You’ve read the first 25 RTJ Laws of Red Teaming, right? And the 11 “See It Like Jones Would” essays? And you still want more? Enlighten and motivate your key thinkers and decision makers with Watermark “Think Like a Red Teamer” training. We’ll teach you how to think, ponder, cogitate, and brood just like a seasoned red teamer (and we’ll introduce you to Laws 25–35, the ones you don’t see on the site!). The principles in the course apply equally to security and business strategy, and we tailor the examples and exercises to your domain. Learn more.

The summer season is beginning in America and that can only mean the joys of workforce planning during the vacation season from Memorial Day through Labor Day. With the additional benefit of federal government furloughs, there are numerous other challenges, including the increase in significant weather throughout the U.S. and the possibility of an unexpected surprise domestically. With these factors in mind, have you considered your plans for continuity of operations (COOP) plans given the reduced expertise present in your organization? Many bosses would probably argue to end all vacation, but in the age of reduced workforces and remote work environments having all of your boots on the ground is not a possibility.
      Organizational memory and expertise, along with social capital, is held in the minds of the employees in any organization. Even with effective knowledge management and standard operating procedures there are always those few people who can “just make things happen.” When I worked in a manufacturing firm, there was an administrative person who had worked with the company for nearly 30 years and took a month of vacation near Christmas to visit grandchildren. Whenever she left town, there were always tasks that fell off the radar because she quietly made things happen behind the scenes. After years of enduring these breaks in productivity, an enterprising HR staffer cataloged her tasks over a period of a month to prevent any breakdown in the machine, thereby plugging the knowledge gap. In an emergency, what if your lead on any given task is absent due to a summer fishing trip? A red team could help prepare and develop the organizational staff to be ready for these unexpected surprises
      What is the plan if your go-to type-A leader is on vacation and crisis presents itself to a junior staff member and an intern?

1. Plan: Conduct planning exercises where primary employees are not able to be the decision makers in a crisis planning session, have their assistant or a different individual conduct the planning and execution of a crisis action plan.
2. Manage Your Knowledge: “Knowing is half the battle,” and leaders in organizations need to know what their employees do. Likewise, it would be pretty helpful to know what the boss does in the event he or she is out of the office when a tornado hits the building. It is vital to have a playbook whether operating in normal conditions or crisis conditions. Plan, train, and refine these standard operating procedures so that non-expert employees have a guideline to base a decision on in the event of a time sensitive crisis. Red teams need to be the voice of reality in COOP exercises and crisis situations. Surprisingly, it is important to remind people in a crisis that checklists and SOPs are guides to a hypothetical solution. Given the details and circumstances of an actual event, they may not present an appropriate solution but provide a framework for completing the decision making process.
3. Rehearse: In a world of uncertainty, practicing time sensitive decision making builds the skills necessary to perform in a crisis. Plan a COOP exercise during a furlough Friday in a federal or military workforce or a fire drill in a civilian work place. In the summer with flex scheduling or liberal leave policies, how long would it take to account for all employees at a safety rally point?

      Keep RTJ Red Teaming law #17 in mind this summer,¹ as less senior staffers watch as those with more vacation time enjoy the fruits of their labor for it may be one of these junior employees that has to make a critical decision in a crisis. So “Bossman,” is your organization ready for you to take your vacation?

Notes:

1. RTJ Red Teaming Law #17: The superior red teamer learns how things work in the real world, not just how they work on a diagram or presentation slide. The most useful insights often come from the bottom of the org chart. The higher up the org you go, the broader the view but the more filtered the information.

Join Robert Bunker and Stephen Sloan as they talk about their book Red Teams and Counterterrorism Training. This podcast has been out since 2011, but it’s still worth a listen. And when you’re done, you can check out the RTJ review of the book here.

If there’s one lesson I’ve learned in the years I’ve been running Red Team Journal, it’s that human beings are fundamentally overconfident. We’re also fundamentally shortsighted, and the two flaws combine in dangerous ways.
      Consider the types of systems we build. We almost always push the limits of technology. Rarely do we pause and ask whether the latest supertech gizmo is worth the cost or the risk. Why? We’re overconfident (we think we can manage any problems that emerge), and we’re shortsighted (we want the very latest and will worry about the risks later). It’s the madness of our age, and our adversaries have learned to exploit it. (The figure below expresses the basic problem.)

      How do we recover? We red team early in the system lifecycle and increase the priority of resilience during the concept and requirements phases. It’s that simple. We can launch graybeard panels, run costly studies, and write long-winded reports, but there’s really no need. I’ve just provided the answer–for free. Now go forth and red team.

Are you interested in an informal meeting in the DC area sometime in June to talk red teaming and meet other red teamers? If so, contact us and let us know. The only condition is that we can’t red team each other!

If you’re new to red teaming and don’t know where to start, we suggest the following links:

• Red Teaming and Alternative Analysis. This will give you some context for what follows.
• Red Teaming: A Balanced View. Red teaming isn’t a silver bullet activity or a one-size-fits-all solution. Learn about some of the considerations you should consider when red teaming.
• The Laws of Red Teaming. Think like a red teamer.
• The Red Team Mindset (at RedTeams.net). Think like a red teamer some more.
• The Information Design Assurance Red Team (at IDART.Sandia.gov). Another perspective on red teaming …

When you’re done with these, we recommend coming back to Red Team Journal, reading the “See It Like Jones Would” series of essays, and digging into the RTJ list of resources. If you still want more, try The Red Teamer’s Bookshelf (2012 Edition).

We’ve collected the “See It Like Jones Would” posts on a single page. We will add new Jones essays to the page periodically. In the meantime, they’re always worth another read!

Red teaming and risk analysis intuitively seem like natural complements, but it’s not always clear how they relate. I’ve attached here a single slide from a capabilities briefing I built for my day job. In it I suggest one way to link the two disciplines explicitly. The gist of the message is that red teaming can enhance each element of the triplet definition of risk.

In Reflections on Intelligence, R. V. Jones briefly reviews the British decision to adopt a convoy system during World War I. The case brings to light two useful insights: (1) know your data’s heritage and (2) value the opinions of junior officers. It also emphasizes how easy it is to work at cross purposes within the same organization.
      The Admiralty was dead set against a convoy system. One of their main arguments was that convoys would require an impractical number of escorts. They based their conclusion in part on the estimate that “5,000 ships entered or left British ports in a typical week.”¹ As Jones notes, even in convoys of 40, this would require hundreds of escorts. Fortunately,

… when a relatively junior officer in the Admiralty, Commander R. G. Henderson, went over the figures he found that they included the movements of all ships over 300 tons. These therefore included all coasters and cross-Channel ferries making several movements each week. When he removed these from the reckoning by counting only ships over 1,600 tons, which were carrying the overseas trade, the weekly figures fell from 5,000 to around 250.²

By applying a simple filter, Henderson reframed the entire problem. What was seemingly impossible suddenly became feasible.
      What is doubly interesting is the origin of the original figure. Apparently,

… the Admiralty had deliberately counted in all the smaller ships so as to play down the proportionate magnitude of the U-boat successes, and to make the neutrals think that they would be reasonably safe using British ports. As the war went on, it seemed that the Admiralty had forgotten how it had biased the figures, and it had become the dupe of its own propaganda … ”³

      Lloyd George and Churchill overruled the Admiralty and instituted convoys. Later, writing in The U-boat Crisis, Churchill noted the value of junior officers’ opinions:

In the naval service the discipline of opinion was so severe that had not the channel, or safety-valve, of the Committee of Imperial Defence been in existence, these opinions [of junior officers] could never have borne fruit or even come to light. The firmly inculcated doctrine that an admiral’s opinion was more likely to be right that a captain’s, and a captain’s than a commander’s, did not hold good when questions entirely novel in character, requiring keen and bold minds unhampered by long routine, were under debate. ⁴

      Elsewhere in his book, Jones expands on the concept of understanding “the actual conditions of battle ‘at the sharp end.’” He lauds Churchill for knowing when to “go through his immediate circle of advisors, and cut through to the level of detail where the work was done,”⁵ a practice Jones refers to as “hierarchical attenuation.” Speaking of Churchill, Jones states “He recognized, of course, that in intelligence he could only do this on rare occasions, but always his instinct was to have as few stages as possible between himself and the front line; these stages being manned by men whom he felt he could trust.”⁶
           Churchill, of course, did not invent the idea. In Command in War, Martin van Creveld describes a very similar concept. He first observes that

“Climbing through the chain of command … such reports tend to become less and less specific; the more the stages through which they pass, the greater the danger that they will become so heavily profiled (and possibly sugar-coated or merely distorted by the many summaries) as to become almost meaningless.”⁷

He continues,

To guard against this danger and to keep subordinates on their toes, a commander needs to have in addition a kind of directed telescope—the metaphor is an apt one—which he can direct, at will, at any part of the enemy’s forces, the terrain, or his own army in order to bring in information that is not only less structured than that passed on by the normal channels but also tailored to meet his momentary (and specific) needs.⁸

Why should you, the red teamer, care? To red team effectively you must get as close as possible the “true” state of affairs (or, more accurately, the multiple perspectives of the true state of affairs). Executive slide decks describing the system of interest might be useful for characterizing the executive point of view, but you‘ll have to dig deeper if you want to understand the system in actuality. If this means refiltering the data–as Commander Henderson did with the “5,000 ships” figure–or stepping out of the C-suite onto the proverbial factory floor, do your best (within your established rules of engagement) to chase down the “truth” stubbornly and persistently. If necessary, remind your customer that the real adversaries of concern will be doing the same.

Notes:

1. R. V. Jones, Reflections on Intelligence, 121.
2. Ibid., 121.
3. Ibid.
4. Churchill, as cited in Reflections on Intelligence, 120.
5. Ibid., 150.
6. Ibid., 151.
7. Martin van Creveld, Command in War, 74–75.
8. Ibid., 75

The Boston Marathon bombing, the plant explosion in West, TX, and ongoing events around the world represent the types of unexpected surprises that red teamers are expected to explore through planning, simulation, and modeling. When the unexpected occurs, how can the red team overcome the chaos, help control the situation, and manage the outcomes while less mentally prepared individuals curl up into a ball under their desks? Resiliency in thought, action, and organizations can be instilled through training, planning, and flexibility in decision making processes.
      Terrorist attacks and active shooter scenarios present crises on multiple scales. Certainly there is the need to address initial triage and evacuation of wounded, security concerns, and the immediate questions of how and why the event occurred. In situations like the Boston Marathon bombing, there is also the need to maintain composure and move forward with the planning and execution of crisis events in multiple timelines both near- and long-term. A red team is incredibly useful in crisis scenarios because they spend a great deal of time thinking like an adversary and are cognitively comfortable with chaos and unpredictable events.
      An organization can build resilience in their staffs by allowing these thinkers to execute rapidly based on imperfect information and supporting actions to get ahead of the adversary’s decision making process. Not only do government and business organizations need to be ready to respond to crises, but NGO and civic organizations help spread the robust response to the community at large. Crisis events require more emotional, physical, and mental energy than the daily grind. This requires some fitness and discipline among operational staffs to maintain a routine, eat right, and exercise to overcome the extreme mental and emotional exertion due to crisis events. Clear rule sets with well-rehearsed situational responses allow for an organization to auto-pilot minor events while preparing the individual mindset for crisis response.
      RTJ Red Teaming Law #23 states Very little is as it appears to be. Create the hypergame and play it to your advantage. The Boston bombing search was an example of a mixed response to understanding the adversary’s mindset and motivations. While social media outreach campaigns by officials in Boston were very effective, shelter-in-place directives risked developing a populace with a fortress mentality. As John Robb, author of A Brave New War, stated in his blog on April 20th, “However, over the long run, I believe this ["shelter in place"] phrase is going to look as silly as ‘Duck and Cover’ does to today’s world. The reason is simple. As the number of disruptions increase, we’re going to face a choice. We can either stay under constant lock-down, or we can become resilient.” This quote captures the essence of alternative analysis in situations of homeland security crisis: one of the best weapons in a situation like the Boston bombing search is the collective, attentive eyes of a million vigilant residents.
      The development of a resilient and vigilant community with the ability to identify potential threats and assist the government in preventing future events can be the goal of an empowered populace. The tools and conduits for a community already exist through civic organizations’ and government agencies’ presence on social media and traditional social networks. Organizations and government agencies have the ability to create the hypergame–in other words, establishing the playing field and forcing the adversary to mold to the rules of the situation. This reduces the power of the adversary, improving the predictability of outcomes and eventually leading to his defeat.
      How does a red team assist with this? As RTJ Red Teaming Law #25 notes: The goal of a red team usually isn’t to find a needle in the haystack, it’s to help you see the haystack. An organization’s planning and operations staff–instead of casting a tri-state or multinational net to catch individual actors in a single event–helps predict the adversarial actions and tighten the response zone to an individual “haystack.” This level of detailed analysis allows for reduced resources and improved response time. These actions assist officials preventing organizational hysteria and paralysis by defining the problem to be solved instead of focusing on the potential “catastrophic outcomes” of an adversary’s actions. The fear and paralysis in action during a crisis are potentially as dangerous as the events causing the crisis; they can undermine organizational response and diminish the confidence of citizens or customers in the organization’s competence, which can in turn cause long-lasting effects. For instance, FEMA is still trying to shake the negative publicity from the events of Hurricane Katrina nearly 10 years ago. With proper planning and organizational mindset, crises provide a catalyst for organizational growth and change due to an unpredicted surprise. The red team can assist in growing the organization’s response plan to ensure that a future crisis does not needlessly waste resources while leaders and decision makers are waiting to respond.

Mike Denny is a contributing editor at Red Team Journal.