The dangers of disclosing defensive strategies

By Alexandra Richter

BUFFALO, N.Y. — When security and defense agencies publicly announce the deployment of new technologies — such as enhanced baggage scanners at airports — they may inadvertently help malicious actors identify which locations are defended and how, according to new research from the University at Buffalo School of Management.

Forthcoming in Production and Operations Management, the study examines how adversaries adapt their plans when they learn about new security measures at locations of interest, including airports, military bases and mass gatherings.

“Security and defense agencies often notify the public when they deploy new technologies and resources, which may lead to strategic responses by adversaries,” says study co-author Kyle Hunt, PhD, assistant professor of management science and systems in the UB School of Management. “For example, if an aviation security agency releases information about new screening technology at a set of airports, adversaries may decide to forgo a planned attack, change their attack plan to avoid the improved security, or select an entirely different target where that technology has not been deployed.”

To explore how defensive information disclosures can influence attackers, the researchers recruited nearly 1,000 participants for an incentivized experiment. Participants took on the role of a pirate (attacker) attempting to steal treasure from two beaches (targets) on an island defended by a queen (defender). In each round of the experiment, participants received an official statement from the defender about where security had been deployed, with the understanding that the message could be deceptive. Then, the participants reported their beliefs about where defenses were located and indicated which target they intended to attack, if any.

The results reveal that attackers adjust their strategies based on the information they receive, making them more likely to attack targets they believe are unprotected. And, when they learn that a defender values one target more than another, attackers assume security measures will be deployed at the higher-value target — even if this was never explicitly stated.

The study underscores how strategic communication by security and defense agencies can be a powerful deterrent. In the experiment, when attackers believed both targets were defended, even if that belief was based on false information, the likelihood of them choosing not to attack increased.

“By demonstrating that attackers are strategic and adaptive actors, we are able to improve our understanding of counterterrorism management, including how different defensive disclosures can influence an opponent’s decisions,” says Hunt.

Hunt collaborated on the study with Sule Guney, PhD, assistant professor of psychological science, University of California, Irvine; Richard John, PhD, professor of psychology, University of Southern California; and Jun Zhuang, PhD, associate dean for research and Morton C. Frank Professor in the UB School of Engineering and Applied Sciences.