# Technology Fixes for the New Global Risks: Do they Address Asymmetric and Non-linear Threats?

### Bahar Barami, Volpe Center

### For Publication in Logistics Spectrum, SOLE -- The International Society of Logistics, January, 2003

The new economy -- powered by the twin galloping horses of technology
and globalization -- has ushered in a staggering mix of opportunities
and threats. The unprecedented growth of the economy over the past
decade has added to our wealth of assets and equipped us with ingenious
new technologies to thwart security threats. Yet much of our strategic
posture is driven by the old economy mindset. Because of this
disconnect, we are not well equipped to deal with the new threats. The
new threats are asymmetric, nonlinear, networked, and highly
unpredictable, whereas most of our tools focus on predictable, linear,
and sequential events.

## New Digital Technologies Have Enabled us to Track and Watch Everything

Security is a growth industry today. Information technology (IT)
accounts for over \$800 billion of the national output, and has produced
net stocks of \$1.5 trillion in equipment and software. Estimates of the
revenues generated by security technologies vary widely, but the IT and
security sectors have clearly had parallel growth paths. The digital
revolution of the past two decades has been directly feeding the demand
for hi-tech security. The exponential growth of microprocessor computing
power has spawned an explosive growth in new digital surveillance,
electronic tracking, and biometrics. We can now watch and track pretty
much everything that moves, intercept potential threats with explosive
detection devices, deny access with "guns, gates, and guards," install
sensors that look through walls and sniff for bombs, and match digital
fingerprints and retinal patterns against the growing databases of
terrorists.

By one estimate, in the aftermath of the September 11 attacks, the
private sector has committed tens of billions of dollars in new security
outlays to bolster workplace and cyber security: over \$18 billion spent
on hiring new guards, erecting barricades to thwart car bombs,
restricting building access, installing ID check points, and shielding
street-level ventilation intake systems to prevent anthrax attacks; and
another \$15 billion spent on added computer security to protect against
cyber terrorism.[^1] We are building firewalls and installing encryption
devices and virus detection software to protect against the unleashing
of the forces of cyber warriors -- who could deploy massive numbers of
"bots" and "digital agents", and detonate "logic bombs" in our computer
systems -- to avert a "cyber Pearl Harbor."

And these are just the private sector security defenses. Progress in our
military technology has been even more staggering.

## With Digital Technology we Have Unrivalled National Defense and Total Asset Visibility 

Modern IT systems have also provided our military with an astonishing
array of gadgets to defend the nation. A series of transformations in
defense capabilities -- the so-called revolutions in military affairs,
or RMA -- have been transforming the U.S. military. By integrating the
myriad communications systems and sensors, tightly coupling the
precision weaponry, surveillance, and reconnaissance tools of each force
into a single system, technology has helped transform the military.
Admiral William Owens, former vice chairman of the Joint Chiefs of Staff
(JCS), has argued that through integration of technologies and forces, a
"system of systems" had emerged. With access to real-time data, the RMA
has enabled the military to create a "dominant battle space knowledge"
that allows "infusion of battlefield awareness" into our forces, so that
the military can "apply force with speed, accuracy, and precision."[^2]
Admiral Owens had hoped that this enhanced battlefield awareness would
significantly benefit the combat efforts, and result in "lifting the fog
of war."[^3]

The digital revolution galvanized the latest RMA and fundamentally
changed the way U.S. forces fight. The *Joint Vision 2010* of the JCS,
published in1996, offered four operational "templates"-- Dominant
Maneuvers, Precision Engagement, Focused Logistics, and Full-Dimensional
Protection -- to guide the evolution of U.S. forces toward a capability
for "full spectrum dominance" by 2010. [^4] U.S. Army's Simulation,
Training, and Instrumentation Command (STRICOM), for instance, has taken
advantage of supercomputing capabilities available on a chip to display
and acquire data and light the battlefield, using retinal scans and
geo-referenced databases to annotate information about every building,
and create digital roadmaps for the combat field.

Focused Logistics is the component of the RMA responsible for
streamlining supply chain networks. There are two major thrusts in
Focused Logistics. One has to do with making operations more
transparent, and the sensor data analysis more intelligent. The second
thrust is the expanded use of simulation, decision-support systems,
threat modeling, and visualization tools. For instance, the Military
Transport Management Command's Automated Identification Technologies
(AIT) program supports force projection and munitions movement through
achieving in-transit visibility (ITV) objectives with radio frequency
identification devices. The ITV system tracks the movement of the
supplies throughout the supply chain -- from the "fort to the port to
the foxhole" -- to provide full transparency for the schedules and
manifests of supply shipments. Another key component of Focused
Logistics is the Global Transportation Network (GTN,) an essential
element of DOD's war fighting capability. GTN supports the US
Transportation Command's command and control operations by monitoring
all essential operations, and providing visibility, status, and location
information for assets and infrastructure.

Are we more secure now as the result of the staggering progress in our
defense capabilities? Is it possible that the very technologies that
have made our defense capabilities more robust, have also made us more
vulnerable? Harvard professor Ashton Carter and William Perry have
argued that in 1991, the latest RMA -- which took place in the aftermath
of the Cold War in order to offset soviet numerical superiority in
conventional tactical forces -- gave the U.S. superior military power by
offering air superiority, dominant intelligence and communications, and
precision weapons. They argue that this advantage is unlikely to work a
second time, because of the asymmetric nature of today's threats. [^5]

Arguing against the RMA premise that technology could "see and
understand everything on the battlefield," eliminate all "friction," and
"win the war," is Mackubin Thomas Owens, a professor of strategy and
force planning at the Naval War College in Newport, Rhode Island, who
maintains that exclusive focus on the RMA "as an outcome rather than a
process" could in fact be detrimental to national defense. Observing
that these days the term "transformation" has replaced RMA as the
"latest buzzword used to bless business as usual," he concludes:

> "A transformed military is a valid objective. But a transformation
> strategy based on a conception of war that is linear, mechanistic, and
> overly techno-centric, which banishes friction, chance, and
> uncertainty from war, and which is wholly disconnected from what an
> adversary may think, want, or do, is a recipe for disaster."[^6]

The sections that follow further examine the issues relating to
asymmetric and non-linear threats and how we manage them.

## But Is Technology A Silver Bullet?

To what extent are these gadgets, surveillance cameras, and biometric
devices protecting us against the threats lurking ahead? Clearly, one
tradeoff of the ballooning outlays on security is the foregone
investment of the outlays in more productive uses. As Chairman Greenspan
observed in his October 11, 2001, testimony before Congress, "increased
deployment of security equipment would not enhance national output, nor
would it improve labor force productivity." But apart from the economic
impact, how effective are these technologies in making us more secure?
Can they in fact be counterproductive?

First, to the extent that the obsessive preoccupation with the
hodgepodge of sensors, surveillance cameras, ID devices, and access
control systems would lull us into a sense of security, and lead us to
ignore more critical threats or more effective preventive measures,
gadgets can be counterproductive. The concept of "risk homeostasis," for
instance, maintains that people unconsciously seek a certain level of
hazard. While they compensate for dangerous conditions by exercising
more caution, they offset the safety measures by taking more risks. This
suggests that effectiveness of some security measures may be
compromised, partly because of the false sense of security that can
potentially lead to more risk taking. [^7]

Numerous security analysts have emphasized that there is no single
silver bullet for combating all security threats, and that the best risk
strategy is one based on a systemic approach to prevention, detection,
and deterrence. Gadgets such as biometric identification devices, RAND's
John Woodward points out, are not a "silver bullet," but one component
of a layered approach to security.[^8]

Second, by diverting resources away from more preventable events,
expenditures in hi-tech gadgets may in fact be detrimental to security.
As Princeton University's Edward Tenner has warned, a single-minded
preoccupation with technology fixes is likely to shift resources away
from improvements that deflect even greater risks: "The ultimate goal
should be improving the hardiness of a nation's infrastructure, creating
buildings less likely to collapse and planes less likely to crash." [^9]

The search for security through the silver bullet of technology gives a
new twist on the old imagery of the "god from a machine," as one
technology commentator has put it. The ancient Romans invoked this
"*deus ex machina"* when they would resort to mechanical devices -- by
lowering an actor-deity from above the stage to dazzle the crowd at the
end of a play and tie up the loose ends of the plot. Today's security
practitioners "have eliminated the gods and are trusting that the
machine itself will solve our problems." [^10]

So what is the alternative? If technology can't work, what will? How are
we to reduce the risks of terrorism? First, we should recognize that the
old risk mitigation strategies no longer work.

## Why Don't the Old Risk Mitigation Paradigms Work Today?

The September 11^th^ disasters may have epitomized the failure of
traditional approaches to risk mitigation. The attacks represented
"signal events," -- i.e., previously underestimated types of risk --
that revealed the nation's vulnerability to hitherto unrecognized
threats. The events underscored the fact that, in today's global
economy, the conventional risk strategies are no longer effective,
because threats are likely to be asymmetric, non-linear, and subject to
significant forecasting errors. This is because modern technologies have
changed the nature of the global infrastructure. Increasingly our
critical infrastructures -- transportation, communications, financial,
energy -- have become networked, complex, and interdependent, while the
threats facing them have become asymmetric, with effects that cascade
downstream. Because of these changes, the old risk mitigation strategies
fail to work.

First, the old risk mitigation paradigms based on superior defense
capabilities are likely to be ineffectual, not because the technologies
are bad, but because they don't work on asymmetric threats. The concept
of "asymmetric warfare" is defined as "warfare aimed at key enemy
vulnerabilities rather than at the enemy's main force." [^11] This means
that rather than taking on the unmatched U.S. military with symmetric
conventional military force, the enemies will seek vulnerabilities where
we least expect them -- e.g., in the

technology-intensive private infrastructure. This is a challenge in
today's security strategies, not only because the enemy is likely to
launch its attacks using the means we had not unanticipated, but also
because as we get smarter in our defense, so does the enemy. A 1999 RAND
report on new forms of terrorism, drove home the shift in defense
paradigms and explored the implications of asymmetric warfare for
national security. [^12]

Second, the old paradigms don't work because today's counter-terrorism
focus has arguably been too heavily weighted towards the "high-end"
threats. Supporting this point has been another RAND report, maintaining
that the recent U.S. strategies have been based mainly on planning for
extreme worst-case scenarios involving exotic weapons. Strategies geared
to high-end threats assume that by focusing on worst-case scenarios, any
less serious incident involving a less sophisticated weapon could simply
be addressed by deploying the defensive measures developed for the
worst. Such an assumption, the report pointed out, ignores the
possibility that these less catastrophic incidents might present unique
challenges of their own, and produce high-casualties too.[^13]
Supporting the RAND contention is a recent NRC report, maintaining that
many of our government agencies, in part because of this focus on
high-end threats, "are in no position to make optimal use of available
modeling and simulation technologies to support the creation of an
overall strategy for their counter-terrorism activities."[^14]

Third, our conventional risk strategies often fail to take into account
the complexities of today's interconnected and networked infrastructure
systems. In highly complex systems, where we routinely add enhancements
and safeguards to make the system more robust, we also introduce new
software and hardware risks. The growing intensity of technology
deployment within an infrastructure is likely to result in a cycle of
technology intensity -- resulting in what Princeton University's Edward
Tenner has called the "pathology of intensity" -- that shows up as a
"revenge effect."[^15] The revenge effects are unanticipated and
perverse outcomes that result from the interaction among the technology
fixes, and further increase the likelihood of malfunction. Other
researchers have identified features in complex networks -- in
particular, the feedback loops that produce vicious cycles of cascading
failures -- that make their behavior unstable and unpredictable. [^16]
Similarly, Yale University's Charles Perrow has maintained that certain
technology-intensive systems are so inherently risky -- defining
high-risk, interdependent systems as those characterized by system
complexity and tight coupling -- that unintended feedback loops are
frequent, and what happens in one directly affects the others. [^17]

Catastrophic chain reactions and cascading failures due to
interdependent functions are illustrated by the AT&T system failure in
September 21, 1991. The chain reactions followed a power failure at the
AT&T switching center in lower Manhattan that disrupted AT&T 1-800
service for 8 hours, resulting in blockage of 5 million calls. Losses
were estimated at hundreds of million of dollars. The 1997 President's
Commission on Critical Infrastructure reported that the indirect losses
to the customers of AT&T were far greater than the direct losses to the
facilities. In the words of the report, the more than 100-fold increase
in downstream costs to the customers -- with the largest "victims" being
the airline industry, because they had to cease operations since the
control towers could not communicate with each other -- was because the
infrastructure represented a "system of systems," where "everyone is a
customer." In a nation "where everyone is somebody's customer," the
report said, the system is more vulnerable because individual businesses
are less likely to have adequate awareness of the risks or incentive to
implement the needed security measures. [^18]

Finally, our traditional risk mitigation strategies fail when dealing
with new threats because of one key problem: data. Data errors and
inexactitudes in raw input used for probability assessments and
prediction are commonplace in risk models. Probabilistic estimates rely
on the frequency of past occurrences. To predict what lies ahead through
extrapolation of past frequencies is fraught with problems, because past
data from real life are not a set of independent observations. They
represent a sequence of unique events. The laws of probabilistic
inference demand that the raw data for statistical models present
independent observations.

A related source of prediction error in risk models is in non-linear
causality inherent in complex infrastructures. Non-linearity means that
results are not proportionate to the cause, partly because deviations in
the real world do not cluster symmetrically on either side of the
average around a normal distribution curve. Many of the sophisticated
models today -- e.g., those based on data fusion and pattern recognition
-- give important insights into the complexity of reality, but fail to
realize that recognition of patterns that precede the arrival of other
patterns is not a proof of cause and effect. As Peter Bernstein, in his
seminal book on risk has pointed out:

## So, What Makes for a More Effective Risk Strategy?

An effective risk management strategy would promote a balanced strategy
of deterrence, mitigation, and prevention, with a mix of technology and
risk strategy that is system-wide, multi-layered, and intelligent.

### A System-Wide Deterrence 

To be effective, a security strategy should be system-wide and global,
with an end-to-end coverage of the supply chain. This would mean a
tightening of security not just within the national borders, but within
the entire global logistics system. An innovative approach to this
global security would be to move the source of security inspections
abroad, to the origins of cargo. Championing this approach has been the
Coast Guard Captain Stephen Flynn -- referred to as "the Paul Revere of
21^st^ century port security" by Senator Lieberman, the chief sponsor of
the Senate bill to create a Homeland Security Department -- who has
warned that the nation is vulnerable to asymmetric, "David and
Goliath-style" terrorist attacks. [^19] Captain Flynn's global port
security strategy recognizes the futility of the conventional border
control methods in stemming the threats posed by containerized cargo:
"Intercepting the ripples of danger in this tidal wave of commerce is
about as likely as winning a lottery." [^20]

Currently several demonstration projects based on a system-wide approach
to cargo security are underway, including Smart and Secure Trade-lanes
(SST), the US Customs' testing of Automated Targeting System (ATS) in
Container Security Initiative (CSI), Customs-Trade Partnership against
Terrorism (C-TPAT), and the TSA/USCG maritime security initiatives,
including Operation Safe Commerce (OSC). [^21] The Volpe Center is
currently involved in conducting several of these demonstrations.

The global approach to commercial cargo security would work backwards
from "point of entry" towards cargo destination to filter the bad from
the good. It would involve the government working closely with the
international trading parties to develop "transparent" systems for
tracking regional and global commercial flows. The greater visibility of
the commercial flows would allow the regulators and enforcement
officials to conduct "virtual audits" on inbound traffic before arrival,
targeting high-risk goods and people for inspection while swiftly
processing the less risky ones. This approach is effective because it
attains global coverage, rather than being limited to ports of entry or
just a few high-profile ports. This end-to-end coverage of the supply
chain would avoid the "balloon effect" that would result from pushing
illicit activities to other points in the logistics system that are less
certain to detect and interdict them. It would also prevent the practice
by shippers who would "port shop" -- i.e., move business to entry points
that clear goods more quickly and have less stringent security. [^22]

### A Layered Approach 

Rather than focusing on a single measure for deterrence or mitigation,
the *layered* approach to security would use an array of measures
deployed in tandem, in a networked environment. The concept of "sensor
fusion" for instance, relies on the premise that no single sensor
technology can be expected to find all threats with acceptable accuracy,
and that an array of sensors will need to be developed and used together
in a reliable, networked manner, so that each sensor can crosscheck the
validity of others.

A recent report of the National Academy of Sciences, National Research
Council, has identified significant areas of R&D need in
prevention/deterrence -- in contrast to control/defense technologies, --
emphasizing that research in sensor fusion could determine how best to
filter out lower risk users. The report concludes by recommending R&D
projects that devise systems for crosschecking the accuracy of many
biometric devices, and would reduce false alarms and the need for costly
follow-on research. [^23]

Another facet of the layered approach is designing redundant
infrastructure that would ensure the nation's transportation system is
able to withstand threats of terrorism and operational disruptions. As
Toronto University's Thomas Homer-Dixon has pointed out, finding and
sabotaging the critical but non-redundant parts of the system is an
effective strategy for our adversaries. He points out that the knowledge
of the weakness of the complex systems enables terrorists to exploit
them, and that the extent of the damage depends on the level of
redundancy in the system, i.e., the degree to which the damaged node's
functions can be offloaded to undamaged nodes. [^24]

### And Finally, We Need An Intelligent Risk Prevention Strategy

How could we deal with the threats before they hit us? How could we
"connect the dots" and prevent the threats from materializing? How are
we to tie together the myriad sensors, databases, and information
sources?

Preventive measures require us to have advance knowledge of what is
likely to happen.

We have a vast knowledge-base of artificial intelligence research that
could be used for threat analysis. We can make better use of intelligent
computing and pattern recognition software to make sense of all the raw
data. In addition to artificial intelligence, data mining is a
capability that is gaining increasing acceptance for security screening.
The NRC report, cited earlier, has emphasized the need for more
systematic research on data mining and applications of artificial
intelligence to threat analysis.

Currently a number of commercial software and proprietary databases are
using data mining techniques for myriad security purposes, including
assignment of a "threat index." For air passengers, for instance,
commercial data mining software has been used to tap myriad databases --
e.g., travel patterns, real estate history, purchasing patterns,
financial and demographic profile -- to develop a threat index based on
resemblance to a terrorist profile. The problem is the difficulty of
predicting action based on behavior patterns. This is partly because the
sample of known terrorists is so small that the profiles have a high
likelihood of being inaccurate.

In a nutshell, technologies help, but the key to an effective security
strategy is a consistent process of assessing all threats and attempting
to prevent them from causing great harm. Ultimately, the best security
strategy is to purse a layered, system-wide, and integrated process of
risk control and threat analysis, rather than focus on the outcomes or
search for a single, silver-bullet remedy.

[^1]: Anna Bernasek, "The Friction Economy," *Fortune*, February 18,
    2002.

[^2]: Admiral William A. Owens, Vice Chairman, Joint Chiefs of Staff,
    "The Emerging U.S. System of Systems," *Strategic Forum,* National
    Defense University, Institute for National Strategic Studies, Number
    63, February 1996.

[^3]: Admiral William A. Owens, with Ed Offley, *Lifting the Fog of
    War,* Farrar, Straus, and Giroux, 2000.

[^4]: A 1997 statement by former defense secretary William Cohen, quoted
    in "Revolutions in Military Affairs," *Northrop Grumman Review*,
    Issue One, February 1999,
    [www.northgrum.com/news](http://www.northgrum.com/news), accessed
    October 2002.

[^5]: Ashton Carter and William J. Perry, "Countering Asymmetric
    Threats, " in Ashton Carter and John P. White, Editors, *Keeping the
    Edge: Managing Defense for the Future, Cambridge, MA Preventive
    Defense Project, 26-000, January 2001.*

[^6]: Mackubin Thomas Owens, "Transforming Debate: The opportunity and
    risk for the military," in *National Review Online*, August 29,
    2002,
    [http://www.nationalreview.com](http://www.nationalreview.com/),
    accessed September 2002.

[^7]: Edward Tenner, *Why Things Bite Back: Technology and the Revenge
    of Unintended Consequences,* Alfred Knopf, 1996, pp. 265-266.

[^8]: John D. Woodward, Jr. *Super Bowl Surveillance: Facing Up to
    Biometrics*, RANS Arroyo Center, 2001.

[^9]: Tenner, op.cit.

[^10]: John Schwartz, "Silver Bulletism: Technology Runs to the
    Defense", NY Times, December 9, 2001.

[^11]: Jonathan Rauch, "Small Wars", *Government Executive Magazine*,
    June 18, 2002.

[^12]: Ian Lesser, "Countering the New Terrorism: Implications for
    Strategy," in Ian Lesser, Bruce Hoffman, John Arquilla, David
    Ronfeld, Michele Zanini, Brian Michael Jenkins, *Countering the New
    Terrorism,* RAND, 1999.

[^13]: Bruce Hoffman, "Terrorism Trends and Prospects," in Ian Lesser,
    Bruce Hoffman, John Arquilla, David Ronfeld, Michele Zanini, Brian
    Michael Jenkins, *Countering the New Terrorism,* RAND Corp., 1999.

[^14]: NRC, *Making the Nation Safer: The Role of Science and Technology
    in Countering Terrorism,* National Academy Press, Prepublication
    Copy, June 2002, available on [www.nap,edu]()

[^15]: Edward Tenner, *Why Things Bite Back: Technology and the Revenge
    of Unintended Consequences,* Alfred Knopf, 1996.

[^16]: Thomas Homer-Dixon, "The Rise of Complex Terrorism, *Foreign
    Policy Magazine*, January /February 2002 issue,
    [www.foreignpolicy.com](http://www.foreignpolicy.com/)., and Thomas
    Homer-Dixon, *The Ingenuity Gap: How can we solve the problems of
    the futures?,* Alfred A. Knopf, 2000.

[^17]: Charles Perrow, *Normal Accidents: Living with High-Risk
    Technologies*, Princeton University Press, 1999.

[^18]: Report to the President's Commission on Critical Infrastructure
    Protection, *Economic Impacts of Infrastructure Failures*, 1997.

[^19]: Molly Peterson, "Ex-Coast Guard commander sees 'dangerously
    unprotected' ports." [www.GovExec.com](http://www.GovExec.com/),
    October 4, 2002.

[^20]: "Beyond Border Control", Foreign Affairs, Volume 79, Number 6,
    November/December 2000,

[^21]: In the mid-1990s, the USCS developed and implemented the ATS at
    U.S. ports to identify imports that pose a high risk of containing
    narcotics and other contraband. ATS uses shipment manifest data
    obtained from carriers and applies a series of weighted rules to
    identify high-risk shippers and carriers.

[^22]: Stephen Flynn "Transportation Security Agenda for the 21^st^
    Century," TR News, 211, November-December 2000.

[^23]: National Research Council, *Making the Nation Safer: The Role of
    Science and Technology in Countering Terrorism,* National Academy
    Press, Prepublication Copy, June 2002, available on [www.nap,edu]()

[^24]: Thomas Homer-Dixon, "The Rise of Complex Terrorism, *Foreign
    Policy Magazine*, January /February 2002 issue,
    [www.foreignpolicy.com](http://www.foreignpolicy.com/).