There is a reason I never feared John Poindexter’s Total Information Awareness plan, why I don’t even fear the secret NSA equivalent now being built.
It won’t work.
My suspicions were confirmed this week by Bruce Schneier, a name to reckon with. Schneier runs Counterpane. He is THE leading computer security expert on the planet. Honest.
And in Wired this week, he says it quite clearly.
Let’s look at some numbers. We’ll be optimistic — we’ll assume the
system has a one in 100 false-positive rate (99 percent accurate), and
a one in 1,000 false-negative rate (99.9 percent accurate). Assume 1
trillion possible indicators to sift through: that’s about 10 events —
e-mails, phone calls, purchases, web destinations, whatever — per
person in the United States per day. Also assume that 10 of them are
actually terrorists plotting.This unrealistically accurate system will generate 1 billion false
alarms for every real terrorist plot it uncovers. Every day of every
year, the police will have to investigate 27 million potential plots in
order to find the one real terrorist plot per month. Raise that
false-positive accuracy to an absurd 99.9999 percent and you’re still
chasing 2,750 false alarms per day — but that will inevitably raise
your false negatives, and you’re going to miss some of those 10 real
plots.
Schneier then runs the numbers. Terrorist plots are like tiny needles in big haystacks. No matter how finely you tune your filter running through that haystack, you are going to come up with too many false positives.
Instead of draining the pond, he suggests, fish where the fish are. Use human intelligence, not just machines. Dogged police work works.
For those of you who have forgotten, Poindexter was Ollie North’s boss, the National Security Advisor to President Reagan during the Iran-Contra scandal. He was pardoned for his crimes, but there is no real punishment for stupidity. Just because someone is named after a cartoon character doesn’t mean they have A Clue.
There is still need for fear. Police investigation of the false positives is cause for concern. They may not find what they’re looking for, but they may act on what they find nonetheless. That’s a major change to the rules of the privacy game.
The outcome could be black-listing on a larger scale than current problems with the Homeland Security “no fly” lists.
Competence and effectiveness are not prerequisite. Incompetence and ineffectiveness can create fearsome circumstances, too.
There is still need for fear. Police investigation of the false positives is cause for concern. They may not find what they’re looking for, but they may act on what they find nonetheless. That’s a major change to the rules of the privacy game.
The outcome could be black-listing on a larger scale than current problems with the Homeland Security “no fly” lists.
Competence and effectiveness are not prerequisite. Incompetence and ineffectiveness can create fearsome circumstances, too.