varies horizontally in column 3 and vertically in row 3. The sector varies horizontally in column 4 and vertically in row 4. The threat scenario varies horizontally in column 5 and vertically in row 5. The dashed green lines are based on linear regression, shown in 20 panels, i.e., all panels except the diagonal panels. The thick red solid curves are based on generalized additive model fitting through the data points. These are linear in seven of the panels where they coincide with the dashed green lines, nonlinear in five of the panels, absent in eight panels since the model cannot find a fit for those points, and absent on the five diagonal panels. The solid black curves on the diagonal panels show the distribution density of data points (using the software www.r-project. org). We now proceed to analyze the data shown in Table I more thoroughly to determine the following multivariate regression model: q = 0.818 · p + 0.0110 · log(AQ) − 0.000307 · Ps −0.000195 · Pt ,

(15)

where 5. MULTIVARIATE REGRESSION ANALYSIS OF THE EMPIRICAL DATA

Ps =

Using the data of additional resource investments Ai Qi in each sector Se under a certain scenario Ts, the original threat scores pi , and the final threat scores qi , shown to the left of the vertical solid line in Table I, we now proceed to explore the relations between these factors. Fig. 1 shows the empirical data in Table I as empty circles in 25 panels, i.e., five rows and five columns. Furthermore, we show the correlations between the original threat score p,

Pt =



( pi − qi ) , s = {Ha, G, Tr , W, C},

i∈s



( pi − qi ) , t = {E, EH, B, H},

i∈t

Ha = {1, 2, 3, 4, 6, 12, 18, 19, 20}, G = {5, 11, 13}, Tr = 7, 23}, W = {8, 9, 14, 15, 17, 22, 24, 25}, C = {10, 16, 21}; E = {1, 2, 3, 4, 5, 6, 10, 11, 12, 13, 16, 18, 19, 20, 21},

718

Hausken and He

Fig. 1. Scatterplot between the original threat score p, the final threat score q, the additional resource investment AQ, the sector Ps , and the threat scenario Pt . The empty circles are the data points from Table I. The linear regression lines are dashed in green (colors visible in online version). The thick red solid curves are based on generalized additive model fitting. The solid black curves on the five diagonal panels from upper left to lower right show the distribution density of data points.

EH = {7}, B = {8, 9, 14, 15, 17, 22, 24, 25}, H = {23},

(16)

where Ps is the sector coefficient, Pt is the threat scenario coefficient, s is a vector

comprising five vectors for the five kinds of sectors, and t is a vector comprising four vectors for the four kinds of threat scenarios, numbering targets as 1, . . . , 25 in Table I. Using Table I, Equation (16) gives PHa = 53.17, PG = 18.90, PW = 39.15, PC = 12.20, PTr

Effectiveness of Security Countermeasures = 2.77, PE = 96.45, PEH = 2.06, PB = 39.15, and PH = 0.71. The multiple R2 value of regression model is 0.9986. The large coefficient 0.818 in Equation (15) shows that the original threat score p has a significant influence on the final threat score q. The equivalence of Equations (1) and (3) when Qi = 0 provides some intuition for a large coefficient between p and q, but the relative size of the coefficient compared with the other coefficients is interesting, and depends crucially on the data and, of course, on Qi . The lower coefficient 0.0110 shows that the additional resource investment AQ has comparably less impact on q. The low coefficients 0.000307 and 0.000195 show that the sector and threat scenario have relatively low impact. For the two latter, the hazard materials sector (53.17) and the threat scenario explosive device (large vehicleborne/cargo size; 96.45) have higher impact on q than the transportation sector (2.77) and the threat scenario hostile takeover/kidnaping/hijacking (0.71). The p-values for the four (explanatory) independent variables are: 1.74e-14 for the original threat score p; 0.0029 for the additional resource investment AQ; 0.19 for the sector coefficient Ps ; and 0.085 for the threat scenario coefficient Pt . That is, the original threat score p is highly significant, and the additional resource investment AQ is also significant. The sector coefficient Ps and the threat scenario coefficient Pt are not significant. An equation like Equation (15) would enable a government to determine the investment needed to get a certain final threat score q, more generally than the specific qs given empirically in Table I, when the original threat score p, additional resource investment AQ, sector coefficient Ps , and threat scenario coefficient Pt are given using Equation (16) and the data in Table I. With the availability of more voluminous data, Equation (15) can be developed for each sector, for each threat scenario, or for combinations of sectors and threat scenarios. Fig. 2 shows the data as 25 red unfilled circles plotted as (p, q) with a number for each target in Table I. Using Equation (15), the fitted model values are plotted as 25 blue unfilled triangles for each target with a prime (‘) after a number to express fitted value. Consistently with the large coefficient between p and q in Equation (15), the empirical data and estimated parameters are spread along the diagonal from lower left to upper right (which suggests

719

Fig. 2. Red circles (colors visible in online version) show the data in Table I with a number for each target. Blue triangles show the fitted model values with a prime (‘) after the number.

that the original threat score p substantially influences the final threat score q). The data off the diagonal reveal the extent to which other factors than p impact q, i.e., AQ, Ps , and Pt . Fig. 3 shows how the final threat score q marked in shades of gray from black for q = 0.36 via gray and light gray to white for q = 0.45, as a function of the original threat score p along the horizontal axis and resource investment AQ along the vertical axis, based on the empirical data in the left panel a, and based on the fitted model in Equation (15) in the right panel b. As we know, the final threat score qi increases as the original threat score pi increases. However, the final threat score does not decrease monotonically or increase as the government’s resources increase. More specifically, increasing the government’s resources decreases the threat score for low levels of AQ and increases the threat score for high levels of AQ. Regression analyses ignoring sector and threat scenario, and considering p-q, gives q = 0.749 · p + 0.0125 · log( AQ) and p − q = 0.1839 · p − 0.01122 · log(AQ) − 0.00030 · Ps − 0.000198 · Pt , respectively, with results similar to Figs. 2 and 3.

720

Hausken and He

Fig. 3. Final threat score q in shades of gray (from white for q = 0.45 to black for q = 0.36), as a function of p and AQ. (a) From empirical data. (b) From Equation (15).

6. CONCLUSION A game-theoretic model is developed where an infrastructure of N targets is protected against terrorism threats. Each target has original and inherent protection and is subject to a terrorism threat that determines an original threat score for that target. The government chooses optimal additional protection, which decreases the risk, causing a final threat score for each target. The government has finite resources allocated optimally across the targets. Analogously, the terrorist allocates his finite resources optimally across the targets to determine the optimal threat against each target. We find that a player’s effort increases as his resources and target valuation increase, and decreases as his unit effort cost increases. The effort for an advantaged player increases in his own resources and target valuation, and decreases in the other player’s unit effort cost. A player’s expected utility increases in his resources, target valuation, and the other player’s unit effort cost, and decreases in the other player’s resources, target valuation, and his own unit effort cost. An advantaged player prefers a large contest intensity. We use data from the Wisconsin Department of Military Affairs, which, for each of 25 targets, shows sector, threat scenario, additional resource investment, and original and final threat scores. Using the

available empirical data, we finally estimate the unknown parameter values in the game model by minimizing the squared differences between the additional resource investment predicted by the model and determined by the data. The model and method constitute tools, and ways of thinking, as we assess resource investments across targets subject to terrorism threats. A multivariate regression model is developed and verified with final threat score as the dependent variable, and original threat score, additional resource investment, sector, and threat scenario as four independent variables. We find that the final threat score varies approximately linearly and positively relative to the original threat score, depends nonlinearly on the additional resource investment, and is relatively independent of sector and threat scenario. The original threat score substantially influences the final threat score, the additional resource investment has less impact, and the sector and threat scenario have low impact. We conduct two alternative regression analyses, first with the difference between original and final threat score as the dependent variable, and second omitting sector and threat scenario. The results provide similar insights. Future research should consider further combinations of which variables are independent versus dependent in the analysis (see, e.g., Gelman and Hill(25) ).

Effectiveness of Security Countermeasures With the availability of more empirical data than what is available for this study, the game and regression models provided in this article can be more accurately verified in future research. Furthermore, various data-mining methods can be applied to unveil possible relations between countermeasure effectiveness, investment effort and other related factors. ACKNOWLEDGMENTS We thank Greg Engle of the Wisconsin Department of Military Affairs (earlier Wisconsin Office of Justice Assistance) and Vicki Bier for providing the empirical data. We thank two anonymous referees of this journal, Vicki Bier, Jun Zhuang, and participants at the University of Buffalo conference “Validating Models of Adversary Behavior,” Buffalo, June 24–26, 2013, for useful comments. In particular, we thank Vicki Bier and Jun Zhuang for carefully thought out exercise problems and data sets that initiated the development of this article. This research was partially supported by the U.S. Department of Homeland Security (DHS) through the National Center for Risk and Economic Analysis of Terrorism Events (CREATE) under award number 2010-ST-061-RE0001. This research was also partially supported by the U.S. National Science Foundation (NSF) award number 1334930. APPENDIX A: NOMENCLATURE Variables ti terrorist’s threat against target i Qi government’s additional protection for target i, beyond Ti

u=

t1m1

721 W pi

government’s resourcefulness original threat score for target i (based on ti and Ti ) qi final threat score for target i (based on ti , Ti , and Qi ) p original threat score in regression model q final threat score in regression model AQ additional resource investment in regression model u terrorist’s expected utility U government’s expected utility Parameters r terrorist’s resources R government’s resources for additional protection Ri government’s resources for additional protection for target i Di government’s inherent protection level Ti government’s original exogenous protection for target i ai terrorist’s unit cost of effort for target i Ai government’s unit cost of effort for target i si terrorist’s valuation of target i Si government’s valuation of target i N number of targets mi terrorism contest intensity for target i Ps sector coefficient in regression model Pt threat scenario coefficient in regression model Ta target, numbered i = 1, . . . , N Se sector Ts threat scenario APPENDIX B In order to differentiate with respect to t1 and Q1 for the first target, we write the expected utilities in Equation (4) as:

t1m1 s1 + (T1 + D1 + Q1 )m1

N−1 

timi si t mi + (Ti + Di + Qi )mi i=2 i  mN  N−1 r − a1 t1 − i=2 ai ti aN + mN  mN s N ,  N−1  N−1 r − a1 t1 − i=2 ai ti Ai Qi R − A1 Q1 − i=2 + TN + DN + aN AN +

722

Hausken and He

U=

N−1  (Ti + Di + Qi )mi (T1 + D1 + Q1 )m1 Si mi m1 S1 + + (T1 + D1 + Q1 ) t + (Ti + Di + Qi )mi i=2 i  mN  N−1 R−A1 Q1 − i=2 Ai Qi TN + DN + AN + mN  mN SN .  N−1  N−1 r −a1 t1 − i=2 ai ti R−A1 Q1 − i=2 Ai Qi + TN + DN + aN AN

t1m1

(B1)

The first-order conditions for target 1 are: m1 s1 t m1 −1 (T1 + D1 + Q1 )m1 ∂u = m1 1 ∂t1 (t1 + (T1 + D1 + Q1 )m1 )2  mN −1  mN  N−1  N−1 r −a1 t1 − i=2 ai ti R−A1 Q1 − i=2 Ai Qi a1 mN s N T + D + N N aN AN −  mN  mN 2 = 0,  N−1  N−1 r −a1 t1 − i=2 ai ti R−A1 Q1 − i=2 Ai Qi aN + TN + DN + aN AN m1 S1 t1m1 (T1 + D1 + Q1 )m1 −1 ∂U = ∂ Q1 (t1m1 + (T1 + D1 + Q1 )m1 )2  mN  mN −1  N−1  N−1 r −a1 t1 − i=2 ai ti R−A1 Q1 − i=2 Ai Qi A1 mN SN T + D + N N aN AN −  mN  mN 2 = 0.  N−1  N−1 r −a1 t1 − i=2 ai ti R−A1 Q1 − i=2 Ai Qi AN + TN + DN + aN AN (B2)

The second-order conditions for target 1 (using Equation (5) to remove the summation signs after the differentiation) are: m −2

m1 s1 t1 1 ∂ 2u = − ∂t12 −

  m (T1 + D1 + Q1 )m1 (m1 + 1)t1 1 − (m1 − 1) (T1 + D1 + Q1 )m1 m (t1 1 + (T1 + D1 + Q1 )m1 )3

a12 s N (t N )mN −2 (TN + DN + QN )mN (mN (mN + 1) (t N )mN − mN (mN − 1) (TN + DN + QN )mN ) 3

a 2N ((t N )mN + (TN + DN + QN )mN )

,

  m m m1 S1 t1 1 (T1 + D1 + Q1 )m1 −2 −(m1 − 1)t1 1 + (m1 + 1) (T1 + D1 + Q1 )m1 ∂ 2U =− m (t1 1 + (T1 + D1 + Q1 )m1 )3 ∂ Q21 −

A21 SN (t N )mN −2 (TN + DN + QN )mN (−mN (mN − 1) (t N )mN + mN (mN + 1) (TN + DN + QN )mN ) A2N ((t N )mN + (TN + DN + QN )mN )

3

.

(B3)

Effectiveness of Security Countermeasures

723

Solving the two equations in Equation (B2) gives: a N s1 (T1 + D1 + Q1 )



a1 s N TN + DN + =

 A1 SN

 N−1 R−A1 Q1 − i=2 Ai Qi AN

AN S1 t1

 N−1 r −a1 t1 − i=2 ai ti aN

(B4)

i=1



(B6)

Ai a N si SN (Ti + Di + Qi ) t N , t1 t1 = ai AN Si s N (TN + DN + QN ) Ai a1 si S1 (Ti + Di + Qi ) t1 , ai A1 Si s1 (T1 + D1 + Q1 )

ai ti in Equation (5) gives:

which is solved with respect to t1 to yield:  N Ai (Ti +Di +Qi )si A1 /( i=1 ) Si t1 = (T1 + D1 + Q1 ) s1 /S1 , a1 /r (B7) where we define W =

N  i=1

Ai (Ti +Di +Qi )si Si

.

Generalizing Equation (B7) from target 1 to target i gives: (B5)

Inserting Equation (B5) into the definition of r =

i=1

 Ai si (Ti + Di + Qi ) a1 S1 t1 , A1 s1 (T1 + Di + Q1 ) Si N

=

Generalizing Equation (B4) from target 1 to target i, and replacing subscript N with subscript 1, respectively, give:

N 

N  Ai a1 si S1 (Ti + Di + Qi ) t1 A1 Si s1 (T1 + D1 + Q1 ) i=1



A1 a N s1 SN (T1 + D1 + Q1 ) t N . (B4) => t1 = a1 AN S1 s N (TN + DN + QN )

=

r =

ti = (Ti + Di + Qi )

Ai /(Si W) , ai /(si r )

(B8)

as shown in Equation (7). Inserting t1 in Equation (B4) into the first-order condition for the government or terrorist in Equation (B2), and solving, gives:

T1 + D1 + Q1 =

 mN 2 + (TN + DN + QN )mN m1 AN S1 (a1 AN S1 s N (TN + DN + QN ))m1 (A1 a N s1 SN t N )m1 t N

mN mN A1 SN t N (TN + DN + QN )mN −1 ((A1 a N s1 SN t N )m1 + (a1 AN S1 s N (TN + DN + QN ))m1 )

2

. (B9)

Generalizing Equation (B9) from target 1 to target i gives:

Ti + Di + Qi =

 mN 2 + (TN + DN + QN )mN mi AN Si (ai AN Si s N (TN + DN + QN ))mi (Ai a N si SN t N )mi t N

mN mN Ai SN t N (TN + DN + QN )mN −1 ((Ai a N si SN t N )mi + (ai AN Si s N (TN + DN + QN ))mi )

2

. (B10)

Inserting tN in Equation (B8) for i = N into Equation (B10), and simplifying, gives:

724

Hausken and He

Ai (Ti + Di + Qi )si Si



2 Ai /(Si W) mi AN /(SN W) mN 1+ mi si AN (TN + DN + QN ) ai /(si r ) a N /(s N r ) = .

mN

mi 2 SN AN /(SN W) Ai /(Si W) mN 1+ a N /(s N r ) ai /(si r ) (B11)

Summing both sides in Equation (B11) from i = 1 to i = N gives: N  Ai (Ti + Di + Qi )si Si i=1





mi

2 AN /(SN W) mN 1+ N mi si  AN (TN + DN + QN ) a N /(s N r ) =W= ,

mN

mi 2 SN AN /(SN W) Ai /(Si W) i=1 1+ mN a N /(s N r ) ai /(si r ) Ai /(Si W) ai /(si r )

(B12)

which is solved to yield: AN (TN + DN + QN ) W = ,



2 m N SN AN /(SN W) Ai /(Si W) mi 1+ mi si N a N /(s N r ) ai /(si r )

mN

2 i=1 AN /(SN W) Ai /(Si W) mi mN 1 + a N /(s N r ) ai /(si r )

(B13)

which is inserted into Equation (B11) to yield:

Ai /(Si W) mi mi si ai /(si r )

2 Ai /(Si W) mi 1+ Ai (Ti + Di + Qi )si ai /(si r ) =W ,

Ai /(Si W) mi Si mi si N ai /(si r )

2 i=1 Ai /(Si W) mi 1+ ai /(si r )

(B14)

Effectiveness of Security Countermeasures

725

which is solved with respect to Qi to yield Equation (7). Generalizing from target 1 to target i, the secondorder conditions in Equation (B3) are satisfied as negative when: (mi +1)timi − (mi −1) (Ti + Di + Qi )mi > 0, −(mi −1)timi + (mi +1) (Ti + Di + Qi )mi > 0.(B15)

Equating the two expressions in Equation (C1) and solving gives:

qi (1 − pi ) 1/mi Ti + Di = , (C2) Ti + Di + Qi pi (1 − qi ) which we rewrite as Equation (11). APPENDIX D

Inserting Equation (B8) into Equation (B15) and simplifying gives Equation (10). APPENDIX C Solving Equations (1) and (3) with respect to timgives: timi =

pi (Ti + Di )mi , 1 − pi

timi =

Equations (1) and (3) imply qi < pi and 1-pi < 1 1/mi pi ) qi (1− pi ) qi and hence qpii(1− < 1 causing lim = (1−qi ) pi (1−qi ) 0, which, together with yi = Equation (13) to yield:

mi →0 Ai /(Si W) , are ai /(si r )

inserted into

qi (Ti + Di + Qi )mi . 1 − qi (C1)

mi si yimi 2 N 1 + yimi Si  si lim Ai Qi (M) = lim Ai Qi , mi mi →0 mi →0  N mi si yi si Si i=1 2 i=1  1 + yimi 2    (1 + ln yi mi ) 1 + yimi yimi − 2 ln yi 1 + yimi yi2mi mi si  4 N 1 + yimi Si  si Ai Qi = lim 2    mi →0  (1 + ln yi mi ) 1 + yimi yimi − 2 ln yi 1 + yimi yi2mi mi si i=1 Si N  4 i=1 si 1 + yimi  N si N N 22 s Si  si Si  si si i=1 S Ai Qi 24 i = lim  N 22 Ai Qi =  N Ai Qi = Si  N i mi →0 s Si s Si i=1 si i i=1 si i=1 4 si i 

2

i=1

i=1

(D1)

where L’Hopital’s rule has been used.

726 REFERENCES 1. Guikema S, Aven T. Assessing risk from intelligent attacks: A perspective on approaches. Reliability Engineering and System Safety, 2010; 95(5):478–483. 2. Hausken K, Levitin G. Review of systems defense and attack models. International Journal of Performability Engineering, 2012; 8(4):355–366. 3. Bier VM, Nagaraj A, Abhichandani, V. Protection of simple series and parallel systems with components of different values. Reliability Engineering and System Safety, 2005; 87:315– 323. 4. Powell R. Sequential, nonzero-sum “Blotto”: Allocating defensive resources prior to attack. Games and Economic Behavior, 2009;67(2):611–615. 5. Patterson SA, Apostolakis GE. Identification of critical locations across multiple infrastructures for terrorist actions. Reliability Engineering and System Safety, 2007; 92(9):1183– 1203. 6. Bier VM, Haphuriwat N, Menoyo J, Zimmerman R, Culpen AM. Optimal resource allocation for defense of targets based on differing measures of attractiveness. Risk Analysis, 2008; 28(3):763–770. ´ 7. Pate-Cornell ME, Guikema SD. Probabilistic modeling of terrorist threats: A systems analysis approach to setting priorities among countermeasures. Military Operations Research, 2002; 7(4):5–23. 8. Michaud D, Apostolakis G. Methodology for ranking the elements of water-supply networks. Journal of Infrastructure Systems, 2006; 12(4):230–242. 9. Levitin G. Optimal defense strategy against intentional attacks. IEEE Transactions on Reliability, 2007; 56(1): 148–157. 10. Brown G, Carlyl, M, Salmer´on J, Wood K. Defending critical infrastructure. Interfaces, 2006; 36:530–544. 11. Reniers G, Soudan K. A game-theoretical approach for reciprocal security-related prevention investment decisions. Reliability Engineering and System Safety, 2010; 95(1): 1–9.

Hausken and He 12. Haimes YY, Crowther K, Horowitz BM. Homeland security preparedness: Balancing protection with resilience in emergent systems. Systems Engineering, 2008;11(4): 287–308. 13. Hausken K. Probabilistic risk analysis and game theory. Risk Analysis, 2002; 22(1):17–27. 14. Kunreuther H, Heal G. Interdependent security. Journal of Risk and Uncertainty, 2003; 26(2/3):231–249. 15. Zhuang J, Bier VM, Gupta A. Subsidies in interdependent security with heterogeneous discount rates. Engineering Economist, 2007; 52(1):1–19. 16. Hausken K. Protecting complex infrastructures against multiple strategic attackers. International Journal of Systems Science, 2011; 42(1):11–29. 17. Hausken K, Zhuang J. The timing and deterrence of terrorist attacks due to exogenous dynamics. Journal of the Operational Research Society, 2012; 63(6):726–735. 18. Hausken K, Bier V, Zhuang J. Defending Against Terrorism, Natural Disaster, and All Hazards. Pp. 65–97 in Bier VM, Azaiez MN (eds). Game Theoretic Risk Analysis of Security Threats. New York: Springer, 2009. 19. Skaperdas S. Contest success functions. Economic Theory, 1996; 7: 283–290. 20. Tullock G. Efficient rent-seeking. Pp. 97–112 in Buchanan JM, Tollison RD, Tullock G (eds.). Toward a Theory of the RentSeeking Society. College Station, TX; Texas A&M University Press, 1980. 21. Hirshleifer J. Anarchy and its breakdown. Journal of Political Economy, 1995; 103(1):26–52. 22. Nitzan S. Modelling rent-seeking contests. European Journal of Political Economy, 1994; 10(1):41–60. 23. Hausken K, Levitin G. Efficiency of even separation of parallel elements with variable contest intensity. Risk Analysis, 2008; 28(5):1477–1486. 24. Hausken K, Levitin G. Protection vs. separation in parallel non-homogeneous systems. International Journal of Reliability and Quality Performance, 2009; 1(1):11–28. 25. Gelman A, Hill J. Data Analysis Using Regression and Multilevel/Hierarchical Models. Cambridge: Cambridge University Press, 2006.