The Blast Radius Has Changed. Has Our Understanding of the Human?
By James J. Frey, Ph.D., and Jeff Russell | St. Moritz Enterprises
A trusted person. Legitimate access. Consequences far beyond the individual.
Commanders, intelligence professionals, and corporate leaders recognize that combination. The difficult question is whether their organizations can recognize a developing problem while there is still time to respond.
Technology has steadily expanded the reach of individual action. The longbow extended the archer’s reach. Aircraft carried effects across borders. Networked systems now allow a person with sufficient access to move information, disrupt operations, or expose an organization at extraordinary scale.
The human being remains part of that system. The consequences of human judgment have grown with the tools.
That expanding “blast radius” is the problem we are examining at St. Moritz: how to give responsible leaders earlier, better-grounded awareness of meaningful change in the people operating consequential systems.
The evidence sometimes existed but went undetected
Robert Hanssen’s espionage began in 1979 and continued intermittently until his arrest in 2001. He went unchecked for nearly 22 years; his espionage was old enough to drink. The Justice Department’s Inspector General documented “repeated security violations, inadequate supervision, and failures to record and act on concerning conduct.” Hanssen also searched FBI systems for references to himself. Audit capability existed, but his improper searches went undetected because audit reviews were not conducted without an allegation of wrongdoing. DOJ Inspector General
That is a consequential distinction: an organization can possess information without turning it into an effective basis for action.
The 2013 Washington Navy Yard shooting presents a different kind of failure. Twelve people were killed. Reporting on the Navy’s investigation described an employer’s “failure to convey adverse information to the government,” despite “concerns that Aaron Alexis might harm others.” The review identified failures in personnel vetting and security oversight. TIME’s account of the Navy review
Espionage and workplace violence are different problems. These cases nevertheless raise a shared operational question: who could have, should have, seen the relevant evidence pulled together, and whom then was responsible for acting on it?
A new algorithm cannot repair information that is never reported or spawn complacent, or uninformed, leadership into action. Any credible technical approach must address that reality.
Earlier awareness requires disciplined interpretation
Across aviation, intelligence, and industry, the practical question is the same: what information would help the person responsible recognize a developing problem and make a better decision while there is still time to act?
Jeff and I approach that question through the relationship between human behavior, operational context, and evidence.
A change in behavior can have several explanations. A new assignment, fatigue, equipment problems, personal strain, a training gap, or deliberate misconduct may produce superficially similar observations. An unfamiliar pattern deserves examination; its meaning must be credibly established.
Consider a hypothetical employee whose working hours change, whose task errors increase, and whose information-access patterns expand. Each observation needs context. Together, they may warrant review – but a new assignment could explain all three.
The reviewer needs a timeline, the underlying sources, relevant job changes, missing information, and plausible alternatives. A numerical risk score alone cannot provide that understanding.
What we are developing
St. Moritz’s Cognitive Fingerprint I/O (CF I/O) is being developed as an intelligence layer that organizes authorized information around an individual’s patterns over time.
The intended process is straightforward: collect relevant information, compare it with an established personal baseline and applicable role requirements, examine persistent changes across available signals, and prepare an evidence-based report for an authorized reviewer.
That report should explain what changed, when it changed, which observations support the finding, and what remains uncertain. It should help the reviewer compare competing explanations and identify appropriate follow-up.
The individual baseline matters, but it cannot stand alone. Conduct does not become acceptable simply because someone does it consistently. Established security requirements, role expectations, and professional judgment remain essential.
The development objective is to make meaningful patterns easier to examine while preserving the distinction between an observation, an interpretation, and a decision.
Could that have helped in earlier cases?
A system that brought documented violations, relevant access activity, and other authorized observations into a coherent review could potentially have supported earlier scrutiny in cases such as Hanssen’s.
That is a hypothesis worth testing. It is not evidence that CF I/O would have identified Hanssen – or prevented the Navy Yard attack, but given what Jeff’s models are doing in simulation, it seems highly probably it would have stop it in its infancy (not a punch drunk 22 year-old).
Demonstrating earlier detection requires information available before the event, a defined decision threshold, and testing against people who did not cause harm. Otherwise, hindsight makes the pattern look easier than it was.
Our evaluation must therefore examine useful warning time, missed cases, false alerts, reviewer workload, and the quality of the resulting decisions.
The arithmetic matters. In a hypothetical population of 10,000 people containing 10 genuine cases of a defined threat, a detector with 90% sensitivity and 99% specificity would produce approximately nine true alerts and 100 false alerts. Only about 8% of its alerts would identify genuine cases. You have to get that right or leadership will dismiss the 8% having been exhausted trying to chase down the 92%.
Those are illustrative numbers, of course, but they show why impressive-sounding accuracy can still create an unmanageable review burden, and why unsupported suspicion can damage innocent people. We’re working toward a solution that will cull the heard of the false reports more effectively. This means more data collected, compared, collated, analyzed against alternative hypothesis (his heart rate is up because he took the stairs, not that he’s nervous), and then it all has to be summarized, made sense of, and presented to the appropriate authority for adjudication and action or inaction.
The organizational obligation
Earlier awareness is useful only when someone can do something appropriate with it.
That means defined access to information, accountable review, proportionate follow-up, and an auditable explanation of how a concern was handled. It also means distinguishing a person who needs assistance from a person whose conduct warrants investigation. Seeking help must not become shorthand for being a threat.
This problem extends across intelligence organizations, defense contractors, aviation, healthcare, and critical infrastructure. The missions differ. Each depends on people whose decisions can carry consequences well beyond their desks.
At St. Moritz, CF I/O brings our work in human performance, operational decision-making, and analytical system design to that problem. We are interested in working with organizations that can help define realistic use cases and test whether the approach improves the information available to their decision-makers.