Probabilities and background knowledge as a tool to reflect uncertainties in relation to intentional acts

Abstract

In security applications probabilities are commonly avoided – it is said that they are impossible to determine and that they are of little interest as a tool to support the decision making and the risk management. Often qualitative assessments are performed on the basis of judgments of actors' intentions and capacities, without references to a probability scale. An example of such a structure is the grading done by the Norwegian Police Security Service (PST), which defines for example a moderate threat level as “One or more parties have the intention and capacity to strike at specific interests. There is an unspecified threat”. In this paper we carry out an in-depth analysis of the meaning of the concept probability in a setting with intentional acts, the main aim being to provide new insights on the scope and use of probabilities in such situations. Comparisons are made with qualitative structures as the PST grading. We question if probabilities have in fact a role to play in security management. The paper concludes that the security field cannot and should not do without judgments of uncertainties using some scale of likelihood or confidence, but such judgments need to be supplemented by other approaches which highlight the background knowledge (including assumptions) that these judgments are based on.

Introduction

The Norwegian Police Security Service (PST) has defined four categories of threat levels [14]:

• Low: The likelihood of a terrorist attack is low. One or more parties may have the intention of, but are not thought to have the capacity to strike at specific interests.

• Moderate: The likelihood of a terrorist attack is moderate. One or more parties may have the intention of and capacity to strike at specific interests.

• High: The likelihood of a terrorist attack is significant. One or more parties have the intention and capacity to strike at specific interests. There is an unspecified threat.

• Extreme: The likelihood of a terrorist strike is extremely high. One or more parties have the intention to strike at specific interests. There is a specific threat. No further warnings are to be expected before a strike is carried out.

Similar systems exist in other countries, for example the UK Government uses the five categories: low – an attack is unlikely, moderate – an attack is possible but not likely, substantial – an attack is a strong possibility, severe – an attack is highly likely, and critical – an attack is expected imminently [16].

These levels refer to likelihood, in the sense that the likelihood is said to be low, moderate, significant and extremely high (or that the attack is unlikely, not likely, highly likely), but without any reference to the quantitative scale of [0,1] normally used for probabilities. In the PST system the categories are linked to some conditions concerning parties' capacities and intentions to strike some interests. These examples are not uncommon in the security community. There is a skepticism about the use of probabilities in the normal sense. The issue is discussed by for example [11], see also [12]. These authors point to some of the problems raised:

• Security failures are deliberate and thus not open to probabilistic analysis and modeling. The attackers know what they are doing so where are the uncertainties?

• Probability is difficult to use because of the essentially unrepeatable nature of the key events.

As commented by [11], the system owner and the defenders will not normally have the knowledge available when the attacker will act and in what way, there are uncertainties. And as probability is a tool for representing or expressing uncertainties, probability enters the scene also in such contexts. The events considered are often on–off situations which excludes frequentist probabilities – but subjective (also referred to as judgmental or knowledge-based) probabilities can always be used.

But why then do we see so seldom subjective probabilities used in security contexts? Are there special problems in using them in security settings or is their absence just a result of the security environment not knowing what these probabilities represent and how to apply them? These are the main issues we discuss in the present paper. Two hypotheses that initiated the present paper were that (i) the security community rejects the use of probabilities as their reference is frequentist probabilities, and (ii) there is a potential for meaningful use of subjective probabilities (including also interval subjective probabilities) in such settings provided that these probabilities are adequately defined and interpreted.

The latter hypothesis is the main focus in this paper. How should we understand and use such probabilities in practice? A well-known problem with specifying (subjective) probabilities in security contexts is that they are so linked to the risk management responses (see e.g. [5]): the analysts may for example assign a high probability number for an attack against some specific facility, the result being that some protective measures are implemented. This action may however cause potential attackers not to consider these facilities as suitable targets, and hence the probability of an attack needs to be reduced.

The example demonstrates clearly how important it is to be precise on what is the background knowledge that the subjective probabilities are based on. In the paper this issue is analyzed in detail: is it possible by proper structuring of the background knowledge to still use such probabilities in a meaningful and useful way? In the paper we also question if it is possible to reformulate qualitative statements such as (1)–(4) above by means of such probabilities? Before we go into the discussion a brief summary of fundamental ideas and definitions related to probability are given.