We are engaged in an exponentially growing cyber war that we are visibly losing. Within the next 3 years it has been estimated that the global cost will equal, or overtake, the UK GDP, and it is clear that our defences are inadequate and often ineffective. Malware and ransomer-ware continue to extort more money, and cause damage and inconvenience to individuals, organisations and society, whilst hacker groups, criminals and rogue states continue to innovate and maintain their advantage. At the same time, our defences are subverted and rendered ineffective as we operate in a reactive and prescriptive, after the fact, mode with no foresight or anticipation. In any war it is essential to know and understand as much about the enemy as possible, it is also necessary to establish the truth and validity of any situation or development. Doing this in the cyber domain is orders of magnitude more difficult than the real world, but some of the relevant tools are now available or at an advanced stage of development. For example; fully automated fact checkers and truth engines have been demonstrated, whilst situational awareness technologies are commercially available. However, what is missing is some level of context assessment on a continual basis. Without this we will continue to be ‘blind-sided’ by the actions and developments of the attackers as they maintain their element of surprise along every line of innovation. What do we need? In short ; a Context Engine that continually monitors networks, servers, routers, machines, devices and people for anomalous behaviours that flag pending attacks as behavioural deviations that are generally easy to detect. In the case of attacker groups we have observed precursor events and trends in network activity days ahead of some big offensive. However, this requires a shift in the defenders thinking and operations away for the reactive and short term, to the long term continual monitoring, data collection and analysis in order to establish threat assessments on a real time. The behavioural analysis of people, networks and ITC, is at the core of our ‘Context Engine’ solution which completes the triangle of: Truth; Situation; Context Awareness to provide defenders with a fuller and transformative picture. Most of the known precursor elements of this undertaken have been studied in some depth, with some behavioural elements identified on real networks and some physical situations. The unknown can only add more accuracy!

1. T r u t h
Situation
Context
Awareness
P r o f P e t e r C o c h r a n e O B E
w w w. p e t e r c o c h r a n e . c o m

2. Russian submarine Captain, Marko Ramius, is planning
to defect with all his officers, and to gift The Red October
to the US in order to prevent a nuclear war
SUB-PLOT: He lost his wife due to the medical negligence of a doctor who
was excused and the communist party simply because he was the son of
an important soviet political officer
Ever since, Marko blamed the government and spent
his time at sea while scheming about defecting
T r u t h
S i t u a t i o n
C o n t e x t
R E A L I T Y D R A M A T I S E D
H u n t f o r t h e R e d O c t o b e r ( 1 9 9 0 )
Tom Clancy Novel - Thought to be
Based on the “Mutiny on the
Storozhevoy”

3. D e at h & D i s a s t e r
W h e r e d o t h e y c o m e f r o m ?
- From a direction you are not looking
- By a mechanism you didn’t anticipate
- At a time that is really damn inconvenient!
B U T :
I f w e k n e w t h e t r u t h
I f w e u n d e r s t o o d t h e s i t u a t i o n
I f w e c o u l d s e e t h e f u l l c o n t e x t
M i g h t w e a v o i d a p e n d i n g c a t a c l y s m ?

4. “Sometimes your greatest strength can emerge as a weakness
if the context changes”
Harsha Bhogle
“I do not fear truth. I welcome it.
But I wish all of my facts to be in their proper context”
Gordon B. Hinckley
TRUTH, SITUATION, CONTEX
A l l n e c e s s a r y f o r a s u r e d e c i s i o n

5. When uncertainty prevails
W e t h e n r e l y o n i n s t i n c t & e x p e r i e n c e
“Information is the resolution of uncertainty”
Claude Shannon (Founder of information theory 1946)
“What we observe is not nature
itself, but nature exposed to our
method of questioning”
Werner Heisenberg

6. Captain, Marko Ramius and his o
ffi
cers are planning to
defect and gift The Red October to the US to prevent a
nuclear war.
As they leave port and submerge
only Ramius knows the exact
the precise
the full

7. T r u t h
S i t u a t i o n
C o n t e x t
P e n t a g o n B r i e f i n g
D a n g e r o u s l a c k o f u n d e r s t a n d i n g
J a c k R y a n ( A n a l y s t ) b r i e f s T h e J o i n t
C h i e f s t h a t T h e R e d O c t o b e r h a d s a i l e d
o u t o f h a r b o u r a n d s h o r t l y a f t e r > 5 0
R u s s i a n s u b m a r i n e s l e f t p o r t a t s p e e d
h e a d i n g o u t i n t o t h e N o r t h A t l a n t i c . I n
a d d i t i o n s o m e 2 8 s u r f a c e s h i p s h a d b e e n
o b s e r v e d t o b e f i r i n g u p t h e i r e n g i n e s i n
p r e p a r a t i o n t o s a i l .
N o c o n c l u s i o n s c o u l d b e
d r a w n , b u t t h e t r u t h a n d
s i t u a t i o n a r e a c c u r a t e l y
d e t e r m i n e d , w h i l s t t h e r e i s
n o c o n t e x t d a t a !

8. P e n ta g o n B r i e f i n g
J a c k R y a n h a s a n e p i p h a n y
T r u t h
S i t u a t i o n
C o n t e x t
L a t e r d u r i n g t h e s a m e g a t h e r i n g J a c k c o m e s u p w i t h a n
a l t e r n a t i v e t o a n a l l o u t a t t a c k o r s o m e f o r m o f m i l i t a r y
a g g r e s s i o n . H e p o s i t s t h a t R a m i u s m i g h t j u s t b e t r y i n g t o
d e f e c t .
T h i s i s c o n s i d e r e d a b s u r d
b y o n e o f t h e g e n e r a l s a n d
t r e a t e d w i t h d e r i s i o n .
H o w e v e r , J a c k h a s m e t
R a m i u s a n d s t u d i e d h i m i n
d e p t h - a n d h e h a s p l a n t e d
a m e m e t h a t h a p p e n s t o
b e c o r r e c t a n d t h e b a s i s
f o r a d i f f e r e n t s t r a t e g y &
c o u r s e o f a c t i o n .

9. R U S S I A N S U B T e r F U G E
T r y i n g t o d e s t r o y R e d O c t o b e r
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T h e R u s s i a n a m b a s s a d o r
a p p r o a c h e s h i s U S c o u n t e r p a r t
t o s u g g e s t t h a t R a m i u s h a s g o n e
r o g u e a n d t h e y n e e d U S h e l p t o
h u n t a n d d e s t r o y T h e R e d
O c t o b e r.
T h i s i s n o t t r u e a n d t h e R u s s i a n
d o n o t k n o w w h a t t h e s i t u a t i o n i s ,
b u t t h e y d o h a v e a h e a d s u p o n
t h e c o n t e x t a s R a m i u s n o t i f i e d
t h e m a n d d e c l a r e d h i s i n t e n t !
T h e U S a m b a s s a d o r k n o w s
t h i s i s a l l a l i e a n d s t a r t s
t o t h i n k t h a t J a c k m a y b e
r i g h t , a n d h e p l a y s a l o n g t o
t r y a n d g a i n m o r e i n s i g h t s .
S o h e h a s a g o o d i d e a w h a t
t h e t r u t h m i g h t b e , a n d t h e
s i t u a t i o n i s v e r y c l e a r, b u t
t h e c o n t e x t i s i n c o m p l e t e …

10. T r u t h
S i t u a t i o n
C o n t e x t
M e a n w h i l e A T S E A
A d a n g e r o u s c o n f l i c t u n f o l d s
H e h a s t h e R e d O c t o b e r - a p e r c e i v e d
t h r e a t - i n h i s s i g h t s a n d d e t e r m i n e s
t o a t t a c k w i t h o u t a f u l l p i c t u r e a n d
u n d e r s t a n d i n g … . b u t
J a c k R y a n i s n o w o n
b o a r d …
T h i s U S h u n t e r - k i l l e r s u b m a r i n e
c o m m a n d e r h a s a c l e a r m i s s i o n & m a n d a t e :
1 ) To p r o t e c t h i s v e s s e l & c r e w
2 ) To p r o t e c t t h e U S A
3 ) To a c t w i t h a u t o n o m y i n p u r s u i t o f 1 & 2

11. T H E B I G G E R P I C T U R E
P u b l i s h e d e v i d e n c e o f > 1 5 n e a r m i s s e s
“ I n c o m p l e t e o r w r o n g i n f o r m a t i o n , c o m m u n i c a t i o n &
p r o t o c o l f a i l s , h u m a n a n d m a c h i n e e r r o r s , a c c i d e n t s a n d
f r e a k c o n d i t i o n s h a v e s e e n n e a r m i s s e s f o r t u n a t e l y a v e r t e d
b y t h e a c t i o n s o f o n e o r t w o t h i n k i n g h u m a n s ”

12. T H E B I G G E R P I C T U R E
P u b l i s h e d e v i d e n c e o f > 1 5 n e a r m i s s e s
“ I n c o m p l e t e o r w r o n g i n f o r m a t i o n , c o m m u n i c a t i o n &
p r o t o c o l f a i l s , h u m a n a n d m a c h i n e e r r o r s , a c c i d e n t s a n d
f r e a k c o n d i t i o n s h a v e s e e n n e a r m i s s e s f o r t u n a t e l y a v e r t e d
b y t h e a c t i o n s o f o n e o r t w o t h i n k i n g h u m a n s ”
W
e
a r e
h e r e
t o d a y
n o t
b y
d e s i g n
b u t
b y
a n
e x t r a o r d i n a r y
r u n
o f
g o o d
l u c k
T H E
L I K E L I H O O D
O F
A
C A T A S T R O P h E
A C C E L E R A T E S
a s
c o m
p l e x i t y
g r o w
s
S O O N E R
O R
L A T E R
A
h U M
A N / M
A C H I N E
M
I S T A K E
O R
a
M
A D M
A N
W
I L L
l i k e l y
s e e
G L O B A L
c a r n a g e

13. Cyber-Info War
Nuclear-Warfare
Bio-Chemical Warfare
W a r f a r e
The wider perspective
Scale of Potential Devastation
Potential Depth
of Penetration
Geographical
Metaphysical
Technological
Psychological
Ecological
Biological
Physical
Virtual
Real
Total
Extinction
Trigger
Event
Catalyst
Land Sea Air Space Cyber Information

14. Cyber-Info War
Nuclear-Warfare
Bio-Chemical Warfare
W a r f a r e
The wider perspective
Scale of Potential Devastation
Potential Depth
of Penetration
Geographical
Metaphysical
Technological
Psychological
Ecological
Biological
Physical
Virtual
Real
Total
Extinction
Trigger
Event
Catalyst
Land Sea Air Space Cyber Information
THERE IS ONLY WAR
AND EVERY DOMAIN
IS INTERCONNECTED
GOVERNMENTS CAN NO
LONGER DEFEND
THEIR POPULATIONS

15. C O M P L E X I T Y
G r o w i n g C h a l l e n g e

16. C O M P L E X I T Y
G r o w i n g C h a l l e n g e
COMPLEXITY AND
SPEED OF CHANGE NOW
WAY BEYOND HUMAN
CAPABILITIES
TEAMS OF NETWORKED
PEOPLE CANNOT SOLVE
THE PROBLEMS IN THE
TIME AVAILABLE
DISTRIBUTED DATA
AND COGNITIVE BIAS
OF INDIVIDUALS IS
DISABLING

17. T
r
u
t
h
S
i
t
u
a
t
i
o
n
C
o
n
t
e
x
t
T
r u
t h
S
i t u
a
t i o
C
o
n
t e
T
r
u
t h
S
i t u
a
t i o
n
C
o
n
t e
x
T r u t h
S i t u a t i o n
C
o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T
r u
t h
S
i t u
a
t i o
n
C
o
n
t e
x
t
T r u t h
S i t u a t i o n
C
o n t e x t
T r i u m v i r at e o f r i s k
T h e t e c h n o l o g i e s a r e t o h a n d
TRUTH
S
I
T
U
A
T
I
O
N
A
W
A
R
E
N
E
S
S
C
O
N
T
E
X
T
A
W
A
R
E
N
E
S
S
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t
T r u t h
S i t u a t i o n
C o n t e x t

18. A T R U T H E N G I N E
D e m o n s t r a t e d e l e m e n t s
“We have a complete design and encouraging
demonstrations with rapidly engineered AI
combined with manual computations”

19. S I T U A T I O N
A W A R E N E SS
A t w h a t e f f i c a c y ?
C o m m e r c i a l l y
a v a i l a b l e f o r
d e f e n c e , g o v
s e r v i c e s ,
i n d u s t r y

20. C O N T E X T
A W A R E N E SS
M o s t l y l a c k i n g
“ B U T w e h a v e a v i s i o n /
d e s i g n w i t h m u c h o f t h e
t e c h t o h a n d t o e n g i n e e r
a n a u t o m a t e d s o l u t i o n ”

21. B E H A V I O U R A L
A N A L Y S I S
P o w e r f u l / i m m a t u r e
N o r m a l d a i l y
o p e r a t i o n
A b n o r m a l
r e q u i r e s
i n v e s t i g a t i o n
S n o w d e n
a t w o r k
S t r a n g e
w i r e l e s s
a c t i v i t y

22. B E H A V I O U R A L
A N A L Y S I S
P o w e r f u l / i m m a t u r e
N o r m a l d a i l y
o p e r a t i o n
A b n o r m a l
r e q u i r e s
i n v e s t i g a t i o n
S n o w d e n
a t w o r k
S t r a n g e
w i r e l e s s
a c t i v i t y
PEOPLE, MACHINES,
DEVICES, THINGS,
NETS ARE HABITUAL
DEVIATIONS FURNISH
INDICATORS &
CLUES
AHEAD OF ACTIONS

23. S O L U T I O N S P A C E
T r u t h , S i t u a t i o n & C o n t e x t
Deep observation & analysis gives a fuller picture of what has/is happen(ed/ing)
Adding the wider context to models reveals potential unknowns & contingencies
Constantly computing the likely outcomes and adjusting with actuality…

24. S O L U T I O N S P A C E
T r u t h , S i t u a t i o n & C o n t e x t
Deep observation & analysis gives a fuller picture of what has/is happen(ed/ing)
Adding the wider context to models reveals potential unknowns & contingencies
Constantly computing the likely outcomes and adjusting with actuality…
NORROW SITUATIONAL
MODELLING
IS NOT
ENOUGH
THERE ARE NO SIMPLE
/SINGULAR SOLUTIONS
TO COMLEX PROBLEMS
INTEGRATING
DATA
INFO, EXPERIENCE
[{AIS} NOW ESSENTIAL
HUMAN &
MACHINE
COGNATIVE BIAS
MUST BE MINIMISED

25. M O R E M E C H A N I S M S
N a t u r a l , M a n - M a d e , S p u r i o u s
ARTIFICIAL (Mankind)
Global Warming
Pollution
Weather
Eco-Fail
War
NATURAL
Astronomical
Geological
Ecological
Biological
Climatic
“None of this is linear or isolated - it all an
unpredictable & combinatorial threat landscape of
irreversible hits that in
fl
ict a dent in the well being and
survivability of future generations”
“No biological entity can
survive in it’s own waste
material”
“Reversing global
warming will not
see the climate
go back to a
1950s state.
it will go to
some new
stability
point”

26. S I M P L E M I S T A K E S
A R E A N O T H E R M A T T E R

27. Thank Y
o
https://petercochrane.com