RED Teaming: We Cannot Control The BLUE Team
Everyone has a plan until they get punched in the mouth. - Mike Tyson, professional boxerI've been assigned to help plan what's officially called a Full Scale Exercise. Or as I like to call it: Red Teaming.
Imagine a simulated public safety emergency with:
- eight (8) to ten (10) police departments;
- eight (8) to ten (10) fire / emergency medical (EMS) departments;
- dispatch / 911 center;
- & multiple hospitals.
The BLUE team is comprised of those who "respond" to the emergency. It's the cops, firefighters, paramedics, 911 operators, public works employees, nurses, emergency management, & other government officials.
The RED team is comprised of role-players who operate at the direction of scenario controllers. They're the victims, witnesses, criminal/terrorist offenders, & innocent by-standers.
Even though I've personally trained many of the BLUE team members who will be participating in this particular exercise, I simply cannot be sure how they will respond, act, behave, or decide. We can wish, hope, expect, or assume what BLUE team will do. But we do not know with certainty. This is because we cannot know how the BLUE team members will:
- make observations...or miss stimuli;
- compare to personal experiences;
- maintain composure...or succumb to stress;
- make sense of or figure out the situation;
- weigh various tradeoffs, compromises, or priorities;
- synthesize various response/intervention options;
- choose & employ an option.
- ...or in summary: Observe, Orient, Decide, & Act (OODA)
And then, once the BLUE team takes any action, the situation (as prepared by or set up by the RED team) has now changed! The situation that the BLUE team is experiencing may no longer be as originally planned by the RED team.
We as the controllers can only influence the behaviors or actions of our RED team!
If we are serious about developing our emergency responders to be as adaptable as possible, we must embrace their creative interventions. This applies to both real life & training scenarios. We'd be especially foolish to expect strict compliance with defined procedures in one (1) environment but creative in another. We can reasonably expect certain technical performance when it comes to technical challenges. But we should be willing to accept non-standard performance when it comes to adaptive challenges.
Having been involved as a RED team controller in hundreds of red teaming exercises (and a dozen at this size and scale), I continue to see one (1) common mistake:
RED teamers place too much confidence in their predictions of how BLUE teamers will observe, orient, decide, and act. RED team controllers foolishly believe that, because they've worked alongside or trained the BLUE team, that they can accurately predict BLUE team behavior. Because of this, simulations tend to be mistakenly designed in a rigid, linear, chronologic format. This error is a form of cognitive bias and demonstrates a misunderstanding of how humans interact in dynamic, complex, or chaotic environments.
RED teamers must stay just as (or more!) nimble, adaptive, and flexible in their planning as the BLUE team should be in their response to the simulation. Some see this RED team openness as an excuse to not plan...or a sign of a lack of organization or structure. I agree this is a lack of structure or organization - but will argue it is a wholly necessary lack of structure or organization. And also disagree about lack of planning; this requires extreme planning. (I've argued before that I am anti-plans but pro-planning.) The planning is extremely non-linear and open-loop in nature:
RED teamers have to have a deep understanding of what they are testing with the BLUE team...and how to create those situations for BLUE teamers to perform in them. RED teamers have to anticipate as many as possible of the ideal, preferred, reasonable, acceptable, inappropriate, untrained, whacky, out-of-the-box, completely crazy, or what-the-hell-were-they-thinking sorts of BLUE team responses. And then have a RED team counter-move to steer the situation to where it will test the functions meant to test. Or if too completely changed, shift the situation altogether to test something new and unexpected for the entire drill!!
Red teaming is an adversarial game. It plots opposing sides, each with their own observations, biases, expectations, hypotheses, forecasts, predictions, values, priorities, risk management, and ultimately...behaviors & actions.
I suggest that if you want to be the best BLUE team member...spend some time on the RED team.
Having been involved as a RED team controller in hundreds of red teaming exercises (and a dozen at this size and scale), I continue to see one (1) common mistake:
RED teamers place too much confidence in their predictions of how BLUE teamers will observe, orient, decide, and act. RED team controllers foolishly believe that, because they've worked alongside or trained the BLUE team, that they can accurately predict BLUE team behavior. Because of this, simulations tend to be mistakenly designed in a rigid, linear, chronologic format. This error is a form of cognitive bias and demonstrates a misunderstanding of how humans interact in dynamic, complex, or chaotic environments.
RED teamers must stay just as (or more!) nimble, adaptive, and flexible in their planning as the BLUE team should be in their response to the simulation. Some see this RED team openness as an excuse to not plan...or a sign of a lack of organization or structure. I agree this is a lack of structure or organization - but will argue it is a wholly necessary lack of structure or organization. And also disagree about lack of planning; this requires extreme planning. (I've argued before that I am anti-plans but pro-planning.) The planning is extremely non-linear and open-loop in nature:
RED teamers have to have a deep understanding of what they are testing with the BLUE team...and how to create those situations for BLUE teamers to perform in them. RED teamers have to anticipate as many as possible of the ideal, preferred, reasonable, acceptable, inappropriate, untrained, whacky, out-of-the-box, completely crazy, or what-the-hell-were-they-thinking sorts of BLUE team responses. And then have a RED team counter-move to steer the situation to where it will test the functions meant to test. Or if too completely changed, shift the situation altogether to test something new and unexpected for the entire drill!!
Red teaming is an adversarial game. It plots opposing sides, each with their own observations, biases, expectations, hypotheses, forecasts, predictions, values, priorities, risk management, and ultimately...behaviors & actions.
I suggest that if you want to be the best BLUE team member...spend some time on the RED team.
***
Lou Hayes, Jr. is a criminal investigations & intelligence unit supervisor in a suburban Chicago police department. With a passion for training, he studies human performance & decision-making, creativity, emotional intelligence, and adaptability. Follow Lou on Twitter at @LouHayesJr or on LinkedIn. He also maintains a LinkedIn page for The Illinois Model.
Comments
Post a Comment