Wargaming for Security Analysis

======================================================================== LECTURE GUIDE: Wargaming for Security Analysis ======================================================================== TOTAL TIME: ~50 minutes (without exercise) | ~65 minutes (with exercise) LEARNING GOALS: 1. Define wargaming and distinguish it from simulations, modeling, and scenario planning 2. Identify the core components of a wargame (scenario, players, rules, adjudication, analysis) 3. Compare wargame types (seminar, tabletop, matrix game) and match each to analytical objectives 4. Evaluate wargaming's strengths and limitations as an analytical tool for complex security problems 5. Apply wargame design principles to their capstone simulation projects 6. Analyze real-world cases where wargames shaped, or failed to shape, security decisions PREPARATION CHECKLIST: - [ ] Review RAND's "Hedgemony" cyber wargame report (reference for Case 2) - [ ] Print or display the Wargame Design Canvas slide for exercise reference - [ ] Have 1-2 recent examples of tabletop exercises in the news (e.g., NATO Steadfast Defender, CISA Cyber Storm) - [ ] Prepare index cards or a shared doc for the matrix game mini-exercise - [ ] Note: Students begin project development on Wednesday (Apr 2), so close by connecting wargaming methodology directly to capstone deliverables - [ ] Review Peter Perla's definition and the Connections UK community for additional examples if needed SECTION BREAKDOWN (TARGET TIMES): 1. Opening: why wargame?: 4 min 2. What is a wargame? (definition + history): 5 min 3. Core components of a wargame: 6 min 4. Types of wargames: 6 min 5. Discussion: which type fits your project?: 4 min 6. The wargaming cycle (design → play → adjudicate → analyze): 6 min 7. Case 1: Millennium Challenge 2002: 5 min 8. Case 2: Cyber wargaming (RAND / Cyber Storm): 5 min 9. Discussion: what can't wargames tell you?: 3 min 10. Designing for insight (not victory): 4 min 11. Mini-exercise: matrix game round (optional): 12-15 min 12. Pitfalls and limitations: 4 min 13. Key takeaways + capstone bridge: 3 min ADAPTATION FOR 30-MIN VERSION: - Skip history slide, open with definition only - Use only one case study (Millennium Challenge, it's more dramatic) - Reduce discussions to 90 seconds each - Skip the optional matrix game exercise - Merge "designing for insight" into takeaways KEY MESSAGES TO REINFORCE THROUGHOUT: 1. Wargames are for generating insight, not predicting outcomes. The conversation IS the product 2. The value of a wargame is in exposing assumptions, not validating plans 3. Good wargame design starts with the question you need answered, not the scenario you want to build ========================================================================

OPENING (4 min) - Start with a question: "How many of you have played a strategy board game, like Risk, Settlers, or chess? You were already wargaming." - The hook: "Every simulation you've participated in this semester has been a form of wargaming. Today we formalize the methodology so you can design your own." - Perla's quote is the thesis of the entire lecture. Return to it at the end KEY MOVE: - Connect to course simulations: "In Phases 1-6, we gave you the scenario, roles, and rules. For your capstone, YOU design those. That's wargame design." TRANSITION: "But what exactly IS a wargame? It's not what Hollywood thinks it is."

**Working definition for this course:**

DEFINITION (3 min) - Keep this simple and intuitive before introducing types and components - The key idea is not "war" in the literal sense; it is structured decision-making under pressure - This also gives you language to connect course simulations to wargaming without claiming they are identical KEY EMPHASIS: - Human decision-making matters because real crises involve judgment, politics, and imperfect information - Pushback matters because plans only become interesting when someone or something resists them TRANSITION: "The term 'wargame' sounds military, and it started that way. But the methodology has spread far beyond defense."

INTUITIVE BRIDGE (2 min) - This slide is about outputs, not structure - Use it to reinforce that insight is the goal - The debrief matters because that's where raw play becomes usable analysis TRANSITION: "Once you have that intuition, the next question is how to build one well."

HISTORY (2 min) - Move through this quickly. The point is trajectory, not detail - Kriegsspiel: the Prussian army credited wargaming with their victories in the Franco-Prussian War (1870), so it was taken seriously at the highest levels - RAND: Herman Kahn's nuclear wargames directly influenced deterrence doctrine; "thinking about the unthinkable" was literally wargaming - The D&D connection is a useful hook. Role-playing games borrowed mechanics from wargaming, and now wargaming borrows back the narrative and role-play emphasis - The 2020s renaissance is driven by great-power competition, plus recognition that traditional analytical methods fail for hybrid and gray-zone threats IF STUDENTS ASK about video game wargames: acknowledge them but distinguish them. Most video games optimize for entertainment, not analytical insight; professional wargames optimize for the quality of the conversation and the decisions surfaced TRANSITION: "So what are the building blocks? Every wargame, from Kriegsspiel to your capstone, has the same core components."

*Optional clip: 0:00-3:30 for Kriegsspiel and the roots of modern wargaming.*

**Watch for:** What stays the same even as the medium changes?

VIDEO (3-5 min depending on clip) URL: https://www.youtube.com/watch?v=-seIA9tukDs USE: - Best placed right after the history slide - Minimum clip: 0:00-3:30 for Kriegsspiel and the early logic of wargaming - Extended clip: 0:00-5:30 if you want the bridge to tabletop gaming culture DEBRIEF: - "What elements from the video still show up in modern policy or cyber wargames?" - Expected answers: roles, rules, adjudication, uncertainty, learning by replay TRANSITION: "History is interesting, but what actually has to be present for a wargame to work?"

COMPONENTS (6 min) - Walk through each row slowly. This is the framework students will use to analyze or design a simulation - For each component, give a concrete example from the course simulations: - Scenario: "In Phase 1, we gave you a cascading infrastructure failure. That was the scenario" - Players: "You were assigned roles: government officials, company executives, NGO leaders" - Rules: "You had limited resources, time constraints, and communication channels" - Adjudication: "The teaching team decided what happened after your decisions. That's adjudication" - Analysis: "The debrief after each phase, that's where the real learning happened" KEY EMPHASIS: - Analysis is listed last but is arguably most important: a wargame without structured analysis is just a game - Adjudication is the hardest design problem: too rigid and players feel railroaded; too loose and outcomes feel arbitrary - These five components are the minimum structure students should look for in any simulation they study COMMON STUDENT QUESTION: "What about data? Where does quantitative information come in?" ANSWER: Data informs the scenario design and adjudication, but the wargame itself is a qualitative method that generates insight through human interaction, not statistical analysis TRANSITION: "In practice, students usually build only a couple of formats. Let's focus on those."

TYPES (4 min) - Keep this anchored in what students have already experienced - The first row is closest to the course simulations they have already played - The second row adds adversarial pressure without requiring a fully separate game system - You can mention matrix mechanics verbally as one way to structure the adversary role WHAT TO SAY: - "Most student projects will look like one of these two: a coordination-focused simulation, or that same simulation with an adversarial role added." TRANSITION: "Let's compare these side by side with a more specific lens."

COMPARISON TABLE (2 min) - Don't read the whole table aloud. Highlight 2-3 key contrasts: 1. If the question is about coordination, do not force an adversary into it 2. If the question is about contestation, deterrence, or disruption, add an adversarial role KEY POINT FOR CAPSTONE: - "Start with what you want students to learn, then decide whether adversarial pressure actually helps reveal it." TRANSITION: "Now let's look at the full lifecycle of running a wargame."

--- ## The Wargaming Cycle **Design** → **Play** → **Adjudicate** → **Analyze** → **Redesign** 1. **Design:** Start with what you want to learn, then build scenario, roles, and rules 2. **Play:** Players make decisions as events and injects unfold 3. **Adjudicate:** The umpire resolves actions and updates the shared situation 4. **Analyze:** Debrief the surprises, assumptions, and coordination failures **Key point:** good wargames are iterative, not one-and-done. WARGAMING CYCLE (4 min) - This is the methodological backbone. Students should internalize this as a design process - Walk through each phase with a concrete example: DESIGN: - "You start with a QUESTION, not a scenario. 'How would our city respond to a coordinated cyberattack on water and power?' That's the question. The scenario is built to force that question into the open." - Design choices constrain what you can learn: if you don't include a media/public opinion role, you can't learn about crisis communication PLAY: - "This is what people think of as 'the wargame,' but it's actually only one phase" - Injects are pre-planned events that escalate or redirect the scenario. They prevent stalemate and force new decisions - Good facilitation keeps play moving and captures key decision points ADJUDICATE: - "This is the hardest part to get right. Three approaches: free adjudication (umpire decides), rigid adjudication (dice/tables), and negotiated adjudication (players argue, umpire rules)" - For matrix games: players present an argument for why their action succeeds; umpire weighs the argument's plausibility ANALYZE: - "If you skip this, you wasted everyone's time. The debrief is where insight crystallizes." - Hot wash (immediately after play) + structured analysis (days/weeks later) - Document: key decisions, surprises, assumptions exposed, gaps identified TRANSITION: "Let's see what happens when wargaming works, and when it goes wrong."

--- ## Discussion: What Can't Wargames Tell You? (3 min) Wargames are powerful, but they are not: - **Predictions** of what will happen - **Proof** that a strategy works - **Representative** of all possible outcomes Given these limits: 1. What kinds of security questions are wargames **poorly suited** for? 2. How should decision-makers interpret wargame results, and what's the right level of confidence? 3. When might a wargame be **actively misleading**? DISCUSSION: LIMITATIONS (3 min) Format: 1 min think, 2 min full-class discussion FACILITATION TIPS: - This is a critical thinking exercise. Push back on both over-confidence and dismissiveness - If students say "wargames can't tell you anything" → "Then why does every major military and intelligence organization invest millions in them?" - If students say "wargames tell you what will happen" -> "Millennium Challenge told the US it would win easily, so how did that work out?" POSSIBLE STUDENT ANSWERS: - "Poorly suited for: highly technical questions where physics/math matter more than human judgment" -> YES, use computational models for those - "Poorly suited for: situations with no clear adversary" -> PARTIALLY, you can still wargame coordination failures, but you need different mechanics - "Misleading when: players don't take it seriously" -> YES, player buy-in is critical; if players treat it as a game, the decisions aren't representative - "Misleading when: designed to confirm a hypothesis" -> YES, Millennium Challenge exactly KEY POINT TO MAKE: - "The right mental model: wargames are like clinical trials for strategy. One trial doesn't prove a drug works, but it reveals effects you wouldn't see otherwise. Multiple wargames with different assumptions build a body of evidence." TRANSITION: "So if wargames aren't about winning or predicting, what ARE they about?"

DESIGNING FOR INSIGHT (4 min) - This slide is the bridge to capstone application. Everything here is a design principle students should apply - "Start with what you want to learn" is the single most important piece of advice. Students will want to start with a cool scenario and work backward, so resist this EXAMPLES OF GOOD VS. BAD DESIGN QUESTIONS: - BAD: "What would happen if China invaded Taiwan?" (too broad, no testable proposition) - GOOD: "Under what conditions would economic sanctions deter Chinese military action against Taiwan?" (specific, testable, reveals assumptions) - BAD: "Can our city respond to a cyberattack?" (yes/no question) - GOOD: "Where does coordination break down between city agencies during a multi-sector cyberattack, and what information would help?" (surfaces specific gaps) KEY EMPHASIS: - "Design for dilemmas" means every player should face at least one moment where their best option still has significant costs. That's where real-world decision-making lives - "Make failure informative" connects to Millennium Challenge: Van Riper's victory was the most informative moment of the entire exercise, and they threw it away TRANSITION: "Before we run a round, here's a quick clip that illustrates what happens when a design stops serving its original purpose."

*Optional clip: 0:00-2:45 as a funny illustration of requirement creep.* **Debrief prompt:** What happens when a design stops serving its original objective?

VIDEO (2-4 min depending on clip) URL: https://www.youtube.com/watch?v=aXQ2lO3ieBA WHY HERE: - This works as a humorous bridge from design principles to design failure - It reinforces "build to the objective" and "find the right balance" WHAT TO LISTEN FOR: - Every stakeholder adds a requirement - The system grows more complex but not necessarily more useful - The design drifts away from the original problem it was meant to solve AFTER THE VIDEO: - "What is the equivalent of 'build the Bradley' in a classroom wargame?" - Good answer: overloading the scenario, too many roles, too many mechanics, no time left to analyze TRANSITION: "That same problem shows up in wargame design all the time, so let's make the mechanics concrete."

ADVERSARIAL MECHANIC (2 min) - Walk through one example turn verbally before the exercise: - "I'm playing as the state governor. My action: I order a mandatory evacuation of coastal counties." - "My three reasons: (1) the hurricane forecast shows direct landfall in 18 hours, (2) we have pre-positioned buses and shelter capacity inland, (3) the last hurricane that hit without evacuation killed 200 people, so there is a political and moral imperative." - "Counter-argument from the county mayor: (1) traffic modeling shows evacuation routes will gridlock in 6 hours, stranding people on highways, (2) 30% of residents have no transportation, (3) the forecast could shift, so a premature evacuation costs $50M and erodes trust for future warnings." - "Umpire rules: mixed success. The evacuation order is issued, but execution is partial; 60% compliance, significant highway congestion." KEY POINT: - "Notice that both sides had reasonable arguments. The umpire doesn't pick a winner; they synthesize a plausible outcome. That's adjudication." TRANSITION: "Now let's try a short example."

--- ## Mini-Exercise: Short Adversarial Simulation **Scenario:** A ransomware attack hits three hospitals in your state. Patient data is encrypted, and the attackers demand $10M within 48 hours. **Setup:** one room-wide game with **4 factions** 1) **State Governor's Office**: political accountability, public safety mandate 2) **Hospital Network CEO**: operational continuity, patient care, financial exposure 3) **FBI Cyber Division**: law enforcement, intelligence, federal coordination 4) **Ransomware Group**: money, leverage, criminal reputation **In each faction:** pick 1 spokesperson, 1 note-taker, and advisors. **Each faction gets one turn:** state the action, explain why it should work, hear a counter, then adjudicate. **Debrief question:** Where did your group's plan collide with another group's interests? MINI-EXERCISE: SHORT ADVERSARIAL SIMULATION (12-15 min total: 2 min setup, 8 min play, 4 min debrief) [OPTIONAL] - SKIP THIS if running short on time. The concepts are covered in the slides regardless SETUP (2 min): - Divide the whole room into 4 large factions - Each faction chooses 1 spokesperson, 1 note-taker, and several advisors - You can play the ransomware group yourself, or assign it to students - Tell factions: "You have 90 seconds to decide your action and prepare your reasoning" - Post the scenario on screen so everyone can reference it ROOM MANAGEMENT FOR ~50 STUDENTS: - Each faction will have roughly 12-13 students - Ask factions to cluster physically so they can confer quickly - Only the spokesperson speaks during the main turn sequence - Invite advisors to pass notes to the spokesperson during other factions' turns ROLE NOTES (for instructor reference): 1) Governor's Office: - Likely actions: declare emergency, activate National Guard cyber unit, press conference - Tension: political pressure to "do something" vs. FBI wanting to preserve evidence - Push them on: "What do you tell the public? How do you handle the 48-hour deadline?" 2) Hospital CEO: - Likely actions: activate backups, consider paying ransom, divert patients - Tension: patient safety vs. legal/ethical issues of ransom payment vs. FBI pressure not to pay - Push them on: "Three patients are on life support with records locked. What's your triage plan?" 3) FBI: - Likely actions: begin attribution, advise against payment, coordinate with CISA - Tension: investigation timeline vs. 48-hour deadline vs. hospital operational needs - Push them on: "The hospital CEO wants to pay. Do you try to stop them? With what authority?" 4) Ransomware Group: - Likely actions: leak sample data to increase pressure, offer "discount" for fast payment, threaten other hospitals - Tension: maximizing payment vs. maintaining credible reputation vs. avoiding attention from state actors - Push them on: "The FBI is involved now. Does that change your calculus?" ADJUDICATION GUIDE: - After each faction states its action and reasoning, invite ONE counter from the most affected opposing faction - Rule outcomes as: strong success / partial success / mixed / partial failure based on argument quality and plausibility - Narrate the outcome briefly: "The Governor's press conference succeeds in calming the public, BUT the ransomware group leaks patient records 2 hours later, creating a second crisis" SHARE-OUTS / DEBRIEF (4 min): - Ask each faction: "What surprised you about how other groups responded?" - Ask: "Where did cooperation break down even though everyone wanted the same outcome (patient safety)?" - Ask: "What information would have changed your decision?" - Highlight the coordination failures. These are the wargame's analytical output DEBRIEF KEY POINT: "Notice that the ransomware group had the simplest decision calculus. The defenders had the hardest job because they had to coordinate with each other while the attacker only had to exploit the seams between them. That asymmetry is why cyber defense is a wargaming problem, not just a technical one."

PITFALLS (4 min) - Walk through each row with a brief example: - Confirmation bias: "This is Millennium Challenge. If you design a wargame to validate your plan, you'll get a plan that looks validated, and then reality will break it." - Player mismatch: "If you ask a 20-year-old to play the President, they'll make decisions a 20-year-old would make, not a president. Either brief them extensively on constraints, or design roles that match your players' actual expertise." - Scenario overload: "This is the #1 capstone pitfall I see: students try to simulate everything and end up with a scenario so complex that players spend all their time confused instead of making interesting decisions." - Weak adjudication: "If your umpire says 'yes' to everything, there's no friction. If they say 'no' to everything, there's no agency. Argument-based adjudication (matrix game style) solves this." - Missing analysis: "The debrief is not optional. Schedule it. Staff it. If you run out of time for the debrief, your wargame failed, even if the play was amazing." KEY EMPHASIS FOR CAPSTONE: - "For your projects, the two biggest risks are scenario overload and missing analysis. Keep your scenario tight and your debrief structured." TRANSITION: "So, what should you take away from all of this?"

HUMAN SECURITY CONNECTION (2 min) - This slide explicitly connects wargaming back to the course framework from Week 1 - Don't read every bullet. Pick 2-3 that connect to student project topics and expand on those - The key point: wargaming was born in military contexts but the methodology transfers anywhere you have adversaries, uncertainty, and consequential decisions EXAMPLES TO EXPAND ON: - Health: "Event 201 in October 2019 was a pandemic TTX. It predicted almost exactly the coordination failures we saw in COVID-19: information sharing, vaccine distribution politics, and public communication breakdowns. The wargame worked; the follow-through didn't." - Political: "Election security wargames: the Belfer Center's 'Defending Digital Democracy' project ran wargames with actual election officials and found that most of them had never practiced responding to a cyberattack on election infrastructure. The wargame was the first time they'd even thought through the problem." TRANSITION: "Let's bring this all together."

--- ## Key Takeaways 1. **Test decisions, not predictions** 2. **Start with what you want to learn** 3. **The conversation is the product** 4. **Match the method to the problem** 5. **Keep scope tight and never skip the debrief** TAKEAWAYS (2 min) - Return to the Perla quote from the opening: "The value of wargaming is not in predicting the future, but in making better decisions about it." - Point 5 is the action item: "Starting Wednesday, you're in full project development. Use these five principles as a checklist for your simulation design." CAPSTONE BRIDGE: - "Your capstone simulation IS a wargame. You're designing the scenario, assigning the roles, building the rules, planning the adjudication, and structuring the analysis. Everything we covered today is your design toolkit." - "If you take one thing from today: start with the question. What do you need your classmates to learn by playing your simulation? Build backward from there." CLOSING QUESTION (optional): "What's one assumption about your capstone topic that you'd like your wargame to challenge?"

--- ## Capstone Design Checklist Use this when building your simulation: - [ ] **Research question:** What specific insight are we trying to generate? - [ ] **Scenario:** What situation forces our research question into the open? - [ ] **Roles:** Whose decisions matter? Are roles matched to player capabilities? - [ ] **Rules:** What can players do? What constraints make decisions meaningful? - [ ] **Adjudication:** How do we determine outcomes? (Argument-based? Dice? Umpire judgment?) - [ ] **Injects:** What events escalate or redirect the scenario? (Plan 3-4 minimum) - [ ] **Analysis plan:** How do we debrief? Who takes notes? What do we report?

CAPSTONE CHECKLIST (1 min) - This is a practical takeaway. Encourage students to photograph or screenshot this slide - Each checkbox maps to a component from the "Core Components" slide earlier - The "time budget" item is critical: students consistently underestimate how long play takes and leave no time for debrief WHAT TO SAY: - "This checklist is your minimum viable wargame. If you can answer every item on this list, you have a designable simulation. If you can't, you need to narrow your scope." - "I'd rather see a tight 30-minute matrix game with a great debrief than an ambitious 90-minute TTX that runs out of time before the analysis." OPTIONAL: If time permits, have students spend 2 minutes filling in the first 2-3 items for their capstone topic and share with a neighbor.

DISCUSSION: WARGAME TYPE SELECTION (4 min) Format: 1 min individual think, 3 min pair discussion FACILITATION TIPS: - Push for SPECIFICITY: not just "a simulation," but what kind of decisions it is trying to surface - Push for JUSTIFICATION: why add an adversary, or why leave one out? - Walk the room and listen for interesting pairings to call on during share-out POSSIBLE STUDENT ANSWERS: - "We're doing a cyber incident response, probably a class simulation because we need to test coordination" -> follow-up: "Would adding an attacker make the exercise better, or just more complicated?" - "We want to explore election interference, probably a hybrid, because we need both institutional coordination and an active adversary" -> follow-up: "Good, what specific role would push back?" - "We want to explore climate migration, maybe no adversary, because the main issue is coordination under pressure" -> follow-up: "What would count as failure in that simulation?" IF DISCUSSION STALLS: Ask "Which of the simulations we've done this semester felt most useful for learning? What made it work?"

======================================================================== POST-LECTURE NOTES ======================================================================== COMMON STUDENT QUESTIONS: - "Can we use a board game or card mechanic?" Yes, if the mechanic serves the research question. Physical artifacts (cards, maps, tokens) can improve player engagement and constrain decision spaces. But don't let the mechanic become the point. - "How do we handle players who don't take it seriously?" Brief them on stakes before play. Assign roles that match their interests. If someone is disruptive, the umpire can introduce consequences in-game (e.g., "your faction's credibility drops because of the contradictory public statement"). - "What if our wargame reveals nothing interesting?" That IS interesting. Either your scenario wasn't challenging enough (redesign with harder dilemmas) or your players found a robust solution (document why it works). A null result in a wargame is rare but informative. - "How many people do we need?" Minimum viable: 4 players + 1 umpire/facilitator + 1 note-taker. Sweet spot for a class period: 8-15 players in 3-4 factions. CONNECTIONS TO OTHER COURSE CONTENT: - Week 1 (Human Security): Wargaming can be applied to any human security dimension. Use the framework to identify which dimensions your scenario touches - Week 2 (Cybersecurity): Cyber wargaming is one of the fastest-growing applications. Connect to CISA Cyber Storm and RAND work - Week 3 (Ethics/Governance): Wargame design involves ethical choices about what scenarios to explore and how to represent adversaries - Weeks 3-9 (Simulation Phases): Students have been PLAYING wargames all semester. Now they design them - Week 8 (Disaster Management): Event 201 and pandemic TTXs are direct applications of wargaming to disaster preparedness ASSESSMENT CONNECTION: - The capstone project (40% of grade) requires students to design and facilitate a simulation. This lecture provides the methodological foundation - Encourage students to reference wargaming terminology in their capstone write-ups: scenario design, adjudication method, analytical findings - The capstone checklist slide maps directly to the project rubric categories RESOURCES FOR DEEPER EXPLORATION: - Perla, Peter. "The Art of Wargaming" (1990): the foundational text - Caffrey, Matthew. "On Wargaming" (2019): history of wargaming's influence on real military decisions - RAND Corporation: "Hedgemony" and other cyber wargame publications (rand.org) - Connections US/UK: annual professional wargaming conferences with open resources (connectionsus.org) - PAXsims blog (paxsims.wordpress.com): covers wargaming, simulations, and serious games for policy - Sabin, Philip. "Simulating War" (2012): wargaming as an academic research method - King's College London Wargaming Network: academic wargaming resources and publications ========================================================================