Hazards with incentives

On the topic of the difference between analyzing security and safety:

There could be a difference regarding the size of the probabilities were safety incidents in many cases have higher probabilities than security incidents. This is discussed by Kunreuther in an article on risk analysis in an uncertain world where he draws some conclusions from terrorist attacks in USA.

Kunreuther however doesn’t discuss the fact that the security threat has a mind, incentives, agenda and intent. In the article Freakonomics of Maritime Piracy J. Kraska uses Steven Levitt’s concept of freakonomics on piracy. They both argue that in many situations human conduct can be described by economic incentives which reveal “interesting findings about the risks people are willing to take, the rewards they seek, and the rationale they use in negotiating choices”.

From this I draw the conclusion that in order to analyze security risks we have to understand the threat’s incentives and from that describe the intent and modus operandi. And when the intent and modus operandi is given we have limited the scenarios, choices and valid probabilities considerably, at least if we are discussing the security of a specific thing such as a car, building, computer system. This because there has to be a link between our protected asset and the intent or it won’t be attacked. But…

…when analyzing the risk of terrorist attacks on society there is no specific asset in the intent, the intent is to cause terror. The specific assets involved are chosen out of convenience. This does off course not limit the scenarios, choices and probabilities and the number of alternatives to analyze is endless. But…

…this if you are to consider the probability of an terrorist attack on society, are you instead ONLY interested in limit a specific assets (car, plane, ship, material…) probability of being used in an terrorist attack, again there has to be a link between that asset and the intent.