The Weakest Link : Risk Management Strategies for Dealing with Interdependencies

Networks increase interdependencies and this creates challenges for managing risks. This is especially apparent in areas such as security and enterprise risk management, where the actions of a single player in an interconnected network can wreak havoc on everyone in the network. The network, in this case, is only as strong as its weakest link. There are related problems in encouraging investments for prevention and protection, since the expected payoffs from such measures by one player are affected by the actions of other players in the network. In this chapter, Howard Kunreuther examines the challenges of interdependent security (IDS) and strategies for addressing these, including coordination with broader networks such as industry organizations and government. On December 21, 1988, Pan Am flight 103 exploded near Lockerbie, Scotland. Terrorists had checked a bag containing a bomb in Malta on Malta Airlines, which had minimal security procedures. The bag was transferred in Frankfurt to a Pan Am feeder line, and then loaded onto Pan Am 103 in London's Heathrow Airport. The bomb was designed to explode above 28,000 feet, a height normally first attained on this route over the Atlantic Ocean. Given such interdependencies among different players in a network, the above example illustrates that security for the entire network may only be as strong as its weakest link. In this case, the terrorists deliberately exploited the widely varying security procedures across the airlines. This problem is common to other transportation modes, where there are interconnections between nodes in the network. 2 Interdependencies create a challenge for airlines in making decisions about investing in security. An airline knows that if it invests in baggage security it may face a security risk from a dangerous bag loaded onto its plane by another airline. It faces this risk unless it inspects all transferred bags, a policy until recently only followed by El Al airlines. In a networked world, the risks faced by any one agent depend not only on that agent’s own choices but also on those of others. More specifically, the economic incentive of any agent to invest in protection depends on how she expects others to behave. The strategies can be risk-reducing measures as well as information-gathering and preparedness activities. The fact that such events are typically probabilistic, and that the risk that one agent faces is often determined in part by the behavior of others, gives a