Modelling Disruption through Operational System Shock (or how I learned to stop worrying and love things going wrong)

Edward Higgins (March 2012) [update on Tamlan Dipper (Feb. 2010)]

ehiggins@23shillings.co.uk

“I asked Captain John Selwyn to tell his men to bring a bangalore torpedo and blow a hole in the fence, and was told that they had not got one on this particular boat. I said that we had better get to work with the wire-cutters, but he said he had not brought any. I was vexed with Selwyn. I started to climb up the left-hand side of the gully, which looked the easier, but almost immediately I lost my balance and fell back on top of Selwyn, who suggested that we were not doing much good and that it might be better to get back in the craft.”

- Maj. P. Young; commandos at Dieppei

1.0 Introduction

This document is intended to give a quick working understanding of the Operational System Shock (OSS) tool. OSS is a method of picturing what an opponent is up to so that you can more efficiently and effectively set about doing him a mischief. It works on physical and conceptual targets, and promotes the use of either lethal or non-lethal methods.

The tone is deliberately non-specialist. If the reader feels degraded by this they are welcome to approach the author for the large dense academic text this document is based upon.

2.0 Why Operational System Shock?

People and organisations come into conflict with great regularityii. When they do there are many approaches to try, such as attrition, intimidation, or using the enforcement of laws. A popular and powerful one is to make certain that the opposition are simply incapable (for whatever reason) of acting on their desire to hurt you, sometimes referred to as being in ‘shock’iii.

If we choose to work out how an opponent can be made incapable, or how we ourselves may become incapable, then it can be helpful to have some way of picturing the process. There are several possible tools available that try to do this. Operational System Shock (OSS) is one of them.

Each of the available tools has its advantages and disadvantages, usually arising from what the tool was designed to do best. OSS has been designed to focus on several key criteria:

To work with partial information, guesswork, and historical precedent To be built by specialists and understood by non-specialists To help specialists from different backgrounds to collaborate To illustrate a range of failures, including both ‘hard’ failure like injury and ‘soft’ failure like

confusion To try and get one step ahead of an opponent who is resourceful and determined and who

responds and innovates

The tool was designed in this way because it has its roots in counter-terrorism, where teams of police, military, lawyers and politicians are obliged to collaborate with very patchy information using as little lethal force as possible.

open release

However, while the tool has its roots in counter-terrorism, there is no technical reason why it cannot be used in operations up to full conventional war, and down to fixing a toaster.

3.0 How does it work?

Usually, when we think about something we don't like we begin by asking ‘who’ and ‘what’, ‘when’ and where’. OSS is more concerned with ‘why’. We are, of course quite used to asking why in a strategic sense. “Why is my neighbour throwing rocks at me?”. But OSS asks operational why questions. In the strategic sense he may be throwing rocks because he is angry with me. We’re more concerned with the operational, or to put it another way: “why rocks and not, for example, flowers?”. In the operational sense he is throwing rocks because the rocks are expected to injure me.

OSS works by building a map of the problem which we want to stop. It does this by picturing the problem as the focus of a cascade of contributing 'why's. Each 'why' is only included if it is impossible to imagine its superior without it. An engineer would say that gravity is felt, and 'why' must include (the object feeling gravity) having mass. A linguist would say that a piece of written information conveys information, and the 'why' must include a grammar and lexicon being shared with the receiver.

We do this so that what we build is a map of critical things, and hence a map of things which represent important vulnerabilities. The 'operational shock' in the name of the model refers to the business of causing one of the 'whys' to fail. Such a failure ripples upwards and causes the operation as a whole to fail.

We accept that my neighbour has inscrutable reasons for throwing rocks, and that they aren’t going to change. It’s probably all that orange paintiv. But we don’t care that he’s angry, we care about all these rocks being thrown at us.

Very quickly, here are some why components of the issue:

We already know why injuring Mr Dipper is there, so the question becomes "Why is Mr Dipper getting injured?" This is answered by the next level down. Mr Dipper is getting injured because physical force is meeting physical vulnerability. If either half of this equation were missing he

open release

wouldn’t be injured. If his neighbour were throwing words he would not be physically bruisedv, and equally if he was an idea and not a person then the neighbour could be chucking mortar rounds and he be fine.

Leaving aside the question of why he is physically vulnerable, which I blame on soft parenting, let us focus on physical force. Why is physical force in this problem? I am no physicist, but I don’t need to be. I don’t need to list every single thing involved in physical force. I only have to list things I know to be critical. That is without them physical force could not happen. Two of these things are energy and the delivery of that energy. I’m not 100% happy about delivery being at this level, because maybe it should be a level higher, but that’s no big deal. I can think about that some more and come back to it later. Remember that this tool was designed for groups to use on complex problems against the clock. If it was fussy it would be no good. The important thing right now is that delivery is in there somewhere.

Likewise, when I set to thinking about energy I find I can only think of one solitary thing that is involved: energy generation. Energy has to come from somewhere. In most similar modelling approaches, having only one arrow in and out is bad, and we'd now be in trouble. This is not the case for OSS. You can only break OSS by putting in non-critical things. Leaving out critical things doesn’t break it, it just makes it slightly less powerful.

Lastly in this quick model we can see how delivery is thought to be a function of motive power, a transport medium (something for delivery to occur across), and target location. Again, muck about with any one of these, or remove it from the collective and the whole thing falls apart. Consider, for example, the neighbour being able to see him, having a clear shot, but possessing a throwing arm like a spider's leg. No motive power, no delivery; no delivery, no physical force; no physical force, no injury.

Clearly, we could keep going on almost indefinitely using this method to pick apart any of the points above. But we’ll leave it there for now because we haven’t completed the model as it stands. To do so we need to add in the “what” and the “who” questions. Unfortunately at this point we need to use some technical jargon to avoid confusion with other descriptions of this technique:

Why becomes ‘effect’. Effects are universal properties like mass and energy or terrifying and dullvi

What becomes ‘generator’. These are objects, people, places.vii

Who becomes ‘governor’. The reason why the what becomes a why.viii

We draw these as shown below, all linking to focus on the operation’s intent.

open release

Effects, then, combine together to achieve an operational effect or ‘focus’, which is oriented on a strategic vision of how things should be. Each effect is generated using a generator at the decision of a governor. Disable ANY effect directly, by damaging its generator, or mucking about with its governor, and the operational plan as it stands will fail.

Now we understand the terms, our first step must be to flesh out the map we have already made. We do this by using the 'why's as effects, and adding appropriate generators and governors.

open release

Note that although we’ve tried to get a generator and governor for each effect some of the entries are rather dubious, and in fact needn’t be there at all (can we really blame Einstein for the workings of physics?). All of the generators and governors can be replaced or made unknown without necessarily changing the effect generated.

Having done this, and assuming our objective is to disrupt our getting injured we have three options for each effect node.

Cripple or destroy the generator producing the effect Cripple, destroy, control, or distract the governor producing the effect Reduce or cap the value of any given effect

Precisely how to cripple or destroy a generator is up to the user. This may seem rather lax on the

open release

part of the model, but in the author’s experience anyone capable of building the model is more than capable of exploiting its information; while groups of users who have got this far now share enough perspective to begin operations. On the other hand there are important issues to keep in mind.

Depending on the context of your disruption, the second most important issue is likely to be the rules of engagement. It is quite clear from the above model that my neighbour is a governor in several nodes. Eliminating him from the operation would induce shock. In both contexts this can be achieved through lethal force to the generator producing the governor effect (his tender body). But this may not be the sort of thing tolerated in your neighbourhood. In most such circumstances, where a generator is inviolate we typically find that if we explore the governor operation, then we expose methods of attack that are not prohibited, or sufficiently clandestine as to escape prohibition.

A commonly used model of the governor operation is shown below.

Damage to any of the effects shown as critical (above) to governing will shock the delivery of the governing into our target operation. The effect being governed will fail, and the target operation as a whole will go into shock through a cascade of failure.

This same process of unpacking effects to discover legal or clandestine methods of disruption applies across all effects, not just governors. Generally speaking, the more unpacking you do, the greater the likelihood of finding a loophole.

However, due to the imperfect world we live in, there are certain to be occasions, especially before a threatened operation has been executed, when neither the precise generator or governor will be known to you. You may know a gun will be involved, or a bomb-maker, but which gun or bomb-maker is a mystery. However, because we have planned our model around effects this does not stop us. In this circumstance we can:

open release

Cap the effect in the vicinity of the target Arrange alarm sensors registering the particular effect in the vicinity of the target Cap or alarm an associated effect of a likely generator If an effect is sufficiently rare, place all generators which possess it under surveillance

An example of capping would be the concrete barriers erected around sensitive locations to prevent the approach of vehicles which might be carrying explosive cargoes (proximity/delivery cap). An example of an alarm would be an automatic missile defence system which registers objects of a given speed. An example of an associated alarm would be the use of metal detectors. The metal detector is sensitive to magnetic fields created by metal, although it is the sharpness or hardness of the metal which is threatening. Finally, an example of rare effect surveillance would be the monitoring of stocks of nuclear weapons.

Doing any of the above will cause system shock in the target operation.

4.0 Target recovery

It is very rare that disruption to an operation will cause permanent operational system shock. If a man intends to catch an aeroplane, but finds no seats are free, he will immediately consider alternative methods of travel. If my pencil breaks I sharpen the stub.

Recovery takes several forms, which can occur singly or all together:

The victim can counter-attack the aggressor Analyse the damage to a generator and repair it Replace a damaged generator with a duplicate Replace a damaged generator with a completely new generator, for example a car being

replaced by a truck Replace one generator with a larger number of weaker generators Replace the existing governor with a more powerful governor

Keep in mind that although we talk about and act to change generators and governors we only actually care about the effects. OSS assumes that how an effect is generated is totally irrelevant to success.ix

i Peter Young, ‘Storm from the Sea’ii People and organisations, or systems come into conflict when their objectives are incompatible, or when they are seen as incompatible. Put simplistically if I want to paint everything in the world orange, and my neighbour wants to paint everything in the world purple, then we’re likely to come into conflict, sooner or later. Similarly if my neighbour thinks I want to paint the world orange, even if I don’t, then conflict may arise. This sort of thing happens quite often and for far stranger reasons than interior decorating.iii For a history of the concept of shock read Shimon Naveh’s seminal book “In Pursuit of Military Excellence; the evolution of operational theory” (1997)iv What’s the matter with you? You don’t read footnotes?v Well, his ears might be, but that’s getting ahead of ourselves.vi Note that ‘effect’ replaces ‘property’ in some descriptions of this method. This is to assist the linkup of OSS to other systems engineering approaches, rather than indicating that ‘property’ was incorrect.vii If you are smarter than I was when I invented this, you will have already worked out that most objects/generators are mainly defined by the effect they have. A knife is a knife because it cuts. When a thing ceases to exhibit it’s primary effects it is usually considered an imitation thing. However, we still find it useful to talk about objects, so we have the generator slot in the model.viii A perfect example of plain English being incomprehensible. The governor makes an object deliver an effect. For example, depending on the governor’s disposition a spoon can be used to make music, to carry soup to the mouth, or poke someone in the eye.

open release

Another point to keep in mind is the importance of the opposition realising they have suffered system shock. If they do not realise an effect is no longer functional then they cannot recover. There is much evidence to support the notion that this has been exploited by British Military Intelligence in Northern Ireland, where agents covertly tampered with weapons and explosives in known caches (‘jarking’). This has an additional benefit of wasting target assets (for example, explosives, money, time) in perpetration of operational plans that do not work.

Conversely, we may take the view that inflicting shock draws in target governors with rare qualities of awareness, authority, and skill to fix the problem. From this perspective it can be wise to inflict obvious damage, such as raiding a house, if we are confident that the cell who normally occupy it will make anguished appeals for assistance to persons higher up the chain of command. This can result in far more profound shock than disrupting any single operation.

The decision of whether to aim for covert or overt disruption is a sensitive one. However, in general it is fair to say that it is dependent on the degree and quality of surveillance in action. If a target is able to evade surveillance measures then provoking a repair effort may result in no high value targets being identified. In such circumstances it may be better to exploit what little is available. Moreover, provided such disruption is sufficiently clandestine it need not jeopardise further information gathering.

As a final point, it is the nature of system shock that in order for shock to be long-lasting it must occur across a wide array of effects in a condensed period of time. When planning a campaign of shock, the campaign goal must embrace this, striking both high and low effects in such a way that the target is either incapable of diagnosing the problems or becomes convinced that the operational goal is simply unachievable. In this way we begin to undermine the strategic conviction of the target, particularly if more attractive operations exist.

5.0 Summary

Operational System Shock is quite simply a method of getting together, and sharing information and viewpoints. It is optimised to do this in support of disrupting the ability of a target to achieve certain objectives. It has been further optimised to do so by offering a wide array of options for attack and defence, and without restricting the avenues of attack by reference to lethality or fixed rules of engagement.

It can be used in this capacity to plan campaigns of attack/prevention on certain operational types. However, it can also be used to communicate the architecture of specific operations, and provide a tracking system for monitoring the operational readiness of certain groups. In this last it can also be used to guide information gathering efforts by highlighting key areas of ignorance.

It is hoped that this model will continue to be useful in counter-terrorist and counter-criminal analysis, and that the reader will feel motivated to vigorously adapt and improve upon it as necessary.

ix Of course this assumption is dangerous, but it does make things simpler. I can light my cigarette with dynamite. It doesn't mean that I should.

open release