... Risk analysis aims to systematically identify the pathways from present circumstances to future outcomes, and the likelihood of negative consequences occurring. To be reliable, the analysis must include a realistic—and in principle complete—description of ... , some of which may be hypothetical. It is especially difficult for situations for which there is little or no direct experience—nuclear war and nuclear terrorism being cases in point (Paté-Cornell 2011)....

... Risk analysis, performed well, encourages participation between those requesting the analysis and those conducting it. The process also helps to inform leadership of the decisions, options, and timelines that can be expected if a harmful event ... harmful, which therefore must be avoided or mitigated even if at great effort. Additionally, identifying the pathways provides the basis for training and preparation to avoid, minimize, or mitigate the failure modes....

... Box 2-1 highlights the importance of characterizing and assessing uncertainties in a well-done risk analysis using scenarios to both span potential outcomes and understand dependencies. One of the ... in making decisions related to avoiding nuclear weapons use (and its risks) or nuclear terrorism is due to the sparsity of direct experience or statistical evidence and the corresponding large uncertainties....

... exist from which one can calculate probabilities (i.e., frequencies of occurrence) for use in the risk assessment. When relevant statistical samples and probabilities based on frequencies in such samples are limited, Bayesian approaches that utilize conditional probabilities can aid in developing a ... can help the risk analyst account for additional information that is known about a system (e.g., information gathered from expert opinions, models, and surrogate data from similar situations) and also reflect aspects of the scenario that may evolve with time (e.g., changes in the adversary, ... of a scenario can then be computed as a series of conditional probabilities reflecting the scenario description (see NASEM 2023a, Chapters 5 and 6). That assessment captures the dependencies among events, through conditional probabilities....

... that information as the possible improvements of the decision. This computation allows accounting for the uncertainties both in the events a priori, and in the information, which can be correct but can also include false positives or simply not include signals when it should (false negatives). That ... allows assessing the value and validity of information of a message, which may allow improving a decision involving uncertain events....

... that scenario development be used for events for which little or nothing is known about the event’s impact or likelihood to aid decision makers and risk analysts (IOM 2013). An example of one such a situation is climate change. The Intergovernmental Panel on Climate Change (IPCC) has developed ... updates a set of possible scenarios. The aim of the scenarios is not to predict the future but to assess the uncertainties linked to possible climate and socioeconomic futures, which can inform decisions (IPCC 2020)....

... Finding 2-1: Risk analysis, when conducted well, can provide a systematic and disciplined approach; illuminate threats, vulnerabilities, and consequences; and analyze complex interactive situations and dependencies among events. Good risk analysis has leadership guidance and support, ... leadership, and includes scenarios and exercises....

... Finding 2-2: Those in charge of developing policy or strategy ought to be made aware of how risk methods could improve options to mitigate risks of nuclear weapons use or nuclear terrorist attacks, especially at a time when those risks are ...

... about objectives, incorporates creative alternatives, addresses relevant outcomes, characterizes uncertainties through development of scenarios and exploration of dependencies, addresses changes to risks over time, and supports transparent discovery and policy deliberation. These define, in part, ...

... conducting the risk assessment to develop, for example, a systematic listing of potential outcomes; the pathways that can lead to those outcomes; and underlying assumptions, including correlations (dependencies) between different paths and outcomes....

... The committee collected information relevant to its tasking in classified meetings held over 7 months. A full list of the presenters and their affiliations can be found in Appendix C. Throughout its information collection efforts, the committee searched for examples of risk assessment ... (Who is doing what?) and how their results were used to develop strategy and guide policy and decisions....

... Tables 2-1 and 2-2 summarize the entities and risk methods presented or provided to the committee as examples of methods used to assess different components of risk of nuclear war and nuclear ... collection; they are not intended to be an exhaustive list of the risk methods used throughout the U.S. government to assess risks of nuclear war and risks of nuclear terrorism. Descriptions of some of the methods listed in the tables are provided in the section titled “Examples of Risk Analysis ...

... Table 2-1 provides a list of agencies and organizations that provided information to the committee on risk methods for estimating nuclear war. The column labeled “Threat” includes methods ... analysis of the intent of adversaries, their state of information and/or intelligence, and their capability (What do they know? What do they...

... Risk analysis encompasses a wide range of activities and methods. According to the Society for Risk Analysis (SRA), risk analysis includes “risk assessment, risk characterization, risk perception, risk ... , risk management, risk governance, and policy relating to risk, in the context of risks of concern to individuals, to public and private-sector organizations, and to society at a local, regional, national, or global level.”a Risk analyses that are high quality and trustworthy ...

... Risk analysis of nuclear war is typically conducted at the global and regional levels, considering conflict among two or more nations. Risk analysis of nuclear terrorism typically considers the following: threats from ... use of nuclear and radiological weapons; global actors; global, national, and local vulnerabilities; and national, regional, and local consequences. In principle, both will also consider the intent, capabilities, and beliefs of adversaries. Based on SRA principles, committee- ... expertise, and testimony provided to the committee, the committee identified the following risk-analysis principles tailored to the requirements and challenges of analyzing the risks of nuclear war and the risks of nuclear terrorism. This short list summarizes components of a high-quality risk ...

... Identify the potential risk management decision(s). Risk analysts need to understand the strategy, policy, funding, system acquisition, or system operational decision(s) that the risk analysis could inform so that the risk analysis is ... to meet the needs of the decision makers and stakeholders. This improves the relevance, effectiveness, and efficiency of the risk analysis results. Some risk analyses could be performed periodically to assess potential risks and inform budget allocations (...

... Specify the decision objectives. Once the type of decision is determined, the objectives of the decision makers and stakeholders need to be understood by the risk analysts. This can be challenging when policy preferences are not clear or evolving. Obtaining ... and support from decision makers for analysis can also be challenging. Risk analysts may also need to consider the potential objectives of allies and adversaries, which can be difficult to estimate....

... significant risks, policy makers need a wide set of possible alternatives to remove, avoid, or mitigate the risks, as possible within time, resource, and capability constraints. Risk analysts should seek to identify these alternatives and include them in their risk analyses. Analysts also should ...

... Define the potential outcomes. Once the decision and the decision objectives are defined, risk analysts need to identify and assess a broad range of outcomes that reflect the concerns of interested and affected stakeholders, and the relative priorities of those different ... . Failure to adequately reflect the values of those making (and affected by) decisions can bias analysis...

...? What do they have?). The column labeled “Vulnerability” refers to the methods of analysis of vulnerabilities of the United States, its partners and allies, and deployed forces. The column labeled “Consequences” reflects methods used to estimate the impacts of nuclear war. The column labeled � ... �Strategy” encompasses efforts to pull together risk assessments and/or to develop plans and actions to achieve an objective....

... focused on risk methods for nuclear terrorism. The “Threat” column includes methods of analysis of the intent of adversaries (i.e., terrorists and terrorist organizations) and their state...

..., or mischaracterization of the priorities of outcomes. The characterization of outcomes is especially challenging for the risks of nuclear war and nuclear terrorism....

... Assess the relevant uncertainties. There are large uncertainties in the available information related to risks of nuclear terrorism and nuclear war, including adversary objectives and capabilities (nation-state and terrorist), potential attack scenarios, adversary actions and ... , the performance of existing systems and new technologies for offensive and defensive purposes, the efficacy of security measures (including contributions to deterrence), and the short- and long-term outcomes of the use of ... and radiological weapons in a nuclear war or a terrorist attack. The identification and quantitative or qualitative assessment of these uncertainties is an essential task in risk analysis....

... Scenarios. Scenarios are a valuable tool for identifying and analyzing uncertainties. Scenarios allow assessment of risk across a wide and meaningful set of future conditions over which events might occur. Failure to do so can lead to errors through omission of factors that affect ... is a balancing act—analysts have to balance identifying groups of scenarios in a description that is simple enough that it can be analyzed and, at the same time, includes all the essential components that will make the results relevant....

... Dependencies. Uncertainty analysis should identify and assess the dependencies among the elements of the scenarios, decisions, adversary actions, and outcomes that could happen in each scenario. These ... need to be identified and modeled or assessed—ideally quantitatively. In this case, the probability assigned to an event is conditioned on other dependent events, such as ... decisions of the United States and its adversaries. For example, reducing U.S. vulnerabilities can affect adversary actions....

... consideration in nuclear risk analysis. Risk analysis must be dynamic to reflect how adversaries, scenarios, technologies, options, outcomes, and preferences may change in the future, and it must include a time horizon because, for example, risks of nuclear war and nuclear terrorism are not ...

... Provide transparent analyses. Risk analysts need to present their analyses in a manner that enables inspection and independent review of their assumptions, scenarios, uncertainties, models, outcomes, and results by decision makers, stakeholders, and peer reviewers. ... The analysis, data, and results need to be clear, traceable, and understandable. This will require significant effort above and beyond simply conducting the analysis, but it is becoming the standard practice for high-quality research....

... of intelligence, and their capability. The “Vulnerability” column refers to methods to assess the vulnerability of the U.S. homeland, including weapons access, material access, transit, targets, insider threats, and know-how. As in Table 2-1, the column labeled “Strategy” ... efforts to pull together risk assessments and/or to develop plans and actions to achieve an objective....

... <testing and simulation>...

... Department of State/Sandia (Caskey 2021)*...

... <probabilistic and deterministic models>...

... <RoSDF, including adversarial decision calculus, intel, and signals>...

... <TTXs and war games>...

... <mostly intel-driven assessments, some scenario-based assessments, TTXs, war games, and adversary decision calculus>...

... NOTES: A dark gray background indicates presentations from U.S. government agencies and organizations; a light gray background indicates presentations from retired officials or those outside of the U.S. government. Risk analysis methods ... shown in angle brackets. An asterisk (*) indicates the briefing is from Phase I. Acronyms and abbreviations are as follows:...

... CISAC, Committee on International Security and Arms Control...

... J5, Plans and Policy...

... J7, Joint Exercises, Training, and Assessments...

... J8, Capability and Resource Integration...

... NASEM, National Academies of Sciences, Engineering, and Medicine...

... NEC, Nuclear Command, Control, and Communications and Enterprise Center...

... Sandia, Sandia National Laboratories...

... USSTRATCOM, U.S. Strategic Command...

... <PRA expanding to include intent and capabilities>...

... <TTXs and exercises>...

... NNSA: NA-80 (NNSA 2021; Tilden and Boyd 2022)*...

... <programmatic and funding risk assessments to guide budgetary decisions>...

... NOTES: A dark gray background indicates presentations from government agencies and organizations; a light gray background indicates presentations from retired officials or those outside of the U.S. government. Risk analysis methods ... shown in angle brackets. An asterisk (*) indicates the briefing is from Phase I. Acronyms and abbreviations are as follows:...

... DHS, Department of Homeland Security...

... NCBC, National Counter Proliferation and Biodefense Center (previously NCPC)...

... S&T, Science and Technology Directorate...

... Differences in Nuclear War and Nuclear Terrorism Risks...

... Nuclear war and nuclear terrorism risk methods are distinct in important ways. The risk of nuclear war is often assessed by considering nuclear armed adversary ... nuclear device or to construct an improvised nuclear device or a radiological dispersal device.1 Two forms of deterrence come into play for both war and terrorism: the power to hurt (i.e., retaliation) and the power to deny (i.e., preventing an adversary from achieving objectives through either ...

... For policy analysts and senior decision makers, the threats posed by other nation-states with nuclear weapons often drives decision making in documents such as the Nuclear ... the potential threat posed by a nuclear armed adversary’s capabilities is as critical as examining the impact of U.S. responses to that threat and identifying military threats and diplomatic assurances that could lead to avoiding or ending a nuclear conflict on acceptable terms to reduce further ...

... In contrast, decision makers in the nuclear terrorism arena are often more focused on nuclear materials attractiveness, availability, and quantity (e.g., based on assessments of the effectiveness of security measures to protect nuclear materials). These assessments can guide ... of where to focus U.S. nonproliferation and nuclear material security assistance programs and dollars. Furthermore, the role of a nuclear nation-state actor distinguishes programmatic decisions in the nuclear terrorism field from those facing ... makers concerned about nuclear deterrence and nuclear war....

... Finding 2-4: Risk analysis is conducted in the U.S. government to address a range of specific and targeted questions related to nuclear war or nuclear terrorism such as threat analysis, vulnerability analysis, and programmatic and budgeting ...

... The U.S. government approaches to assessing risk, shown in Tables 2-1 and 2-2, vary by the goals and objectives of the organizations using them. Organizations interested in understanding threats, such as the intelligence agencies, rely on methods ... characterize the intent and capabilities of adversaries who might seek to obtain and use nuclear weapons or devices. Organizations such as the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) focus ... securing nuclear weapons and materials, preventing sabotage of nuclear facilities, or preventing successful use of nuclear weapons in an attack. They use methods to identify and ... vulnerabilities to facilities, security systems, and transit pathways. Those who focus on developing responses to the nuclear attack or prioritizing scenarios, such as the Department of Defense’s (DoD� ... ��s) Defense Threat Reduction Agency (DTRA), Joint Chiefs of Staff, U.S. Strategic Command (USSTRATCOM), and DHS analyze some (but not all) of the consequences of nuclear detonations....

... The committee recognized the use of formalized risk methodologies within the U.S. government. Other than understanding the types of assessments being conducted and the methods they used, the committee did not evaluate the level of quality of the risk assessment ... were conducted. If not currently following the principles of a well-conducted risk analysis listed in Box 2-1, any of the examples in Tables 2-1 and 2-2 would likely benefit by adopting them....

... Several risk methods and approaches to decision making shown in Tables 2-1 and 2-2 are further described below to highlight a variety of analyses for both nuclear war and nuclear terrorism risks....

... 1 The Phase I report addressed the scenarios (Chapter 2), history and literature of risk assessment (Chapter 3) and the use of risk assessment for nuclear war and nuclear terrorism (Chapter 4). These three chapters also highlight the differences between the risk of ... war and nuclear terrorism....

... is one part of a traditional risk equation. DTRA maintains DoD’s nuclear war consequence models. DTRA uses probabilistic models for targeting and damage estimates, including blast, cratering, and ground shock. Human effects that are included in the current models are focused on the ability of ... to conduct their missions. Some estimates of collateral damage to humans are included—prompt, thermal, and air blast effects. Deterministic models have been developed, for example, for the propagation of dust, fire, and ground-level and high-altitude ... pulse. Political, military, economic, social, information, and infrastructure impacts are not currently included in DTRA’s models. DTRA consequence models are used by DoD, DTRA reach-back teams, the Army, the ... Force, the Navy, and the Missile Defense Agency.2...

... In the Phase I report, the committee outlined the effects of a nuclear explosion by its immediate, near-term, and long-term effects. DTRA confirmed that its categorization is similar (NASEM 2023a, pp. 4-9, 4-13, and 4-15; quotes are unclassified):...

... The immediate effects of a nuclear explosion include an intense burst of gamma and neutron radiation; a fireball (anything inside the fireball is likely to be totally consumed); an intense, blinding flash and a pulse of thermal ... (causing burns and igniting fires); a powerful blast wave, accompanied by intense winds; and an intense electromagnetic pulse (localized for blasts within the atmosphere, but more far-reaching for blasts in space). (p. 4-9)...

... Near- and long-term effects are wide reaching. In the near term (roughly, 1 hour to 1 week after the event), widespread evacuations and grid instability are possible along with initial radiation effects on humans. In the long term (weeks to several months or years after the event), ... include social and economic unrest, political and governance crises, health effects, infrastructure failures, negative environmental and climate effects, migration, and psychological distress. (p. 4-9)...

... Updating our Cold War understanding of blast damage in a modern city is another important area of research. The bombings of Hiroshima and Nagasaki demonstrated that the area of glass breakage is nearly 16 times greater than the area of significant structural damage. Injury from broken ...

... Early studies show that some researchers (and funders) recognized the importance of and were beginning to explore the social and psychological effects of nuclear war. It is noteworthy and disturbing that there has been so little attention to further deepening understanding of ...

... DTRA consequence modelers are in a “wait and see” mode to be able to address the gaps outlined above. With the exception of electromagnetic pulse effects, DTRA has not been asked to model the ... gaps outlined in the committee’s Phase I Conclusion 4-1. Because of DTRA’s dual role to provide combat support as well as testing and training of systems to be deployed (i.e., both an “aider” and “grader”), any effort spent producing or improving a product such as the ... war consequence models needs a requirement and a metric. Developing a metric for inclusion of political, military, economic, social, information, and infrastructure impacts in their consequence models, for example, is difficult, especially because no one has issued a requirement for it....

...” to produce a written collateral damage estimate before use of conventional weapons (CJCS 2021). The requirement to assess collateral damage and the consequences for the use of nuclear weapons was not as widely scoped. Based on CJCS (2021) and what the committee heard, this is an important gap....

... Finding 2-5: Within DoD, DTRA provides estimates of the impact of nuclear weapons. The consequence assessment is focused on prompt effects and military objectives. This results in a partial accounting of the consequences leading to a limited understanding of the breadth of the outcomes....

... 2 Other agencies use DTRA models for code comparison (see Interagency Modeling Analysis Committee [IMAC]; Sward 2023). In addition, other agencies and programs within the U.S. government produce or are contributing to consequence models, especially nuclear and radiological infrastructure modeling, ... the National Laboratories, EPA, and DHS....

... consequences of nuclear explosions resulting from strategic deterrence failure are limited to prompt military effects, especially detonation (blast) and some fallout effects, and does not extend to broader and longer-term effects. This information further supports the committee’s Phase I Conclusion ... -1, that there is a need to better understand other physical effects of nuclear weapons (e.g., fires, damage in modern urban environments, electromagnetic pulse effects, and climatic effects, ... as nuclear winter), as well as the assessment and estimation of psychological, societal, and political consequences of nuclear weapons use....

... each nuclear-armed adversary. Although strategic, these assessments are refreshed daily to account for global diplomatic, informational, military, and economic conditions. The USSTRATCOM commander summarizes RoSDF assessment outputs (and other information) into a weekly update to the Secretary of ... and the Chairman of the Joint Chiefs. This assessment informs discussions with the National Command Authority and was briefed directly to the President on at least two occasions early in the Russia–Ukraine crisis. Geographic combatant commands such as the ... Command and the Indo-Pacific Command do not develop their own risk assessments of deterrence failure but rather participate in the development of the RoSDF assessment that USSTRATCOM ... for DoD. The RoSDF analysts incorporate information from other agencies—including, for example, the Departments of State and Treasury—to ascertain the diplomatic, economic, and informational impacts on adversary perceptions that drive risk....

... “Adversary decision calculus” is a method cited to assess an adversary’s goals, psychology, cultural perspective, information, and reasoning (USSTRATCOM 2021a; Long 2022; Weaver 2022; Weidner et al. 2022). Adversary decision calculus is used within USSTRATCOM’s RoSDF as well as ...

... with scenario-based methods that are highlighted earlier in this chapter. Scenario-based methods force more attention to interactive behavior and other dependencies that influence potential outcomes....

... Risk of Nuclear and Radiological Terrorism...

... DHS’s Science and Technology (S&T) Directorate is responsible for developing and maintaining the capability to perform terrorism risk assessments of weapons of mass destruction tailored to a variety of different users (DHS 2021). ... uses probabilistic risk assessment (PRA) methodology to assess risk that uses a set of scenarios with derived data and modeled probabilities and consequences. Risk assessments are scaled to user requirements and can be used to address components of overall risk, or they can be used to assess ... the United States. Recently, the DHS Countering Weapons of Mass Destruction (CWMD) Directorate produced its first chemical, biological, radiological, and nuclear (CBRN) Strategic Rick Assessment Summary (DHS 2022)....

... In its risk modeling, DHS has identified three categories of terrorist organizations (international organizations, domestic groups, and small groups or lone actors) with a range of financial and technical capabilities; many different target types and dissemination modes; and hundreds ... of nuclear facilities is not included in the DHS risk model, as it is being addressed by others, including the U.S. Nuclear Regulatory Commission and the Department of Energy....

... Development of the risk assessments has been an ongoing, community-driven process so as to ensure that the methodology and resultant outputs adequately address the needs of the Homeland Security Enterprise (HSE) and interagency stakeholders. On a regular basis, S&T [ ... CWMD] meets with other DHS components and interagency partners to gather requirements for risk assessments and to ensure that the results are vetted by the appropriate experts. (DHS, Phase 1, 2021, p. 2)...

... Intelligence assessments follow strict analysis and reporting guidelines (Grabo 2002; DIA 2009) to characterize and understand threats to the United States. For long-standing intelligence oversight reasons, the Intelligence Community (IC) does not collect information on or ... interactions with U.S. plans and choices, nor does the IC typically assess the consequences or vulnerabilities to the United States or its interests (Murphy 2022). However, those ... intelligence reports to develop their own “intel-driven assessments” or “intelligence-informed leadership judgment,”4 as shown in Tables 2-1 and 2-2 (the right-hand column in both tables)....

... COMMITTEE FINDINGS, CONCLUSIONS, AND A RECOMMENDATION RELATED TO RISK METHODS USED IN U.S. GOVERNMENT...

... used across the U.S. government to address different aspects of nuclear risks, the committee provides the following additional findings, conclusions, and recommendations....

... Finding 2-6: Based on the information collected by this committee, risk analysis is conducted in the U.S. government to address a range of specific and targeted questions related to nuclear war and nuclear terrorism, such as programmatic and budgeting decisions. In these cases, the risk analysis ... efforts addressing the broader question of overall risks of nuclear war or terrorism were found. One exception is the effort within DHS S&T and Countering Weapons of Mass Destruction (CWMD) directorates focused on assessing CBRN risks. DHS S&T and CWMD, in conjunction with DHS partners ... other federal agencies, have developed a risk analysis capability to assess and guide decisions related to terrorism, including nuclear terrorism. Another exception is a recently developed qualitative tool, RoSDF, within ...

... Finding 2-7: RoSDF is a qualitative tool intended to guide integrated deterrence planning and decision making. It was one of the few examples discovered during the committee’s information collection activities of a risk assessment tool ... on risk of nuclear war. To its credit, the RoSDF process combines input from the Combatant Commands, the Intelligence Community, the U.S. interagency, and allies. RoSDF is a nascent cross-government, multidisciplinary analysis of nuclear war risks ... scope is nonetheless defined by a hierarchy of requirements documents and DoD structure. This necessary hierarchy imposed by DoD limits RoSDF assessments to threats to U.S. vital interests posed by nuclear-armed adversaries ... identified in Campaign Plans, National Security Strategy, Nuclear Posture Review, and National Defense Strategy. It precludes the incorporation of risks of minor conflicts; integration of emerging technologies and domains (cyber, ... intelligence, space); contributions from economic, technological, and information risks; and inadvertent or accidental nuclear launch....

... Finding 2-8: Sensitive aspects of USSTRATCOM’s RoSDF analysis are understandably classified, including the specific sources and methods used for data collection and RoSDF’s requirements to limit its focus on specific adversaries (as specified in USSTRATCOM’s Campaign Plan). ... presented to the committee do not emphasize the kind of interactive scenario-based risk analysis mentioned in this report. However, the general scope and methodology of the RoSDF effort could be made more widely available to enable awareness of RoSDF goals and capabilities across the U.S. government ...

... Recommendation 2-1: The U.S. Strategic Command’s risk of strategic deterrence failure (RoSDF) capability to monitor and assess the risk of deterrence failure and to assess the impact of U.S. actions on adversary’s actions should be more widely shared across the U.S. ... agencies and the executive branch. This added transparency and resulting feedback and engagement with others could improve early RoSDF capabilities....

... Conclusion 2-3: The main differences between the U.S. government’s nuclear security strategy when it comes to nuclear terrorism risks and nuclear war risks are in their scope, current capability, and use. The risks posed by nuclear and radiological terrorism has received National ... Council (NSC) attention and guidance (NSM 19 2023). A capability to assess overall risks leading to terrorists’ use of nuclear or radiological weapons exists within DHS and ... focus (based on the information that was available to this committee). This leads to a disconnect between integrated-deterrence failure analysis and current capabilities. Both risk analysis capabilities, one residing within DHS for nuclear terrorism and another within USSTRATCOM for nuclear war, ... either not known or were dismissed by interagency partners, leading to the possibility that both capabilities are underscrutinized and underutilized....