Resource Security and Risk Management

One of the current hot topics in international politics is resource security. Energy security - specifically fossil fuels - is the most extensively discussed flavor of the issue, but other areas of study include rare earth metals (used in many modern electronics) and even water. Some analysts predict wars revolving around scarce water resources within the foreseeable future.

A few days ago, I ran across this video...



... which reminded me of this podcast from the Department of War Studies at King's College London, which was published in late 2010. The two items provide valuably contrasting points on the topic.

Rare earth metals provide a good case study for some of these phenomena. For those readers who are unaware, rare earth metals are a range of heavy metals whose properties make them indispensable in the manufacture of modern electronics. While they are found in several locations, the vast bulk of rare earth metals are exploited from mines in China. In recent months, China has been accused of restricting rare earth metal exports. As these materials are critical not only for consumer electronics, but also for systems vital to international security, the potential decline in availability relative to demand could become a serious international issue, similar in many respects to the supply and sourcing of fossil fuels. The potential risk affects not only the price, but the actual international availability of the critical commodity in question.

At the same time, the increased risk to global supply makes the potential exploitation of other sources of rare earth metals more lucrative. For example, Japan reported a number of months ago that it had located a source of rare earths in the Pacific seabed - a source that has become lucrative enough to exploit due to the Chinese lockdown on their supplies. According to Wired, it has also compelled the Pentagon to research new ways to mine rare earth metals, and I've also heard (but unfortunately, don't remember the source) that technical experts are also researching methods of manufacturing modern electronics without rare earths.

Of course, the world is seldom so simple: for example, there are allegations that the rare earth mineral coltan has fueled a war in the Democratic Republic of Congo. Additionally, the the mining and refinement of rare earth metals is an ecologically hazardous process. This introducing environmental concerns as an additional limiting factor on sources outside of developing nations, in the same way that environmentalism has limited the use of both traditional fossil fuels and the proliferation of nuclear energy.

The lesson, of course, is that while the so-called "invisible hand" can impact the management of risk, even in matters of resource security, it is ultimately subordinate to human factors.

Maritime Risk Management

One of the growing markets in international risk management is maritime private security. A recent book on the topic is Maritime Private Security: Market responses to piracy, terrorism and waterborne security risks in the 21st century, edited by Claude Berube and Patrick Cullen. Berube and Cullen lectured on the topic at the Heritage Foundation in March. You can watch a video of the event or download the podcast here.

Although the rise of piracy in the vicinity of Somalia garners most of the current news attention, risk management professionals monitor security threats in a variety of other key areas. These include maritime bottlenecks such as the Straits of Gibraltar, Hormuz, and Malacca, and the Panama and Suez Canals. A July 2010 attack on a Japanese tanker in the Strait of Hormuz may have been linked to al Qaeda, and investigative journalist Richard Miniter has tied al Qaeda to several disrupted plots to attack shipping in the Strait of Malacca. Berube and Cullen's presentation goes into further detail on implications and strategies for maritime risk management efforts for the foreseeable future.

Using Comedy to Illustrate OPSEC

A few years ago, I attended the National Operational Security Conference. In one of the lectures I attended, the speaker played a clip from an old episode of Saturday Night Live that aired during the Persian Gulf War. You can read the transcript of that sketch here, and anyone who uses Netflix can view it online (Saturday Night Live: The 1990's, Season 16: Ep. 12 (Kevin Bacon)). It's a good illustration of the challenges faced by anyone whose job is to disseminate information to the public while protecting information that could be potentially damaging.

The military term for protecting critical information from exploitation by an enemy is Operational or Operations Security, or "OPSEC". The military goes to great lengths to train personnel of all stripes to protect information that could be useful to adversaries, and a legion of Public Affairs Officers are specially trained to provide relevant information to the public without divulging secrets that could jeopardize personnel or operations. In the corporate world, this is accomplished by strategic communications specialists. Although the military stakes are often higher, companies take the control of information very seriously. Improper disclosure of sensitive data about a corporation or other organization could encourage corporate espionage, or damage the public's perception. The same is true of the military, with the added risk of endangering the lives of personnel and the effectiveness of missions vital to national security.

The military uses the Five Step OPSEC Process as a tool to help protect sensitive information. The process is as follows:

1) Identify critical information
2) Threat analysis
3) Vulnerability analysis
4) Risk assessment
5) Implement OPSEC Measures

The best OPSEC principle I've ever heard is called "The New York Times Rule", or the "Karachi Corollary". When determining whether information should be protected or released, ask yourself: "Would I want this information to be published on the front page of the New York Times? What about on the screen in an Internet cafe in Karachi, Pakistan?" More often than not, the answer is "no".

As with any functional area of security, the best advice is to err on the side of caution. If you think that a piece of information could be useful to an adversary, it probably could be. Organizations with security concerns should do their best to promote a culture of awareness and caution.

Omani Terrorists?

I was shocked to see this article on Long War Journal as I was reviewing my RSS feeds this evening. One Omani terrorist is counterintuitive, as Omanis follow the moderate and tolerant Ibadhi sect; the idea of a group of Omani jihadists is almost beyond belief. I visited Oman earlier this year, and fell in love with the country and its people. To think that several of Oman's sons have dedicated themselves to jihad is tragic.

Camera Phones and Security

I tend to disagree with Andrew Exum a lot, but his recent op-ed is spot-on, and reflects one of my earlier posts about security and social media. The case of the American troops caught snapping pictures of themselves posing with dead Taliban is disconcerting, but the questions it raises about camera phones in combat are synonymous with the questions it raises about camera phones and both personal and organizational security. The implications are different for every person and every organization - for example, I probably don't have to worry as much about a stalker collecting information about me from pictures I post of myself online as would a hundred-pound cheerleader. In the business realm, a local flower shop will have less cause to hire a public affairs officer to clear the release of employees' camera phone photos than the Department of Defense. "Ex" is right: some of this will improve as policy makers retire and are replaced by a senior officer and NCO corps that understands technology - as "natives", to quote Ex. That said, I think an issue still stands, because whereas the retiring officer and NCO corps views security through a post-Cold War framework in which information required tight controls, but was also much easier to control. Today's young people come from a culture in which it's natural to share every detail, all the way down to the time and location of the restaurant that you've just "checked into". A greater understanding of technology and its capabilities (positive and negative) is important, but so is strong training on why some information is sensitive and worthy of protection. The same concept applies to individuals and private organizations.

A Victory for Afghan Security

Earlier this week, the Taliban staged what has been described by media sources as a daring raid. I'm of the mind that this gives undue credit to the Taliban, as high profile raids are no substitute for support from the populace and the military superiority required to stage militarily costly attacks on an enemy. The Taliban boasts neither widespread voluntary support from the Afghan population, nor the military capability to openly challenge ISAF or Afghan forces. Raids like the one that took place earlier this week serve no military purpose, and are purely designed to give the appearance of strength to those who don't know to read between the lines. Unfortunately, what high profile raids lack in military effectiveness, they more than make up for in propaganda value.

The security situation in Afghanistan isn't promising. Good news is scarce, and bad news is plentiful - like the latest example of troops behaving inappropriately with Afghan human remains. The aftermath of the raid produced some rare good news, because Afghan security forces in Kabul repulsed this latest attack with minimal support from their coalition partners. I doubt this is the paradigm shift that wins the war, but it's at least encouraging. It will take a lot more stories like this for this conflict to end in anything other than a protracted continuation of the conflict.

Ironically, this story comes in the wake of Russian concerns over NATO's stated 2014 withdrawal deadline. Russia's vocal concern is ironic, given that Russia has made no attempt to volunteer its support, and has actively complicated ISAF's efforts to establish redundant supply lines in Central Asia. Afghanistan's fate could have a greater direct impact on Russia's national security than on America's, which makes Russian statements and policies all the more ironic.

Timothy McVeigh and Terrorism

As I've continued my graduate school pre-readings, I've come across several mentions of the Oklahoma City Bombing and Timothy McVeigh in the context of domestic terrorism. After 9/11, Oklahoma City was repeatedly invoked for one reason or another, as it was the most recent violent mass casualty event prior to the al Qaeda operation. Yesterday, a question struck me: did the Oklahoma City Bombing meet the technical definition of "terrorism"? The same question could be asked of the ongoing Anders Behring Breivik trial in Norway, or the Beltway Sniper case. All of these incidents were obviously horrific, unjustifiable outrages committed against scores of unarmed and innocent civilians, and by posing the question, my intent is not to detract from that outrage in any way. My question is more a matter of semantics, with limited relevance to discussions of security policy.

Most definitions of terrorism include the concept of influencing political decisions - essentially, violence is used against civilians or other non-combatants in order to cause widespread fear, which then influences the political process in favor of demands made by the terrorist. The influence on politics is a key element of the definition of "terrorism". In the case of the Oklahoma City Bombing, while McVeigh's motives for carrying out the attack were influenced by politics, he doesn't seem to have stated a desired outcome or made any policy demands. I've seen no evidence that McVeigh had any policy demands to accompany the horrific violence he had committed, and he stated that the bombing was an act of revenge for the events of the Waco Standoff several years earlier. The question, then, is whether "terrorism" is the right word to define the Oklahoma City Bombing; or would another, such as "mass murder", be more appropriate? The same could be said of Anders Behring Breivik, who distributed a manifesto shortly before carrying out his attack, but who doesn't appear to have had specific policy demands.

To a great degree, this question identifies a difference without a distinction: the methods we employ to stop al Qaeda from detonating car bombs are the same as the methods we employ to stop another Timothy McVeigh from detonating car bombs. Where the distinction could become important is in the discussion of policy objectives aimed at mitigating threats of terrorism. By associating the likes of al Qaeda, ETA, and the Real IRA with the likes of Timothy McVeigh or Anders Behring Breivik, security strategists and public officials tend to generalize methods for prevention and interdiction. I would make a comparison to heart disease and cancer: both are insidious diseases that can kill you; their causes, treatments, and preventative measures share some commonalities; but if a physician were to treat them as the same disease, said physician would likely do a poorer job of addressing both, whereas identifying key points of similarity and key differences allows for more effective mitigation of both. In the same way, it seems logical that a mass murderer like Timothy McVeigh not be summarily lumped in with a terrorist group like al Qaeda, so that the commonalities can be addressed while simultaneously focusing on the aspects which divide the two in order to more effectively prevent and mitigate attacks by both.