Saturday’s active shooter incident in Tucson, Arizona – the shooting of Rep. Gabrielle Giffords and others – demonstrates (again) that we cannot predict every negative event. The event itself is incredibly lamentable, but I’ll leave the discussion about the political implications and causes, and the very necessary discourse about civility in politics, to others. I will point out that elected representatives are thrust into leadership, and that a widespread perception of vitriol and antipathy between people who disagree is setting the stage for much less civil interactions at all levels of society over time.
Effective risk management demands an understanding of both causes and effects. We cannot manage all the causes because we cannot predict all the causes, but we can predict all the effects, and should use both to manage our risks, in particular the threats we know and do not know. Professional organizations, the Capitol Police and the Sheriff of Pima County will surely examine what happened from their own perspectives, regardless of their statutory duties, to establish where they could have helped identify and manage the risk of an active shooter – an assassination attempt – at that event. However, the issue shouldn’t be trying to enumerate the risk of an active shooter but on any form of threat requiring law enforcement resources materializing at that gathering, such as fervent, confrontational opponents of the congresswoman’s views turning up to protest.
Too many risk management techniques today are wrong for two reasons; they focus on identifying every individual threat and their causes, which is impossible, and they see those threats as binary – it happens or it doesn’t for a given value of impact. This is likewise wrong. A negative event will have a scale of effects depending on the seriousness of the event, and it is that risk curve that we must capture, understand and use for calculation and understanding.
This argument may appear esoteric, but DHS’ published risk management methodology and formula falls victim to these misunderstandings about risk. If DHS’ own methodology is too threat focused, how can we deliver effective risk management to their model, and indeed, should we?
The shooting in Tucson is a tragedy that hopefully will teach a wide range of lessons if people are willing to learn. Now is the time to be open to understanding that our underpinning doctrine may not be correct and to learn the lessons of such an unfortunate incident.
