Game Theory and
Risk Analysis for
Counterterrorism
David Banks
U.S. FDA
1
1. Context
Terrorists can invest in a portfolio of
attacks.
The U.S. can invest in various kinds
of defense.
If the U.S. fails to invest wisely, then
we lose important battles.
2
A Smallpox Exercise
The U.S. government is concerned
about the possibility of smallpox
bioterrorism.
Terrorists could make no smallpox
attack, a small attack on a single
city, or coordinated attacks on
multiple cities (or do other things).
3
The U.S. has considered four
defense strategies:
•
•
•
•
Stockpiling vaccine
Stockpiling and increasing
biosurveillance
Stockpiling, surveilling, and
inoculating first responders and/or
key personnel
Inoculating all consenting people
with healthy immune systems.
4
Deciding What To Do
Currently, the U.S. government is:
•
•
•
•
•
•
Holding public meetings
Soliciting scientific advice
Seeking counterintelligence
Calculating political support
Balancing alternative threats
Ensuring availability of options
5
But the U.S. government is not using:
•
•
•
•
Statistical risk analysis
Game theory
Cost-benefit analysis
Portfolio theory
These are methodologies that can
and should inform decision-making
to counter terrorist threats.
6
2. Normal-Form Games



Classical game theory uses a
matrix of costs to determine
optimal play.
Optimal play is usually defined as
a minimax strategy, but sometimes
one can minimize expected loss
instead.
Both methods are unreliable
guides to human behavior.
7
Game Theory Matrix
No Attack
Small Attack
Big Attack
Stockpile
C11
C12
C13
Surveillance
C21
C22
C23
First Responders
C31
C32
C33
Mass Inoculation
C41
C42
C43
8
Minimax Strategy
The U.S. should choose the defense with
smallest row-wise max cost.
The terrorist should choose the attack with
largest column-wise min cost.
If these are not equal then a randomized
strategy is better.
9
Minimum Expected Loss
Sometimes there is more information
and different structure than classic
game theory supposes.
This occurs in serial games, where
probabilities can be assigned to
future actions. This extensive-form
game theory generates decision
trees.
10
Extensive-form game theory invites
decision theory criteria based upon
minimum expected loss.
In our smallpox exercise, we shall
implement this by assuming that
the U.S. decisions are known to
the terrorists, and that this affects
their probabilities of using certain
kinds of attacks.
11
Game Theory Critique




Game theory does not take
account of resource limitations.
It assumes that both players have
the same cost matrix.
It assumes both players act in
synchrony (or in strict alternation).
It assumes all costs are measured
without error.
12
3. Risk Analysis
Statistical risk analysis makes
probabilistic statements about
specific kinds of threats.
It also treats the costs associated
with threats as random variables.
The total random cost is developed
by analysis of component costs.
13
Cost Example
To illustrate a key idea, consider the
problem of estimating the cost C11
in the game theory matrix. This is
the cost associated with stockpiling
vaccine when no smallpox attack
occurs.
Some components of the cost are
fixed, others are random.
14
C11 = cost to test diluted Dryvax +
cost to test Aventis vaccine +
cost to make 209 x 106 doses +
cost to produce VIG +
logistic/storage/device costs.
15
Assume that an expert indicates that:
Dryvax and Aventis testing have costs that are
independent and uniformly distributed on [$2
million, $5 million].
New vaccine production is not random; the contract
specifies $512 million.
VIG production is normally distributed with mean
$100 million, s.d. $20 million.
Logistics costs are normally distributed with mean
$940 million, s.d. $100 million.
16
Other Cij s
The other costs in the matrix are also
random variables, and their
distributions can be estimated in
similar Delphic ways.
Note that different matrix costs are
not independent; they often have
components in common across
rows and columns.
17
Other components include:
Number of attacks; this is Poisson
with mean 5, plus 2.
Number of key personnel; this is
uniform between 2 million and 12
million.
Number of smallpox cases per
attack; this is Gamma with mean
10 and s.d. 100.
18
Cost to treat one smallpox case; this
is normal with mean $200,000 and
s.d. $50,000.
Cost to inoculate 25,000 people; this
is normal with mean $60,000 and
s.d. $10,000.
Economic costs of a single attack;
this is gamma with mean $5 billion
and s.d. $10 billion.
19
4. Games + Risk
Game theory and statistical risk
analysis can be combined to give
arguably useful guidance in threat
management.
We generate many random tables,
according to the risk analysis, and
find which defenses are best.
20
We run 100 game theory matrices
and count how many times each
defense is optimal in terms of
• Minimaxity
• Minimum Expected Loss
We also calculate a score for each,
since the second-best defense
may have nearly the same cost as
the best.
21
Screenshot of Output
22
Minimum Expected Loss
The table in the lower right shows the
elicited probabilities of each kind of
attack given that the corresponding
defense has been adopted.
These probabilities are used to
weight the costs in calculating the
expected loss.
23
Scores
The scores beside the left-hand
tables are found by
• Summing the maximum costs in
each row
• Dividing each maximum by the
sum
• Allocating weight to the decisions
proportionally.
24
5. Conclusions
For our rough risk analysis, minimax favors
universal inoculation, minimum expected
loss favors stockpiling.
This accords with the public and federal
thinking on threat preparedness.
And the approach can be generalized.
25