Planning Under Deep Uncertainty: Methods for Multi-Decade Continuity Planning

11. Introduction

Most planning methods assume that the planner can describe the range of possible futures and attach probabilities to them. For many of the decisions the Department faces, neither assumption holds. A choice of archival media for Continuity Research Facility Charlie, designed for unpowered survivability of more than a hundred years, must be made without knowing which reading technologies will exist in 2126. A research program with phases running to 2034 and beyond must be designed without knowing what its early phases will find. A systemic risk assessment must be acted upon without knowing whether the model that produced it is structurally right.

This paper is about making such decisions well. Its central argument is simple: where the future cannot be predicted with confidence, the aim of planning should shift from choosing the option that is best for the most likely future to choosing options that perform acceptably across many futures, that can be adjusted as the future reveals itself, and that are owned by institutions capable of making the adjustments. The paper takes these three requirements in turn — robustness, adaptivity and institutional persistence — and between them addresses the verification of long-range forecasts and the question of how the Department should act on projections of severe outcomes.

22. Levels of uncertainty

Uncertainty is described as deep when the parties to a decision do not know, or cannot agree on, the model that relates actions to consequences, the probability distributions over key inputs, or the value of the outcomes. Deep uncertainty is not simply wide uncertainty. A quantity can be very uncertain yet well characterized, as the outcome of a fair die is; a quantity can be narrowly bounded in every expert’s estimate and yet deeply uncertain, if the experts’ estimates rest on models none of which can be tested in the relevant regime.

The level is a property of a question, not of a domain. The Department’s systemic risk assessments contain all five: monthly nowcasts of energy reserve margins are Level 1 or 2; the behavior of governance systems under stress never observed in the calibration record is Level 4. A frequent error is to carry the confident methods appropriate to the lower levels into questions at the higher ones, often because the same model produces answers to both.¹

33. Robust decision making

Robust decision making (RDM) reverses the usual order of analysis. Rather than first agreeing on a forecast and then optimizing against it, the analyst first proposes candidate strategies and then searches across a large ensemble of futures for the conditions under which each strategy fails. The method proceeds in four steps: framing the decision by its uncertainties, levers, relationships and measures of performance; generating a large ensemble of futures by sampling uncertain factors without assigning them probabilities; using statistical scenario discovery to identify the regions of that ensemble in which a strategy fails; and comparing strategies by the size and plausibility of their failure regions and the costs of reducing them.

Worked example: replication strategy for a century-scale archive

The authors applied RDM, with staff of the Long-Duration Information Preservation Program, to a stylized version of a real design question: how to replicate a 20 PB reference corpus so that it remains complete and interpretable for 100 years. Four strategies were compared across 5,000 futures generated by sampling nine uncertain factors, including media failure rates, the duration of any interruption in funding (0–15 years), the interval before reading equipment for each medium becomes unobtainable, the loss of one or more sites, and the loss of the staff knowledge needed to interpret encoded data.

Scenario discovery explains the results. Strategy A fails principally in futures where funding is interrupted for more than four years: active tape survives only as long as someone migrates it. A single rule — a funding interruption longer than four years combined with reader obsolescence within 15 years — describes 83 percent of Strategy A’s failures with a precision of 0.91. Strategy B removes most of these failures by adding a medium that does not depend on scheduled migration. The residual failures of B and C are of a different kind: they occur where the data survive but the knowledge needed to decode them does not. That is not a media problem but an institutional one, and it motivates both the human-readable documentation in Strategy C and the discussion of institutional longevity in Section 8.

The example illustrates the main practical benefit of RDM. It does not identify an optimal strategy; it identifies what each strategy is vulnerable to, in terms concrete enough for decision-makers to judge whether those vulnerabilities are acceptable.²

44. Adaptive pathways

Robust strategies can be expensive if they must be robust from the outset. Adaptive pathways reduce this cost by recognizing that most long-lived systems are built and operated as sequences of decisions, not as single choices. The method identifies, for each available action, its adaptation tipping point — the change in conditions at which the action no longer meets its objectives — and maps the sequences of actions that can follow one another as tipping points are reached. A pathway map makes visible which near-term actions keep the most future options open and which lock in a single route.

Illustration: compute power supply

The authors developed an illustrative pathway map, with Continuity Infrastructure Administration engineering staff, for the objective of sustaining ICSM production and the NCRP emulation benchmark suite at Facility Alpha through the 2030s. Alpha has 42 MW of contracted grid supply against a design IT load of 30 MW and a target annual power usage effectiveness of 1.15, giving a design facility demand of about 34.5 MW. The map is a planning illustration and not a statement of facility plans.

The pathway shows that the decision of most consequence is not whether to add firm generation — which can be deferred until its signpost moves — but whether to preserve the workload flexibility of Action 3. If ensemble scheduling is designed in a way that makes every run time-critical, Action 3 disappears and the pathway jumps directly from Action 2 to the expensive and slow Action 4. Decisions that appear to be about software scheduling can thereby foreclose options in energy infrastructure. Finding such couplings is a principal purpose of the method.

55. Signposts and triggers

Adaptive plans fail most often not in analysis but in execution: the signpost moves, and nobody acts, because the action was never agreed in advance or because acting requires an admission that the original plan was wrong. The authors therefore recommend that every adaptive plan specify, before adoption, its signposts (the indicators monitored), its triggers (the threshold values at which action is required) and its pre-agreed responses (what is done, by whom, and within what period). Responses are of four kinds: defensive (protect the plan’s objectives), corrective (adjust the plan), capitalizing (take advantage of favorable change) and reassessment (reopen the plan entirely).

Two design rules make such a system durable. Triggers should be set where a reasonable person would have agreed in advance to act, not where action becomes unavoidable. And responsibility for each response should rest with a named office, not with the body that drafted the plan, so that the plan’s authors are not the only people able to declare it in need of revision.

66. Verifying long-horizon forecasts

A ten-year forecast cannot be scored for ten years, and the institution that issued it will by then have issued nine more. Without deliberate design, long-horizon forecasting escapes accountability almost entirely. The authors propose a layered approach in which each horizon is verified by the means available to it.

The core of the approach is a forecast registry: a time-stamped, immutable record of every quantitative projection the Department publishes, with the model configuration, assumptions and scoring rule fixed at the time of registration. Registry entries would be scored on a published schedule, and the scores published whether favorable or not. The registry should be stored on the Department’s archival infrastructure so that the record of what was forecast survives longer than the people who made the forecasts.³

Long-horizon risk forecasts face a further difficulty: they are intended to change the outcome they describe. If a projection of systemic stress prompts action that reduces stress, the projection will appear to have been wrong. The authors recommend that each registered projection state explicitly the response assumptions on which it is conditioned — for example, “no response beyond that represented in the model’s stylized policy rules” — so that later assessment can distinguish a forecast that was mistaken from one that was conditional on a course of events that did not occur. This does not fully resolve the problem, but it makes the conditionality auditable.

77. Acting on projections of severe outcomes

The Department’s mandate requires it to act on projections of outcomes that would be severe if they occurred. The appropriate response depends on two quantities that are often conflated: how probable the model judges the outcome to be, and how much confidence there is in the model. A probability produced by a model is a model-conditional probability. It becomes an estimate of real-world probability only after accounting for the chance that the model is structurally wrong, which in the regimes of most concern cannot itself be quantified with any precision.

Low probability, high consequence

For low-probability projections, the familiar risks are neglect and its opposite, fixation. The paper recommends that such projections be handled as portfolio items: each is assigned signposts and a small budget for low-regret preparation, and the portfolio as a whole is reviewed annually so that attention is distributed by expected consequence and by the ambiguity of the estimate rather than by the vividness of the scenario. Because the probability of any one such outcome is low but the number of them is large, the combined probability that at least one occurs over a multi-decade horizon may be substantial.

High probability, high consequence

The harder case, and the one the Department now faces, is a projection that a high-consequence outcome is more likely than not within the planning horizon. The Office of Strategic Risk Assessment’s first Civilizational Systems Outlook, due for release in October 2026, is expected to present results in this range. The authors offer five observations.

1. State both probabilities. Publications should report the model-conditional probability, a qualitative statement of structural confidence, and the specific validation limits behind that statement. A probability without its structural caveat overstates what is known; a caveat without the probability understates what the model shows.
2. A high projected probability strengthens the case for prevention. Where an outcome is projected for the late 2020s or early 2030s, the window for reducing its likelihood is finite and closing. High-probability projections are a reason to bring prevention forward, not to abandon it.
3. Pursue two tracks together. Actions that reduce likelihood (evaluation of automated control, diversification at chokepoints, strengthening of manual fallback) and actions that reduce consequence (continuity infrastructure, preservation of knowledge and records) are complements, not alternatives. Neither should be described as a substitute for the other.
4. Guard against fatalism. Preparation for an outcome is not a prediction that it is inevitable, and public communication should not allow it to be read as one. Calm, specific and uncertainty-explicit communication reduces the risk that a projection becomes self-fulfilling through loss of confidence.
5. Commit with reassessment built in. Adoption of a severe outcome as a planning baseline should carry its own triggers for reassessment in both directions, so that the Department is as prepared to stand down commitments as it was to make them.

88. Institutional longevity

Every plan discussed in this paper presumes an institution capable of carrying it out over decades: of monitoring signposts, honoring triggers, migrating media and remembering why decisions were made. Long-lived institutions are rare. Most organizations do not survive the people who founded them in recognizable form, and many that do survive have lost their original purpose. The authors reviewed the design of organizations that have sustained a function over a century or more — certain universities and religious communities, scientific bodies maintaining long observational records, standards organizations, and repositories of seeds and genetic material — and the record of public institutions that did not persist. From this review they propose nine design principles.

The ninth principle deserves emphasis because it runs against institutional instinct. Organizations facing growing problems tend to respond by adding structure — offices, procedures, systems — each of which carries a permanent maintenance cost. Over long periods, that accumulated cost can come to exceed the benefit the structure provides, leaving the institution brittle precisely when it most needs to adapt. A Department whose mission is continuity should be particularly attentive to its own complexity.

The second and eighth principles connect directly to the archive example in Section 3, whose residual failures were losses of knowledge rather than of data. The authors suggest that knowledge continuity be treated as an engineered property of the Department, with its own signposts (Table 4), in the same way that media durability is treated as an engineered property of its archives.⁴

99. Recommendations for discussion

1. Classify the principal uncertainties in each major Departmental plan by level (Table 1), and apply probabilistic optimization only to questions at Levels 1 and 2.
2. Require that plans with horizons beyond ten years be tested by robust decision making or an equivalent method, and that their principal vulnerabilities be stated in plain terms in the plan itself.
3. Express continuity infrastructure plans as adaptive pathways, identifying near-term choices that preserve or foreclose later options.
4. Adopt signposts, triggers and pre-agreed responses for each adaptive plan, with responsibility for each response assigned to a named office.
5. Establish a Departmental forecast registry, stored on archival infrastructure, with scoring on a published schedule beginning in 2027.
6. Report model-conditional probabilities together with explicit statements of structural confidence, and adopt a graded posture (Table 6) for acting on high-consequence projections.
7. Treat knowledge continuity as an engineered property of the Department, and review its institutional design against the principles in Table 7 at least once every five years.

Comments on this paper are invited from Departmental staff, the External Scientific Advisory Board and the Model Review Panel. A revised version will be prepared in 2027 in light of comments and of experience with the first Civilizational Systems Outlook.