I was reading the Information Age Warfare Quarterly’s inagural issue and the first article on “Distributed Adaptive Logistics” by Jeffrey R. Cares got me thinking.

I’ve already discussed why resilience needs to be our goal and not passive armoring. Cares’s article got me thinking about what resilience really means, and how one might go about engineering an organization to make it resilient. The nexus of these thoughts is the No Free Lunch Theorem. I need to do more reading on it (and I already know that I think the name is confusing; “no free lunch” is my 30 second way of explaining the second law of thermodynamics), but the gist of the theorem is that “there are no universally best optimization routines.” Or, putting it another way,

…all algorithms that search for an extremum of a cost function perform exactly the same, when averaged over all possible cost functions. In particular, if algorithm A outperforms algorithm B on some cost functions, then loosely speaking there must exist exactly as many other functions where B outperforms A.

This is important because traditional operations research and system engineering approaches attempt to optimize system performance. When we are dealing with a predictible and stable environment, such techniques (linear programming, queuing networks, modeling through decomposition, …) help you to design a system optimized for that environment. Optimization is specialization, and so in order to improve performance in one environment, one must necessarily trade off performance in another. That other environment could be an utterly irrelevent one (e.g. your car is optimized to drive on roads at the expense of being able to drive on water - a trade off we’re all willing to make!), and so there really isn’t a problem. Until you are in a situation where a human adversary is part of the environment your system faces. That adversary can affect the environment with the intent of crippling your system - meaning that those reasonable trade-offs you made to optimize your system for ideal conditions turn into vulnerabilities.

This means that instead of trying to optimize organizations to deal with likely environments, we ought to be finding ways to engineer organizations that can rapidly change their operating algorithms. It doesn’t matter what environments are likely, because the very act of optimizing for one environment weakens a system’s ability to deal with another environment. And a thinking adversary will always be looking for that other environment, that vulnerability, no matter what it is. So we want to be able to respond to a new environment (which very well might have been caused by global guerilla tactics) without having to engage in expensive and time-consuming overhauls of our enterprise’s operating procedures. This is what I think Enterra Solutions is getting at when they say that their technology allows companies to “turn new rule sets into executable code elements that are embedded into IT systems and make automated processes fully auditable, intelligent and adaptable. ” A new environment requires new rule sets and we want those to be adopted as quickly as possible.

From a Boydian perspective, global guerillas can change our environment and so we must observe those changes. If we can’t orient to these changes then we’re dead in the water. Finding ways to re-orient companies and agencies in response to challenges is the essense of resilience.

Got a post brewing regarding resiliency, operations research, and complexity theory. Should be up tomorrow evening.