Digital twins as a security risk?

Digital twins have become a popular and widely used tool for assessing risk and resilience, particularly as they have increased in the fidelity and accuracy of their representation of real-world systems. Although digital twins provide the ability to experiment on and assess risks to and from a system without damaging the real-world system, they pose potentially significant security risks. For example, if a digital twin of a power system has sufficient accuracy to allow loss of electrical power service due to a natural hazard to be estimated at the address level with a high degree of accuracy, what prevents someone wishing to lead to disruption at this same building from using the model to solve the inverse problem to determine which parts of the power system should be attacked to maximize the likelihood of loss of service to the target facility? This perspective article discusses the benefits and risks of digital twins and argues that more attention needs to be paid to the risks posed by digital twins.

Artificial intelligence for risk analysis-A risk characterization perspective on advances, opportunities, and limitations.

Artificial intelligence (AI) has seen numerous applications for risk analysis and provides ample opportunities for developing new and improved methods and models for this purpose. In the present article, we conceptualize the use of AI for risk analysis by framing it as an input-algorithm-output process and linking such a setup to three tasks in establishing a risk description: consequence characterization, uncertainty characterization, and knowledge management. We then give an overview of currently used concepts and methods for AI-based risk analysis and outline potential future uses by extrapolating beyond currently produced types of output. We end with a discussion of the limits of automation, both near-term limitations and a more fundamental question related to allowing AI to automatically prescribe risk management decisions. We conclude that there are opportunities for using AI for risk analysis to a greater extent than is commonly the case today; however, critical concerns about proper uncertainty representation and the need for risk-informed rather than risk-based decision-making also lead us to conclude that risk analysis and decision-making processes cannot be fully automated.

On the use of the term "real risk".

The term "real risk" and variations of this term are commonly used in everyday speech and writing, and in the scientific literature. There are mainly two types of use: i) in statements about what the real risk related to an activity is and ii) in statements about the risk related to an activity being real. The former type of use has been extensively discussed in the literature, whereas the latter type has received less attention. In the present study, we review both types of use and analyze and discuss potential meanings of type ii) statements. We conclude that it is reasonable to interpret a statement about the risk being real as reflecting a judgement that there is some risk and that the knowledge supporting this statement is relatively strong. However, such a statement does not convey whether the risk is small or large and needs to be supplemented by a characterization of the risk.

A risk science perspective on liability/guilt and uncertainty judgements in courts.

This article aims to provide new insights about risk and uncertainty in law contexts, by incorporating ideas and principles of contemporary risk science. The main focus is on one particular aspect of the law: its operation in courts where a defendant has been charged with a violation of civil or criminal law. Judgements about risk and uncertainty-typically using the probability concept-and how these relate to the evidence play a central role in such situations. The decision on whether the defendant is liable/guilty or not may strongly depend on how these concepts are understood and communicated. Considerable work has been conducted to provide theoretical and practical foundations for the risk and uncertainty characterizations in these contexts. Yet, it can be argued that a proper foundation for linking the evidence and the uncertainty (probability) judgements is lacking, the result being poor communication in courts about risk and uncertainties. The present article seeks to clarify what the problems are and provide guidance on how to rectify them.

A risk science perspective on vaccines.

Vaccines can be seen as one of the greatest successes in modern medicine. Good examples are the vaccines against smallpox, polio, and measles. Unfortunately, vaccines can have side effects, but the risks are considered by the health authorities and experts to be small compared to their benefits. Nevertheless, there are many who are skeptical of vaccination, something which has been very clearly demonstrated in relation to the COVID-19 disease. Risk is the key concept when evaluating a vaccine, in relation to both its ability to protect against the disease and its side effects. However, risk is a challenging concept to measure, which makes communication about vaccines' performance and side effects difficult. The present article aims at providing new insights into vaccine risks-the understanding, perception, communication, and handling of them-by adopting what is here referred to as a contemporary risk science perspective. This perspective clarifies the relationships between the risk concept and terms like uncertainty, knowledge, and probability. The skepticism toward vaccines is multifaceted, and influenced by concerns that extend beyond the effectiveness and safety of the vaccines. However, by clarifying the relationships between key concepts of risk, particularly how uncertainty affects risk and its characterization, we can improve our understanding of this issue.

Data-driven predictive modeling in risk assessment: Challenges and directions for proper uncertainty representation.

Data-driven predictive modeling is increasingly being used in risk assessments. While such modeling may provide improved consequence predictions and probability estimates, it also comes with challenges. One is that the modeling and its output does not measure and represent uncertainty due to lack of knowledge, that is, "epistemic uncertainty." In this article, we demonstrate this point by conceptually linking the main elements and output of data-driven predictive models with the main elements of a general risk description, thereby placing data-driven predictive modeling on a risk science foundation. This allows for an evaluation of such modeling with reference to risk science recommendations for what constitutes a complete risk description. The evaluation leads us to conclude that, as a minimum, to cover all elements of a complete risk description a risk assessment using data-driven predictive modeling needs to be supported by assessments of the uncertainty and risk related to the assumptions underlying the modeling. In response to this need, we discuss an approach for assessing assumptions in data-driven predictive modeling.

On the Use of Standards and Guidelines as a Tool to Fulfil Regulatory Requirements.

Over the years, industrial safety regulation has shifted from a "hard" command and control regime to a "soft" regime. A "hard" regime includes the use of strict prescriptive requirements which explain how industry should solve particular issues. A "soft" regime, uses more functional requirements, pointing out what goals are to be achieved. In a "soft" regime, prescriptive standards might still exist, but they are considered suggested solutions, with alternative solutions also being considered if they achieve the overall regulatory goals. The purpose of such a shift is to create regulations that are more flexible, meaning that they are more open for the use of novel technology and for the use of risk assessments as a basis for decision making. However, it is not clear that the shift from a hard to a soft regime has made it easier to use risk assessments for such a purpose in practice. In the present article, we discuss the limitations caused by strict adherence to prescriptive requirements presented in standards or regulations and present our perspective on why and how these can limit risk management in practice. The article aims to discuss the strengths and weaknesses, with regard to risk management, when regulations are strictly dependent on prescriptive or specification-based standards and guidelines. Several examples are used to illustrate some of the main challenges related to the use of specification-based technical standards and how the regulatory shift from "hard" to "soft" has not necessarily made it easier to implement technological solutions based on risk assessments.

The Role of Time in Risk and Risk Analysis: Implications for Resilience, Sustainability, and Management.

There is a persistent misconception that risk analysis is only suited for considering the immediate consequences of an event. Such a limitation would make risk analysis unsuitable for many challenges, including resilience, sustainability, and adaptation. Fortunately, there is no such limitation. However, this notion has stemmed from a lack of clarity regarding how time is considered in risk analysis and risk characterization. In this article, we discuss this issue and show that risk science provides concepts and frameworks that can appropriately address time. Ultimately, we propose an adjusted nomenclature for explicitly reflecting time in risk conceptualization and characterizations.

Foundational Challenges for Advancing the Field and Discipline of Risk Analysis.

Risk analysis as a field and discipline is about concepts, principles, approaches, methods, and models for understanding, assessing, communicating, managing, and governing risk. The foundation of this field and discipline has been subject to continuous discussion since its origin some 40 years ago with the establishment of the Society for Risk Analysis and the Risk Analysis journal. This article provides a perspective on critical foundational challenges that this field and discipline faces today, for risk analysis to develop and have societal impact. Topics discussed include fundamental questions important for defining the risk field, discipline, and science; the multidisciplinary and interdisciplinary features of risk analysis; the interactions and dependencies with other sciences; terminology and fundamental principles; and current developments and trends, such as the use of artificial intelligence.

When Is a Risk Assessment Deficient According to an Uncertainty-Based Risk Perspective?

The Petroleum Safety Authority Norway (PSA-N) has recently adopted a new definition of risk: "the consequences of an activity with the associated uncertainty." The PSA-N has also been using "deficient risk assessment" for some time as a basis for assigning nonconformities in audit reports. This creates an opportunity to study the link between risk perspective and risk assessment quality in a regulatory context, and, in the present article, we take a hard look at the term "deficient risk assessment" both normatively and empirically. First, we perform a conceptual analysis of how a risk assessment can be deficient in light of a particular risk perspective consistent with the new PSA-N risk definition. Then, we examine the usages of the term "deficient" in relation to risk assessments in PSA-N audit reports and classify these into a set of categories obtained from the conceptual analysis. At an overall level, we were able to identify on what aspects of the risk assessment the PSA-N is focusing and where deficiencies are being identified in regulatory practice. A key observation is that there is a diversity in how the agency officials approach the risk assessments in audits. Hence, we argue that improving the conceptual clarity of what the authorities characterize as "deficient" in relation to the uncertainty-based risk perspective may contribute to the development of supervisory practices and, eventually, potentially strengthen the learning outcome of the audit reports.

The Use of Simulation to Reduce the Domain of "Black Swans" with Application to Hurricane Impacts to Power Systems.

Recently, the concept of black swans has gained increased attention in the fields of risk assessment and risk management. Different types of black swans have been suggested, distinguishing between unknown unknowns (nothing in the past can convincingly point to its occurrence), unknown knowns (known to some, but not to relevant analysts), or known knowns where the probability of occurrence is judged as negligible. Traditional risk assessments have been questioned, as their standard probabilistic methods may not be capable of predicting or even identifying these rare and extreme events, thus creating a source of possible black swans. In this article, we show how a simulation model can be used to identify previously unknown potentially extreme events that if not identified and treated could occur as black swans. We show that by manipulating a verified and validated model used to predict the impacts of hazards on a system of interest, we can identify hazard conditions not previously experienced that could lead to impacts much larger than any previous level of impact. This makes these potential black swan events known and allows risk managers to more fully consider them. We demonstrate this method using a model developed to evaluate the effect of hurricanes on energy systems in the United States; we identify hurricanes with potentially extreme impacts, storms well beyond what the historic record suggests is possible in terms of impacts.

Concerns, challenges, and directions of development for the issue of representing uncertainty in risk assessment.

In the analysis of the risk associated to rare events that may lead to catastrophic consequences with large uncertainty, it is questionable that the knowledge and information available for the analysis can be reflected properly by probabilities. Approaches other than purely probabilistic have been suggested, for example, using interval probabilities, possibilistic measures, or qualitative methods. In this article, we look into the problem and identify a number of issues that are foundational for its treatment. The foundational issues addressed reflect on the position that "probability is perfect" and take into open consideration the need for an extended framework for risk assessment that reflects the separation that practically exists between analyst and decisionmaker.

Probability and possibility-based representations of uncertainty in fault tree analysis.

Expert knowledge is an important source of input to risk analysis. In practice, experts might be reluctant to characterize their knowledge and the related (epistemic) uncertainty using precise probabilities. The theory of possibility allows for imprecision in probability assignments. The associated possibilistic representation of epistemic uncertainty can be combined with, and transformed into, a probabilistic representation; in this article, we show this with reference to a simple fault tree analysis. We apply an integrated (hybrid) probabilistic-possibilistic computational framework for the joint propagation of the epistemic uncertainty on the values of the (limiting relative frequency) probabilities of the basic events of the fault tree, and we use possibility-probability (probability-possibility) transformations for propagating the epistemic uncertainty within purely probabilistic and possibilistic settings. The results of the different approaches (hybrid, probabilistic, and possibilistic) are compared with respect to the representation of uncertainty about the top event (limiting relative frequency) probability. Both the rationale underpinning the approaches and the computational efforts they require are critically examined. We conclude that the approaches relevant in a given setting depend on the purpose of the risk analysis, and that further research is required to make the possibilistic approaches operational in a risk analysis context.

Mapping climate discourse to climate opinion: An approach for augmenting surveys with social media to enhance understandings of climate opinion in the United States.

Surveys are commonly used to quantify public opinions of climate change and to inform sustainability policies. However, conducting large-scale population-based surveys is often a difficult task due to time and resource constraints. This paper outlines a machine learning framework-grounded in statistical learning theory and natural language processing-to augment climate change opinion surveys with social media data. The proposed framework maps social media discourse to climate opinion surveys, allowing for discerning the regionally distinct topics and themes that contribute to climate opinions. The analysis reveals significant regional variation in the emergent social media topics associated with climate opinions. Furthermore, significant correlation is identified between social media discourse and climate attitude. However, the dependencies between topic discussion and climate opinion are not always intuitive and often require augmenting the analysis with a topic's most frequent n-grams and most representative tweets to effectively interpret the relationship. Finally, the paper concludes with a discussion of how these results can be used in the policy framing process to quickly and effectively understand constituents' opinions on critical issues.