University of California Transportation Center
UCTC- FR- 2010- 34
Securing linked transportation systems: economic implications and
investment strategies
Adib Kanafani and Jiangchuan Huang
University of California, Berkeley
November 2010
123
Journal of Transportation
Security
ISSN 1938- 7741
Volume 3
Number 4
J Transp Secur ( 2010)
3: 257- 274
DOI 10.1007/
s12198- 010- 0051- 2
Securing linked transportation systems:
economic implications and investment
strategies
123
Your article is published under the Creative
Commons Attribution Non- Commercial
license which allows users to read, copy,
distribute and make derivative works for non-commercial
purposes from the material, as
long as the author of the original work is
cited. All commercial rights are exclusively
held by Springer Science + Business Media.
You may self- archive this article on your own
website, an institutional repository or funder’s
repository and make it publicly available
immediately.
Securing linked transportation systems: economic
implications and investment strategies
Adib Kanafani & Jiangchuan Huang
Received: 19 July 2010 / Accepted: 13 September 2010 / Published online: 23 September 2010
# The Author( s) 2010. This article is published with open access at Springerlink. com
Abstract The security of the transportation system depends on that of any of its
components and how they are interlinked. But the securing of each component is
oftentimes in the hand of the agency in whose jurisdiction it falls. Literature on
reliability and security economics suggests that when security is defined by the
weakest link in an interlinked system, then its level is determined by the agent with
the highest cost- benefit ratio, and the other agents have the tendency to under- invest
or free ride. When security is a function of total effort, then the opposite obtains and
the reliability will depend on the agent with the lowest cost- benefit ratio. These
conditions arise in urban transportation. This research explores agency investment
behavior in multi- agency urban transportation systems develops guidelines for
investments in security. The question to answer: is it preferable to let each agency
operate its own security budget and make its own investment decisions or is this
process better centralized?
Keywords Transportation network security . Shared node and exclusive node
dominated network . Mixed network . System reliability
Introduction
Understanding the vulnerability of transportation networks has taken on a
heightened urgency following the events of the last decade, as Government agencies
scramble to develop investment strategies to protect these networks from security
threats. The little we know about transportation security suggests increased
J Transp Secur ( 2010) 3: 257– 274
DOI 10.1007/ s12198- 010- 0051- 2
Research supported by a grant from the University of California Transportation Center.
A. Kanafani (*) : J. Huang
University of California, Berkeley, CA, USA
e- mail: kanafani@ berkeley. edu
J. Huang
e- mail: jiangchuan@ berkeley. edu
Author's personal copy
vulnerability at points of inter- modal connection or at large scale termini, where two
conditions arise: large numbers of people making transfers and an institutional
ambiguity regarding who is responsible for securing the system. This ambiguity can
result in unbalanced and inefficient security investment. For example while large
amounts of money are spent on securing an airport, little or nothing, is done to
secure the shuttle buses that penetrate deep into the airport infrastructure!
Current literature on the vulnerability of transportation systems focuses mainly on
the problem of physical topological deficiency and deals with the loss of particular
links or nodes in a network. Du and Nicholson ( 1997) measure vulnerability using
performance of the transportation network. Berdica ( 2002) analyzes vulnerability
from a perspective of reliability of connectivity, travel time and capacity, which he
calls serviceability. Jenelius et al. ( 2006) uses graph theory to depict exposure,
criticality and importance. Nagurney and Qiang ( 2007) define an efficiency measure
to assess the performance of a transportation network.
Little has been done on how to reduce vulnerability or to allocate security
investment between transportation agencies and among the different components of
the transportation network. But the literature on reliability economics does provide a
way of thinking about the problem of transportation network security. The
framework of investment in public goods has been used for this considering that
security is in many respects a public good. Hirshleifer ( 1983) considered the
marginal cost and marginal return of each individual involved in the provision of
public good and defined conditions for a Nash equilibrium. Varian ( 2004), in
his work on information system reliability built on Hirshleifer’s work, defined
three prototypical cases in the context of system reliability: ( a) Total effort,
where reliability depends on the sum of the efforts exerted by the individuals,
( b) Weakest link, where reliability depends on the minimum effort, and ( c) Best
shot, where reliability depends on the maximum effort. He analyzed the Nash
equilibrium and social optimum of the utility of individuals with different cost-benefit
for each case.
In this paper we analyze the endogenous and exogenous features of transportation
network that affect the security investment behavior of agencies and thus the security
of the transportation network. We also analyze the effect of the knowledge of the
attacker to different network types. We aim to extend Varian’s work to the level of a
transportation network, of which different components come under the jurisdiction
of different agencies. We map two of the three prototypical cases mentioned above
to the particular transportation networks, with the total effort case applying to a
shared node dominated network and the weakest link case to a perfect information
exclusive node dominated network. We also create a combination of total effort and
weakest link applying to the imperfect information exclusive node dominated
network and the mixed network. We draw a comparison between the Nash
equilibrium and social optimal, as defined by the utility of the actors and security
level of the system in each case and show that social optimal is always preferable to
Nash equilibrium. Finally, we give two examples of two- agency mixed network,
one with similar investment incentive and the other with different investment
incentives with application to the security of airport- shuttle bus operator system. We
conclude with some policy recommendations regarding the organization of
investment in system security.
258 A. Kanafani, J. Huang
Author's personal copy
Definitions and concepts
Transportation facilities that make up a complex transportation network often come
under the jurisdiction of different transportation agencies. Questions regarding the
following arise when more than one agency is involved in investment on security:
( a) the incentive of each agency to invest; ( b) the effectiveness of each agency to
invest; ( c) the relationship between the actions of different agencies; and ( d) the
attacker’s knowledge of the level of security in each node. The first and second
questions can be dealt with in a cost- benefit analysis ( an endogenous agency
feature), the third and fourth questions require an analysis of the type of
transportation network the agencies are involved in ( an exogenous system feature)
based on a perfect or imperfect information assumption separately.
Agency feature ( endogenous)
We define a taxonomy of agencies involved in the transportation system based on
two criteria: whether they are motivated to invest in the security of the system, and
whether they are effective in doing so. The resulting four categories are shown in the
Table 1.
We assume the following behavior for each category as shown below, with some
examples for each:
1. Motivated and Effective (++): this agency will invest in securing its system
themselves. Examples include Pentagon, White House
2. Motivated but Not Effective (+ −): pay other effective agencies to invest, e. g.
airport on the security of shuttle bus
3. Not Motivated but Effective (− +): paid by other motivated agencies to invest, e. g.
shuttle bus operator for an airport
4. Not Motivated and Not Effective (− −): not involved check the wording here!
In which category an agency falls in is mostly determined by its intrinsic feature,
partially determined by the part to secure and the current security level of the facility.
For example, the airport is effective to secure its facilities while it has no way to
secure the shuttle buses owned by another agency that penetrate deep into the airport
infrastructure. Also, when the security level of an agency is already very high, it
is not motivated or effective to invest any more. Thus each agency invests on
the security of the system with different investment incentive and investment
effectiveness.
Table 1 Different agency behavior according to different motivation and effectiveness.
Effective
Yes No
Motivated Y Invest themselves Pay other effective agencies to invest
N Paid by other motivated agencies to invest Not involved
Securing linked transportation systems: economic implications 259
Author's personal copy
System feature ( exogenous)
The transportation system is composed of nodes ( stations, airports, ports) and links
( roads, subway lines, air routes). Each node or link may be under the jurisdiction of
one ( exclusively owned) or more ( shared) agencies. The securing of shared nodes is
subject to investment decisions made by the agencies that have jurisdiction over
them. For example, railway and highway agencies may be involved in the securing
of a same bridge they share. Exclusive system components may come under the
jurisdiction of one agency, even though their operation may involve intermodal
connections that involve systems that come under the jurisdiction of other agencies.
For example, a shuttle bus operator may have the sole responsibility to secure its
buses that connect between a city terminal and an airport.
In this context we can think of shared node dominated networks, exclusive node
dominated networks and mixed networks. In a shared node dominated network, most
of the nodes are shared and the lack of investment by one agency will not necessarily
result in increased vulnerability since other agencies may decide to invest in the
system. In an exclusive node dominated network, each node is exclusively owned by
one agency and the absence of investment by the cognizant agency will lead to
increased vulnerability. In a mixed network, there are significant amounts of both
shared and exclusive nodes and the network will have the common features of the
former two network types.
The attacker’s knowledge ( counterpart)
In a shared node dominated network, the attacker’s knowledge of the current security
level of each nodes does not quite matter in the system security and the invest
incentive of agencies. Since almost all nodes are shared nodes, if some agencies fail
to invest, other agencies can still invest in the shared nodes and sustain a high
security level of the system. The attackers will always find themselves in a situation
where almost all the nodes are in the same security level. Knowledge of the security
level of each agency does not help them make decision, they just pick up one node
randomly to attack. On the other side, the agencies, knowing that the knowledge of the
attacker on their decision of investments on the security is of little use to the attacker,
make decision without considering whether the attacker knows their decision or not.
In an exclusive node dominated network, however, the attacker’s knowledge of
the current security level of each nodes can make big difference in the system
security and the invest incentive of agencies. Since exclusive node dominated
network can be deficient in certain part if some agencies fail to invest, if the attacker
knows the security level of each nodes, they will always attack the nodes belong to
the agency with the fewest investment, rendering the additional investment of other
agencies on their nodes useless. If the attacker does not know the security level of
each node, they will attack randomly, with a probability of attack on each node. This
lead to the discussion of perfect information and imperfect information of the attacker
on exclusive node dominated network.
Our interest in this paper is in shared node networks and exclusive node networks in
different information set of the attacker and their common features adaptable to mixed
networks, and in the interplay between investment decisions of multiple agencies.
260 A. Kanafani, J. Huang
Author's personal copy
Utility function
Following Varian ( 2004) we adopt the following utility function to describe an
agency’s goal of securing its system at minimum cost:
Ui ¼ Pðx1; x2; " " " ; xnÞvi % cixi; i ¼ 1; 2; " " " ; n
where:
Ui is the utility of agency i.
xi is the level of effort expended by agency i in system security.
P( x1, x2, · · · , xn), is the security function— a measure of the resulting level of
security, such as the probability that the system is secured. P( · ) can
take different forms depending on the relationship between
agencies.
vi is the utility received by agency i if the system is secured. It
measures an agency’s motivation or incentive to enhance the
security.
ci is the cost to exert one unit of effort. It measures an agency’s
effectiveness to enhance the security— the smaller ci, the more
effective agency i in securing its system. We can use ci/ vi, the cost-benefit
ratio of agency i as a comparative indicator of incentive and
effectiveness for security investment.
The following properties of the utility function: Ui ¼ Pðx1; x2; " " " ; xnÞvi % cixi are
fairly obvious:
1. Nonnegative: xi " 0, vi " 0, ci " 0, P( x1, x2, · · · , xn) " 0
2. Diminishing investment incentive: P( x1, x2, · · · , xn) is C1, @ P
@ xi ! ! ! x % i
is nonnegative and
decreasing on xi, where x % i
çðx1; x2; " " " ; xi % 1; xiþ1; " " " ; xnÞ 3. Relative investment advantage: @ P
@ xi
> @ P
@ xj
when xi ' xj
4. Investment motivations: Agency i is motivated to invest on security when
@ Ui
@ xi ¼ vi
@ P
@ xi % ci > 0, i. e. marginal return MR ¼ v1
@ P
@ x1
> marginal cost MC= c1.
Let G( · ) be the inverse of P0ð " Þ, define Individual investment optimum
x »
i ¼ G ci
vi " # , thus x »
i satisfies vi
@ P
@ xi ¼ ci , @ Ui
@ xi ¼ vi
@ P
@ xi % ci ¼ 0.
Then @ Ui
@ xi
> 0 when xi < x »
i , @ Ui
@ xi
< 0 when xi > x »
i . This implies Claim 1:
Claim 1: Under free will, one agency wants to match its investment to its
individual optimum, it will never invest in its negative incentive zone.
That is, the agency will never invest more than x »
i .
Mapping
In this section we develop the security investment models for a number of situations
that might arise in real world transportation systems. We first consider the case of a
Securing linked transportation systems: economic implications 261
Author's personal copy
shared node dominated network in which the security of the system depends on the
total effort expended by all agencies involved. We then consider the case of an
exclusive node dominated network in which each agency decides separately on its
security investment and in which the attacker has perfect information about the level
of security in each node, thus making this a case of weakest- link vulnerability. We
follow that with a case representing a combination of these conditions. We conclude
the mapping in Table 2.
Shared node dominated network— Total effort
In a shared node dominated network, any agency can invest in any of the
nodes, the efforts are substitutable and cumulative, i. e. @ P
@ xi ¼ @ P
@ xj
for all xi " 0, xj " 0,
making this a total effort case as defined in Varian ( 2004) with the security
function:
Pðx1; x2; " " " ; xnÞçP X n
i ¼ 1
xi !
Without loss of generality, we look at the case of two agencies, 1& 2, both of
which can invest in any node of the network. The diminishing margin of P( x1, x2, · · · , xn)
implies that if agency 2 invests more, agency 1’ s investment is squeezed in the
diminished part, causing a reduction of incentive and resulting in free riding. An
illustration is shown in Figure 1a, where 1; 2 means both agency 1 and 2 can invest in
the node. The isoquant map of security function P is shown in Figure 1b, which
illustrates the diminishing returns of P.
Let’s say agency 1 has a higher cost- benefit ratio, c1= v1 > c2= v2, then agency 2
has higher investment incentive than agency 1 ( either has higher security incentive,
higher v2; or is more effective, lower c2). For the sake of reader, we recap Varian’s
model for Nash equilibrium and social optimum with extensions of our own
understanding. Note that xNi
, UN
i , UN, PN are the effort and utility of agency i, the
utility of the system and the security level of Nash equilibrium ( when agencies
choose to plan individually). Similarly, xSi
, US
i , US, PS are the same quantities of
social optimum ( when agencies choose to plan coordinately).
Table 2 Map from network types to reliability prototypical cases in different information set.
The attacker’s knowledge of the level of security in each node
Perfect information Imperfect information
Shared node dominated network Total effort Total effort
Exclusive node dominated network Weakest link Combination of total effort and weakest
link
Mixed network Combination of total effort and weakest link
262 A. Kanafani, J. Huang
Author's personal copy
Nash equilibrium
Agency 1 makes decision ( chooses x1) with respect to agency 2’ s decision ( x2) by
solving: max
x1
U1jx2
i: e: max
x1
v1Pðx1 þ x2Þ % c1x1
Let G( · ) be the inverse of P0ð " Þ, then it is decreasing. From claim 1, we know the
individual investment optimum of agency 1& 2 are x »
1 ¼ G c1
v1 " # and x »
2 ¼ G c2
v2 " # ,
neither of them choose to invest more than x »
1 and x »
2.
Take first order condition: v1P0ðx1 þ x2Þ % c1 ¼ 0, we get agency 1’ s decision
( x1) with respect to agency 2’ s decision ( x2):
x1 ¼ max G c1
v1 n " # % x2; 0o ¼ max x »
$ 1 % x2; 0 % Similarly, agency 2’ s decision ( x2) with respect to agency 1’ s decision ( x1) is:
x2 ¼ max G c2
v2 n " # % x1; 0o ¼ max x »
$ 2 % x1; 0 % The two decision curves only have one intersection point, this is the Nash
equilibrium, where xN1
¼ 0, xN2
¼ G c2
v2 " # . Since the efforts are substitutable and
cumulative, agency 2, with higher investment incentive, fulfills its obligation by
investing at its individual optimum x »
2 ¼ G c2
v2 " # while agency 1 frees rides. In a
word, the security is determined by the most motivated or effective agency ( with the
lowest cost- benefit ratio), others free ride. This is shown in Figure 2.
Social optimum
We want to maximize the utility of the system by solving max
x1; x2
ðU1 þ U2Þ
i: e: max
x1; x2
ðv1 þ v2ÞPðx1 þ x2Þ % c1x1 % c2x2
if c1< c2, this reduces to max
x1; x2 ¼ 0
ðv1 þ v2ÞPðx1Þ % c1x1
Take first order condition: ðv1 þ v2ÞP0ðx1Þ % c1 ¼ 0
P1 P2 P3
Increasing security
x2
x1
1,2
1,2
1,2
1,2
1,2
1,2
a b
Figure 1 a Shared node dominated network b Isoquant map of security function
Securing linked transportation systems: economic implications 263
Author's personal copy
We get social optimum when xS1
¼ G c1
v1þv2 " # , xS2
¼ 0 for c1< c2
Similarly, We get social optimum when xS1
¼ 0, xS2
¼ G c2
v1þv2 " # for c1> c2
We have xS1
¼ G c1
v1þv2 " # G c1
v1 " # ¼ x »
1 and xS2
¼ G c2
v1þv2 " # G c2
v2 " # ¼ x »
2.
While the agency with the lowest cost exerts enough efforts for itself, there is still
marginal benefit for the system. The system demand the lowest- cost agency to invest
in its negative incentive zone, that is, to invest more than its individual optimum,
which is a violation of claim 1. The lowest- cost agency is not willing to cooperate
for social optimum. Other agencies could give the lowest- cost agency money to
offset the difference between individual and social optimum. Alternatively, the
government could give the lowest- cost agency some subsidy to entice it to invest at
social optimum.
To sum up, we have the investment strategies of agency 1& 2 and the outcomes as
shown in Table 3 ( c1< c2) and Table 4 ( c1> c2).
At the Nash equilibrium, the level of security is determined by the agency with
the lowest cost- benefit ratio and the other agencies free ride. But at the social
optimum the security level is determined by the agency with the lowest cost, and the
Social optimum
Social optimum
2 free rides
1
2
Nash equilibrium
1 free rides
x2
v2
x2
S G
v1
=
+
! c 2 "
# $
% &
v2
x1
S G
v1
=
+
! c 1 "
# $
% &
v2
G
! c 2 "
# $
% &
v1
G
! c 1 "
# $
% &
x1
Figure 2 Nash equilibrium and
social optimum of total effort
Table 3 Nash equilibrium and social optimum of shared node dominated network c1= v1 > c2= v2, c1< c2.
Nash equilibrium Social optimum
xN1
¼ 0, xN2
¼ G c2
v2 " # xS1
¼ G c1
v1þv2 " # , xS2
¼ 0
PN ¼ P G c2
v2 " " # # < PS ¼ P G c1
v1þv2 " " # # UN
1 ¼ v1P G c2
v2 " " # # > US
1 ¼ v1P G c1
v1þv2 " " # # % c1G c1
v1þv2 " #
UN
2 ¼ v2P G c2
v2 " " # # % c2G c2
v2 " # < US
2 ¼ v2P G c1
v1þv2 " " # # UN ¼ ðv1 þ v2ÞP G c2
v2 " " # # % c2G c2
v2 " # < US ¼ ðv1 þ v2ÞP G c1
v1þv2 " " # # % c1G c1
v1þv2 " #
264 A. Kanafani, J. Huang
Author's personal copy
other agencies free ride. The social optimum results in a higher level of security
( PS > PN) and of system utility ( US > UN).
Perfect information exclusive node dominated network— Weakest link
In an exclusive node dominated network, only one agency can invest in a node, the
investments are neither cumulative nor substitutable. Each agency will always find
the need of investment for itself and the burden cannot be pushed to others. The
failure of one agency will lead to large deficiency of the transportation system. All
the agencies have the incentive to invest on their own nodes. As described below
system vulnerability in this case depends on the weakest link, rather than on the total
effort by all agencies.
Since exclusive node dominated network can be deficient in certain part if some
agencies fail to invest, the attacker’s knowledge of the current security level of each
nodes can make a big difference in the system security and the invest incentive of
agencies. This lead to the discussion of perfect information and imperfect
information of the attacker on exclusive node dominated network.
If the attacker knows the current security level of the nodes in an exclusive
node dominated network, then they will always attack through the most
vulnerable node, the security of the network is determined by the agency that
exerts fewest effort, i. e. @ P
@ xi
> @ P
@ xj ¼ 0 when xi ' xj. The security function takes
the form:
Pðx1; x2; " " " ; xnÞçminfPðx1Þ; Pðx2Þ; " " " ; PðxnÞg ¼ Pðminfx1; x2; " " " ; xngÞ
The equality holds because P( xi) is monotonically increasing.
The network type and the isoquant map of security function P are shown in
Figure 3a and b for the case of two agencies, where 1 means only agency 1 can
invest in the node and 2 means only agency 2 can invest in the node.
Using the same assumption ( c1= v1 > c2= v2) and notation in Shared node
dominated network— Total effort, We repeat Varian’s model for Nash equilibrium
and social optimum with extensions of our own understanding.
Table 4 Nash equilibrium and social optimum of shared node dominated network c1= v1 > c2= v2, c1> c2.
Nash equilibrium Social optimum
xN1
¼ 0, xN2
¼ G c2
v2 " # xS1
¼ 0, xS2
¼ G c2
v1þv2 " # PN ¼ P G c2
v2 " " # # < PS ¼ P G c2
v1þv2 " " # # UN
1 ¼ v1P G c2
v2 " " # # < US
1 ¼ v1P G c2
v1þv2 " " # # UN
2 ¼ v2P G c2
v2 " " # # % c2G c2
v2 " # > US
2 ¼ v2P G c2
v1þv2 " " # # % c2G c2
v1þv2 " # UN ¼ ðv1 þ v2ÞP G c2
v2 " " # # % c2G c2
v2 " # < US ¼ ðv1 þ v2ÞP G c2
v1þv2 " " # # % c2G c2
v1þv2 " #
Securing linked transportation systems: economic implications 265
Author's personal copy
Nash equilibrium
Agency 1 makes decision ( chooses x1) with respect to agency 2’ s decision ( x2) by
solving: max
x1
U1jx2
i: e: max
x1
v1Pðminfx1; x2gÞ % c1x1
( i) If x1< x2, max
x1
v1Pðx1Þ % c1x1
Take first order condition: v1P0ðx1Þ % c1 ¼ 0 ) x1 ¼ G c1
v1 " # x2
( ii) If x1 " x2, max
x1
v1Pðx2Þ % c1x1, agency 1 sets x1 as small as possible, thus x1= x2
We get agency 1’ s decision ( x1) with respect to agency 2’ s decision ( x2):
x1 ¼ min G c1
v1 n " # ; x2o ¼ min x »
n1; x2o
Similarly, agency 2’ s decision ( x2) with respect to agency 1’ s decision ( x1) is:
x2 ¼ min G c2
v2 n " # ; x1o ¼ min x »
n2; x1o
As Varian observed, there are a whole range of Nash equilibria. The largest of these
is at xN1
¼ xN2
¼ min G c1
v1 " # ; G c2
v2 n " # o. This Nash equilibrium Pareto dominates
the others, so it is natural to think of it as the likely outcome ( Varian 2004).
Since agency 1 has a higher cost- benefit ratio by assumption and G is decreasing,
we have G c1
v1 " # G c2
v2 " # ; xN1
¼ xN2
¼ G c1
v1 " # .
We could see that claim 1 holds in that agency 1& 2 never choose to invest more
than their individual investment optimum. Also, they never choose to invest more
than the other one does. This is because the nodes exclusively owned by the agency
with the fewest investment become the most vulnerable part of the network. The
attacker, knowing this, will always attack the nodes belong to the agency with the
fewest investment, rendering the additional investment of other agencies on their
P3
P2
P1
x2
x1
1 Increasing security
1
1
2
2
2
a b
Figure 3 a Perfect Information exclusive node dominated network b Isoquant map of security function
266 A. Kanafani, J. Huang
Author's personal copy
nodes useless. Thus other agencies choose to match their investment to that of the
one with the fewest investment and of course not to surpass their own individual
investment optimum. As a result, each agency matches their investment to the least
individual investment optimum, min x »
1; x »
2; " " " ; x »
$ n % ¼ Gðmaxfci= vigÞ. In a word,
the security is determined by the least motivated or effective agency ( with the
highest cost- benefit ratio), no one free ride. This is shown in Figure 4.
Social optimum
We want to maximize the utility of the system by solving max
x1; x2
ðU1 þ U2Þ
i: e: max
x1; x2
ðv1 þ v2ÞPðminfx1; x2gÞ % c1x1 % c2x2
It is obvious that x1= x2 at optimum, thus the problem reduces to
max
x
ðv1 þ v2ÞPðxÞ % ðc1 þ c2Þx
Take first order condition: ðv1 þ v2ÞP0ðxÞ % ðc1 þ c2Þ ¼ 0
We get social optimum when xS1
¼ xS2
¼ G c1þc2
v1þv2 " # . Since G is decreasing, we
have
xS1
¼ xS2
¼ G
c1 þ c2
v1 þ v2 & ' > min G c1
v1 " # ; G c2
v2 " # n o ¼ xN1
¼ xN2 :
Follow our assumption, xS1
¼ xS2
¼ G c1þc2
v1þv2 " # > G c1
v1 " # ¼ xN1
¼ xN2
While at Nash equilibrium each agency matches their investment to the least
individual investment optimum, there is still marginal benefit for the system. The
system demand each agency to enhance their investment to the system investment
optimum G P n
i ¼ 1
ci P n
i ¼ 1
& ( vi ' . Agencies with lower individual investment optimum
Social optimum
Nash Equilibrium
2
1
x2
x1
v2
G
! c 2 "
# $
% &
v1
G
! c 1 "
# $
% &
v2
x1
S G
v1
= x2
S =
+
! c 1 "
# $
% &
+ c2
Figure 4 Nash equilibrium
and social optimum of
weakest link
Securing linked transportation systems: economic implications 267
Author's personal copy
( with a higher cost- benefit ratio than P n
i ¼ 1
ci P n
i ¼ 1
( vi) than the system optimum do not
want to cooperate. Other agencies could give these higher cost- benefit agencies
money to offset the difference between the Nash equilibrium and the social
optimum. Alternatively, the government could give these higher cost- benefit ratio
agencies some subsidy to entice them to cooperate.
To sum up, we have the investment strategies of agency 1& 2 and the outcomes as
shown in Table 5.
In Nash equilibrium, the security level is determined by the agency with the
highest cost- benefit ratio, with all the agencies contribute the same, whereas at the
social optimum the security level is determined by the cost- benefit ratio of the
system P n
i ¼ 1
ci P n
i ¼ 1
( vi, with all agencies contributing the same. The social optimum
results in a higher level of security ( PS > PN) and of system utility ( US > UN).
Imperfect information exclusive node dominated network and mixed
network— Combination of total effort and weakest link
If the attacker does not know the current security level of the nodes of an exclusive
node dominated network, they will attack randomly, this becomes a partial weakest
link case. i. e. @ P
@ xi
> @ P
@ xj
> 0 when xi ' xj. The security function takes the form:
Pðx1; x2; " " " ; xnÞç P n
i ¼ 1
PðxiÞ
n ¼ P X n
i ¼ 1
aixi !; where X n
i ¼ 1
ai ¼ 1 and ai > aj if xi < xj
The equality holds because of the concavity of P( · )
If n= 2, and x1 < x2, then a1 > a2
Pða1x1 þ a2x2Þ ¼ Pðða1 % a2Þx1 þ a2x1 þ a2x2Þ ¼ Pðða1 % a2Þminðx1; x2Þ þ a2ðx1 þ x2ÞÞ
This is a combination of weakest link and total effort as shown in Figure 5.
Another case that ends in the combination of total effort and weakest link is the
mixed network. The network type and the isoquant of security function P are shown
in Figure 6a and b.
Table 5 Nash equilibrium and social optimum of exclusive node dominated network c1= v1 > c2= v2.
Nash equilibrium Social optimum
xN1
¼ xN2
¼ G c1
v1 " # < xS1
¼ xS2
¼ G c1þc2
v1þv2 " # PN ¼ P G c1
v1 " " # # < PS ¼ P G c1þc2
v1þv2 " " # # UN
1 ¼ v1P G c1
v1 " " # # % c1G c1
v1 " # > US
1 ¼ v1P G c1þc2
v1þv2 " " # # % c1G c1þc2
v1þv2 " # UN
2 ¼ v2P G c1
v1 " " # # % c2G c1
v1 " # < US
2 ¼ v2P G c1þc2
v1þv2 " " # # % c2G c1þc2
v1þv2 " # UN ¼ ðv1 þ v2ÞP G c1
v1 " " # # % ðc1 þ c2ÞG c1
v1 " # < US ¼ ðv1 þ v2ÞP G c1þc2
v1þv2 " " # # % ðc1 þ c2ÞG c1þc2
v1þv2 " #
268 A. Kanafani, J. Huang
Author's personal copy
Since we have social optimum is better than Nash equilibrium in both total effort
and weakest link cases, this should also hold for their combination.
Examples
For a mixed network, one could see that to plan coordinately is better than plan
individually. Here we set up a simple topology, two- agency example to illustrate this.
We have two transportation agencies: agency 1 owns node 0, node 1; agency 2
owns node 0, node 2. They have a shared node 0, which is the target, and each has
an exclusively owned node, as shown in Figure 7.
Agency 1& 2 want to secure the system at minimum cost. Let x11, x10 be the
investment on node 1, node 0 ( target) by agency 1, and x22, x20 the investment on node
2, node 0 by agency 2. Then the security budget of agency 1 is x1 ¼ x10 þ x11, and the
security budget of agency 2 is x2 ¼ x20 þ x22. The security budget of the system is
x1+ x2.
The attacker could either insert the bomb directly at node 0 ( target) or insert the
bomb at either node 1 or 2 and make the bomb propagate to node 0.
Let p0 the probability bomb inserted directly at node 0, and p10, p20 the
probability bomb inserted indirectly at node 0 from node 1 and node 2. p( x) should
be decreasing since more invest leads to lower bomb insertion rate, and be convex
since the more you invest the less you will decrease the probability of bomb
insertion. Thus we have
p0 ¼
1
1 þ x10 þ x20
; p10 ¼
1
1 þ x11
1
1 þ x10 þ x20
; p20 ¼
1
1 þ x22
1
1 þ x10 þ x20
Figure 5 Combination of total effort and weakest link
P3
P2
P1
Increasing security
x2
x1
1,2
1,2
1
1,2
1,2
2
a b
Figure 6 a Mixed network b Isoquant map of security function
Securing linked transportation systems: economic implications 269
Author's personal copy
Let P be the probability that the system is secured:
P ¼ 1 % ðp0 þ p10 þ p20Þ
¼ 1 %
1
1 þ x1
1
1 þ x10 þ x20 þ
1
1 þ x10 þ x20 þ
1
1 þ x2
1
1 þ x10 þ x20 & '
¼ 1 %
1
1 þ x10 þ x20
1 þ
1
1 þ x11 þ
1
1 þ x22 & '
Agency 1& 2 each gets v1, v2 if the system is secured, their utilities are:
U1 ¼ v1P % x1 ¼ v1P % x11 % x10
U2 ¼ v2P % x2 ¼ v2P % x22 % x20
And the utility of the system U ¼ U1 þ U2.
Similar incentive
If the two agencies have similar incentive to secure the system, let us say v1= v2=
1000. If the two agencies act coordinately under the regulation of the government,
they solve max
x10; x11; x20; x22
U, such that x10 þ x11 ¼ x1, x20 þ x22 ¼ x2. From the
symmetry of the problem, we know the optimum is reached when x1= x2, x10= x20,
x11= x22. Table 6 shows the optimal investment of each agency on each node when
the security budget of the system ( x1+ x2) ranges from 5 to 30.
However, if the two agencies make their investment decision individually, they
might lose the holistic view and make decisions superficially because of the
complexity of transportation system security. For example, agency 2 might find itself
end in higher utility than agency 1 if it chooses to free ride as shown in Table 7
Target
1 0 2
Agency 1 Agency 2
Figure 7 Layout of two agencies
Table 6 Investments, utilities and security level when agency 1 & 2 act coordinately.
Security
budget
x1 x2 x11 x10 x22 x20 U1 U2 P
5 2.5 2.5 0.464101 2.035899 0.464103 2.035897 530.994 530.994 0.533494
10 5 5 1.123105 3.876895 1.123106 3.876894 773.151 773.151 0.778151
15 7.5 7.5 1.690416 5.809584 1.690416 5.809584 854.347 854.347 0.861847
20 10 10 2.196148 7.803852 2.196155 7.803845 892.108 892.108 0.902108
25 12.5 12.5 2.656867 9.843133 2.656856 9.843144 912.7201 912.7201 0.92522
30 15 15 3.082774 11.91723 3.082756 11.91724 925.0082 925.0082 0.940008
270 A. Kanafani, J. Huang
Author's personal copy
( Note that Table 7 only shows one unwise decision of agency 1 and 2 when they
plan individually, it is not a case of Nash equilibrium).
Table 7 shows that the agency that free rides has higher utility than the agency
that invests ( U1 < U2). This dilemma is more obviously shown in Figure 8. As a
result, both the agencies want to free ride on the system and it ends in responsibility
ambiguity ( as one Chinese idiom says: one monk fetches the water to drink, two
monks have no water to drink).
Compare Tables 6 and 7 for the same security budget of the system ( x1+ x2), we
could see that when two agencies act coordinately, both of them have higher utility
and enjoy higher security level than they act individually. The government plays a
significant role in making agencies act coordinately under a holistic view and pulling
them out of the dilemma of responsibility ambiguity. This is shown in Figures 8 and 9.
Different incentive
It is not uncommon in transportation systems that agencies have different incentive
to invest in security, some may be indifferent of the damage caused. For example,
each airport has shuttle buses serving the passengers, and the bus terminals are
usually set close to the airport. While the airport is for all practical purposes
Figure 8 Utilities when two
agencies act individually and
coordinately
Table 7 Investments, utilities and security level when agency 1 invests, agency 2 free rides.
Security budget x1 x2 x11 x10 x22 x20 U1 U2 P
5 5 0 0.436492 4.563508 0 0 510.388 515.388 0.515388
10 10 0 1.000002 8.999998 0 0 740 750 0.75
15 15 0 1.45804 13.54196 0 0 819.491 834.491 0.834491
20 20 0 1.854102 18.1459 0 0 857.239 877.239 0.877239
25 25 0 2.208099 22.7919 0 0 877.836 902.8362 0.902836
30 30 0 2.531131 27.46887 0 0 889.8 919.8003 0.9198
Securing linked transportation systems: economic implications 271
Author's personal copy
barricaded with layers of security, little or nothing, is done to secure the shuttle
buses that oftentimes penetrate deep into its terminal buildings.
Secure the airport alone is not enough while the shuttle bus operator has little
incentive to secure its shuttle buses. From the previous example with agency 1
representing airport, v1= 1000, and agency 2 representing shuttle bus operator, v2= 0.
The shuttle bus operator will always set x20= x22= 0 since it has no incentive to
secure the system. The airport makes investment decision by solving max
x10; x11
U1, such
that x10 þ x11 ¼ x1, x20= x22= 0. Table 8 shows the Nash Equilibrium when the
airport and the shuttle bus operator acts individually under different security budget
of the system.
However, this is not the best strategy for the airport, the attacker could easily
insert a bomb on a shuttle bus to an airport and the explosion may blow up the whole
terminal. It would be better for the airport ( agency 1) to pay the shuttle bus operator
( agency 2) to secure its buses. In this case, the airport makes investment decision
by solving max
x10; x11; x20; x22
U1, such that x10 þ x11 ¼ x1, x20 þ x22 ¼ x2. This is shown in
Table 9:
Compare Table 8 with 9 for the same security budget of the system ( x1+ x2), we
could see that this 1+ 1 strategy is better than 2+ 0 strategy. The airport ends up in
higher utility and enjoys higher security level when it wisely sponsors the shuttle bus
operator on its security as shown in Figures 10 and 11.
Figure 9 Security levels when
two agencies act individually
and coordinately
Table 8 Investments, utilities and security level when agency 2 is indifferent of the damage.
Security budget x1 x2 x11 x10 x22 x20 U1 U2 P
5 5 0 0.436492 4.563508 0 0 510.388 0 0.515388
10 10 0 1.000002 8.999998 0 0 740 0 0.75
15 15 0 1.45804 13.54196 0 0 819.491 0 0.834491
20 20 0 1.854102 18.1459 0 0 857.239 0 0.877239
25 25 0 2.208099 22.7919 0 0 877.836 0 0.902836
30 30 0 2.531131 27.46887 0 0 889.8 0 0.9198
272 A. Kanafani, J. Huang
Author's personal copy
Figure 10 Utilities when two
agencies act individually and
coordinately
Table 9 Investments, utilities and security level when agency sponsors agency 2 to invest on security.
Security budget x1 x2 x11 x10 x22 x20 U1 U2 P
5 2.5 2.5 0.463991 2.035987 0.464036 2.035987 528.494 0 0.533494
10 5 5 1.122989 3.876979 1.123052 3.876979 768.151 0 0.778151
15 7.5 7.5 1.690358 5.809626 1.690391 5.809626 846.847 0 0.861847
20 10 10 2.196149 7.80385 2.196151 7.80385 882.108 0 0.902108
25 12.5 12.5 2.656855 9.843146 2.656853 9.843146 900.2201 0 0.92522
30 15 15 3.082766 11.91722 3.082798 11.91722 910.0082 0 0.940008
Figure 11 Security levels
when two agencies act
individually and coordinately
Securing linked transportation systems: economic implications 273
Author's personal copy
Conclusions
1. In a multi- agency environment, each agency has its own motivation and
effectiveness in the investment on security of the transportation system under its
jurisdiction. An agency is motivated to invest on security if its marginal return is
larger than marginal cost. Diminishing marginal return and constant marginal
cost leads to diminishing utility, thus diminishing incentive to invest. An
increase in the investment of one agency is always good for the other agencies
dealing with liked transportation systems.
2. In a shared node dominated network, the security level is determined by the
advanced agency ( the one with either the lowest cost or cost- benefit ratio), other
agencies always free ride. Government will allocate the whole security budget to
this most advanced agency, thereby letting the most capable and effective
agency do everything if the efforts are totally substitutable.
3. In a perfect information exclusive node dominated network, since one agency
alone cannot secure the system, each agency only chooses to match the effort of
the least capable agency ( with highest cost- benefit ratio). In a Nash equilibrium,
every agency is dragged down to the performance of the least capable agency. In
social optimum, every agency matches the performance of the whole system.
4. In an imperfect information exclusive node dominated network or a mixed
network, a combination of total effort and weakest link applies.
5. In all cases, the social optimum is always superior to the Nash equilibrium,
resulting in higher security level and sum of utility. The government should
mandate the agencies to coordinate or set some incentives to encourage agencies
that are not cooperative to coordinate. Alternatively, the more motivated
agencies will find it advantageous to pay the less motivated agencies in order
to entice them to coordinate.
Open Access This article is distributed under the terms of the Creative Commons Attribution
Noncommercial License which permits any noncommercial use, distribution, and reproduction in any
medium, provided the original author( s) and source are credited.
References
Berdica K ( 2002) An introduction to road vulnerability: what has been done, is done and should be done.
Transp Policy 9: 117– 127
Du ZP, Nicholson A ( 1997) Degradable transport systems: sensitivity and reliability analysis. Transp Res
B 31( 3): 225– 237
Hirshleifer J ( 1983) From weakest- link to best- shot: the voluntary provision of public goods. Public
Choice 41( 3): 371– 386
Jenelius E, Petersen T, Mattsson L- G ( 2006) Road network vulnerability: identifying important links and
exposed regions. Transport Research Arena, Göteborg
Nagurney A, Qiang Q ( 2007) A transportation network efficiency measure that captures flows, behavior,
and costs with applications to network component importance identification and vulnerability.
Proceedings of the 18th Annual POMS Conference. Dallas, Texas
Varian HR ( 2004) System reliability and free riding. Economics of information security. Kluwer, pp 1– 15
274 A. Kanafani, J. Huang
Author's personal copy