" specifying probability (unlike WIPP, where intrusion is the most important scenario, and" . . . .