Worth repeating? II

Another consequence of the recent "underwear bomber" (i.e. Abdul Farouk Abdulmutallab) attempt is that discussion re 'profiling' is also back in vogue. Now the problem with this is that many if not most of those calling for 'profiling' misunderstand what it is... For example, those calling for "Muslims" and other such over-broad categories to be targeted are off-base and likely to cause more harm than good. Others, much fewer in number, also call for appropriate 'profiling' - the judicious application of logic, risk factors, and specific criteria designed to shrink as much as possible the universe of subjects to be identified for increased scrutiny... Also, the use of 'behavioral profiling'

Below are reprints of a number of much older entries - the first is on the topic of profiling; the second some basic math concepts for security; the third re a reliance on "science and technology" to ensure safety; and the fourth a framework against terrorism. Reading and integrating all four might be useful in achieving a holistic view of the issues.

I. OPED2: airport "profiling" (reprint from Dec 2001)

Following the terrorist attacks of 9/11 there have been many discussions regarding "profiling" at airports. These discussions have been chaotic, with proponents and opponents firmly entrenched in their positions and talking past each other. The inability to have a useful and substantive discussion has mainly been due to the lack of a common agreement of what constitutes "profiling". The following is a very brief attempt to focus in on profiling, and to provide an example of a system that might be used for profiling airline passengers for increased scrutiny......

Profiling is not simply picking out a certain racial or demographic group for increased scrutiny. Besides being unethical and possibly illegal, this is also inefficient and of limited utility. The use of overly broad categories (e.g. Middle-Eastern looking males, dark-skinned men with beards, etc..) will only result in the identification of many people for increased scrutiny. This results in an increase in the dissatisfaction of the target group without a commensurate increase in real security. Profiling is the judicious use of a select group of specific criteria designed to shrink as much as possible the universe of subjects to be identified for increased scrutiny. These criteria need to be focused on the target that is to be screened for. By this means resources may be deployed effectively with a much higher probability of identification of the target, resulting in a real increase in security.

For example, the following is a system that could be used for airport profiling. Each passenger would be assigned different weights for a number of criteria based on subject demographics, travel information, and environmental factors:.

a) Demographic data:

• Country of origin. A weight between 1 and 10 by country of origin, e.g. Saudi Arabia 10, Switzerland 1
• Age - 18-40 +4 / >60 -4
• Gender - Male +5 / Female -1

b) Travel information:

• One-way ticket +4
• Ticket purchase: >6 months prior to trip -2 / 4-6 months prior to current trip +1 /
  
• No luggage +2

c) Travel History:

• A weight between 1 and 10 by country of visit for each overseas trip in the previous 3 years (e.g. France, Germany, U.K. +10, Iran +5, Hong Kong +2, Switzerland +1, etc.)

d) Residency/Citizenship Factors:

• US citizen > 20 years -7
• US citizen 10-20 years -3
• US resident > 20 years -5
• US resident 10-20 years -2

e) Environmental Risk factors = Alert Status

• High alert +10, medium alert +5

Each passenger would be scored by the sum of their individual factor weights and the environmental factor. A score of 21 or greater would trigger increased security measures e.g. passenger interview, body search, hand check of carry-on luggage, etc. The environmental factor allows for the level of scrutiny to be proportional to the alert level - a higher level of scrutiny resulting when the country is on alert (FBI or CIA having received credible threats of possible terrorist actions)

For this system to work it would be necessary that:

• The criteria and weightings not be public knowledge, to prevent terrorists 'gaming' the system.
• The criteria be updated (both the individual criteria and the weightings) on a regular basis to ensure that the system evolves with changes in the threat profile.
• While the system should be followed as much as possible, room needs to be left for human discretion e.g. security check of a person exhibiting excessive nervousness, etc.

II. OPED4: Some basic math concepts for security (reprinted from Dec 2001)

• Base rate fallacy:

The base rate fallacy comes into play when one ignores, or is unaware of, the very low probability of an occurrence in comparison to another. For example, consider an inspection mechanism checking for terrorists that is able to make this determination with an accuracy of 99.99% (i.e. if someone is a terrorist there is a 99.99 percent chance that the mechanism indicates "terrorist," and if someone is not a terrorist, there is a 99.99 percent chance that the mechanism indicates "non-terrorist.") Assuming that one in twenty five million passengers is a terrorist, what is the chance that a person identified as a terrorist by the mechanism actually is a terrorist? Though it may seem counter-intuitive the answer is 0.04%. How?? Let us run the numbers:

Assuming that one in twenty five million flyers actually is a terrorist, the mechanism's false positive rate means that in addition to the one person who is a terrorist, (1-0.9999)*25,000,000 = 2,500 people will also be incorrectly identified as terrorists. Thus the probability that the person identified is a terrorist actually is one is 1/2500*100 = 0.04%

Thus, though the accuracy of the mechanism is high it is very likely that the rate of false alarms would eventually cause the people running the mechanism to distrust its results. Any such mechanism (e.g. biometric identification of iris) would also be expensive, and its deployment in every airport would be a burden in terms of dollars, manpower, etc.

• Crossover error rate:

Inspection mechanisms such as profiling or biometrics are subject to two types of errors. The first is known as the False Rejection Rate (FRR) or Type 1 Error, in which a valid test subject is incorrectly rejected. The second is known as the False Acceptance Rate (FAR) or Type 2 Error, in which the test subject is incorrectly accepted. For example, for an iris scanner a Type 1 error would occur if the machine incorrectly rejected a subject that was in the database, while a Type 2 error would occur if it incorrectly OK'd a person not in the database. As the sensitivity of the inspection mechanism is increased the mechanism will become more selective and the incidence of incorrect rejections (FRR) will increase. Conversely, as the sensitivity is decreased the mechanism will become less selective and the incidence of incorrect acceptances (FAR) will increase. The graph below shows the relationship between these variables.

III. OPED14: Science to the rescue (reprinted from Feb 2002)

Following the events of 9/11 'security' in all its manifestations has become an urgent concern of many people, who look to science and technology for help. This OPED looks at a few instances of technology that have been advanced recently as potentially having a role in making the country safer.

• As reported in the British journal Nature, researchers at the Mayo Clinic (Rochester, MN) have found that when people lie the blood flow around their eyes increases, and so have proposed that screeners using high-definition, heat-sensing cameras could determine if someone was telling the truth or a lie. Preliminary experiments have been conducted using this technology and the findings are that the accuracy of this system is slightly higher than that of polygraphs. In the experiment the camera identified 75% of the "guilty" subjects and 90% of the "innocent" subjects. The Mayo Clinic study authors' hypothesis is that this blushing is part of the "fright or flight response", which can signal willful deception. Skeptics point to the possibility that the physiological changes could be due to anxiety and not guilt. Others have noted that the number of subjects used in the experiment is too small to determine if this truly is meaningful. However, Honeywell has patented this system, and tests will be ongoing to see if this will work in real-life situations.
Note: even if this system is validated and achieves the rates of accuracy stated, its use in isolation would be less than useful due to the base rate fallacy (see OPED4 for an explanation). However, as a part of a structured screening process it could prove valuable. First, profiling - see OPED2 - would reduce the population needing further screening, and this would be further reduced by use of this system, so that interview, individual search, etc. would need to be performed on a manageable number of people.
• Another technology showing promise is using an ion mobility spectrometer to detect minute traces of explosives. The Sandia National Laboratories has developed a portal for airport use that closely resembles the existing metal detectors. As the passengers pass through the portal air flows downwards from the top of the portal. Small air jets on the sides agitate the passengers' clothing to dislodge any contamination. The airflow is then pulled into a 'screen preconcentrator' in which the large volume of air is passed through a high-density metal screen. Heavy organic molecules (e.g. trace explosives) are trapped by the screen. The screen is then heated to 200 degrees Centigrade, which converts any collected explosive traces back into a gas that is then passed to the ion mobility sensor. The net effect is that trace explosives from a large volume of air are concentrated by a factor of 100-1000 before passing to the spectrometer for detection, thus increasing the chances of detection. Experiments done at the Alburquerque airport in 1997 were positive... A throughput rate of five passengers/minute was achieved, with a false detection rate of less than one percent (information on the types or quantities of explosives this system can detect were not disclosed for security reasons.) Further refinement of this portal has been underway for several years, and it may be commercially available in the near future.
• A problem with airport screeners is that even well trained security personnel find it difficulty to maintain the requisite level of concentration while watching X-ray scanner screens for long periods. PerkinElmer Instruments (Boston, MA) has developed a software package known as TIP - Threat Image Projection to combat this and to ensure that screeners stay alert. The software can project images of guns, knives, or explosive devices on the images of the bags that are passing through the scanners. This is used to improve the screeners' abilities, as well as to periodically check on their alertness.
• Another promising technology is Quadropole Resonance. It is known that when explosives are bombarded with certain radio frequencies the nitrogen compounds in the explosives vibrate, and that QR scanners can then detect these vibrations. This technology is being adapted to scan trucks, shipping containers, etc. The truck or container is bombarded with low-power radio waves of specific frequencies. If explosives are present their nitrogen compounds begin to vibrate, and very sensitive radio receivers that surround the truck pick this up. A computer system can then identify the explosive present by comparing the signals captured against a database of known compounds. Since the radio waves do not effect people and are not distorted by steel shipping containers, entire vehicles could be scanned at one time.

In conclusion, numerous technologies are being developed that can help in increasing security levels. Science and technology can provide tools that may contribute to increased security and the fight against terrorism, but there is no "magic bullet". What is necessary is the deployment and use of multiple technologies to provide a systematic, multi-layered defense.

IV. OPED23 A framework against terror (reprint from Apr 2002)

This OPED attempts to demonstrate a framework against terrorism. First some background:

• The struggle against terrorism is not "a war". While the war metaphor might seem apt given the magnitude of the endeavor, it is counter-productive in the longer run. First, although military action is a significant and integral component, a comprehensive counter-terrorism strategy will also have intelligence , diplomatic, civil defense or homeland security, economic, financial , law enforcement, and human rights components in addition to the military component. Second, the war metaphor tends to imply an end point, when in reality the fight against terrorism has no conclusion and must be an integral part of society. Third, the war metaphor might make people feel that the struggle against terrorism is only the responsibility of the armed forces when in fact every citizen has a role to play. Lastly, the war metaphor twists the terms of the debate which can have unfortunate and unintended consequences - examples might be a lessening of concern about our civil liberties that result in inappropriate actions (e.g. certain parts of the USA PATRIOT Act), or a stifling of the debate that is a vital and integral part of our democratic system (e.g. when any discussion over the direction the country is taking is shouted down by people as inappropriate while we are "at war")

• The complexity of the counter-terrorism strategy with all its different parts places a premium on coordinating the various efforts.Finally, in general the various components of the counter-terrorism strategy enumerated above must all posses the following characteristics:

• Appropriate funding for long-term viability.
• Multi-layered, redundant services to provide protection "in depth".
• Utilization of people with the appropriate levels of expertise and core competencies.
• Real-time detection and response.
• Resilient security that is adaptive and can respond to a changing threat environment.
• An emphasis on partnerships.

The bottom line is that the world is a dangerous place, that terrorism is here to stay, that mitigation efforts need to be continuous and ongoing, and that given the open nature of our society it is impossible to provide 100% protection. However, if a comprehensive systems approach is utilized terrorist incidents will be exceptions and the terrorist threat can be "managed"