1

Game Theory and Risk Analysis for Counterterrorism

David Banks

U.S. FDA

2

1. Context

Terrorists can invest in a portfolio of attacks.

The U.S. can invest in various kinds of defense.

If the U.S. fails to invest wisely, then we lose important battles.

3

A Smallpox Exercise

The U.S. government is concerned about the possibility of smallpox bioterrorism.

Terrorists could make no smallpox attack, a small attack on a single city, or coordinated attacks on multiple cities (or do other things).

4

The U.S. has considered four defense strategies:

• Stockpiling vaccine• Stockpiling and increasing

biosurveillance• Stockpiling, surveilling, and

inoculating first responders and/or key personnel

• Inoculating all consenting people with healthy immune systems.

5

Deciding What To Do

Currently, the U.S. government is:

• Holding public meetings• Soliciting scientific advice• Seeking counterintelligence• Calculating political support• Balancing alternative threats• Ensuring availability of options

6

But the U.S. government is not using:

• Statistical risk analysis• Game theory• Cost-benefit analysis• Portfolio theory

These are methodologies that can and should inform decision-making to counter terrorist threats.

7

2. Normal-Form Games

Classical game theory uses a matrix of costs to determine optimal play.

Optimal play is usually defined as a minimax strategy, but sometimes one can minimize expected loss instead.

Both methods are unreliable guides to human behavior.

8

Game Theory Matrix

No Attack Small Attack Big Attack

Stockpile C11 C12 C13

Surveillance C21 C22 C23

First Responders C31 C32 C33

Mass Inoculation C41 C42 C43

9

Minimax Strategy

The U.S. should choose the defense with smallest row-wise max cost.

The terrorist should choose the attack with largest column-wise min cost.

If these are not equal then a randomized strategy is better.

10

Minimum Expected Loss

Sometimes there is more information and different structure than classic game theory supposes.

This occurs in serial games, where probabilities can be assigned to future actions. This extensive-form game theory generates decision trees.

11

Extensive-form game theory invites decision theory criteria based upon minimum expected loss.

In our smallpox exercise, we shall implement this by assuming that the U.S. decisions are known to the terrorists, and that this affects their probabilities of using certain kinds of attacks.

12

Game Theory Critique

Game theory does not take account of resource limitations.

It assumes that both players have the same cost matrix.

It assumes both players act in synchrony (or in strict alternation).

It assumes all costs are measured without error.

13

3. Risk Analysis

Statistical risk analysis makes probabilistic statements about specific kinds of threats.

It also treats the costs associated with threats as random variables. The total random cost is developed by analysis of component costs.

14

Cost Example

To illustrate a key idea, consider the problem of estimating the cost C11 in the game theory matrix. This is the cost associated with stockpiling vaccine when no smallpox attack occurs.

Some components of the cost are fixed, others are random.

15

C11 = cost to test diluted Dryvax +

cost to test Aventis vaccine +

cost to make 209 x 106 doses +

cost to produce VIG +

logistic/storage/device costs.

16

Assume that an expert indicates that:

Dryvax and Aventis testing have costs that are independent and uniformly distributed on [$2 million, $5 million].

New vaccine production is not random; the contract specifies $512 million.

VIG production is normally distributed with mean $100 million, s.d. $20 million.

Logistics costs are normally distributed with mean $940 million, s.d. $100 million.

17

Other Cij sThe other costs in the matrix are also

random variables, and their distributions can be estimated in similar Delphic ways.

Note that different matrix costs are not independent; they often have components in common across rows and columns.

18

Other components include:

Number of attacks; this is Poisson with mean 5, plus 2.

Number of key personnel; this is uniform between 2 million and 12 million.

Number of smallpox cases per attack; this is Gamma with mean 10 and s.d. 100.

19

Cost to treat one smallpox case; this is normal with mean $200,000 and s.d. $50,000.

Cost to inoculate 25,000 people; this is normal with mean $60,000 and s.d. $10,000.

Economic costs of a single attack; this is gamma with mean $5 billion and s.d. $10 billion.

20

4. Games + Risk

Game theory and statistical risk analysis can be combined to give arguably useful guidance in threat management.

We generate many random tables, according to the risk analysis, and find which defenses are best.

21

We run 100 game theory matrices and count how many times each defense is optimal in terms of

• Minimaxity• Minimum Expected Loss

We also calculate a score for each, since the second-best defense may have nearly the same cost as the best.

22

Screenshot of Output

23

Minimum Expected Loss

The table in the lower right shows the elicited probabilities of each kind of attack given that the corresponding defense has been adopted.

These probabilities are used to weight the costs in calculating the expected loss.

24

Scores

The scores beside the left-hand tables are found by

• Summing the maximum costs in each row

• Dividing each maximum by the sum

• Allocating weight to the decisions proportionally.

25

5. Conclusions

For our rough risk analysis, minimax favors universal inoculation, minimum expected loss favors stockpiling.

This accords with the public and federal thinking on threat preparedness.

And the approach can be generalized.