The CARVER Technique

[Music] thank you [Music] if you were trying to be a more prepared citizen in today's unique and challenging world you might notice that our society is full of vulnerabilities from cyber attacks to social violence and every false flag attack in between at least one thing is certain in this world if the good guys don't identify our own vulnerabilities the bad guys certainly will so we take steps to move in the right direction and we learn a lot of new stuff intelligence preparation of the battle space is a huge step in the right direction same thing with terrain analysis and other topics we've covered before but you might get to a point where you say okay I've identified the places and Facilities that are vulnerable what do I do next one answer to that is the Carver process also called the Carver technique or the Carver Matrix this is a structured analytical technique to identify categorize and narrow down the specific details of how an attack might be carried out against you in short it's a very helpful way for you to identify the targets that an adversary might attack this process this was originally created by the office of strategic services for use by French Resistance Fighters during World War II and saw extensive use in Southeast Asia by Mac V sogg during the Vietnam war more recently this process saw a lot of use in Iraq and Syria as a way of prioritizing Targets in the war against the Islamic State so what is the Carver technique and how does it work well let's tackle the acronym first Carver stands for criticality accessibility recuperability vulnerability effect and recognizability by thinking about these criteria we can calculate the value of various targets and the statistical likelihood of success based on the resources that we have think of it as combat statistics if we flip open our handy dandy intelligence publication in this case ATP 2-33.4 we can flip to the page on matrices using a matrix is one common analytical technique used to gain insight about something by putting variables in basically a chart to compare them more easily the Carver method is just one type of Matrix to use the Carver method we can draw a chart putting the various Carver criteria along the top then we start listing various potential targets along the side we then go down the list giving a numerical value to each of the factors along the top usually we rank things on a scale of one to five with one being the least significant or impacting and five being the most worst case scenario if you are not comfortable with giving things a numerical value just arbitrarily or if you get stuck trying to decide between giving something a three or a 4 or something like that you can use this chart to help you decide what number to give each factor this ensures consistency along the entire process so that everything is ranked the way that it should be once you dish out your rankings filling out the chart completely we add them all together row by row the row that has the highest number is the Target that has the highest Carver ranking therefore it's the one that you should probably give the most attention too it's the one that's most likely to be attacked the most devastating things would happen if it were attacked and it's just a summation of all of these factors put together now you might have noticed that we are speaking about the Carver technique in defensive terms this process can be used in an offensive role as well but it's not nearly as helpful from that angle in my opinion yes the Carver technique can help you narrow down a list of targets to one but at that point you've had to identify the Targets in the first place so you really aren't gaining that much if a bad actor were looking to use this process offensively they have to collect and analyze so much intelligence just to get to the point where they can fill out this chart accurately and if they're going to do that they're most likely just going to go for it at that point using their gut feelings more than a mathematical process for the last minute before an attack for a bad guy on the outside of this process it's not going to be easy to conduct this analysis because the vulnerabilities of a Target are usually hidden so a bad actor would not really know what ranking to give each factor right so by the time a bad guy actually figures out what a vulnerability is this process isn't that beneficial but defensively where you know your own stuff and you have your own data this is where the cover process really shines in a defensive role or in the hands of a prepared and responsible citizenry of good guys the Carver process can be a handy tool for using math to predict what targets an adversary might go for the risk associated with each option and most importantly what potential targets are worth defending and how the Carver process supplements other analytical work as well since the last step in the process is recognizability we can use the Carver process to identify deception opportunities tricking our adversary and influencing them to go for the wrong target if they recognize a Target as being more vulnerable than it really is well they might give it the wrong rating and that might skew all of their results right hopefully with this example we can see how fluid the intelligence world really is is the Carver process can be a part of ipb or it can be the result of it likewise it can be a part of a targeting cycle or it can be the end result something that we do after all of the analysis is already more or less done this technique can even flow into deception and camouflage operations and even factor into our own risk management practices and since this process is an attempt to assign numerical values to fluid ideas it can factor into any number of other analytical techniques as well now we can clearly see the benefits of the Carver technique but in what situations does it fail or it doesn't really work that well for one this process does help identify targets but you really have to have a general idea of what targets are in the battle space already so you have to do some level of ipb first even if it's informal or you don't really think about it you have to have some data to compute there has to be something to go on the chart also when time is of the essence the cover process might get skipped over in favor of instincts but when we have the time to do the math it's quite helpful remember the Carver technique is a statistical process and in many cases it's the statistical outlier that kills you so be aware that the difference between a three or a 4 on your notepad might mean the difference between a Target getting beefed up security and not this is because the Carver process can lead you to very similar results the whole process is supposed to allow you to take a list of targets and narrow it down to the ones that need protection the most so if you can only protect three out of the 10 targets well you put the protection at the three targets and have the highest Carver Factor but you can get to a point that you do the math and find out that they all need protection so you went through a lot of effort just to end right back up where you started and that's the way of the Intel World sometimes which is not necessarily A Bad Thing remember the Carver technique is a process it's just one tool in the toolbox and can never replace the common sense of the analyst nor should should it it's meant to help the analyst by statistically giving an idea of risk despite what it's intended to be this process is a Rough Guide it is not a complete end-all solution many times I will look at my own work and think okay this target has the highest Carver score but this target over here is way more vulnerable and has a lot more other important factors going on or factors that I can't really put in the carver process chart so this one over here gets the defensive priority even if it didn't have the highest car for score personally I also use this technique when trying to rack and stack intelligence priorities the targets to get a higher score get more of my analytical attention I also tend to use this at different parts of the ipb process just as a sort of Sanity check along the way it's also quick and easy to do in the field so if you've got a few minutes of downtime you can use this technique to constantly evaluate and confirm what you already know about your own vulnerabilities like I mentioned it is really hard to use this method with any accuracy in an offensive role without conduct lifting a whole lot of analysis which makes this process kind of redundant and irrelevant but if you have the data because you know your own infrastructure this technique can be very helpful for allocating your scarce resources for defense so that's pretty much it another analytical tool that helps with ipb and terrain analysis and serves as a pretty good way to figure out what your biggest vulnerabilities are very helpful if you are trying to fight in the shade don't worry the working ways no need to hurry [Music]