A Model of Optimal Incapacitation