A Risk Analysis Framework for Cyber Security and Critical Infrastructure Protection of the U.S. Electric Power Grid

The purpose of this article is to introduce a risk analysis framework to enhance the cyber security of and to protect the critical infrastructure of the electric power grid of the United States. Building on the fundamental questions of risk assessment and management, this framework aims to advance the current risk analysis discussions pertaining to the electric power grid. Most of the previous risk-related studies on the electric power grid focus mainly on the recovery of the network from hurricanes and other natural disasters. In contrast, a disproportionately small number of studies explicitly investigate the vulnerability of the electric power grid to cyber-attack scenarios, and how they could be prevented or mitigated. Such a limited approach leaves the United States vulnerable to foreign and domestic threats (both state-sponsored and “lone wolf”) to infiltrate a network that lacks a comprehensive security environment or coordinated government response. By conducting a review of the literature and presenting a risk-based framework, this article underscores the need for a coordinated U.S. cyber security effort toward formulating strategies and responses conducive to protecting the nation against attacks on the electric power grid.     

Risk Reduction of an Invasive Insect by Targeting Surveillance Efforts with the Assistance of a Phenology Model and International Maritime Shipping Routes and Schedules

Reducing the risk of introduction to North America of the invasive Asian gypsy moth (Lymantria dispar asiatica Vnukovskij and L. d. japonica [Motschulsky]) on international maritime vessels involves two tactics: (1) vessels that wish to arrive in Canada or the United States and have visited any Asian port that is subject to regulation during designated times must obtain a predeparture inspection certificate from an approved entity; and (2) vessels with a certificate may be subjected to an additional inspection upon arrival. A decision support tool is described here with which the allocation of inspection resources at North American ports can be partitioned among multiple vessels according to estimates of the potential onboard Asian gypsy moth population and estimates of the onboard larval emergence pattern. The decision support tool assumes that port inspection is uniformly imperfect at the Asian ports and that each visit to a regulated port has potential for the vessel to be contaminated with gypsy moth egg masses. The decision support tool uses a multigenerational phenology model to estimate the potential onboard population of egg masses by calculating the temporal intersection between the dates of port visits to regulated ports and the simulated oviposition pattern in each port. The phenological development of the onboard population is simulated each day of the vessel log until the vessel arrives at the port being protected from introduction. Multiple independent simulations are used to create a probability distribution of the size and timing of larval emergence.     

Agency Problems and Airport Security: Quantitative and Qualitative Evidence on the Impact of Security Training

We analyze the issue of agency costs in aviation security by combining results from a quantitative economic model with a qualitative study based on semi‐structured interviews. Our model extends previous principal‐agent models by combining the traditional fixed and varying monetary responses to physical and cognitive effort with nonmonetary welfare and potentially transferable value of employees' own human capital. To provide empirical evidence for the tradeoffs identified in the quantitative model, we have undertaken an extensive interview process with regulators, airport managers, security personnel, and those tasked with training security personnel from an airport operating in a relatively high‐risk state, Turkey. Our results indicate that the effectiveness of additional training depends on the mix of “transferable skills” and “emotional” buy‐in of the security agents. Principals need to identify on which side of a critical tipping point their agents are to ensure that additional training, with attached expectations of the burden of work, aligns the incentives of employees with the principals' own objectives.     

Lessons learned from Toulouse and Buncefield disasters: from risk analysis failures to the identification of atypical scenarios through a better knowledge management

The recent occurrence of severe major accidents has brought to light flaws and limitations of hazard identification (HAZID) processes performed for safety reports, as in the accidents at Toulouse (France) and Buncefield (UK), where the accident scenarios that occurred were not captured by HAZID techniques. This study focuses on this type of atypical accident scenario deviating from normal expectations. The main purpose is to analyze the examples of atypical accidents mentioned and to attempt to identify them through the application of a well-known methodology such as the bow-tie analysis. To these aims, the concept of atypical event is accurately defined. Early warnings, causes, consequences, and occurrence mechanisms of the specific events are widely studied and general failures of risk assessment, management, and governance isolated. These activities contribute to outline a set of targeted recommendations, addressing transversal common deficiencies and also demonstrating how a better management of knowledge from the study of past events can support future risk assessment processes in the identification of atypical accident scenarios. Thus, a new methodology is not suggested; rather, a specific approach coordinating a more effective use of experience and available information is described, to suggest that lessons to be learned from past accidents can be effectively translated into actions of prevention.     

Intake fraction for multimedia pollutants: a tool for life cycle analysis and comparative risk assessment.

We employ the intake fraction (iF) as an effective tool for expressing the source-to-intake relationship for pollutant emissions in life cycle analysis (LCA) or comparative risk assessment. Intake fraction is the fraction of chemical mass emitted into the environment that eventually passes into a member of the population through inhalation, ingestion, or dermal exposure. To date, this concept has been primarily applied to pollutants whose primary route of exposure is inhalation. Here we extend the use of iF to multimedia pollutants with multiple exposure pathways. We use a level III multimedia model to calculate iF for TCDD and compare the result to one calculated from measured levels of dioxin toxic equivalents in the environment. We calculate iF for emissions to air and surface water for 308 chemicals. We correlate the primary exposure route with the magnitudes of the octanol-water partition coefficient, Kow, and of the air-water partitioning coefficient (dimensionless Henry constant), Kaw. This results in value ranges of Kow and Kaw where the chemical exposure route can be classified with limited input data requirements as primarily inhalation, primarily ingestion, or multipathway. For the inhalation and ingestion dominant pollutants, we also define empirical relationships based on chemical properties for quantifying the intake fraction. The empirical relationships facilitate rapid evaluation of many chemicals in terms of the intake. By defining a theoretical upper limit for iF in a multimedia environment we find that iF calculations provide insight into the multimedia model algorithms and help identify unusual patterns of exposure and questionable exposure model results.     

Risk analysis under attack: How risk science can address the legal,social, and reputational liabilities faced by risk analysts

The role of the risk analyst is critical in understanding and managing uncertainty. However, there is another type of uncertainty that is rarely discussed: The legal, social, and reputational liabilities of the risk analyst. Recent events have shown that professionals participating in risk analysis can be held personally liable. It is timely and important to ask: How can risk science guide risk analysis with consideration of those liabilities, particularly in response to emerging and unprecedented risk. This paper studies this topic by: (1) Categorizing how professionals with risk analysis responsibilities have historically been held liable, and (2) developing a framework to address uncertainty related to those potential liabilities. The result of this framework will enable individual analysts and organizations to investigate and manage the expectations of risk analysts and others as they apply risk principles and methods. This paper will be of interest to risk researchers, risk professionals, and industry professionals who seek maturity within their risk programs.     

基于粗糙集的投标风险分析与规避决策模型研究——国家自然科学基金项目（70271031）回溯

回顾了国家自然科学基金项目"基于粗糙集的投标风险分析与规避决策模型研究(70271031)"的立项背景,介绍了本项目的主要研究内容与主要成果,以及本项目的代表性论文、论著。     

Sensitivity of Concentration and Risk Predictions in the PRESTO and MMSOILS Multimedia Models: Regression Technique Assessment

This paper describes the application of two multimedia models, PRESTO and MMSOILS, to predict contaminant migration from a landfill that contains an organic chemical (methylene chloride) and a radionuclide (uranium-238). Exposure point concentrations and human health risks are predicted, and distributions of those predictions are generated using Monte Carlo techniques. Analysis of exposure point concentrations shows that predictions of uranium-238 in groundwater differ by more than one order of magnitude between models. These differences occur mainly because PRESTO simulates uranium-238 transport through the groundwater using a one-dimensional algorithm and vertically mixes the plume over an effective mixing depth, whereas MMSOILS uses a three-dimensional algorithm and simulates a plume that resides near the surface of the aquifer.A sensitivity analysis, using stepwise multiple linear regression, is performed to evaluate which of the random variables are most important in producing the predicted distributions of exposure point concentrations and health risks. The sensitivity analysis shows that the predicted distributions can be accurately reproduced using a small subset of the random variables. Simple regression techniques are applied, for comparison, to the same scenarios, and results are similar. The practical implication of this analysis is the ability to distinguish between important versus unimportant random variables in terms of their sensitivity to selected endpoints.     

企业风险管理与经营效率:来自中国保险业的经验证据

本文从风险管理的视角对企业效率评估的数据包络分析技术进行了改进,探讨了风险管理与经营效率的内在关联,并以中国保险业为例,对1999年以来企业真实的经营效率水平进行了评估。结果表明:企业内部的风险管理能力对其经营效率水平的提升具有明显的影响,而且这种影响力正在逐渐加强。不考虑企业内部的风险管理水平将直接导致其经营效率的测算结果出现低估,2002年以后这种低估的程度越发明显,这可归因于同期保险企业开始逐渐重视提高自身的风险管理能力。以上结论也为企业如何在管控风险的同时提升经营效率水平提供了有价值的指导。     

Measurement error, skewness, and risk analysis: coping with the long tail of the distribution.

Probabilistic risk analyses often construct multistage chance trees to estimate the joint probability of compound events. If random measurement error is associated with some or all of the estimates, we show that resulting estimates of joint probability may be highly skewed. Joint probability estimates based on the analysis of multistage chance trees are more likely than not to be below the true probability of adverse events, but will sometimes substantially overestimate them. In contexts such as insurance markets for environmental risks, skewed distributions of risk estimates amplify the "winner's curse" so that the estimated risk premium for low-probability events is likely to be lower than the normative value. Skewness may result even in unbiased estimators of expected value from simple lotteries, if measurement error is associated with both the probability and pay-off terms. Further, skewness may occur even if the error associated with these two estimates is symmetrically distributed. Under certain circumstances, skewed estimates of expected value may result in risk-neutral decisionmakers exhibiting a tendency to choose a certainty equivalent over a lottery of equal expected value, or vice versa. We show that when distributions of estimates of expected value are, positively skewed, under certain circumstances it will be optimal to choose lotteries with nominal values lower than the value of apparently superior certainty equivalents. Extending the previous work of Goodman (1960), we provide an exact formula for the skewness of products.     

Learning from the Piper Alpha Accident: A Postmortem Analysis of Technical and Organizational Factors

The accident that occurred on board the offshore platform Piper Alpha in July 1988 killed 167 people and cost billions of dollars in property damage. It was caused by a massive fire, which was not the result of an unpredictable "act of God" but of an accumulation of errors and questionable decisions. Most of them were rooted in the organization, its structure, procedures, and culture. This paper analyzes the accident scenario using the risk analysis framework, determines which human decision and actions influenced the occurrence of the basic events, and then identifies the organizational roots of these decisions and actions. These organizational factors are generalizable to other industries and engineering systems. They include flaws in the design guidelines and design practices (e.g., tight physical couplings or insufficient redundancies), misguided priorities in the management of the tradeoff between productivity and safety, mistakes in the management of the personnel on board, and errors of judgment in the process by which financial pressures are applied on the production sector (i.e., the oil companies' definition of profit centers) resulting in deficiencies in inspection and maintenance operations. This analytical approach allows identification of risk management measures that go beyond the purely technical (e.g., add redundancies to a safety system) and also include improvements of management practices.     

Stability and Inoculation of Risk Comparisons'' Effects Under Conflict: Replicating and Extending the "Asbestos Jury" Study by Slovic et al.

Promotion or criticism of risk comparisons in risk communication has far exceeded empirical tests of their effects. Slovic et al. (1990) experimented with a hypothetical jury trial in which an asbestos-installing firm was accused of subjecting school occupants to unreasonable risk. A risk comparison sharply reduced subjects' estimates of risk and judgments that the firm was guilty, but a critique of the risk comparison had risk estimates and guilt judgments rebounding to the original (without risk comparison) level. Slovic et al. concluded that risk comparisons' effects were highly unstable, at least in conflict-ridden situations such as a jury trial. The present study replicates and extends this important study, using the same stimuli and questions. The respective effects of the risk comparison and the critique recurred, although much less sharply than in Slovic et al. Moreover, judgments of guilt, risk, and other aspects of the case seemed shaped more by demographics and beliefs about risk generically (e.g., about the likelihood of cancer after exposure to a carcinogen) than by either risk comparison or critique. A variant design, in which the defense's expert witness dismissed potential criticisms of the risk comparison, appeared to "inoculate" people against shifting their views after seeing the critique. Overall, these results show that risk comparisons might change some beliefs about risks in conflict and that "inoculation" can reduce vulnerability to criticism. However, the results also show strong limits on effects of both comparisons and their critiques: they shifted only a minority of judgments and had small effects relative to people's social locations and prior risk beliefs.     

An emotion-based model of risk perception and stigma susceptibility: cognitive appraisals of emotion, affective reactivity, worldviews, and risk perceptions in the generation of technological stigma.

A study (N=198) was conducted to examine hypotheses derived from an emotion-based model of stigma responses to radiation sources. A model of stigma susceptibility is proposed in which affective reactions and cognitive worldviews activate predispositions to appraise and experience events in systematic ways that result in the generation of negative emotion, risk perceptions, and stigma responses. Results of structural equation modeling supported the hypotheses. Radiation sources that scored higher on a measure of stigma were included in the analyses (i.e., nuclear power plants, radioactive waste from nuclear power plants, radiation from nuclear weapons testing). Individual differences in negative reactivity and worldviews were associated with the strength of emotional appraisals that were associated, in turn, with negative emotion toward stigmatized radiation sources. As hypothesized, the model fit better with perceived risk as a function of negative emotion rather than vice versa. Finally, a measure of stigma was associated with negative emotion and, to a lesser extent, with risk perceptions. Risk communication about stigmatized objects may benefit from a more complete understanding of how affective and emotional reactions are constructed and the routes through which they affect responses and behaviors.     

Accident Epidemiology and the U.S. Chemical Industry: Accident History and Worst-Case Data from RMP*Info

This article reports on the data collected on one of the most ambitious government-sponsored environmental data acquisition projects of all time, the Risk Management Plan (RMP) data collected under section 112(r) of the Clean Air Act Amendments of 1990. This RMP Rule 112(r) was triggered by the Bhopal accident in 1984 and led to the requirement that each qualifying facility develop and file with the U.S. Environmental Protection Agency a Risk Management Plan (RMP) as well as accident history data for the five-year period preceding the filing of the RMP. These data were collected in 1999-2001 on more than 15,000 facilities in the United States that store or use listed toxic or flammable chemicals believed to be a hazard to the environment or to human health of facility employees or off-site residents of host communities. The resulting database, RMP*Info, has become a key resource for regulators and researchers concerned with the frequency and severity of accidents, and the underlying facility-specific factors that are statistically associated with accident and injury rates. This article analyzes which facilities actually filed under the Rule and presents results on accident frequencies and severities available from the RMP*Info database. This article also presents summaries of related results from RMP*Info on Offsite Consequence Analysis (OCA), an analytical estimate of the potential consequences of hypothetical worst-case and alternative accidental releases on the public and environment around the facility. The OCA data have become a key input in the evaluation of site security assessment and mitigation policies for both government planners as well as facility managers and their insurers. Following the survey of the RMP*Info data, we discuss the rich set of policy decisions that may be informed by research based on these data.     

Valuation of childhood risk reduction: the importance of age, risk preferences, and perspective.

This article explores two problems analysts face in determining how to estimate values for children's health and safety risk reductions. The first addresses the question: Do willingness‐to‐pay estimates for health risk changes differ across children and adults and, if so, how? To answer this question, the article first examines the potential effects of age and risk preferences on willingness to pay. A summary of the literature reporting empirical evidence of differences between willingness to pay for adult health and safety risk reductions and willingness to pay for health and safety risk reductions in children is also provided. The second dimension of the problem is a more fundamental issue: Whose perspective is relevant when valuing children's health effects—society's, children's, adults‐as‐children, or parents'? Each perspective is considered, followed ultimately by the conclusion that adopting a parental perspective through an intrahousehold allocation model seems closest to meeting the needs of the estimation problem at hand. A policy example in which the choice of perspective affects the outcome of a regulatory benefit‐cost analysis rounds out the article and emphasizes the importance of perspective.     

The dynamic performances of DDTs in the environment and Japanese exposure to them: a historical perspective after the ban.

The fugacity model for evaluating DDTs dynamic performances in the environment was combined with the dietary exposure evaluation model, including the contribution of imported food, to develop the macroscopic mathematical model relating DDTs in the environment with the health risks of the reference Japanese. The model validity was examined by comparing the simulated DDTs concentrations in environmental media, various kinds of food, and dietary intake with those observed. Numerical simulations were done for the past half and future of one century to evaluate the effect of the DDTs usage prohibition in 1970 in Japan. The major results obtained under the limits considered are as follows. The DDTs concentrations in environmental media, various kinds of foods, and the dietary intake showed the steady exponential decrease after the DDTs usage prohibition in 1970. The DDE/DDTs ratio is larger in the higher position in an ecological system, and increased steadily with time. The critical exposure of DDTs occurred through animal product intake until 1960; after 1990 marine product intake caused the most exposure. The estimated DDTs intake was evaluated to be less than the PTDI and RfD. The annual excess cancer induction risk due to the annual dietary intake of DDTs was the largest at the level of (0.5 - 2.0) x 10(-6) (1/yr) in the early 1970s. The effect of the DDT usage prohibition on dietary exposure reduction was expected to appear after about 20 years. The life-span excess cancer induction risk was conservatively estimated to be larger than 10(-5) (1/lifespan) for the reference Japanese who were born before 1970. The DDTs usage prohibition in 1970 was effective to reduce the life-span cancer risk under the 10(-5) level.     

Assessing the Benefits and Costs of Homeland Security Research: A Risk-Informed Methodology with Applications for the U.S. Coast Guard

This article describes a methodology for risk-informed benefit–cost analyses of homeland security research products. The methodology is field-tested with 10 research products developed for the U.S. Coast Guard. Risk-informed benefit–cost analysis is a tool for risk management that integrates elements of risk analysis, decision analysis, and benefit–cost analysis. The cost analysis methodology includes a full-cost accounting of research projects, starting with initial fundamental research costs and extending to the costs of implementation of the research products and, where applicable, training, maintenance, and upgrade costs. The benefits analysis methodology is driven by changes in costs and risks leading to five alternative models: cost savings at the same level of security, increased security at the same cost, signal detection improvements, risk reduction by deterrence, and value of information. The U.S. Coast Guard staff selected 10 research projects to test and generalize the methodology. Examples include tools to improve the detection of explosives, reduce the costs of harbor patrols, and provide better predictions of hurricane wind speeds and floods. Benefits models and estimates varied by research project and many input parameters of the benefit estimates were highly uncertain, so risk analysis for sensitivity testing and simulation was important. Aggregating across the 10 research products, we found an overall median net present value of about $385 million, with a range from $54 million (5th percentile) to $877 million (95th percentile). Lessons learned are provided for future applications.     

Using the CAUSE Model to Understand Public Communication about Water Risks: Perspectives from Texas Groundwater District Officials on Drought and Availability

Public communication about drought and water availability risks poses challenges to a potentially disinterested public. Water management professionals, though, have a responsibility to work with the public to engage in communication about water and environmental risks. Because limited research in water management examines organizational communication practices and perceptions, insights into research and practice can be gained through investigation of current applications of these risk communication efforts. Guided by the CAUSE model, which explains common goals in communicating risk information to the public (e.g., creating Confidence, generating Awareness, enhancing Understanding, gaining Satisfaction, and motivating Enactment), semistructured interviews of professionals (N = 25) employed by Texas groundwater conservation districts were conducted. The interviews examined how CAUSE model considerations factor in to communication about drought and water availability risks. These data suggest that many work to build constituents’ confidence in their districts. Although audiences and constituents living in drought‐prone areas were reported as being engaged with water availability risks and solutions, many district officials noted constituents’ lack of perceived risk and engagement. Some managers also indicated that public understanding was a secondary concern of their primary responsibilities and that the public often seemed apathetic about technical details related to water conservation risks. Overall, results suggest complicated dynamics between officials and the public regarding information access and motivation. The article also outlines extensions of the CAUSE model and implications for improving public communication about drought and water availability risks.