Modeling for risk in the absence of sufficient data: A strategy for treaty verification