Schneier on Security
A blog covering security and security technology.
« Evading Copyright Through XOR |
| Cubicle Farms are a Terrorism Risk »
March 30, 2006
An Economic Analysis of Airport Security Screening
Interesting paper: "Passenger Profiling, Imperfect Screening, and Airport Security," by Nicola Persico and Petra E. Todd. The authors use game theory to investigate the optimal screening policy, in a scenario when there are different social groups (separated by felons, race, religion, etc.) with different preferences for crime and/or terrorism.
Posted on March 30, 2006 at 1:59 PM
• 21 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
The only problem I have with applying game theory to something like airport screening is that this conclusion: "Better targeting does not necessarily decrease the overall crime rate, although it will decrease crime in the group that is targeted" depends on the proposition that a passenger will commit a crime whenever the utility of committing the crime exceeds the expected utility of not committing the crime.
For purely fiscal criminal activities, this proposition has some truth. However, for crimes where the utility cannot be measured in easily quantifiable terms (such as a successful terrorist attack), this proposition may or may not be true, which damages the conclusion.
There is also the fact that particularly for terrorist activities, the agent of the crime usually is not the person measuring utility. If I'm being ordered to carry out a suicide attack, and when I get to the airport the screening methods themselves will not change my value estimation. The expectation of a successful attempt has less impact upon the decision making process, due to the impact of the proxy.
If the utility of not committing the crime is continuing to have a miserable unimportant life and be a failure to one's family, while the utility of committing the crime is a fortune for your family, and for yourself martyrdom, international reknown, and paradise with 72 virgins, it would be insane not to commit the crime. Especially if you could blow up the checkpoint if found out.
The authors assume that screeners can reliably use 'nervousness' as an indicator of crime. Ordinary smugglers have such high confidence and admirable calm that they almost always make it through check stations. Which is why they have high confidence and admirable calm.
What 'group' does a smuggler belong to, and how does the screener tell who belongs in that group?
What 'group' does someone belong to if she's wearing a pregnancy suit, sporting platinum blonde hair, heavy makeup, and a nose ring? And carrying a bomb on her belly, with the explosives sealed in to avoid chemical detection?
The assumption that 'd(i) = 1 for all i' is the assumption of perfect detection success. I'm not only gobsmacked, I want to slap somebody silly.
Doesn't the use of utility imply an assumption that the agent is rational ?
A slightly different story: A report of the Dutch anti-terrorist agency has been presented to parliament, report (in Dutch):
Summary of findings (all translation errors are mine):
- there are several extremist muslim groups in the Netherlands, locally organized; some of them are trying to establish international contacts. Many of these groups are no threat.
- Women play an important role in those groups, taking initiative. (This is assumed to be unique to the Dutch situation.)
- Influencing Dutch politics and public opinion seems to be a central issue.
- The Internet is a catalyst for extremism.
- People that have been imprisoned as terrorism suspect, or have been convicted, gain status when they return in the extremist network.
Some notes from the critical translator:
+ It seems that a significant part of the "extremist youth" are looking for their identity and a way to live as a devout muslim in a non-muslim society. A democratic society should discuss with them.
+ "Anti-terrorst" legal action can grow terrorism.
"Doesn't the use of utility imply an assumption that the agent is rational?"
Sort it. It implies that he's consistent, within some kind of framework. It might not be a normal rational framework -- blowing yourself up is not rational, for example -- but it is a consistent framework.
"The assumption that 'd(i) = 1 for all i' is the assumption of perfect detection success. I'm not only gobsmacked, I want to slap somebody silly."
The authors of this paper did not make that assumption. In fact, they extended another model by removing that assumption from it.
> It implies that he's consistent, within some kind of framework.
Right, and isn't that a pretty big assumption? Maybe it's not...
"blowing yourself up is not rational, for example -- but it is a consistent framework"
Interesting. Almost sounds like the beginning of a justification for limiting the rights of anyone found to be irrational.
I thought that is why Locke argued that suicide is neither rational nor consistent because the choice to kill oneself is bound by an inalienable right -- performing the act denies you the very ability to make any further choices. Thus you can't have a consistent framework to commit suicide since it is inconsistent with the framework of life. He also spoke about liberty and estate, which makes me wonder about all the voters in a democracy who readily choose to give up their liberties. Would the "irrational but consistent" framework allow these people to regain their liberties (as inalienable rights) or have they lost them forever? Personally, I'd rather we not separate "rational" from "framework" unless something more meaningful than consistency can be offered as a value system.
Anyone that thinks heaven is a brothel has serious problems:
> and paradise with 72 virgins
A comment about 72 virgins sums up the mentality of these people
I read somewhere that, depending in the translation, it could actually say "72 raisins".
Okay. So they're using game theory to investigate an optimal screening process when there are different social groups with different preferences for crime and/or terrorism. But this does not make them cyberterrorists.
"Interesting. Almost sounds like the beginning of a justification for limiting the rights of anyone found to be irrational."
Don't we already do that? Murder is not rational. Burglary is not rational. And so on.
Do we punish murder and burglary because of their irrationality? I was under the impression that we did it because it inflicted damage on other people or the society at large. However, I agree with Bruce that there is a strong bias in discourse against irrationality in almost all western societies. In prectice, however, things are not so clear... Seems that we can be irrational, as long as we do not realize or acknowledge that we are being irrational.
"Murder is not rational. Burglary is not rational"
Burglary may not be ethical or moral, but irrational?
I suspect within the framework of the criminal mindset, the decision to commit burglary is entirely rational.
Burglary in most cases is entirely rational. I suspect that some murders are too.
Zappahey makes the a great point about the morality of it.
@Stu: Actually it's 72 Virginians. When bin Laden gets his final reward, George Washington, Thomas Jefferson, George Mason, and so on, will kick the no-longer-living snot out of him. :-)
On extremely rare occasions burglary and murder may be rational. But the majority of offenders are probably not. Unless a whole lot of them are getting away with it. It's irrational if there is a strong likelihood of being caught, since the punishment far outweighs the benefit in most cases.
I personally think that basically all people are rational, including terrorists and criminals in general. They're simply working from a different view of the world, which is (probably(hopefully)) incorrect.
I see a touch of ethical relativism creeping in here. Where are moral objectivists when you need them?
Two issues jump out at me when you say "Murder is not rational":
The first is a problem of tautology: if the word "murder" necessarily implies or is defined as an irrational act, then you might as well be be saying "irrational acts are not rational". This is not very helpful as a definition or framework, so the second problem stems from the first: without a universal proof to show/prove that murder is in fact an irrational act, people generally substitute in concepts of "morality" and "vice" to help prove that murder is irrational.
However, David Hume had this to say (in "A Treatise of Human Nature", Book One, Part Three):
"Take any action allowed to be vicious: Willful murder, for instance. Examine it in all lights, and see if you can find that matter of fact, or real existence, which you call vice. In whichever way you take it, you find only certain passions, motives, volitions and thoughts. There is no other matter of fact in the case. The vice entirely escapes you, as long as you consider the object. You never can find it, till you turn your reflection into your own breast, and find a sentiment of disapprobation, which arises in you, towards this action. Here is a matter of fact, but it is the object of feeling, not of reason. It lies in yourself, not in the object. So that when you pronounce any action or character to be vicious, you mean nothing, but that from the constitution of your nature you have a feeling or sentiment of blame from the contemplation of it."
Bruce, perhaps you see no rational base in murder because you are not sympathetic with the motive(s)?
...reminds me of that song by The Police:
"Now you can join the ranks of the illustrious
In history's great dark hall of fame.
All our greatest killers were industrious
At least the ones that we all know by name.
But you can reach the top of your profession
If you become the leader of the land,
For murder is the sport of the elected,
And you don't need to lift a finger of your hand
Because it's murder by numbers, 1, 2, 3,
It's as easy to learn as your ABC. "
"Burglary is not rational."
Yeah, well, again you aren't on firm ground here. You can say that theft stems from desire, which is irrational, but a simple story like Robin Hood might change your mind and disprove your position.
But I'll give you the fact that when law enforcement theorists talk about a crime triangle based on "desire, opportunity and target" they always seem to suggest that it is easier to control the latter two than eliminate desire.
>I read somewhere that, depending in the translation, it could actually say "72 raisins".
Ya, I'd blow myself up for the promise of 72 raisins chained to a bed. That's a translation that makes *much* more sense.
On a more serious note, profiling makes a lot of sense for a traditional "bad guy" who wants to do something and not get caught. All of our standard tools (profiling, game theory, security measures, etc.) break down when dealing with a suicide bomber. They have no fear of getting caught, and they are so few in number that profiling for them is a stasticial nighmare.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.