I527-290 ESRIF Final Report (WEB).indd - European Commission

130
Many mechanisms like climate change, scarcity of raw materials, the introduction of nano technologies, and the proliferation of
cyberspace lifestyles generate or enable new risks but seldom lead to the radical removal of old ones. Increasing complexity and
interdependence make the networks of higher order eff ects of an incident harder to foresee and comprehend. While the mixture of
trends and events may diff er dramatically between plausible futures, only few risks and challenges are likely to become completely
irrelevant.
It turned out that ESRIF members diff ered in their reactions to this fi nding. With a reasonable simplifi cation it is possible to
distinguish between two main positions.
The first view is that if a risk is real, sooner or later it will manifest itself. Therefore, the key aspect of major risks is
the magnitude of their consequences, their future likelihood is difficult to assess and, at least according to some,
also irrelevant. Therefore in principle security solutions must be put in place for all real risks of major magnitude,
to disallow them by design, intercept them (‘incident prevention’ as opposed to ‘root-cause prevention’, which is of
limited relevance per this view) or to reduce their consequences – often referred to as resilience. Combining this
with the growing panorama of risk one is led to fear that an ever-increasing share of our wealth would have to be
expended on security – directly and indirectly, e.g., due to time delays caused by security screening. This can be called
a consequence-oriented view.
An alternative view can be understood departing from the observation that societies diff er greatly with regard to the levels of,
e.g., serious violent crime even though this phenomenon exists in essentially all societies. In line with this the general character of
scenarios M and W as ‘malign’ and G and N as ‘benign’ comes very strongly across in our work with the other WGs. The insight from
this comparison can be expressed such that security at societal level is no zero-sum game. Societies in the world diff er with regard
to the levels of trust and social cohesion, and, as a consequence, of real and perceived security. Per this view it is natural to base
security decisions on both magnitude and likelihood. Then there is a security dividend for high-trust societies that do not have
to spend so much on perimeter defences and intervention forces: Even if the scope of risk increases, the combined impact may
still go down. Thus here investing 10 in ‘root-cause prevention’ can be a very viable alternative to ‘incident prevention’, resilience,
and crisis management. At a more day-to-day level per this view it is natural to make security operations intelligence-led, varying,
e.g., levels of access controls with levels of assessed threat and risk. According to a standard defi nition of risk as being a combined
measure of likelihood and consequence this view can be labelled risk-oriented. The most well-known technical approach here is
of course probabilistic risk assessment (PRA), using the statistical expectation of the consequences as the composite measure.
It is possible to carve out two radically opposed positions based on the discussion above. Our main assertion is that the most
compelling challenge lies in developing intermediate positions between the two views. But as a background to this, in Box 1
we do precisely such carving out of the extremes.
Box 1: A discussion of consequence vs. risk oriented views in relation to ESRIF’s key messages
We start with ‘societal resilience’ – or perhaps better ‘human’ to stress which aspect we are after. From this vantage
point – and with the benefit of a long-term perspective – the risk-oriented view suggests reducing fundamental
causes of risks and threats (‘root cause prevention’): for example, less social exclusion in Europe is likely to lead to
less violent radicalisation and hence reduced risks for home-grown terrorism. The consequence-oriented view may
also lead to proposals for increasing trust and social cohesion, but here the focus is typically to prepare people to
better handle and reduce consequences of, e.g., a terrorist attack in preparation or being perpetrated. While this
is no irrelevant concern for the risk-oriented view either, the two views in pure form are likely to lead to different
results on the importance of striving for inclusiveness also of marginalised groups in building cohesion.
In terms of technology the consequence-oriented view stresses innovation and a flexible system-of-systems
approach (‘systematic approach to capability development’) to be able to satisfy the ever increasing scope of
security demands without running out of reasonable economic bounds. The risk-oriented view may lead to similar
approaches to flexibility – but here more to enable intelligence-led operations of security systems, i.e. smoothly
10 By ‘investment’ we mean decisions that are costly to implement and/or revoke, In addition to, e.g., equipment this can also
apply to organisation and legislation. Research and innovation involve many investment decisions of this nature under
‘broad’ (or ‘deep’ – terminology diff ers) uncertainty.
ESRIF FINAL REPORT - PART 2 • Working Group: Foresight and Scenarios