For those who want to do some forecasting of high uncertainty events, we’ve added a new page for software. Free software, too.

## Archive for OSInt

The title says it all. We’re going to try to give a meaningful probability of the Turks imposing a No Fly zone for the Syrian Air Force over part or all of Syria.

Now usually, when people here the word statistics, they seek out the nearest bathroom and try to hang themselves. But hold on, my curious friend, this is going to be an interesting trip…

## Methodology

- Research and gather OSInt (open source intelligence) which are indicators (events that tend to hint) of Turkey imposing a No-Fly zone
- Outline the possible indicators with probability of happening before a No-Fly zone is imposed, and happening anyway. This is normally done by an analyst with expert knowledge, but I’ll take a crack at it.
- Line out givens, such as the starting probability.
- Use Bayesian math to quantify expert opinion into stats

## Research

### Factors

Shallow and Deep Web research pulls up these current factors-

- Syria shot down a Turk jet fighter over international airspace. Turkey called for UN condemnation: P(e|h) = 0.80 & P(e|nh)=.85
- Turkish Popular support at home is against conflict with Syria: P(e|h) = 0.2 & P(e|nh)=0.2 (not an indicator)
- Turkey army placed on high alert 10/11 after imposing a commercial no fly zone over syria: P(e|h) = .70 & P(e|nh)=.50
- Syria closes its airspace to Turkish flights. 10/13: P(e|h) = .80 & P(e|nh)=.40
- Syria shelled a little into Turkey, the Turks didn’t take kindly to it and shelled back heavily.: P(e|h) = .85 & P(e|nh)=.80
- Military sources in Ankara also disclosed that at least 25 F16 fighter jets had been transferred to the Diyarbakir air base near the Syrian border. (Debkafile): P(e|h) = .85 & P(e|nh)=.65
- The Turks intercept a civi airliner from Moscow to Damascus based on intel there was military contraband onboard. Tensions heated up with the Russians and increase probability Russia may take action against Turkey. P(e|h) = .80 & P(e|nh)=.50

After each item item I have 2 numbers – P(e|h) = the event happens given Turkey plans a no flight zone & P(e|nh) that the event happens given Turkey does not plan a no-fly zone

Factoring all of these into an intuitive estimate I currently give the estimate to be a 40% probability of Turkey imposing a military no fly zone for the Syrian AF in the next 60 days. This is just a gut instinct number. We’ll compare it to real math later.

I’ve also got to be careful not to fall under the intel analyst fallacy of ‘recency’ which is to overweight recent evidence like the civil air no-fly ban. Which I really really think should be heavily weighed.

Again, this part is where an good analysts expert opinion really helps the accuracy. I’m not an intel analysis, I just play one on TV.

## Hypotheses

>> What we seek! –

P(h|e)The probability that h (our hypothesis) is true GIVEN (the | means ‘given’) that the evidence/event has happened.

P(h)= That probability the Turks will impose a no fly zone on the Syrian AF in the next 90 days.

P(e)= The probability that the event/evidence would happen whether the hypothesis is true or not.

P(e|h)= The probability that the evidence would happen given the hypothesis is true.

I’m going to put my neck out on a limb and put down an estimate of P(h) of the probability Turkey would make a no fly zone in any conflict. This is without knowing any current events, just that a conflict is underway. If I had time, I’d go back and research all conflicts Turkey has fought since 1960. Then basically count the times it has done a no-fly zone divided by conflicts fought. In this case, I’ll just throw down 10% as a SWAG. Thus P(h)=0.10

## Using Bayesian statistics for Prediction

Basic Bayes theorem is

P(h|e)= (P(h) * P(e|h)) / P(e)

For prediction purposes and ease of use, the intel community has reordered the thing for easy updating to:

**P(h|e)/P(nh|e)=[P(h)/P(nh) x P(e|h)/P(e|nh)]**

and replace the awkward equation with symbols to get

**R = P x L**

So P is merely **P(h)/P(nh)** = 0.1/ (1-0.1) = 0.1111

Just to be clear here, my estimation of a no fly during a conflict without any events is a swag of 0.1 — therefore the P(nh) is (1-0.1)=0.9 because they either DO impose a no-fly or they DON’T. It has to add up to 1.0.

where L=** P(e|h)/P(e|nh) ** which, as you notice is a ratio (Called the Likelihood). And you may notice that those numbers are estimated up top under my section called **Factors**.

Now here we go. I’m going to compute all the ratios under the section **Factors **in order from #1 – #7

**0.8/0.85 x 0.2/0.2 x 0.7/0.5 x 0.8/0.4 x 0.85/0.8 x 0.85/0.65 x 0.8/0.5 = 5.858**

So back to **R = P x L**

R = 0.1111 x 5.858

R = 0.6508

Remember R = **P(h|e)/P(nh|e) **is just a ratio aka **Odds**. This is saying there is a ~2/3:1 chance that Turkey will put the kabosh on Assad.

So don’t think this is a percentage aka 65%. Nope, that is wrong. The answer could just as easy been 2.23 and you can’t say 223% (not only a no-fly zone over Syria but Iran, too!). Therefore, we must convert to a percentage

Percentage = odds/ (odds +1)

= 0.6508/(0.6508 +1)

= 39.4233 % and to compensate for significant figures (we’re making guesses, duh) we round to 1 decimal.

**= 40 %** chance that Turkey will impose a no-fly zone inside Syria on Syria’s air force. Take note that my intuitive estimate was 40% so it passed my reality check. But the cool thing here, is analyst can argue not about the final number, but the **P(e|h) & P(e|nh)** given to each factor. It becomes a sort of accounting and audit method for predictions.

The cool thing about Bayes, is if more Factors come to light we can update our Ratio.

So, I reach out to all interested parties. If you think we should change some of our probabilities on the Factors, then put a comment below. If a new factor arises, post your **P(e|h) & P(e|nh)** for that factor.

+++++++++++++++

## Update 16OCT12, yet again

I’ve been give lots of feedback to take in new factors. Main flaw is that I have ignored negative factors, so I will update my Likelihood factor.

Last left at L=**5.858**

### Additional Factors

- Syrian Air Defences are superior and will require neutralizing: P(e|h) = .20 & P(e|nh)=.40
- Political Will by Turkey to get involved in Syria : P(e|h) = .4 & P(e|nh)=.6

new R= 0.11 x 5.858x .12/.4 x .4/.6

R=0.21479

Percentage = .21470/(1+.21479) = 17%

With 1 sig fig it rounds to 20% which I think is more believable.

++++++++++++++++++++

## Update 17OCT12

### New Factors

- Russia has sent Technical Advisers to set up S-300 anti-aircraft missiles to aid Syria and decrease the chances of Turkey or the West will attempt airstrikes or impose no-fly zones. Source is London-based Arabic language
*Al Quds-Al Arabi*, according to News7. P(e|h) = .4 & P(e|nh)=.5 - Russia has installed advanced radar systems at key Syrian military and industrial installations. Radar will also cover as the Incirlik military base in Turkey, from the Syrian side. Same source as above. P(e|h) = .40 & P(e|nh)=.45
- Moscow veiled threat to become involved to protect Syria. Source same as above. Unvetted. For sake of exercise, assumed accurate. The P() on this is more subjective than others. P(e|h) = .8 & P(e|nh)=.85

Last R=0.21479 call it R1

R = R1 x .4/.5 x .4/.45 x .8/.85

= 0.14375

Percentage R/(1+R) = 12.56% and for 1 sig fig becomes…

= 10% chance Turkey will impose no-fly zone on Syria in the next 90 days.

FTR – Now would be a good time to review all the factors and rank the ones that affect R the most to the least. In this way, I could update my percentage of P() to more valid numbers and reduce the bias caused by recency on some events. ie. Syria closing it’s airspace to Turkish flights was given P(e|h) = .80 & P(e|nh)=.40 which I believe now to be too much weight on that event.

Now I see that my original gut instinct was way to high. But this one seems a bit low. However, Bayesian forecasting is proven to be better than the expert who gives the P() for factors. And I am definitely no expert on Syria.

Lots of Video on the 3 sites about InfoSec and Cyber security. Because Video is Deep Web, I’ll include it in the search engine resource page

## Cyber War / InfoSec

Iron Geek irongeek.com — An excellent library of videos explaining many facets of InfoSec and hacking & security

Security Tube – securitytube.net — A large library of videos covering many topics in InfoSec, cyberwar, and most of the hacking conferences.

DefCon — The main hackers Con, so well known that now the Feds send their folks here and it has become a wild west training ground for coming trends. Archives go back to Defcon 1. They are now on Defcon 20, I think.

Although it appears to be designed to help you find a username on any social network site, it can be used as a reverse lookup for a targeted Open Source Intelligence gathering.