Ed Felten reports that the Secure Flight initiative (a successor to the much ballyhooed CAPPS II system for grabbing and processing data on airline passengers) has been mothballed, “$200 million later”:http://www.freedom-to-tinker.com/?p=974.
bq. Today, airlines are given a no-fly list and a watch-list, which they are asked to check against their passenger lists. … The 9/11 Commission recommended keeping the lists within the government, and having the government check passengers’ names against the lists. A program designed to do just that would have been a good idea. …There would be privacy worries, but they could be handled with good design and oversight. Instead of sticking to this more modest plan, Secure Flight became a vehicle for pie-in-the-sky plans about data mining and automatic identification of terrorists from consumer databases. As the program’s goals grew more ambitious and collided with practical design and deployment challenges, the program lost focus and seemed to have a different rationale and plan from one month to the next.
Felten was on the initiative’s advisory committee; he knows that whereof he speaks. But the Secure Flight story speaks to a wider set of issues. There’s a whole host of government initiatives at different stages of development and deployment which apply data mining procedures to big databases in order to identify potential terrorists, including, most notoriously, the illegal NSA program. As far as we can tell, they all have one important feature in common – they _don’t work._ The NSA program generated an awful lot of “calls to Pizza Hut”:http://www.prospect.org/weblog/archives/2006/01/index.html#008883 but not very much in the way of actual leads. The real positives are overwhelmed by the false ones. There are uses for data mining in law enforcement, but the notion that it can somehow magically spotlight the terrorists is wishful thinking, given current technology.
This gets obscured in current debates – both the proponents of these programs (such as Poindexter and his mates), and their opponents (such as the ACLU) have an interest in hyping them up. The killer argument against them isn’t that they’re a bad tradeoff between privacy rights and security (although they are). It’s that they suck up hundreds of millions of dollars, and don’t contribute anything worthwhile to our security in the first place. Big data mining initiatives are the Star Wars program of the information age. A massive waste of money and time.
{ 12 comments }
J Thomas 02.11.06 at 8:35 pm
The NSA program generated an awful lot of calls to Pizza Hut but not very much in the way of actual leads.
Well, but at this point it looks like there weren’t any other al Qaeda cells operating in the USA. So of course the NSA program didn’t find them. If there had been thousands of al Qaeda cells maybe the ratio of good to bad leads would have been higher.
Hard to tell how well it would have worked when there wasn’t any threat for it to work against.
Half 02.11.06 at 9:43 pm
“Looking for a needle in a haystack, their approach is to add more hay.”
bmm6o 02.12.06 at 12:17 am
Bruce Schneier (who was on the working group with Felton) has written a lot about this boondoggle (e.g. http://www.schneier.com/blog/archives/2005/07/secure_flight.html).
Has anybody had anything good to say about it?
abb1 02.12.06 at 5:52 am
Without any special knowledge in this area, from general considerations it seems to me that for the data mining approach to work the whole haystack has to be sifted thru, not just a subset defined by some weak criterion, like ‘people getting calls from abroad’.
You have to listen and analyze every call, period. You can’t be a little pregnant, you can’t have a little bit of a police state; the internal logic dictates that you monitor all of the population.
Tom Parmenter 02.12.06 at 12:17 pm
Here’s a footnote on data mining and NSA, my brief treatment of the Emacs command Meta-X spook, which inserts suspicious words into a mail message in order to tease NSA.
J Thomas 02.12.06 at 2:20 pm
Abb1, the internal logic says you want to analyse every single call. But what if the available technology only lets you look at 1%? You can spend say 50 times as much and do the whole thing, or you can pick and choose.
Here’s a compromise — when somebody makes a suspicious call, save it and wait. Then when they make X number of further suspicious calls, get somebody to review them. X can be chosen according to how many human beings you can spare to do the reviews. You naturally want to review the most suspicious-looking ones first.
Now, say that some foreign group knows this. They can hire people to make a ghost network. Get people who have nothing to do with the organization except a vague sympathy, and pay them to pretend they’re doing plots that actually have nothing to do with the real plots. And they can implicate people who have no sympathy at all for them, people who will travel to the USA.
Then we get to listen to lots of plots and arrest people and we’re satisfied. They get to hide their real plans and get people interrogated who didn’t have any sympathy for them — before. We’re quite ready to believe that they’re just careless and not spoofing us, so we get lots of successes to not tell the public about. It’s win-win.
abb1 02.12.06 at 3:04 pm
But what if the available technology only lets you look at 1%?
Is it true, though, if by ‘look’ you mean “record and run thru voice recognition software scanning for certain words and other patterns”? I don’t think it’s impossible, especially if you request help from the local phone companies.
It’s not that it’ll help you find enemies (although it might), but the advantage is that when you discover an enemy by other means, you already have all his/her phone communications in the database, which allows you to discover the whole ‘cell’ and its connection to other cells right away without wasting time on torturing the guy, then arresting and torturing fellas he implicated (by that time they might’ve disappeared already), etc.
If you have all the information, then, ideally, once you know one guy – you already know the whole organization. But if you only have a small portion, bits and pieces – then you have pretty much nothing.
Doug 02.12.06 at 5:00 pm
Given the success of the Star Wars programs (in bureaucratic turf wars and continued funding, mind you, not in actually achieving anything like its announced goals), I think Henry has just given all of us a gold-plated stock tip for the next five to 10 years. What publicly listed companies are doing TIA-type stuff? What other ivestments can a normal person make in this area?
With our capital gains (soon to be tax-free, yippee!), we should be able to buy a great many ponies indeed.
Neil Sroka 02.13.06 at 12:46 am
While I agree with the sentiment underlying Henry’s argument (i.e. that data mining programs have been over-hyped and have largely failed thus far), it seems to me that the potential threat uninhibited governement data mining poses to the freedom of everyday, law-abiding citizens is real and is probably better off being combated before politicos can tout its eventual successes. Data mining is a real force and will only get better in the years ahead. Even if Henry is right in saying that the ACLU and other organizaitons concerned with the protection of civil rights is doing little to correct the inaccurate fears about today’s technology (and are reaping the benefits), we’re probably better off supporting future oriented policies rather than taking a “wait and see” approach.
aaron 02.13.06 at 8:09 am
Even though the NSA program seems to most likely violate a statute, it very likely that the statue in valid in circumstances of the program. However, it does appear that with Patriot Act, there could be inappropriate sharing of information from the program.
aaron 02.13.06 at 8:10 am
“very likely that the statute isn’t valid…”
Steve LaBonne 02.13.06 at 9:31 am
Another thing that needs to be understood is that most of these proposals actually have nothing to do with terrorism, except that it serves as a handy excuse. The “security” apparatchiki always have a standing list of new snooping initiatives that they would love to undertake, and whenever there’s a terrorist attack or other security “crisis” they know it’s a good time to drag out the ol’ laundry list with some prospect of getting at least some of it adopted. In a sense the question of whether massive data mining, etc. really “works” is almost irrelevant- the true driving force is that a certain kind of government functionary just salivates over this stuff.
Comments on this entry are closed.