The Value of Advance Disruption Information on Transportation Gateways: The Inventory a Warning Replaces

Imagine a busy port, an airport runway, or a railway hub as the throat of a supply chain. Every day, goods flow through these gateways to keep cities fed, factories running, and hospitals stocked. Now imagine a saboteur, perhaps a cyber-attacker, who plans to shut that throat closed. Unlike a hurricane, which gives days of warning, or an earthquake, which offers seconds, a deliberate attack can be detected before it strikes. Intruders leave digital footprints, sensor glitches, or patterns of interference that a monitoring system can spot. But this warning is never perfect. The system might scream "attack" when nothing is happening, or it might stay silent when an attack is already underway. The people in charge of the gateway face a difficult choice: do they act on a warning and spend money to stockpile goods or reroute traffic, only to find out it was a false alarm? Or do they ignore the warning and risk a total shutdown that leaves them with empty shelves and angry customers?

This is the central puzzle James Rappold tackles in his research on the value of advance disruption information. He asks a practical question that port authorities and logistics commanders must answer before buying expensive detection systems: how much is a warning actually worth? The answer depends on three specific numbers that describe any detector: how far in advance it can see the trouble, how often it cries wolf when there is no wolf, and how often it misses a real attack. Rappold builds a mathematical model to calculate the exact economic value of this information, treating the problem as a game of inventory management. He assumes the defender can temporarily increase the flow of goods through the gateway to build up a buffer of stock before a closure, but this "surge" capacity is limited and costly. The goal is to find the sweet spot where the cost of holding extra inventory is balanced against the cost of a backlog when the gateway is closed.

The research reveals that the value of a warning is not a simple "yes or no" proposition; it is a delicate balance of timing and capacity. The study finds that the most effective strategy for a defender is to maintain a baseline level of inventory at all times, just in case the detector misses an attack. When a warning does arrive, the defender should immediately surge to acquire a second, larger layer of inventory, known as a hedge. This hedge is only held if the alarm is real; if the alarm turns out to be false, the defender simply lets the extra stock be consumed by normal demand, accepting the cost of having bought it for nothing. This creates a three-tiered system of inventory: a permanent base, a temporary emergency stock, and a level of stock that is never held because the risk is too low or the cost too high.

One of the most striking findings is that having more time to prepare does not always mean having more value. The research shows that the value of a warning rises as the lead time increases, but only up to a point. Once the warning gives the defender enough time to build the entire emergency stockpile using their limited surge capacity, any extra time adds no further benefit. For a gateway that is already running near its maximum capacity, this "sufficient" lead time can be very long. In fact, a busy gateway might need so much time to build a hedge that no current detector can provide it, meaning the warning is worth less where it is needed most. Conversely, a gateway with plenty of spare capacity can build its hedge quickly, so even a short warning is highly valuable.

The study also identifies a critical threshold for false alarms, a "cry-wolf" point beyond which a warning system becomes useless. If the detector raises false alarms too frequently, the cost of constantly building and then discarding the emergency stockpile outweighs the benefit of avoiding a closure. The research calculates that this threshold is roughly determined by the ratio of the cost of holding inventory to the cost of rushing goods through the gateway. If the detector is too noisy, the defender is better off ignoring it entirely. However, the study notes that even when false alarms are frequent, a tiny amount of value might remain because the warning allows the defender to time their actions more precisely, though this remaining value is small compared to the cost of the errors.

Perhaps the most counterintuitive result concerns the nature of the attack itself. The research suggests that the value of a warning is highest when the duration of a potential closure is unpredictable and potentially long. If a closure is short and predictable, the defender can simply wait it out. But if a closure could last for weeks or months, the ability to prepare in advance becomes critical. The study also highlights that the cost of a backlog—goods that cannot be delivered and must wait—is what drives the entire system. Because unserved demand waits to be fulfilled later rather than vanishing forever, the defender can afford to take risks and build stockpiles. If goods were lost forever the moment the gateway closed, the warning would be far less valuable because the cost of waiting would be infinite.

In a detailed numerical simulation of a single-runway airfield, the researchers tested these concepts against a realistic scenario. They found that a warning system with a four-day lead time could reduce the daily operating costs by about fifteen percent. This saving came almost entirely from holding less inventory on average; the defender no longer needed to keep a massive stockpile sitting idle for months. Instead, they could hold a smaller base level and only add the extra stock when a warning arrived. The simulation confirmed that the value of the warning drops sharply if the false alarm rate rises even slightly. For instance, if the false alarm probability increases from five percent to fifteen percent, the value of the warning system collapses, losing three-quarters of its potential benefit.

The paper concludes that buying a detection system is not just about buying a sensor; it is about buying a specific set of operating characteristics. A buyer should look for a detector that offers a lead time long enough to build the necessary hedge for their specific capacity, and a false alarm rate low enough to keep the cost of preparation manageable. The research provides a clear formula for pricing these systems: a detector is worth buying if the money saved by avoiding backlogs and holding less inventory exceeds the price of the detector itself. The study emphasizes that these calculations do not require knowing the attacker's intentions or strategies. The defender only needs to know their own costs, their own capacity limits, and the historical record of how long closures have lasted in the past. By focusing on these internal factors, a defender can determine exactly how much a warning is worth and avoid paying for a system that is either too slow or too noisy to be useful.