Robustness of redundancy-backfire dynamics in security systems: extending Ghaffarzadegan's (2008) guard-force model to heterogeneous agents, human-resource processes, disaggregated infiltration, deterrence, and endogenous adversary growth

Adding redundant security forces can make a system less secure. Ghaffarzadegan (2008) formalized Sagan's qualitative hypotheses — common-mode error (insider infiltration via the guards themselves), social shirking, and overcompensation — in an aggregate system-dynamics model and showed that common-mode error makes security backfire as the guard force grows, that shirking amplifies this effect, and that the system endogenously overcompensates, since overcompensation alone does not backfire but drives the system to a critical state from which backfiring follows independently of the adversaries' initial power. The paper explicitly left open whether these conclusions generalize beyond its simplifying assumptions: a single aggregated perception of security, guards as the only infiltration vector, no guard human-resource dynamics, fixed functional forms for infiltration and effectiveness, negligible psychological deterrence, and an uncharacterized endogenous 'birth of adversaries' phenomenon. No later work has taken up any of these extensions. The open problem is to determine, model-based, whether the backfiring conclusions survive these relaxations and under what conditions endogenous adversary growth becomes self-sustaining.

Background

In reliability engineering, redundancy — duplicating a protective component — is a standard way to raise safety. In a 2004 Risk Analysis article, political scientist Scott Sagan argued that in security systems this intuition fails: adding nuclear security forces can produce less nuclear security through three mechanisms. First, common-mode error: redundancy fails when components share a failure mode, and guards themselves can become the shared failure mode, since a larger force offers more positions for adversaries to infiltrate (insider threat). Second, social shirking: as a team grows, responsibility diffuses and each member's vigilance drops, so per-guard effectiveness declines with team size. Third, overcompensation: when people feel safer, they take more risk or use the protected asset more intensively, eroding the safety gain. These arguments were qualitative. Ghaffarzadegan (2008) quantified them with a system-dynamics model — a simulation of coupled differential equations organized around feedback loops. The model's security observable is the dimensionless guard-force power adequacy ratio — security = guard force power / guard force power needed, with desired level 1 — and the perception of security is a delayed function of security; 'backfiring' means that, as the guard force grows under the redundancy solution, security declines or fails to reach its desired level, making the system more susceptible to attack. Guard force size $G$ raises the number of infiltrators $i = G\,\eta$ , where the infiltration probability $\eta = \min[\eta_N (G/C)^{\beta}, 1]$ increases with $G$ relative to the organization's controlling capability $C$ (screening, monitoring, counterintelligence); infiltrators in turn raise the adversaries' power $P_a$ . Per-guard effectiveness follows $e(r) = \min(r^{-\gamma}, 1)$ , where $r = G/G_n$ is the redundancy ratio (actual guards over the number needed) and $\gamma > 0$ measures shirking. Overcompensation acts through utilization $u$ : when perceived security rises, high-risk facilities are used more intensively, expanding the attack surface. Monte Carlo sensitivity analysis (3,000 runs sampling the infiltration parameters $\eta_N$ and $\beta$ ) and policy experiments (raising controlling capability linearly or mildly superlinearly with $G$ ) supported the common-mode-error and shirking hypotheses, while overcompensation alone produced no backfiring but a critical state vulnerable to common-mode error; backfiring was qualitatively independent of the adversaries' initial power, because the system endogenously overcompensates. The model rests on strong simplifications: security is perceived by one aggregate agent rather than heterogeneous individuals with perceptual biases; the guard workforce has no training, attrition, or replacement dynamics (and hence no time delays); guards are the only infiltration vector, although scientists, engineers, and technicians could also be recruited; infiltration is modeled as one aggregate flow rather than per-facility processes; the min- and power-law functional forms for $\eta(G/C)$ and $e(r)$ are assumed rather than tested; guards exert no psychological deterrence on adversaries; and the simulations hint at a 'birth of adversaries' — a reinforcing loop in which infiltration feeds adversary power and overcompensation feeds attack opportunity, so that the system eventually backfires and the adversaries' initial power merely changes the time to backfire — whose self-sustaining conditions were not characterized.

Problem Statement

Determine, by explicit modeling and analysis, whether the redundancy-backfire conclusions of Ghaffarzadegan's (2008) security-system model — that common-mode error (infiltration via guards) makes security decline as guard force $G$ grows, that social shirking amplifies this failure, and that the system endogenously overcompensates, since overcompensation alone does not backfire but drives the system to a critical state from which backfiring follows independently of the adversaries' initial power — generalize beyond the model's simplifying assumptions, where security is the source-defined observable: the dimensionless guard-force power adequacy ratio (guard force power / guard force power needed, desired level 1), and backfiring means this quantity declines or fails to reach its desired level as $G$ grows under the redundancy solution. In addition, characterize the 'birth of adversaries' phenomenon suggested by the simulations — the reinforcing loop in which infiltration feeds adversary power and overcompensation feeds attack opportunity, so that the system eventually backfires whatever the adversaries' initial power, which merely changes the time to backfire — by establishing under what structural and parameter conditions this endogenous adversary growth becomes self-sustaining, i.e., persists without exogenous adversary input; the precise criterion used is to be stated and justified.

The source's own discussion suggests directions for relaxing the aggregate formulation. These are independent directions for probing the generality of the backfiring conclusions; that generality is established by re-testing the three conclusions above under at least one such relaxation: (1) disaggregate the single aggregate perception of security into heterogeneous agents with perceptual biases and test whether the backfiring results survive; (2) incorporate guard human-resource processes — training, attrition, replacement, and the time delays training imposes — and quantify how they moderate infiltration and shirking dynamics; (3) add other employee classes (scientists, engineers, technicians) as explicit infiltration vectors and quantify their contribution to insider risk; (4) replace the aggregate formulation of infiltration effects on assets with disaggregated per-facility infiltration processes to capture spatial and organizational heterogeneity; (5) test alternative functional forms for the infiltration probability $\eta(G/C)$ and the per-guard effectiveness $e(r)$ (beyond the assumed min- and power-law forms) to assess robustness of the conclusions to functional form; (6) relax the assumption that psychological deterrence from larger guard numbers is negligible, and evaluate whether and how adversary deterrent perceptions alter the long-run equilibria. The common scientific objective unifying these directions is a verdict on the generality of the backfiring phenomenon (and, where it fails, the identification of the structural features responsible), together with the conditions for self-sustaining endogenous adversary growth.

References

Ghaffarzadegan, N. (2008). How a System Backfires: Dynamics of Redundancy Problems in Security. Risk Analysis 28(6): 1669-1687. doi:10.1111/j.1539-6924.2008.01132.x. https://doi.org/10.1111/j.1539-6924.2008.01132.x
Ghaffarzadegan, N. (2007). How a System Backfires: From a Redundancy Solution to Redundancy Problems in Security. Proceedings of the 25th International Conference of the System Dynamics Society, Albany, NY. https://proceedings.systemdynamics.org/2007/proceed/papers/GHAFF223.pdf
Sagan, S. D. (2004). The Problem of Redundancy Problem: Why More Nuclear Security Forces May Produce Less Nuclear Security. Risk Analysis 24(4): 935-946. doi:10.1111/j.0272-4332.2004.00495.x. https://doi.org/10.1111/j.0272-4332.2004.00495.x
Gisladottir, V.; Ganin, A. A.; Keisler, J. M.; Kepner, J.; Linkov, I. (2017). Resilience of Cyber Systems with Over- and Underregulation. Risk Analysis 37(9): 1644-1651. doi:10.1111/risa.12729. https://doi.org/10.1111/risa.12729
Ghaffarzadegan, N.; Andersen, D. F. (2012). Modeling Behavioral Complexities of Warning Issuance for Domestic Security: A Simulation Approach to Develop Public Management Theories. International Public Management Journal 15(3): 337-363. doi:10.1080/10967494.2012.725566. https://doi.org/10.1080/10967494.2012.725566
Ghaffarzadegan, N.; Lyneis, J.; Richardson, G. P. (2011). How small system dynamics models can help the public policy process. System Dynamics Review 27(1): 22-44. doi:10.1002/sdr.442. https://doi.org/10.1002/sdr.442
Elmrabit, N.; Yang, S.-H.; Yang, L.; Zhou, H. (2020). Insider Threat Risk Prediction based on Bayesian Network. Computers & Security 96: 101908. doi:10.1016/j.cose.2020.101908. https://doi.org/10.1016/j.cose.2020.101908
Miyamoto, I.; Holzer, T. H.; Sarkani, S. (2017). Why a counterfeit risk avoidance strategy fails. Computers & Security 66: 81-96. doi:10.1016/j.cose.2016.12.015. https://doi.org/10.1016/j.cose.2016.12.015
Yang, S.-C.; Wang, Y.-L. (2011). Insider Threat Analysis of Case Based System Dynamics. Advanced Computing: An International Journal 2(2): 1-17. doi:10.5121/acij.2011.2201. https://doi.org/10.5121/acij.2011.2201
Linkov, I.; Poinsatte-Jones, K.; Trump, B. D.; Ganin, A. A.; Kepner, J. (2019). Rulemaking for Insider Threat Mitigation. In: Cyber Resilience of Systems and Networks. Springer, pp. 265-286. doi:10.1007/978-3-319-77492-3_12. https://doi.org/10.1007/978-3-319-77492-3_12