Schneier on Security

Roger • January 22, 2006 3:27 AM

A couple of respondents seem a little unclear on this, so I thought I’d spell out why this is not so much “pie-in-the-sky” as nonsense. Or to be more accurate, it looks like pie-in-the-sky that has been turned into nonsense as it wended its way through the halls of bureaucracy and got a little “mission creep”.

Polygraphs are simply machines which — as the name suggests — measure several physiological responses at once. Typically, heart rate, blood pressure, skin resistance, respiratory rate and depth. The theory is that they can be used to detect stress by seeing these properties change against a measured baseline when the only environmental variables are the questions, and that by comparing stress levels produced by “Irrelevant Questions”, “Control Questions” (questions not related to the interview, but which are presumed to produce stress in most people), and “Relevant Questions”, it can be detected if the subject lies about any of the Relevant Questions, or is unduly distressed by them. That’s not all of it by any means, but a reasonable summary.

Now it should also be said that even their most enthusiastic advocates only claim 90% accuracy (most suggest much lower), and they are more than somewhat controversial. For one thing, they don’t actually measure lies, they measure stress, so anyone who can lie without stress (e.g. sociopaths) is home free, while anyone who is distressed by certain truths may look like a liar. For another thing, they don’t even actually measure stress at all, but several proxy factors, and many people have different responses. Most seriously, despite the phrase “Control Questions”, they don’t actually have any real controls in the scientific sense, because the truth or falsity of answers to the “Control Questions” is not actually known, and the test is not conducted double-blind. As a result of this, in most jurisdictions polygraph evidence is considered pure junk science and is totally inadmissible in court.

Now, what does this tell us about the proposed remote polygraph? First, consider the proposed usage “pinpoint fighters hiding in a combat zone, or even to spot signs of stress that might mark someone out as a terrorist or suicide bomber.”
1. It was highly dubious stuff to begin with;
2. We now have no Control Questions
3. We also have no Relevant Questions
4. Actually, we have no Irrelevant Questions either
5. There are lots of environmental variables (except, there aren’t any questions!)
So what the hell is it supposed to measure then? Oh: “heart, respiratory and galvanic skin responses that are outside the norm,”?! This is utter nonsense. None of these parameters have a “norm”. They have enormous variation not only between individuals, but within one individual according to environmental variables. Someone who has just run after his bus will likely have much higher heart rate, respiratory rate and galvanic skin response than someone just strolling along. How much higher it will be, and how long that elevation will last, depends on how often he works out, and whether or not he is acclimatised, and whether or not he is well or ill, and how much water he has had to drink today, and whether his collar is too tight, and a dozen other factors. With no measured base line to compare to, the measured physiological parameters simply tell you nothing at all. They do not give, say, 20% accuracy as Evan was hoping; they give you absolutely nothing.

However, there is another application that is worth considering: suppose we have a more controlled environment, a sort of interrogation, but where a polygraph can’t be used. Say, for example, we have an agent in place who can gradually and cautiously slip some “Irrelevant Questions”, “Control Questions” and “Relevant Questions” into the conversation, while the magic gizmo is hidden inside the espresso machine and monitoring the subject’s response. In such a circumstance, the device might, in principle, be useful. I can imagine that the project started off this way: a request for a portable covert polygraph system, requested by field agents who didn’t know how unreliable they are. But it is rather doubtful: polygraphs are dubious science to begin with, and the result will be made worse by the limited control over the environment (is the suspect rattled by that question, or is he looking at a pretty girl over the agent’s shoulder?), plus the fact that outside a genuine interrogation most recommended “Control Questions” are likely to get a very hostile response. Further, there is a lot of evidence that when polygraphs work at all, they do so in part by frightening the suspect. If so, that makes a covert polygraph a contradiction in terms.

Still, suppose it could be done. What then? Well, for one thing it would spell the end of HUMINT, and allow the organised crime families to recover their power.