Complex adaptive systems

The theme of this book is that biological concepts are more useful than the physics toolbox when examining cyber risk. John Foster, in a paper published in the Cambridge Journal of Economics in 2005 (Vol 29, 873–892), developed a scheme for describing orders of complexity which has four levels.

In the hierarchy he sets out, physics and biology are just the first two steps in a sequence which then extends into psychology and economics. We will be using concepts from those two disciplines later (see views 17, 23, and 24) but for now here are the four levels of complexity described in his paper:

First order complex systems: These are systems with purely physical components. A tornado, for example, is a complex structure that requires sophisticated non-linear mathematics to model its flow.

A supercomputer can crunch the numbers in a natural catastrophe model to estimate the damage caused when a tornado hits a set of buildings in a specific place. But the tornado and the buildings are both physical structures, so this problem is only of first order complexity.

Second order complex systems: Second order complexity shifts from the physical to the biological realm. In these systems, there is the extra element of adaptation as Darwinian evolution becomes a factor. So, a tornado will not become stronger as a result of buildings becoming stronger, but a cheetah will evolve to run faster in pursuit of antelope on the savannah.

Third order complex systems: Third order complex systems are one step more adaptive, as they involve creativity rather than just natural selection. The adaptation is directed by an intelligence that actively tries to change the environment to benefit itself.

Humans first using tools marked a transition point from second order to third order complexity. Second order systems progress under the influence of feedback loops. In third order systems, there is a feedforward effect too: an ability to actively create a different future by design.

Fourth order complex systems: In fourth order systems, there are two intelligences rather than one. The environment is one of anticipatory change.

The protagonist and the opponent are trying to predict the other’s moves before they have even happened and retaliating in advance.

All markets are fourth order complex, where the secret to success is not to figure out what something is worth but how your opponent will value it. You are not judging a beauty contest; you are judging the judges of a beauty contest.

The cyber realm is also fourth order complex, with hackers anticipating defensive responses and vice versa. So, the key difference between cyber risk and natural catastrophe risk is that the former is fourth order complex while the latter is only first order complex.

See 17 The Laffer curve See 23 Psychology: the human firewall and the rogue insider See 24 The tragedy of the commons