Timely exposure of a secret project: Which activities to monitor?

A defender wants to detect as quickly as possible whether some attacker is secretly conducting a project that could harm the defender. Security services, for example, need to expose a terrorist plot in time to prevent it. The attacker, in turn, schedules his activities so as to remain undiscovered as long as possible. One pressing question for the defender is: which of the project's activities to focus intelligence efforts on? We model the situation as a zero‐sum game, establish that a late‐start schedule defines a dominant attacker strategy, and describe a dynamic program that yields a Nash equilibrium for the zero‐sum game. Through an innovative use of cooperative game theory, we measure the harm reduction thanks to each activity's intelligence effort, obtain insight into what makes intelligence effort more effective, and show how to identify opportunities for further harm reduction. We use a detailed example of a nuclear weapons development project to demonstrate how a careful trade‐off between time and ease of detection can reduce the harm significantly.