A Vulnerability Assessment (VA) is the final step in a Security Analysis, based on information developed in all the earlier stages (Site Survey, Area Study, Threat Assessment, and External Assets Evaluation). It requires honest qualitative evaluation of strengths and weaknesses against various threats, from which we identify upgrades worth pursuing. There are several useful techniques.

There are several components of wargaming in the BOGSAT, TDG, and Terrain Walk methods described in Part 2 of this series. The distinction between these and wargaming is the latter's adherence to a more rigorous and formal structure and process, and by a greater degree of interactivity and competition. Analysis of plans, tactics, component and system performance, and decision making – the heart of Vulnerability Assessment – can performed with greater structure, rigor, and value through interactive wargaming, that inserts a thinking adversary into the mix.

The main drawback to most wargaming techniques is that they require specialized competencies in the referee or moderator, and commitment by participants to learn and abide by a set of rules governing process and outcomes. It can also take more time, especially when several iterations of each scenario are required in a time frame limited by other responsibilities of the participants.

Those with no experience of wargaming, either on the recreational, civilian level or in the professional arena, may not understand its value, history or wide usage. Professional military wargaming has been used in the Western world since at least the early 19th Century. Some of the most formidable military forces in history, like the 20th Century U.S. Navy and the German army between 1860 and 1945 used wargames on many levels to develop plans, train leaders, and test doctrine and technology.

Wargames, like all forms of analysis, have limitations. They predict nothing with high confidence. They always abstract and simplify a complex reality, and inevitably reflect the biases of the designer. Unfortunately, they can also be used also predict anything, and often are used to reinforce predetermined conclusions and political agendas. A wargame that posed a Blue force armed with photon torpedoes, transporter beams, and replicators against a Red force using 1960-vintage SCUD missiles and rotary-dial telephones would conclusively (and unsurprisingly) prove the need for photon torpedoes, transporter beams, and replicators.

Professional wargames have often been either relied on or ignored at precisely the wrong times. The Imperial Japanese Navy extensively wargamed their planned attack on Pearl Harbor in 1941, identifying and solving technical problems like the running depth of aerial torpedoes, and refining their plans and tactics for the largest aircraft carrier operation yet attempted anywhere. The final iteration of their wargame predicted success and influenced the decision to proceed with the attack on Pearl Harbor, which proved to be a tactical success, but a strategic disaster. In one sense, this was a successful application of wargaming, but it was also a dangerously misguided one, because the wargame only addressed technology and tactics, overshadowing the far more important strategic dimension. Just because a thing can be done is not always reason enough to do it. In the VA process that concerns us here, we might wargame violent responses to violent threats that work in isolation but would still be ill-advised in a civilian, domestic, peacetime, rule-of-law environment.

Six months after Pearl Harbor, the Japanese wargamed their plan for an attack on Midway Island in the central Pacific. That game predicted defeat for the Japanese, but was ignored; the operation was conducted anyway, and the resulting catastrophic Japanese defeat reversed the course of the Pacific War in an afternoon.

Still, wargames can help us evaluate technology and tactics, and identify gaps in our plans or capabilities. All forms of wargaming provide advantages of cost, convenience, and leverage, because exercising actual forces in real time, under realistic conditions, over the terrain they would fight on is sometimes impossible, often costly and always rare and infrequent. Well-designed wargames can provide many of the necessary benefits of full-scale exercises at a fraction of the cost, and can be repeated many times over to assess the impact of changes in threats and preparedness.

For a professional (vs. a recreational) wargame to be effective, it must address several key questions.

  • Just as in a TDG, the player/participant needs to know who he represents in the "game" and should have the knowledge, skills and ability to decide and act competently in that role. An HR manager, for instance, may be competent in his occupational specialty but be unprepared for tactical decision making against violent threats.
  • No matter how competent he may be, the participant should have only the information, control, and responsibility that position would have in real life. General George S. Patton said that a division commander should only give orders to his brigades, and know the location of the battalions that comprise them but never give orders to them directly. In recreational, historical wargames – and in poorly designed professional ones – the participant may have greater control of larger and more dispersed forces, and more knowledge (a "God's eye view") of the overall situation than any one leader would have in a real-life situation. Results will be very unrealistic if that is the case. Wargame design and execution should carefully limit each participant's span of control and the scope and accuracy of information provided to him.
  • How can the wargame represent the chaos of an actual field of conflict? Chess is often recognized as an ancient precursor of today's wargames, but for all its depth and complexity, it utterly fails to represent the randomness and uncertainty of conflict. You see all the pieces, yours and your opponents'. You can know, limited only by time, patience, and your analytical skills where every piece could move, and you know that when it attacks an enemy piece, it always wins. No horse ever loses a shoe and throws its rider, no shot ever misses, and no foot soldier loses heart and refuses an order to advance.

A professional wargame requires credible execution. It usually relies upon a facilitator who understands the game's intent and design, and who has experience in the subject matter that participants will respect. He must prevent bickering about technical issues of performance and outcomes, and overcome the natural tendency of players to "game the game" (taking advantage of loopholes in the rules, or of information they would not have in real life), and to argue "that would never happen" when anything bad happens to them in the game. All forms of dynamic conflict are full of seemingly unrealistic, inconsistent, and apparently impossible happenings. Guided by a competent moderator/referee, participants must accept take the wargame – its scenario, its process, and its outcome – on its own terms. Play the game, don't critique it.

What differentiates a wargame from other analytical methods is interactivity, with one or more participants playing the role of the adversary. In training or even recreational use it can be a free-play exercise, but in a VA analytical application, the adversary's actions are usually somewhat constrained in accordance with a threat scenario script that is hidden from the "friendly" players.

Now that we have laid a foundation of theory, let's look at some useful wargaming methods for small tactical units and their leaders. These are all more labor, space, and resource-intensive than the TDG, but can permit a deeper analysis of a tactical problem or set of interrelated problems. There are three variants in terms of physical presentation, and two distinct methods of running this sort of wargame.

Physical wargaming resources 

1. Tabletop or Sand Table games use a three-dimensional terrain model of the area. This can a semi-permanent model built like a model railroad or miniature wargame layout or diorama, or one literally made with sand and other components that can be shaped on demand to represent different terrain. Architectural models or simpler models of buildings using scratch materials or commercial gaming components can be used to represent buildings and urban or suburban settings.

This approach requires dedicated space, resources, and skill for effective execution. Its advantage is that for many people, a three-dimensional model is easier to relate to actual terrain, and makes it easier to visualize the action. Personnel and vehicles can be represented by a wide variety of toys, model components, or commercial wargaming miniatures; a caution in this regard is to try to maintain a constant scale between the terrain model and the miniatures. For all but the smallest areas, the 1/285 or 6mm scales are usually best.


2. Maps or two-dimensional diagrams can be cheaper and easier to obtain or produce than an accurate tabletop layout or sand table. They do not require a dedicated space, as they can be easily rolled up or folded for storage when not in use.

The main drawback of maps and diagrams is that they are more abstract in appearance, requiring more interpretation on the part of participants. Just as people have different learning styles, some find it easier to visualize terrain from a three-dimensional model than from a two-dimensional map or diagram. Urban terrain and building interiors can be difficult to represent two-dimensionally.

Maps or diagrams can be utilized, like sand tables, with three-dimensional models of people and vehicles in various combinations; but you can also use various sorts of abstract markers, including readily available commercial wargame components – or you can simply cover them in clear acetate or plexiglass and use water-based or dry-erase markers.

A variety of computer software products can be used to generate maps or diagrams. Some may even allow you to "push pieces around" on the digital image. If you can project that image onto a wall or screen, you will have an interactive wargame platform accommodating multiple participants and observers. You would need a computer-savvy operator, depending upon the options and sophistication of the system you are using, as well as a set of rules and a facilitator to control and adjudicate the action, as discussed in the next section.


Methods of tabletop and computer wargaming

1. Deterministic wargames are controlled by a moderator or referee, who decides the outcome of all encounters, either by applying set rules and procedures or by simply exercising his professional judgment. It is the quickest and easiest method, but its value depends upon having a referee whose mastery of the subject matter and whose decisions and rulings are consistent, unbiased, and credible to participants, and plausibly realistic. The purpose and perspective of the wargame and the particular threat scenario guide the referee's actions.

Even a referee-moderated wargame will benefit from having a set of rules that can be briefed to participants, and which provides at the minimum an orientation to the physical scale (how many yards or meters to the inch), the time scale (how many seconds or minutes are represented by a game 'turn' or 'round'), how far vehicles and personnel are allowed to move in that time, and at least in general terms, how combat is resolved. The game, however imprecisely, is attempting to simulate reality, and participants have to know how to translate real world intent and actions to the game environment.

2. Probabilistic wargames introduce an element of chance into outcomes, usually be rolling dice (the poor man's random number generator) after the overall odds of alternative outcomes have been determined according to the rules. The element of uncertainty tends to keep players more honest and cautious in their decision-making, because they cannot be confident of the outcome of any action until they commit to it. They might, for instance, select a position from which to observe or engage an adversary, at a particular range they believe is reasonable; but what anyone considers "reasonable" or "likely" is modified in the real world by many variables that might not be fully known or predictable. This uncertainty can be represented in a wargame environment by a determination (usually based on printed charts and tables themselves based on reliable databases and analysis) that spotting the adversary or hitting him with aimed fire will succeed at the given range and under the existing conditions 8 time out of 10. The player or a moderator rolls a ten-sided die, and the action is deemed successful if the result is 1 through 8, but fails if a 9 or 10 is rolled. This type of wargame can be conducted without a referee facilitating the action if the rules and "playing aids" are complete, understood and accessible; however, a referee can still be useful in this type of game for two reasons:


a. The presence of a referee reduces the necessity for an airtight set of rules. Rules for un-moderated interactive games must be more comprehensive and legalistic and thus require more investment of time and effort on the part of players to learn and master them. Rules that are ambiguous or unnecessarily complex (too often, they are both!) will result in more time being spent on interpretation and argument than on tactical play.

b. A referee can provide a means for players to keep some of their units or forces hidden when they would not be visible to the opponent's forces. This mitigates one of the key weaknesses of tabletop wargaming, the highly unrealistic ability to always see the location and movements of the opposing force.

3. Commercial analog wargames. There are a variety of commercially available tabletop board wargames – and rule sets for "miniatures" wargames – which simulate tactical level combat. Their advantage is that the difficult work of design and development, has been done for us, by professionals in the field. Some are designed to allow users to build their own scenarios, representing different mixes of friendly and opposing forces, weapons, vehicles and equipment. After learning the map conventions, we can create our own maps based on specific real-world terrain and structures. There are commercial wargames that represent present-day small team combat with a reasonable degree of fidelity. Some of them are based upon, or have themselves been used as professional wargames for training purposes. However, they tend to be complex and slow to play, in direct proportion to their realism and usefulness. Mastering the game system itself can require considerable time and effort.

4. Commercial computer wargames – we are not speaking of "first person shooter" or arcade-style games, but battlefield simulations – have most of the desirable features of the analog variety, in addition to a much easier learning curve and quicker play, because the computer code handles much of the complexity of regulating movement, sighting, and combat. Commercial products priced between fifty and one hundred dollars are readily available - in some cases derived from versions developed originally for the military - and provide reasonably realistic simulations of tactical environments. Their primary disadvantage for training or analysis is that it is hard to engage more than one or two participants in active roles. Networked workstations that meet specified minimum system requirements for graphics, processing speed, etc., can make it possible to use some commercial wargaming engines across a multi-station network. In most cases, this would require purchasing multiple copies of the game or negotiating the purchase of a multi-user license from the publisher. If our protected site is large and complex enough, this could be a worthwhile investment.


5. Distributed command post exercise (CPX). This is a variant that can be applied to any tabletop or computer wargaming method. If leaders, detached elements, or individuals would have limited communications or situational awareness in the threat scenario, we can place those players in a location physically removed and isolated from the map, tabletop, or computer screen, and from other players. This could be in the far corner of a large room, or down the hall in a closed room, or similarly isolated. Provide them some form of map or diagram to represent the terrain in a fashion compatible with the main display – this can be simply a reduced version or duplicate of the primary tabletop, map, or diagram. Provide them with a form of communications – telephone, intercom, or handheld radio - and rules for how they may communicate with other friendly players. This technique sometimes requires not just one but a team of moderators.

Force on Force (FoF) Exercises

These are the ultimate form of wargaming for armed teams or individuals against the full spectrum of violent threats. They are conducted in real time and full scale and are equally useful for training and for assessment of personnel or security force plans and proficiency. In the professional military and security community, they are widely used in the VA process. They can be limited in size, scope, and duration, or they can be extended bouts of free play between opposing forces, or anything in between. Even more importantly than in TDGs, tabletop or computer wargames, they are of little use for VA or other analytical purposes if the participants are not already well-trained and proficient.

FoF exercises utilize some form of "engagement simulation system" to allow participants to engage each other safely, but with some form of feedback to save us from the arguments we remember from childhood: "I got you!" "No, you didn't!" Typically, we utilize paintball, Simunitions, Ultimate Training Munitions, or Airsoft non-lethal training firearms and ammunition. There are of course many limitations to the use of any of these systems to simulate live fire engagements, including:

  1. They all have limited engagement range, which may create an illusion of safety or invincibility that does not serve us well when real bullets are encountered. Dye marker cartridge systems like UTM or Simunitions are typically inaccurate beyond about 25 yards, which conditions participants to simply not engage at ranges that would be well within the effective range of their live fire weapons because they know it will not avail them in the "game." Conversely, it encourages participants to close the distance in order to engage, when that often risky behavior would not be necessary with live fire weapons.
  2. Being hit by hostile fire results in embarrassment, occasional transitory pain or bruising, and little else. It is up to the controllers and organizers of the event to establish and enforce rules for adjudicating the effect of these hits, i.e., what constitutes a killing or disabling hit, and how do peripheral, wounding hits affect participant activity? In a training context, operators are often taught to "fight through it," or continue after receiving hits; they can condition them not to react psychologically to wounds that would not be disabling or life-threatening in real-life. However, ignoring the impact of solid hits on combat effectiveness may lead operators or their leaders to underestimate the risk or the difficulty of certain tasks or tactics. Exercise rules of engagement, enforced as necessary by controllers, must seek a balance between extremes.
  3. There are significant safety hazards in the use of any engagement simulation system by individuals who routinely carry live fire weapons. Rigorously enforced procedures must be in place to ensure that no live fire weapons or ammunition are accessible during FoF exercises. People have died because their partners went into an exercise believing – wrongly – that they had secured their live fire gear and transitioned to the engagement simulation system. Use of clearly marked, dedicated weapons which cannot chamber live ammunition is one of many measures that can protect against such a tragic outcome, but humans are prone to stupidity, carelessness, and complacency and we must apply airtight procedures, consistently and in total seriousness, to guard against these tendencies.
  4. Conducting FoF exercises in any setting that permits public observation can be very dangerous. Uninformed observers may witness what appears to them to be a lethal force encounter, and report it as such to law enforcement, or even intervene themselves, with extreme consequences.

FoF exercises, whether scripted or free play, must be carefully planned and controlled. Safety plans and exercise plans should be carefully developed to anticipate the most unlikely occurrences and put control measures in place to prevent or mitigate them.

Summary

This concludes our overview of wargaming techniques and applications that can be useful in Vulnerability Assessment. We will provide references and links for further information, guidance, and resources for those who are interested.