A General Multi-Risk Assessment Method for Natural Disasters and CBRNe Attacks

Since 2012 the authors of this work proposed in the Italian academic arena [9] a first essential method for risk assessment to be applied for the Italian Civil Protection and Civil Defence applications. The here presented Multi-Risk Assessment Method (MRAM), illustrate the complete approach, refined during these last years, suitable to estimate both impact and risk in qualitative, semi-quantitative and quantitative fashion for catastrophic or calamitous events, including terrorist non-conventional CBRNe attacks.

Drawing part of the inspiration from methods proposed in the USA for Critical Infrastructures protection and for the management of natural/terrorist disasters [10-13], the MRAM presents the following characteristics:

• it applies both natural/anthropic disaster and terroristic attacks (CBRNe) to estimate the risk of an event;
• it allows to manage and analize different kinds of risk (all-hazards/threats approach) being useful for identifying and prioritizing actions and investments in preparedness, protection and resilience of critical areas and critical infrastructures;
• the risk is evaluated by using three mathematical quantities: Threat, Vulnerability and Exposure, where any quantity is evaluated selecting a ‘level’ on a predefined scale;
• it is scalable and modular on the basis of the application context;
• the method is focused on the safety of the population (fatalities and casualties), although a similar approach can be adopted to estimate even the economic risk;
• it allows to perform the impact analysis for an event by estimating approximatively the number of dead/injured;
• logarithm scales are adopted to make easier the interpretation of the results and the management of the method;
• it needs detailed data for quantitative analysis, but less stringent precision is due for qualitative analysis that is oriented to the ‘order of magnitude’ approach in the results;
• risk formula is oriented to a very fast-run application of the method both for political decisions and technical one, in general used for DSS applications.

It is important to highlight that MRAM applies logarithmic scales for the following reasons:

• a logarithmic scale is a non-linear scale often used when there is a large range of amplitude in the analysed quantities. In particular, a logarithmic scale to base 2 it is proposed in the MRAM, even though application with logarithmic scale to base 3 for civil protection planning has been considered;
• logarithmic scales make it possible to manage easily ‘orders of magnitude’, rather than a standard linear scale, so the value represented by each equidistant mark on the scale is the value at the previous mark multiplied by a constant, the base value;
• for semi-quantitative case the doubling criterion or power of 2 criterion holds. For example:
  
  • an increment of 1 in the value of the risk (see Table 6) corresponds to a doubling (multiply by 2¹=2) of the original previous value (doubling criterion or power of 2 criterion);
  • an increment of 2 in the value of the risk (see Table 6) corresponds to a double doubling (multiply by 2²=4) of the original previous value;
  • an increment of 3 in the value of the risk (see Table 6) corresponds to multiply by 2³=8 of the original previous value;
  • and so on …

Observe that for the logarithmic scale to base 3, tripling criterion or power of 3 criterion holds, and so on for the value of the base increasing.

For the application of the MRAM the following definitions of fundamental quantities are adopted:

• Threat T represents the number of occurrences of an event in 1 year (through a range of levels). It is expressed in terms of probability in a discrete scale, through a finite (and scalable) number of levels represented by a threat probability array. For terrorist attacks it depends on the attacker capabilities (economic, means, weapons, time, knowledge and skill), on the attractiveness of the target, and on the deterrence/robustness of the activated protections. For natural disasters it depends on historical sequences of similar events in a specific area.
• Vulnerability V represents a possible weakness of people, of a system, of a structure or a territory through which a threat can carry damage (i.e. a building built with no anti-seismic measures is vulnerable to the earthquake threat, that can cause damage to the population inside). Vulnerability can be expressed with a number between 0 and 1(with the meaning similar to the probability); its value depends on the considered threat and on the analyzed kind of damage;
• Exposure E represents the maximum potential target/asset that can be affected by the threat. Exposure must be evaluated on the basis of objective parameters (i.e. number of people present in the considered scenario interested by the event).

In the following sections we will see how the estimate of these three quantities can lead to an effective and coherent risk assessment.

The application of the MRAM is strictly conditioned in the obtained results by the capability of selected Risk assessment experts in charge of the analysis to interpret the considered scenarios and to select the appropriate levels of the risk parameters. For these reasons, the method can be applied only under the strict control of experts in the field of interest for the risk evaluation. Many decisions have to be taken on the basis of experience, with a holistic vision of the scenario, in particular, as we will discuss in the following, for the Vulnerability parameter.

In order to help risk assessment experts in the MRAM application, the method proposes an in-depth analysis and distinguishes two different kinds of Vulnerability: Internal Vulnerability and External Vulnerability.

Internal Vulnerability (V_i) represents the statistical weakness of a human being (in case of damage to population) with respect to a given threat. Internal Vulnerability values are expressed in the range 0 ≤ V_i ≤1, as in the case of a probability. Example: humans are defenceless against lethal viruses (i.e. Ebola) as their immune system is inadequate to face them. This is a case of internal vulnerability and, for example, V_i =0.8 is the statistical probability to die after the infection.

External Vulnerability (V_e) represents (in case of damage to population) the weakness of structures with respect to a given threat (i.e. in case of an earthquake) or the effectiveness of the attack (i.e. in case of a terrorist attack). Even External Vulnerability values are expressed in the range 0 ≤ V_i ≤1, as in the case of a probability. Example: a lethal virus can be spread by aerosol or spread in the water pipes or in an air conditioning system. The three methods imply different infection probabilities, and therefore different external vulnerabilities.

Overall (or Total) Vulnerability (V_t) is computed as a function of V_i and V_e . Assuming that V_i and V_e are independent variables (that is almost always true), then

V_t = V_i^.V_e

If a dependence exists between V_i and V_e , the conditional probability can be calculated through Bayes theorem.

Setting a value for the measure of the Vulnerability is one of the most delicate phases of the MRAM.

The same criticality is true, in general, for every risk assessment method, and on this issue ISO 31010 [2] proposes three major different approaches:

historical records in order to extrapolate the probability of success of the attacks;

probability forecasts using predictive techniques such as fault tree analysis and event tree analysis;

expert judgments based on analytical, statistical methods and previous experiences.

As far as the measure of the Threat probability, the MRAM proposes to refer for natural disasters to Civil Protection historical records and for terrorist attacks to refer to Intelligence evaluations of the different threat scenarios, updated to current evolving national and international context.

Finally, MRAM proposes the use of a numerical factor, so called Vulnerability Reduction Factor (VRF) to evaluate the amount of reduction of the vulnerability obtained by means of the countermeasures.

The scale of this factor is expressed as a set of classes. Ten or two factor scales are proposed.

In Table 8 a ten factor is proposed: stepping from a class to the successive one, the VRF increases by a factor equal to 10.

Table 8. Vulnerability reduction factor

With reference to Table 8, a Class 2 countermeasure allows a vulnerability reduction equivalent to dividing by 100 (i. e. multiplied by 10^-2) its original value, while a Class 0 countermeasure is completely ineffective, as it corresponds to a division by 1 (i. e. 10⁰) of the original vulnerability value.

The same applies, with the power of 2 instead of 10, in Table 9.

Table 9. Vulnerability reduction factor classes (Two factor)

When multiple countermeasures are applied to face the same vulnerability Total Vulnerability Reduction Factor (VRF_tot) can be determined:

If the countermeasures are independent - as it generally occurs - VRF_tot is the product of VRF_x associated to the single countermeasures;

If there is a dependence among countermeasures, VRF_tot must be computed as a combined or conditioned probability.

Once evaluated VRF_tot starting from the Original Vulnerability V_o (with no countermeasures applied that is often set to 1) we can calculate the Residual Vulnerability V_r as

V_r = V_o^.VRF_tot .

Starting from the Residual Vulnerability we can re-apply the MRAM and evaluate the Residual Risk that remains after the risk treatment (i.e. after the introduction of countermeasures for the vulnerability reduction).

As last practical advice, the MRAM method can be integrating with the creation of a Catalogue of countermeasures in which at any countermeasures is associated, by experts, a possible set of values of Vulnerability Reduction Factors, in order to make the risk management treatment phases faster and, possibly, easier.

The MRAM has been during the years interested by software implementation of tool. Example of software available on the shelf that adopted the MRAM are: Self Safety Planner (SSP), Gestione dei Piani di Emergenza Comunali (GPEC) and TEGIS provided by the Italian firms Servizi Professional Innovative srl, http://www.servizipi.it/.

Hence; the first application of this medod has been proposed several years ago in Self Safety Planner – SSP - that is a Decision Support System for territorial risk classification and assessment.

These tools aim to facilitate the cooperation of all the Italian actors involved in risk management and supports municipalities, Ministry of Interior authorities and Civil Protection organizations in risk assessment processes, through the preparation and dissemination of municipal emergency plans. The tolls in practice are a Decision Support System for territorial risk classification and assessment.

The application allows us to list risks which the territory is exposed to, by using MRAM for the risk assessment.

SSP is a software as a service tool accessed via a web browser. It is developed with Java language and uses, inter alia, the freely available Open Street Map (OSM) geodata: in Figure 1 a simple application of the SW for the Barletta city (Apulia, Italy) is shown. In fig.1 the different Critical Areas are depicted in the Barletta old town and in the industrial area of the city. In any Critical Area it is possible to characterize a potential risk.

1.png

Figure 1. Example of software window for city of Barletta, Italy

The software, based on MRAM approach, evaluates the qualitative value of the risk level of more than 60 different possible threats on the identified Critical Areas.

Threats are mapped and risk priorities are highlighted through a chromatic classification, as presented in the previous sections.

The qualitative risk level and impact level, respectively, are directly calculated by the system on the basis of risk assessment expert data input and MRAM algorithm.

As an example of practical application of the MRAM approach and of the creation of a rank of risks in a specific part of a territory, we can highlight the Civil Protection Plan of Marino town (Rome, Italy) [19] in which the MRAM is adapted [20] for civil protection application to the territory creating after the analysis in [19], page 105, a rank for 21 different risks that are incumbent in the municipality and that are distributed from the higher level of risk (level 17) to the lower (risk level 6) in the rank.

MRAM=Multi-Risk Assessment Method

CBRNe=Chemical Biological Radiological Nuclear explosive

DHS=Department of Homeland Security

ISO=International Standard Organization

VRF=Vulnerability Reduction Factor