Cybersecurity is the backbone of a successful digitalization of society, and cyber situation awareness is an essential aspect of managing it. The COVID-19 pandemic has sped up an already ongoing digitalization of Swedish government agencies, but the cybersecurity maturity level varies across agencies. In this study, we conduct a census of Swedish government administrative authority communications on cybersecurity to employees at the beginning of the COVID-19 pandemic. The census shows that the employee communications in the beginning of the pandemic to a greater extent have focused on first-order risks, such as video meetings and telecommuting, rather than on second-order risks, such as invoice fraud or social engineering. We also find that almost two thirds of the administrative authorities have not yet implemented, but only initiated or documented, their cybersecurity policies.

The COVID-19 pandemic has accelerated the digitalization of the Swedish public sector, and to ensure the success of this ongoing process cybersecurity plays an integral part. While Sweden has come far in digitalization, the maturity of cybersecurity work across entities covers a wide range. One way of improving cybersecurity is through communication, thereby enhancing employee cyber situation awareness. In this paper, we conduct a census of Swedish public sector employee communication on cybersecurity at the beginning of the COVID-19 pandemic using questionnaires. The study shows that public sector entities find the same sources of information useful for their cybersecurity work. We find that nearly two thirds of administrative authorities and almost three quarters of municipalities are not yet at the implemented cybersecurity level. We also find that 71 % of municipalities have less than one dedicated staff for cybersecurity.

In recent years, the Swedish public sector has undergone rapid digitalization, while cybersecurity efforts have not kept even steps. This study investigates conditions for cybersecurity work at Swedish administrative authorities by examining organizational conditions at the authorities, what cybersecurity staff do to acquire the cyber situation awareness required for their role, as well as what experience cybersecurity staff have with incidents. In this study, 17 semi-structured interviews were held with respondents from Swedish administrative authorities. The results showed the diverse conditions for cybersecurity work that exist at the authorities and that a variety of roles are involved in that work. It was found that national-level support for cybersecurity was perceived as somewhat lacking. There were also challenges in getting access to information elements required for sufficient cyber situation awareness.

In current command and control system design, the concept of information plays a central role. In order to find architectures for situation and threat databases making full use of all dimensions of information, the concept of information awareness must be understood. We consider and define some information attributes: measures of precision, quality and usability, and suggest some uses of these concepts. The analysis is Bayesian. A critical point is where subjective Bayesian probabilities of decision makers meet the objective sensor related Bayesian assessments of the system. This interface must be designed to avoid credibility problems.

Simulator training is becoming increasingly important for training of time-critical and dynamic situations. Hence, how simulator training in such domains is planned, carried out and followed up becomes important. Based on a model prescribing such crucial aspects, ten decision-making training simulator facilities have been analyzed from an activity theoretical perspective. The analysis reveals several conflicts that exist between the training that is carried out and the defined training objectives. Although limitations in technology and organization are often alleviated by proficient instructors, it is concluded that there is a need for a structured approach to the design of training to be able to define the competencies and skills that ought to be trained along with relevant measurable training goals. Further, there is a need for a pedagogical model that takes the specifics of simulator training into account. Such a pedagogical model is needed to be able to evaluate the training, and would make it possible to share experiences and make comparisons between facilities in a structured manner.

Målsättningen har varit att ta fram ny kunskap inom miljötillsynen och därigenom uppnå en effektivare miljötillsyn samt att få in nya vetenskapliga perspektiv på miljötillsyn.

I rapporten studeras metoder för inspektioner och det kommunikativa samspelet mellan inspektören och företrädare för den verksamhet som inspekteras, hur den institutionella ramen för inspektionsprocessen fungerar samt visar på möjligheter att mäta effekterna av inspektioner och tillsyn.

Naturvårdsverket kommer att ha resultatet som ett kunskapsunderlag i fortsatt arbete med tillsynsvägledning och utveckling av hur tillsyn och tillsynsvägledning kan följas upp och utvärderas.

This paper introduces two concepts—dialogical emergency management and strategic awareness—as means touse and understand the content of social media for the purpose of emergency communication. Dialogicalemergency management denotes that the emergency management organizations follow what people publish invarious social media on emergencies and ongoing emergency response, and then adjust their informationstrategies in a way that matches the expectations and needs for emergency information of the public. Theconcept of strategic awareness suggests that it is essential to have an understanding of the receiver (public) ofemergency information but also to have an understanding of the receivers’ idea about the emergency andemergency response. Hence, the notion of strategic awareness incorporates structured awareness of how peopleinterpret, value, and reacts on communication based on what they think about the sender’s (emergencymanagement organization’s) actual intentions and motives.

A highly developed aerial surveillance concept is presented. When fully implemented, the outlined surveillance system enhances situational awareness in two ways: it enhances the overall situational awareness in a large, possibly multinational, area and it provides the possibility to gain additional awareness in critical sites. The system is intended to be beneficial within various kinds of crisis management situations, e.g., disaster relief situations, humanitarian crises, chemical discharges, etc. In particular, the combination of large-area coverage with the possibility to instantly gain local situational awareness is believed to allow for pan-European collaboration and interoperability. Another targeted area includes critical ground sites such as ground transportation and infrastructure. The proposed concept uses surveillance at different altitudes and passes on near real-time information to a variety of end users through its embedded sensor and communications architecture.

Maximizing expected utility has been the foremost method for decision-making for centuries and has been applied to numbers of decision tasks of various kinds. The ideas of using utility matrices in a tree structure to predict behavior among intelligent agents is however new with several contributions during the last decade. We have investigated such a decision-theoretic framework, the Recursive Modeling Method, which is originally applied within intelligent agents. This framework includes a data structure that holds information regarding the surrounding environment, and a model for computation that takes advantage of the mentioned data structure. The data structure is based on utility matrices used for storing information regarding preferences, the environment and other agents. These utility matrices are organized in a tree structure that also contains probability distributions representing beliefs regarding the current situation picture. The probability distributions are used recursively together with the utility matrices in order to solve decision tasks. We conclude that the investigated framework needs to be extended to be fully functional for Command and Control decision-making. Therefore we outline an extended framework where we introduce the “attribute domain”, which will be used throughout the model. The main idea is to keep track of different utility variables, one for each attribute, throughout the recursive process so that information can be used for various decision tasks. We believe that different utility functions will be used from time to time and therefore the utility cannot be combined into one single variable. Instead the data structure must be designed to hold sets containing one utility value for each attribute, rather than one single utility value describing all kinds of profit.

In emergency management and in military operations, command and control comprises the collection of functions, systems and staff personnel that one or several executives draw on to arrive at decisions and seeing that these decisions are carried out. The large amount of available information coupled with modern computers and computer networks brings along the potential for making well-informed and quick decisions. Hence, decision-making is a central aspect in command and control, emphasizing an obvious need for development of adequate decision-supporting tools to be used in command and control centers. However, command and control takes place in a versatile environment, including both humans and artifacts, making the design of useful computer tools both challenging and multi-faceted.

This thesis deals with preparatory action in command and control settings with a focus on the strategic properties of a situation, i.e., to aid commanders in their operational planning activities with the utmost goal of ensuring that strategic interaction occurs under the most favorable circumstances possible. The thesis highlights and investigates the common features of interaction by approaching them broadly using a gaming perspective, taking into account various forms of strategic interaction in command and control. This governing idea, the command and control gaming perspective, is considered an overall contribution of the thesis.

Taking the gaming perspective, it turns out that the area ought to be approached from several research directions. In particular, the persistent gap between theory and applications can be bridged by approaching the command and control gaming perspective using both an applied and a theoretical research direction. On the one hand, the area of game theory in conjunction with research findings stemming from artificial intelligence need to be modified to be of use in applied command and control settings. On the other hand, existing games and simulations need to be adapted further to take theoretical game models into account.

Results include the following points: (1) classification of information with proposed measurements for a piece of information's precision, fitness for purpose and expected benefit, (2) identification of decision help and decision analysis as the two main directions for development of computerized tools in support of command and control, (3) development and implementation of a rule based algorithm for map-based decision analysis, (4) construction of an open source generic simulation environment to support command and control microworld research, (5) development of a generic tool for prediction of forthcoming troop movements using an algorithm stemming from particle filtering, (6) a non-linear multi-attribute utility function intended to take prevailing cognitive decision-making models into account, and (7) a framework based on game theory and influence diagrams to be used for command and control situation awareness enhancements. Field evaluations in cooperation with military commanders as well as game-theoretic computer experiments are presented in support of the results.

To authorize and initiate necessary investments and enforce appropriate policies and procedures, decision-makers need to have at least a fair understanding of computer security fundamentals. This paper presents the course design and the laboratory settings that have been developed for, and used within, the high rank officer curriculum at the Swedish National Defence College. The developed course looks at computer security from an attack versus defend viewpoint, meaning that computer attacks are studied to learn about prevention and self-defense. The paper discusses the pedagogical challenges related to education of high rank officers and similar personnel in light of recently-held courses and contrasts the course relative to similar undertakings. A standpoint taken is that computer security is best taught using hands-on laboratory experiments focusing on problem solving assignments. This is not undisputed since, e.g., high rank officers are busy people who are not fond of getting stuck learning about the peripherals.

To authorize and initiate necessary investments and enforce appropriate policies and procedures, decision-makers need to have at least a fair understanding of computer security fundamentals. This paper presents the course design and the laboratory settings that have been developed for, and used within, the high rank officer curriculum at the Swedish National Defence College. The developed course looks at computer security from an attack versus defend viewpoint, meaning that computer attacks are studied to learn about prevention and self-defense. The paper discusses the pedagogical challenges related to education of high rank officers and similar personnel in light of recently-held courses and contrasts the course relative to similar undertakings. A standpoint taken is that computer security is best taught using hands-on laboratory experiments focusing on problem solving assignments. This is not undisputed since, e.g., high rank officers are busy people who are not fond of getting stuck learning about the peripherals.

Understanding and dealing with computer security issues is normally considered a key objective for information technology (IT) support personnel. From a broader perspective, however, information-based threats are primarily a concern for managers and superior commanders who need to authorise and initiate the necessary investments and to enforce the appropriate policies and procedures to protect the organisation at hand. Enabling these latter-mentioned superior decision-makers to make well-founded decisions and to make sure the personnel actually conform to the approved procedures and practices require the decision-makers to have at least a fair understanding of computer security fundamentals. For this purpose, the Swedish National Defence College is in the midst of putting together a series of courses within information assurance to fulfil the need of IT training in governmental organisations. This paper presents the course design and the laboratory settings that were used within the first experimental course taught to students becoming high rank officers, i.e., officers elected for the very last two years of education within the curriculum of ordinary Swedish military training. The course looks at computer security from an attack versus defend viewpoint, i.e., computer attacks are studied to learn about prevention and self-defence. The pedagogical challenges related to education of high rank officers or similar personnel are discussed in light of the recently-held course. A standpoint taken is that computer security is best taught using hands-on laboratory experiments focusing on problem solving assignments. This is not undisputed since, e.g., high rank officers are busy people who are not fond of getting stuck learning about the peripherals. Also, it is emphasised that knowledge and tools within computer security by nature serve both the purpose of the attacker and the defender. The difference should be regarded purely as a question regarding intent.

Developers of tomorrow’s Command and Control centers are facing numerous problems related to the vast amount of available information obtained from various sources. On a lower level, huge amounts of uncertain reports from different sensors need to be fused into comprehensible information. On a higher level, representation and management of the aggregated information will be the main task, with the overall objective to provide reliable and comprehensible situation awareness to commanders. Hence, we consider prediction of future course of events being a necessary ingredient. Unfortunately, traditional agent modeling techniques do not capture gaming situations, i.e., situations where commanders make decisions based on other commanders’ reasoning about one’s own reasoning. To cope with this problem, we propose an architecture based on game theory for inference, coupled with traditional methods for uncertainty modeling. Applying an example, we show that our architecture could be used as a decision support tool, offering enhanced situation awareness in Command and Control. Finally, we wind up with a philosophical discussion regarding the ambiguities and the difficulties in interpreting the solution that game theory offers in the form of mixed strategy Nash equilibria.

Intelligence and Security Informatics (ISI) is an interdisciplinary field of research that focuses on the development, use, and evaluation of advanced information technologies, including methodologies, models and algorithms, systems, and tools, for local, national, and international security related applications. Over the past decade, the European ISI research community has matured and delivered an impressive array of research results that are both technically innovative and practically relevant.

Understanding and dealing with computer security issues is normally considered a key objective for IT support personnel. From a broader perspective, however, information-based threats are primarily a concern for managers and superior commanders who need to authorize and initiate the necessary investments and to enforce the appropriate policies and procedures to protect the organization at hand. Enabling these latter-mentioned superior decision-makers to make well-founded decisions and to make sure the personnel actually conform to the approved procedures and practices requires the decision-makers to have at least a fair understanding of computer security fundamentals. For this purpose, the Swedish National Defence College is in the midst of putting together a series of courses within information assurance to fulfill the need of IT manager training in governmental organizations. This paper presents the course design and the laboratory settings that were used within the first experimental course taught to students becoming high rank officers, i.e., officers elected for the very last two years of education within the curriculum of ordinary Swedish military training. The course looks at computer security from an attack versus defend viewpoint, i.e., computer attacks are studied to learn about prevention and self-defense. The pedagogical challenges related to education of high rank officers or similar personnel are discussed in light of the recently-held course. A standpoint taken is that computer security is best taught using hands-on laboratory experiments focusing on problem solving assignments. This is not undisputed since, e.g., high rank officers are busy people who do not have time to get stuck learning about the peripherals. Also, it is emphasized that knowledge and tools within computer security by nature serve both the purpose of the attacker and the defender, meaning that from a technical viewpoint it is not possible to distinguish between attack and defense. Instead, this difference should be regarded purely as a question regarding intent.

Developers of tomorrow's command and control centers are facing numerous problems related to the vast amount of available information obtained from various sources. On a lower level, huge amounts of uncertain reports from different sensors need to be fused into comprehensible information. On a higher level, representation and management of the aggregated information will be the main task, with prediction of future course of events being the uttermost goal. Unfortunately, traditional agent modeling techniques do not capture situations where commanders make decisions based on other commanders' reasoning about one's own reasoning. To cope with this problem, we propose a decision support tool for command and control situation awareness enhancements based on game theory for inference and coupled with traditional AI methods for uncertainty modeling.

Higher levels of the data fusion process call for prediction and awareness of the development of a situation. Since the situations handled by command and control systems develop by actions performed by opposing agents, pure probabilistic or evidential techniques are not fully sufficient tools for prediction. Game-theoretic tools can give an improved appreciation of the real uncertainty in this prediction task, and also be a tool in the planning process. Based on a combination of graphical inference models and game theory, we propose a decision support tool architecture for command and control situation awareness enhancements.

This paper outlines a framework for command and control decision-making in multi-agent settings. Decision-makers represent beliefs over models incorporating other decision-makers and the state of the environment. When combined, the decision-makers’ equilibrium strategies of the game can be inserted into a representation of the state of the environment to achieve a joint probability distribution for the whole situation in the form of a Bayesian network representation.

Higher levels of the JDL model call for prediction of future development and awareness of the development of a situation. Since the situations handled by Command and Control systems develop by actions performed by opposing agents, pure probabilistic or evidential techniques are not quite sufficient tools for prediction. Game theoretic tools can give an improved appreciation of the real uncertainty in this prediction task, and also be a tool in the planning process. We review recent developments in game theory and apply them in a decision support tool for Command and Control situation awareness enhancements.

Prediction of future courses of events is a necessary ingredient in tomorrow's command and control centers. This is being identified in higher levels of, e.g., the JDL model where awareness of the development of a situation is crucial for providing a complete and comprehensible situation picture. To cope with gaming situations, i.e., situations where commanders make decisions based on other commanders' reasoning about one's own reasoning, traditional AI methods for inference need to be extended with algorithms stemming from game theory. In this article, we formalize the ideas of an information fusion "game component". Also, we review current state of the art when it comes to computational game theory and discuss the time constraints from an information fusion perspective along with a discussion regarding the solution/equilibrium selection problem. Furthermore, results from computer simulations and analysis of computational bottlenecks are presented.

Recent experimental studies have explored how well adaptive honeypot allocation strategies defend against human adversaries. As the experimental subjects were drawn from an unknown, nondescript pool of subjects using Amazon Mechanical Turk, the relevance to defense against real-world adversaries is unclear. The present study reproduces the experiments with more relevant experimental subjects. The results suggest that the strategies considered are less effective against attackers from the current population. In particular, their ability to predict the next attack decreased steadily over time, that is, the human subjects from this population learned to attack less and less predictably.

Modern command and control systems present the current view of the situationthrough a situation picture that is being built up from fused sensor data. However,merely presenting a comprehensible description of the situation does not give thecommander complete awareness of the development of a situation. This articlepresents a generic tool for prediction of forthcoming troop movements. The techniqueis similar to particle filtering, a method used for approximate inference indynamic Bayesian networks.The prediction tool has been implemented and installed into an existent electronicwarfare system. The tool makes use of the system’s geographic informationsystem to extract geographic properties and calculate troop velocities in the terrainwhich is, in turn, being used for the construction of the tool’s transition model.Finally, the result is presented together with the situation picture.The prediction tool has been evaluated in field tests performed in cooperationwith the Swedish Armed Forces in an exercise in Sweden during the spring of2005. Officers and operators of the electronic warfare system were interviewedand exposed to the tool. Reactions were positive and prediction of future troopmovements was considered to be interesting for short-term tactical command andcontrol.

In order to be able to successfully defend an IT system it is useful to have an accurate appreciation of the cyber threat that goes beyond stereotypes. To effectively counter potentially decisive and skilled attackers it is necessary to understand, or at least model, their behavior. Although the real motives for untraceable anonymous attackers will remain a mystery, a thorough understanding of their observable actions can still help to create well-founded attacker profiles that can be used to design effective countermeasures and in other ways enhance cyber defense efforts. In recent work empirically founded attacker profiles, so-called attacker personas, have been used to assess the overall threat situation for an organization. In this paper we elaborate on 1) the use of attacker personas as a technique for attacker profiling, 2) the design of tailor-made cyber defense exercises for the purpose of obtaining the necessary empirical data for the construction of such attacker personas, and 3) how attacker personas can be used for enhancing the situational awareness within the cyber domain. The paper concludes by discussing the possibilities and limitations of using cyber defense exercises for data gathering, and what can and cannot be studied in such exercises.

In the cyber security landscape, the human ability to comprehend and adapt to existing and emerging threats is crucial. Not only technical solutions, but also the operator’s ability to grasp the complexities of the threats affect the level of success or failure that is achieved in cyber defence. In this paper we discuss the general concept of situation awareness and associated measurement techniques. Further, we describe the cyber domain and how it differs from other domains, and show how predictive knowledge can help improve cyber defence. We discuss how selected existing models and measurement techniques for situation awareness can be adapted and applied in the cyber domain to measure actual levels of cyber situation awareness. We identify generic relevant criteria and other factors to consider, and propose a methodology to set up cyber situation awareness measurement experiments within the context of simulated cyber defence exercises. Such experiments can be used to test the viability of different cyber solutions. A number of concrete possible experiments are also suggested.

Social media has become an integrated part of human communication, both as a means to establish and maintain social relationships, and as a means of sharing and co-creating information. Social media comes with an array of possibilities for individuals as well as organizations, corporations, and authorities. Within the field of crisis communication, social media possibilities such as online sharing and social networking have had an impact on the way crisis information is disseminated and updated. This paper addresses the issues related to using social media for communicating crisis information and broadcasting alert messages to the general population, discusses the role of social media in future pan-European crisis alerting, and presents a prototype system demonstrating the possibilities. An extensive systematic literature review was carried out to identify factors that affect the use of social media for alerting and warning. These factors were mirrored in experiences, collected through interviews, obtained by emergency management organizations in three European countries (Sweden, Czech Republic, and Spain). The factors finally form the basis for suggestions and recommendations regarding the design of technological tools for both communication and information collection to serve as an integral part of a future pan-European crisis alerting system.

Decision help and decision analysis are tools that will be of importance indecision support systems. They are likely to exist both in real operationalsystems and in simulation based systems used for training. In command andcontrol an example of a decision task is to command units in a geographicalenvironment. We have taken a closer look at this type of decision task, usinga simulated microworld as a research tool. In particular we are interested inthe case when the decision maker already has selected a course of action,but wants to have critique and suggestions of improvements. To analyze adecision where the “main direction” is already known in this way we denotedecision analysis, as opposed to decision help.An algorithm for decision analysis in maps has been developed. Thisalgorithm is based on rules. An implementation in Java with classes suitedfor reuse has been developed. The implementation has been tested in a microworldsystem, C3FIRE, suited for practice in forest fire fighting.

Lone wolf terrorists pose a large threat to modern society. The current ability to identify and stop these kind of terrorists before they commit a terror act is limited since they are very hard to detect using traditional methods. However, these individuals often make use of Internet to spread their beliefs and opinions, and to obtain information and knowledge to plan an attack. Therefore, there is a good possibility that they leave digital traces in the form of weak signals that can be gathered, fused, and analyzed.

In this work we present an analysis method that can be used to analyze extremist forums to profile possible lone wolf terrorists. This method is conceptually demonstrated using the FOI Impactorium fusion platform. We also present a number of different technologies that can be used to harvest and analyze information from Internet, serving as weak digital traces that can be fused using the suggested analysis method, in order to discover possible lone wolf terrorists.

In this paper, we describe preliminary work on a toolbox aiming to help analysts involved in the intelligence production process. Intelligence analysts are overwhelmed by information, both in the form of sensory data, text stemming from human observations and other sources. In order to make sense of this information and to produce the intelligence reports needed by decision-makers, assisting computer tools are needed. We briefly describe parts of the intelligence process and touch upon the subject of what parts can and cannot be automated. A tool for tagging information semantically that we are currently working on is described, and ideas for two other tools are briefly outlined.

In the tasks facing the armed forces today there is a need for new and improved intelligence analysis tools. The opponents no longer follow strict doctrines that determine their behavior and force-composition. Several different opposing groups must be taken into account, some of which will appear to act friendly towards us. In this paper, we describe a vision for how various information fusion tools can be used to help intelligence analysts and decision-makers achieve situation awareness. We consider intelligence work and propose an analyst-centric toolbox aiming to help analysts involved in the intelligence production process to prepare suitable reports. Intelligence analysts are overwhelmed by information, both in the form of sensory data, text stemming from human observations and other sources. We describe parts of the intelligence process and touch upon the subject of what parts can and cannot be automated. The toolbox is outlined by describing a number of possible tools, e.g., semantic information tagging, a threat model construction assistant, a situation picture construction assistant, social network visualization, a game-theoretic reasoning engine, etc. Some of the tools described have been implemented as concept prototypes whereas others are the subject of ongoing research.

Describing social positions and roles is an important topic within social network analysis. One approach is to compute a suitable equivalence relation on the nodes of the target network. One relation that is often used for this purpose is regular equivalence, or bisimulation, as it is known within the field of computer science. In this paper we consider a relation from computer science called simulation relation. Simulation creates a partial order on the set of actors in a network and we can use this order to identify actors that have characteristic properties. The simulation relation can also be used to compute simulation equivalence which is a less restrictive equivalence relation than regular equivalence but is still computable in polynomial time. This paper primarily considers weighted directed networks and we present definitions of both weighted simulation equivalence and weighted regular equivalence. Weighted networks can be used to model a number of network domains, including information flow, trust propagation, and communication channels. Many of these domains have applications within homeland security and in the military, where one wants to survey and elicit key roles within an organization. Identifying social positions can be difficult when the target organization lacks a formal structure or is partially hidden.

An ocean of data is available on the web. From this ocean of data, information can in theory be extracted and used by analysts for detecting emergent trends. However, to do this manually is a daunting and nearly impossible task. We describe an implemented semi-automatic system in which data is automatically collected from selected sources, and to which linguistic analysis is applied to extract, e.g., entities and events. The extracted information is automatically transformed into OSINT reports which are clustered and visualized. The user can interact with the system in order to obtain a better awareness of historic as well as emergent trends.