Fighting Terrorists Through Software, Anonymously?

Silwenae writes "MSNBC has a story online from this week's Newsweek about Jeff Jonas, founder of System Research and Development. SRD's software attempts to verify a person is who he says he is, and then tries to determine who that person may be connected with. Originally used in casinos, the CIA has invested in SRD for use in the war against terrorism. Apparently, Jonas has developed a system that can anonymize the data being analyzed through hashing, so the government can share this information with the private sector to look for hits, without the private sector seeing the specific data."

Comments

Stealth Snooping

[R.Caley]

[...]so the government can share this information with the private sector to look for hits, without the private sector seeing the specific data.

I.e. so the state can put people it doesn't like on the list of people to be tracked with less risk that that person, or the rest of us, can know who is on the list.

Yeah, that's really reassuring.

Big brother may be watching you, but you have no way of knowing...

Re:Stealth Snooping

[Hektor_Troy]

Big brother may be watching you, but you have no way of knowing...

Which is far more scary ... to me at least.

Personally I'd feel more comfortable travelling in China, as I know for a fact what will happen to me, if I were to air my oppinions about their government. In the USA however ... well - I'm a foreign citizen, so hey presto - enemy combatant.

Re:Stealth Snooping

[Anonymous Coward]

What's really wonderful is that, since this is a static system, this is still subject to the Carnival Booth terrorist screeing attack which was documented not so long ago and which guarantees that this will reduce and not increase security by allowing terrorists to identify which people they can use to carry out attacks.

Idiots.

Re:Stealth Snooping

[kfg]

This would be a valid criticism if any of these "antiterrorist" technologies had anything to do with security.

They're about the DEA and tracking potential "politcal radicals." i.e. people who are likely to oppose you politically.

KFG

Re:Stealth Snooping

[johnjay]

The point of protecting the list from the private sector is because the people on the list are suspicious, but not guilty. Human nature is such that, if a person showed up on a public list of suspected terrorists their life would be ruined.

It's a question of degree. Many people on the government's list of 'suspicous characters' are going to be innocent. Their lives will be somewhat effected by police attention, but (if the system works) they will be shown to be innocent, and removed from the list after whatever inconveniences they have endured. The point is that this is relatively minor harm compared to the alternative of making the list publicly available. If the list was publicly available it would become a true blacklist, and the people put on the list would be in much worse shape. They would be shunned by the fearful, attacked by vigilantes, and taken advantage of by criminals.

Although they are susceptible to abuse, these lists of 'suspicious characters' exist, and have always existed. It's the only way the law can be efficient in protecting the innocent public. The recent changes like the Patriot Act attempt to make these lists available to people who need them (like other law enforcement agencies), while keeping them from the public eye for the reasons explained above.

There are many reasons why government lists of suspicious characters are bad. But, I do not see a practical way to avoid such lists.

There are many reasons that making the FBI and CIA lists of suspicous characters more accessible to outside inquiries is bad. But (I think) these would be technical flaws that could be handled by improving the rules of access. (This post explains why one-way hashing alone isn't the answer). I don't think that there is a fundamental reason why better (but not public) access to such lists would be bad.

Re:Stealth Snooping

[Syberghost]

Big brother may be watching you, but you have no way of knowing...

Unless you're operating under the assumption that they people they watch never, EVER turn out to be actual terrorists, I would think the reasons why that's an absolute necessity would be obvious.

The CIA is spending money to enhance their ability to do their job, while still preserving as much of the person's privacy as possible. We should be applauding this, not lamenting it.

Re:Stealth Snooping

[kfg]

So we've recreated the 2nd Red Scare

Second? Hell, we've been down this road so many times the cobbles are worn to little nubs. We've had the French scare, the Loyalist scare, the Mexican scare, the Spanish scare, the Nez Perce scare, the bootlegger scare and the British scare alone was milked for 100 years. The Alien and Sedition acts were passed in 1798.

Christ almighty, if you want to get an idea of how far back this goes just read the Bible.

KFG

Re:Stealth Snooping

[R.Caley]

Unless you're operating under the assumption that the people they watch never, EVER turn out to be actual terrorists, I would think the reasons why that's an absolute necessity would be obvious.

I'm sure the East German secret police occasionaly caught someone who was an actual danger to people (rather than to the state). Would that justify their networks of secret informers etc?

I think we are well into ``those who would give up...'' terretory here.

Re:Stealth Snooping

[tom's a-cold]

The false-positive rate should be emphasized far more than it has been. What does it mean? It means that whatever system they have in place, if it's based on statistical indicators rather than someone's hunch, will inevitably identify several innocent people for every terrorist that they find. Depending on the sensitivity of the detection algoritm, the value of "several" could be anywhere from dozens to thousands. And these people are not "borderline" terrorists in any sense. They are no more likely to be real terrorists than anyone else in the population. They're entirely innocent. So the use of such a system is guaranteed to falsely identify, stigmatize and punish large numbers of innocent people. This is not a tradeoff between freedom and security. It's a tradeoff between justice and the false perception of security.

Re:Stealth Snooping

[R.Caley]

What happens when a crime is committed? The police round up suspects. How do they get that list of suspects?

One would hope that they start from the crime and compile the list, rather than starting from a list and trying to fit list members to the crime.

Otherwise we end up with Louis:

Realising the importance of the case, my men are rounding up twice the usual number of suspects.

The classic case in the UK is the `Birmingham Six'. Faced with the worst terrorist attack ther had ever been on the UK mainland, the police started with their list and worked really hard to find some suspects who fitted. Needless to say, those convicted were eventually found innocent and set free, and the people who did it were never caught and punished.

Re:Stealth Snooping

[johnjay]

But we aren't...talking about finding people after the crime, but rather tracking people someone thinks may someday commit a crime.

Here is the heart of the issue. The theory of information sharing about crimes isn't all that bad. The advantages seem to outweigh the costs. The secret lists of which we have been speaking are not so terrible and have an obvious, practical value. The real problem concerns this particular type of information: lists of suspected terrorists. You are right: these are not short-term lists of people who might have committed last week's crime; these are lists of people who could be watched and hounded for years in an attempt to disclose whether or not they are some sort of deep-cover sleeper agent.

The criminals being sought are those types: gang-members, gangsters and terrorists, that attempt to game the system. The theory of impartial, innocent-until-proven-guilty law inforcement has many flaws, and these groups attempt to exploit those flaws to gain immunity. In doing so, they can get away with evil or provoke more draconian counter-measures, and either way attempt to ruin the system of law for the innocent.

And that is the basis of your fear. You fear a growing police state more than you fear the threat of terrorism. You believe that the system of law is broken or will break if we attempt to change the rules to handle these gangs of thugs. You believe that, rather than fighting the evil of terrorism in this manner, we should either surrender completely or start from a different position, and come to a more ideal solution for policing the threat.

If you throw out the current system, you have two choices: design a different system or surrender to the marauders. The one thing you cannot do is say that the terrorists don't exist. They are coming soon to a railyard near you. Much nearer you than I, unfortunately for you, since you live closer to Europe.

If you know of a better solution than is currently being designed, than I would be interested to hear it. If you simply cannot abide living under the current one, you are of very little use in the current debate.

Using Hashing

[MoonFog]

His response was to invent ANNA ("NORA's little sister," he explains), a system that "anonymizes" data by an encryption technique called hashing. Because the data are scrambled, private records can be shared with the government and secret watch lists can be distributed to private entities, all without fear--because they can't be read

Although this is a step in the right direction, hashing algorithms can be brute forced right ?
I mean, this information may be valid for years, a thing you did when you where 18 may still be there when you are 50. I don't think this data should be distributed much at all, even though it's encrypted.

Re:Using Hashing

[Jane_Dozey]

You should say that it's _currently_ not feasible. Who knows if it'll still be the case in 10 years time.

False Positives and False Negatives

[billstewart]

Great. While there are definite positive privacy things they _could_ accomplish with this, it's also open to lots of possible problems like "The computer said you matched a terrorist's name, no we don't know why, or where the list came from, we just have to cancel your account and call the police on you" which are as hard to defend against as being on the "No-Fly List" of Americans whose rights to travel are arbitrarily and unconstitutionally limited, or the "Strip-Search-Before-Flying" list, or the "Hollywood Suspected Commies Blacklist".

Re:False Positives and False Negatives

[actiondan]

And to catch terrorists you'd think they'd only really need to put people from other countries on this list

Is there no such thing as an American terrorist?

Even if you forget about the cases where US citizens have turned to terror, don't you think it is possible that US citizens could become terrorists?

Dan.

This worries me.

[Adolph_Hitler]

As much as I am against terrorism, these technologies are going to be used on us, not terrorists! What are we going to do when our government overlords decide to enslave us? The patriot act, operations tips, now this. The war on terrorism can be faught without completely giving up our privacy and freedom. What if we don't want to be in some big government database? What if we don't want to be watched all the time, or put on some list? But you know, when you agree to give your government the power to spy on you, you also agree to give your government even more power over you and for so called conservatives this big government stuff is hypocritical. At least the democrats want to make government big with social programs, this is becoming a facist police state. Thank you Mr. Bush

Why should we spy on ourselves?

[Adolph_Hitler]

I understand fighting terrorism, but fighting terrorism has nothing to do with this. This is just outright invasion of privacy to the nth degree. Whats the point of living in America if we are going to throw the constitution into the trash and become a police state like Saddams Iraq once was? This country is supposed to be the most free, now we let some terrorists rob us of our greatest strength? What are people dying for in Iraq?

Re:Why should we spy on ourselves?

[DigitumDei]

Isn't the point of this system so that there is security without the invasion of privacy?

Now I'd assume there would be concerns to the security of the data. I'm sure most of the information this database contains could be found elsewhere (though it'd be spread out between different sources). The point though is that the US is trying to find ways to find the terrorists amongst you, and any method that helps with this while not making all your personal information available to any law enforcement agency that wants it, is a method that should at least be looked at.

definition of "war against terrorism"?

[fantomas]

Can anybody help me and define the limits of the problem "the war against terrorism"?

It strikes much of the issue is defining the problem, hey we're geeks right, give us a spec to build to, yup? This seems to be the chief concern of slashdot posters so far, that the problem has not been bounded and there are varying interpretations being made on what the problem is. How can we define the problem? Or are we accepting that the term is a worthless media and political construct to sell newspapers and justify military/ intelligence spending? Can we frame this fuzzy problem in a more meaningful way?

Re:definition of "war against terrorism"?

[kfg]

Can anybody help me and define the limits of the problem "the war against terrorism"?

The human world is made up of human beings who exasperatingly insist on exhibiting human nature.

Extrapolate.

Predict what your girlfriend is going to do, as well as where and when.

Now all you have to do is expand that technology to encompass the general populace.

Did that help?

KFG

Re:definition of "war against terrorism"?

[Anonymous Coward]

No. In fact that's exactly the sort of naive thinking that landed us here in this mess to start with.

Many men far wiser than us have pondered the human mind, and we have discovered its complexity and depth are pretty much beyond comprehension. ( I know PhDs in cognitive science, AI and psychology who all say the same thing so dont even argue the point unless you fall into that category ) Deterministic behaviourism is a childs philosophy, as are the many inadequate and naive tools used by so called 'anti - terrorism' agencies. The field is rife with charlatans and soothsayers peddling thier predictive tools, data miners, pattern matchers, signal processors (voice stress analysis), did you know the utterly discredited 'polygraph' is still used by some dumb government agencies? Most of this technology is snake oil, a comfortable lie at best.

All this adds up to jack, trust me.

It makes jobs for the boys. They get to spend your taxes on black suits, fancy gadgets and have a laugh sitting all day long disecting your telephone calls, emails, laughing at your love affairs and dirty secrets.

Meanwhile, 'terrorists', who do exist, and are far far smarter than you ever would imagine slip in and out at will. They are ethereal, nebulous, unseen. They use cunning methods of communication that are thousands of years old and completely undetectable by the most sophisticated modern equiptment. They have no physical or geographial base. No rules of engagement to hamper them. They can blend in to normal society as your brother, sister, workmates. They have enduring patience and can 'sleep' for decades. They may not even know they are a 'terrorist' - one day some average joe just 'wakes up' and goes postal, that's terrorism, unpredictable, unforseen, unavoidable*.

Every time some prick wastes another tax dollar on some technological snooping scheme my blood boils. Get it into your heads people.. YOU CANNOT WIN A WAR ON TERRORISM, all these measures disguised as fighting terror are big brother control methods, nothing more. The government is using your fear to make you willing slaves.

KFG, I respect you for your normally intelligent and insightful posts, but if you believe that predicting terror is a matter of 'extrapolation' you are living in a dream world my friend.

The best way to stop terror is to stop terrorising people.

Freedom for security

[mu-sly]

Obligatory quote:

"Those willing to give up a little liberty for a little security deserve neither security nor liberty." - Benjamin Franklin

My personal opinion on the matter is that you can't fight a war against terrorism without looking at what the root causes of that terrorism are. The fact is, that at the moment the west is seemingly willing to just overlook what the causes of terrorism are, and are trying to just blow the terrorists to smithereens.

When will people learn that labelling people "terrorists" and killing them just creates new "terrorists" at an exponential rate? As far as these "terrorists" are concerned, America and the UK are "terrorists" too.

Clever tracking software or not, "terrorists" are not going to go away until we start looking at why they are "terrorists" in the first place.

Just because a government chooses to carry out military activities, doesn't make them any less terroristic or any more legitimate.

Perhaps those doubting the terrorism carried out by the US and allies in Iraq should check this page for help in visualising the numbers.

Re:Freedom for security

[Anonymous Coward]

So the version of the quote I always heard was that those who would trade in essential liberties for temporary security deserve neither. A quick Google search shows both that version and yours floating around the net.

I don't support the Patriot Act or many of the steps taken by this administration, but the quote you start off with is going too far the other direction. We give up little liberties all the time for security. We are checked for bombs when we enter a plane. The various state governments require a license to drive a vehicle, to ensure some minimal qualifications to ensure the safety of others. Drawing the right compromise is a bitch, but the world is complicated like that. (Personally, I think a few more liberties need to be taken away from 16-18 year old drivers, but I digress...)

I'm also not arguing that the US has acted poorly with regard to this whole situation, and the war with Iraq was unnecessary. But it's not simply the case that all terrorism comes forth from actions like the ones we're taking now. One of the root causes of terrorism are regimes that actively promote it, whether by flooding propoganda ("Jews are evil baby-eating thieves!") or by providing funding or safe harbor. One of the worst offenders was Pakistan, our "ally" against terrorism these days.

Re:Freedom for security

[Anonymous Coward]

"The only correct reaction to terrorism is no reaction at all."

Hmmmm, Lets see.

Dec. 29, 1992 - In an apparent plot to kill U.S. servicemen headed to Somalia, a bomb explodes at a hotel in Aden, Yemen and kills two Austrian tourists. - America does nothing

Feb. 23, 1998 -
Bin Laden and Dr. Ayman al-Zawahiri issue a declaration with other extremist groups calling on Muslims to kill Americans anywhere in the world. - America does nothing

Aug. 7, 1998
American embassies in Nairobi, Kenya and Dar es Salaam, Tanzania are bombed almost simultaneously. The Kenya bombing kills 213 and injures 4,500; the Dar es Salaam bombing kills 11 and injures 85 - America does (basically) nothing

Oct. 12, 2000
Two men in a skiff pull alongside the American destroyer and detonate an explosive that rips through the hull and kills 17 U.S. sailors. - America does nothing

Sept. 11, 2001
WTC bombed. 3000 dead.

at what point was your philosophy supposed to kick in ?

how many people were you willing to let die on the presumption that the terrorists only wanted attention ?!?!

why don't you listen what Islam says in thier own words ?

1. Oh ye who believe! the non-Muslims are unclean. (Repentance:17)

2. Oh ye who believe! Murder those of the disbelievers and let them find harshness in you. (Repentance: 123)

This is getting absurd

[hardcode57]

The peoples of democratic countries need to wake up to the fact that terrorism represents less of a threat than their own governments' response to it. Even 9/11, the worst terrorist attack in history, did not do much to increase the annual rate of homicides in the US. It remains much more dangerous to cross the street, drive to the supermarket, walk in the hills, or go for a drink on a weekend night (let alone smoking or eating burgers). We need to accept, and insist our governments accept, that there are risks involved in the world, of which terrorism is by no means the greatest, and that these cannot be eliminated while maintining a reasonable quality of life.

Re:This is getting absurd

[hardcode57]

I don't say that we shouldn't fight terror, any more than we shouldn't fight crime. What I'm saying, albeit poorly, is that in deciding the balance between individual liberty and the fight against terror, we must take a step back and look at what terrorism actually does. Physically, the effects are not statisticly significant. The real effect is, as the word terrorism implies, the emotional impact that it has on society.
If we let our response be governed by that reaction, we lose our liberties, and the terrorists achieve what they set out to do.

The correct response to any terrorist attack, surely, is not to scream and shout and run in circles, nor to pull up the drawbridge and lock ourselves away, but to carry on as usual, and, while we try to catch terrorists, to make it plain by our conduct as free societies that terrorists do not have the power to change one damn thing that matters.

To what degree...

[Sciamachy]

...does this work? I mean, the theory goes that we're all connected by 6 degrees of seperation. How do they define a connection? Depending on these factors, anyone could be condemned as connected somehow with undesirables.

Guilt By Association

[wfberg]

Pure and simple.

Re:No its not racist.

[Adolph_Hitler]

If we are having a war on terrorism, why do we accept refugees? Its illogical.

If you search deep enough...

[MavEtJu]

If you search deep enough, you'll find something which will link me to a terrorist group. Just broaden your definition of terrorism wide enough, make the links deep enough and oh my...

It will be cheaper to put a fence around the whole country I'm living in than to build prisons for all of us.

Dumb idea...

[shic]

It is not sensible to publish this data - even in "anonymous form." Use of hashing will only prevent a party with access to the hash from directly reverse engineering the hashed data to arrive at a list of suspect names - however this completely misses the mark.

If I were a terrorist organisation planning something like 9/11 and I knew many of my lemming-recruits would be identified by airport security as risks, I would process my terrorist volunteers myself and only send those who would not raise any eyebrows. This information (anonymous though it is) would be of great value as it would eliminate another uncertainty from the evil plan.

If I were a private individual with interest in knowing the identities of all suspects then I would be able to mount a dictionary attack using, say, the electoral role or census data - with only a few billion people worldwide, a modest cluster of PCs would be able to exhaustively search for matches in reasonable time.

Finally - if this anonymous data were to be available only to authorities to whom the raw information would otherwise have been available then this approach is still a disadvantage. Without access to the reason for someone matching, it will make it much harder for authorities to make appropriate judgement calls based upon a match. The mere possibility that a match might be due to a hashing collision or data- entry errors prior to hashing could result in the wrong decisions being taken. There is certainly a risk that without information on why someone is a suspected risk that related vital clues may be missed - possibly resulting in an otherwise preventable disaster.

The terrorists are winning.

[Colin Smith]

The US governments reactions to terrorist threats are exactly what the terrorists wanted.

They now have thousands of US servicemen they can take pot shots at any time they feel like a laugh.

There is now a second destabilised regime in the middle east within which they can work. Who wants to put money on Iraq not collapsing into civil war within 5 years of the allies pulling out?

The US government is now monitoring it's citizens movements, associations and actions closely. Security being the word of the day, not freedom.

As far as I can see, the US is going down the terrorist's list of 101 fun things to do and basically just going along with them.

terrorist?

[evil_one666]

You say: "terrorist"

You mean: "enemy of corporate america's interests"

NO WAY! Stop corporate abuse, now!

[SgtChaireBourne]

As flawed as the government(s) may be, at least there are mechanisms in place to protect from abuse, at least in theory. In contrast, we have no such mechanisms, such as the Bill of Rights among other things, to protect from corporate abuse. This gets worse when you have a monopoly condition, even a local monopoly. Then it's even harder to vote with your feet or wallet.

Authority without accountability is a recipe for abuse which has been illustrated many times each year. In the U.S. the corporate boards even lack representation from the employees, labor market or relevant union. Laugh at the problems democracy is having now, but how many corporate officers or board members did you have the chance to elect or have the job of representing you or your interests?

Terrorists winning

[tehanu]

Has anyone in government thought about, if the terrorists stated aims really *are* to "destroy freedom and democracy", if we give up "essential liberties" for a little "temporary safety" or state heading down the path of a police state, or Fortress America, that the terrorists will in fact, have won.

Re:No its not racist.

[Anonymous Coward]

And didn't most of the terrorist in the 9/11 attack have american or european citizenship ?

We don't know. We know what their fake IDs said, who they claimed to be when the ticket was booked. Several of the people named as the hijackers have turned up, alive and well (and not terrorists). They had the bad luck to have their identities stolen.

On another tangent, I really don't think that it's believable that Mohammed Atta's (sic?) passport could have survived a fireball intense enough to [theoretically] melt steel and land in front of a federal agent on the streets of NYC below the WTC... draw your own conclusions.

Re:NO WAY! Stop corporate abuse, now!

[Anonymous Coward]

You are incorrectly assuming there is a seperation between megacorps and govt. Who do you think runs the govt? They only give you the illusion that you have a say in it. Let's have a MS lawyer be in charge of all the anti-trust stuff. Yea, that makes perfect sense. Let's have the wolf make sure the hen house is safe too.

If, as you say, there are 'protections' from the govt doing something to you or with your data; all they do is 'outsource' it to a company to do the dirty work for them. Then the finger pointing starts if you ever catch wind of it, then it's all about making the country safer, and it's for your own good, and nothing changes. You lose in the end. BIG TIME.

This probably will never happen, but if people would quit feeding the corps, buying in to their "you have to wear this, drink this, act this way, gotta own this, need to BUY software to have a lower TCO..." type of propaganda then their power (money) would eventually start to dwindle. Unfortunately we are too groomed with greed that most people are not willing to give up the products/services that fund the cycle.

There isn't enough tinfoil on earth anymore!

[Anonymous Coward]

Really, this is all such bullshit.
Nasa with mind reading shit, BB reading my email and watching the websites I visit. WTF?

You don't trust me? Fuck you.

This is NOT the America that I was born into.
America has turned into a third world police state. We are all treated as suspects and potential enemies of the state. You trample my rights? Fuck you too.

Kiss the Bill of Rights goodbye, they've wiped their asses with it and flushed it down the toilet. Anyone in the 40+ age range knows what I'm talking about, you've watched it happen, America is gone, they've already destroyed it.

I'm leaving, I'm moving to an island in the middle of nowhere and live without any modern crap. No computers, no phones, no TV, no electricity, NO BIG BROTHER....

Bye bye Amerika....

(and I have to post AC so I don't get a visit from the AMERSTASI goons)

This is a huge threat to civil liberties

[Sivaram_Velauthapill]

This is a huge threat to civil liberties. Typical citizens will still be safe for a while. This won't have a major impact on citizens until the technology is passed from the spy agencies (eg. CIA) to the police agencies (eg. FBI). Not really sure when this will happen but at the rate the "war" on terrorism is going, it may be tomorrow...

Sivaram Velauthapillai

This is the stupidest concept ever.

[DavidTC]

And it's not stupid because it's a privacy invasion, it's stupid because it makes it more likely terrorists can get past the system.

All they have to do is figure out their position on this 'watch list', which is easy enough to do with the ability to query the list in private hands. Then pick the least suspected one of them to carry the bomb. If they want to be really clever, send a half dozen really suspicious people in in front of the guy with the bomb, so security is busy and they won't get hit with a random search.

Flagging suspicious people in ways they can find out they have been flagged is so mind-bogglingly stupid anyone suggesting it should be utterly shunned by the security community. Hello, terrorists normally operating in groups! In any group, there's going to be a few people we've never suspected, and we must never let the terrorists know which ones those are!