Schneier on Security
A blog covering security and security technology.
« Cameras Protecting Other Cameras |
| Non-Terrorist Embarrassment in Boston »
February 1, 2007
Recognizing a Suicide Bomber
Fascinating story of an Israeli taxi driver who picked up a suicide bomber. What's interesting to me is how the driver comes to realize his passenger is a suicide bomber. It wasn't anything that comes up on a profile, but a feeling that something is wrong:
Mr Woltinsky said he realised straight away that something was not quite right.
"When he got into my car, I had a bad feeling because he did not behave normally -- his eyes, his nerves -- and the fact he was wearing a big red jacket even though it was hot.
"I asked him where he wanted to go but he didn't say anything, just waved his hand.
"When I asked him again, he said only one word, "Haifa", in an Arab accent. Haifa is hundreds of kilometres away, so now I was almost 100% sure he was a suicide bomber."
In other words, his passanger was acting hinky.
EDITED TO ADD (2/1): The Israeli was not a taxi driver. Apologies.
Posted on February 1, 2007 at 6:26 AM
• 41 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Not to belabor Bruce's point, but let's spell a few things out:
1. The car driver is not trained in law enforcement (Although living where he does might count as counterterrorism training).
2. At the time of "detection" the identity of the bomber was completely unknown.
3. Detection was based on visual cues and observed behavior. No background search, no x-rays, metal detectors, etc...
4. Detection took less time than your typical security screening process.
There are two things to the story:
- Having citicens take responsibility for collective security adds a lot of hands, eyes and brains to fighting crime and terrorism.
- There seems to be a gap between the security professionals and the eyes and brains on the streets... With better communication it might have been possible to arrest the bomber before his explosion.
How exactly does communication help with arresting someone with a bomb vest?
... who goes in to put the handcuffs on?:)
But isn't profiling racist and wrong?
Not to take away from what you're saying, but it says right in the article that the car driver was a lieutenant colonel in the reserves. I'd say he probably has some training...
Off-topic, but when can we expect commentary on the Adult Swim scare in Boston, Bruce? I'm really looking forward to it.
@wiredog: no, it's profiling based on race (etc.) that is racist and wrong. Profiling based on "hinkiness" is good, although people of course need to be trained to not (consciously or unconsciously) rely on race (etc.) as a criterion for determining whether someone's acting "hinky".
I've just read the same story in our local newpaper (in the Netherlands).
It included that the driver considered crashing the car, killing both of them, but decided against it because he wasn't sure the man was a bomber.
Also, the man was carrying a backpack, which, presumably, contained the bomb.
Please note that this is a newspaper, I don't know if they got the details right.
I think the driver did everything right, except that he might have been able to get the man to leave the car without the backpack.
On this occasion the Taxi driver was correct twice,
1) The Taxi driver was susspicious
2) The man did have a bomb
THe question it begs is how often does one or both of these fail.
We have some idea when the driver is not suspicious and the bomber is real as he (usually) detonates at his chosen target and the result is reported in the news.
What we don't hear reported is how often a Taxi driver is suspicious and the person is not a bomber (mistaken / false identifcation).
It is this last measure that is important...
In a country like Israel where the likley hood of a bomber is high then mistaken identification will be taken seriously by the security services. But more importantly most people will not be overly fussed about it, and accept it as part of the "greater good"
In the US however where the likley hood of a bomber is quite low, first of the Taxi driver is less likley to be belived so the chance that his report will be taken seriously is by the security services is less. But more importantly the "falsly identified" person is likley to raise all kinds of hell against the taxi driver, even possibly litigation against him and his employer.
The net result is in Israel they will accept the inconveniance and treat it seriously thus it is a realistic defense measure.
However in the U.S. it won't be accepted or tolerated for very long, therefore as a deterent it is negligable.
Profiling 101: Looks like even the suicide bombers sometimes do have nerves.
The thing we don't really know here is the false positive rate. He thought someone was a suicide bomber, and was right. How many people has he thought were suicide bombers but been wrong about? And will this incident cause his own personal rate to go up or down? What about the rate of other cabbies?
Good profiling is hard; but don't forget that taxi drivers are allowed to make a friendly chat: Where do you want to go in Eilat? Family or business? What kind of business are you in?
Off course a suicide bomber will lie about the purpose of his visit, buy the stress of lying will show in his reactions.
Back when I drove cab, one night I picked up three young guys who were hinky: they were all paying very close attention to me and their surroundings, so I knew they were trouble before all of them were inside the cab. When they gave their destination -- a well-known market, isolated from its neighbors, that was already closed for the night -- I knew they planned to hijack the cab to use as a getaway vehicle, and would not need a live driver as a witness.
As I pulled out, the obvious leader said he wanted to take the back way, but I warned him that the cops have been on our tails all night, trying to catch us speeding, so if they see a cab duck down a street, they're going to hotfoot it right after us, and I couldn't afford another ticket. (All lies, but so what?) He really had no choice but to let me take well-lit streets and the direct route. I helpfully pointed out that the direct route was the shortest and would be the lowest priced.
When we got there, I got a knife at my neck and was ordered to shut off the ignition -- which would cut off power to the radio.
I moved just right and spoke the fastest I ever have in my life when I keyed the mike, getting out "Respond PD Lassen". There was a moment of hesitation by the crew, then the dispatcher hit the foot switch, saying "PD is on the way".
The guys had watched too much TV. They bolted immediately, running off in three different directions.
I sat there with the engine running, waiting for the cops, talking to the dispatcher, now that I had a two-and-a-half ton lightly-armored deadly weapon in my hands and was quite safe. (The PD never made it, nor did the SO or the HP, so I was really rescued by a fast-thinking civilian.)
THE DRIVER WAS NOT A TAXI DRIVER. It never said that in the story. It said he was an auditor at a hotel in town, and stopped to give the guy a lift, thinking he was a hotel employee.
The words "taxi" and/or "cab" never appear in the article.
"Hinky" -- What you're talking about it a double-edged sword. How many times in this blog has you posted stories about airline passengers freaking out on false pretexts?
Just a minor nitpick about the writeup and many of the comments here--the article says the driver was a hotel auditor driving to work, not a taxi driver. Looks like alertness (not paranoia) did more than all the security checks and special training (e.g. for cab drivers) would have in this case.
@Bruce: "his passenger was acting hinky"
From time to time you bring up a case such as this (the last one was about a football shirt, I seem to remember), as though to advocate treating oddly-behaving people with suspicion.
Do you have a peer-reviewed statistical study measuring the correlation between hinkiness and wrongdoing?
How many calls a year do the Israeli police get about non-criminals acting hinky?
I don't mean to claim that hinkiness isn't a useful profiling characteristic, but I think it should be rated against competing profiling measures using more than anecdotal evidence.
Juan Carlos de Menezes was slandered after his death. He was variously accused of wearing a coat on a hot day ("acting hinky"), running from police, and associating with terrorists. None of that turned out to be true, but those making the hinkiness accusation were confident that, if it were believed that he were indeed acting hinky, the killing would be that much closer to acceptable.
There was a minor row in a UK newspaper because a columnist described one of his neighbours as "slightly creepy-looking", and the neighbour's mother wrote to let him know that in fact he suffered from Asperger's Syndrome, and had great difficulty interacting with people:
Is there a danger that by advocating hinkiness-profiling, you create a new class of false alarms, and as much trouble for "slightly creepy-looking" people as profiling for Islam does for Muslims?
Before doing so, shouldn't be be confident that it works?
So here's a case of an untrained person correctly identifying someone suspicious. Yet you've decried publicly posted signs asking people to report to the police that which they find suspicious. And in so doing, you said the public, whom you referred to as "amateur spies" could not be trusted to identify suspicious, or shall we call it "hinky", behavior. See: http://www.schneier.com/blog/archives/2006/04/... So, can so-called "amateur spies" identify "hinky" behavior or not? And isn't the "if everyone does it...." logic just a canard?
@SteveJ: "Is there a danger that by advocating hinkiness-profiling, you create a new class of false alarms, and as much trouble for "slightly creepy-looking" people as profiling for Islam does for Muslims?"
Of course there is such a danger. However, one of the things we have evolved to be rather good at is noticing "things that don't fit." Generally speaking, it is not the ordinary and boring that is dangerous. Thus, the extraordinary merits closer scrutiny.
You then see "how hinky" something seems, and "get a feel" for the situation.
This approach has all kinds of weaknesses. For one thing, members of a minority race are automatically non-ordinary, and therefore invite extra attention through this mechanism. For another thing, "ordinary behavior" to members of one culture may seem extraordinary to members of another.
That's why Bruce is usually pulling for "trained, experienced personnel" to be actively surveilling. Such people presumably have a broader, hopefully more-relevant, reference-set upon which to base their impressions, and should therefore produce far fewer false-positives. They will hopefully have a better false-negative rate, too, recognizing covert behaviors as well.
Several people have already mentioned this, but it bears repeating: Profiling based on "hinkiness" doesn't scale. It relies on social norms which on a world wide scale presents problems as what's acceptable in one place is often a little odd elsewhere. Within the US the challenge is somewhat amplified because of our populations' ethnic and social diversity.
The biggest challenge with hinky-based profiling is that individuals that get nervous around people who simply look different (as opposed to act different) are more likely to believe they are seeing peculiar behavior when it isn't there.
Because of this, I believe that the false positive rate is high and we simply don't hear a lot about it. We've heard enough about it (Babe On Board, etc.) to know that it happens from time to time. Most are simply not outrageous enough to catch the media's eye.
An empirical way to look at this would be to look at the false positive rate for tips when police put out a public request to identify a criminal based on a sketch.
In this case it's good that the guy reported someone acting "hinky" but that's a hard situation to respond to. In this case, nothing prevented this person from causing harm to others, but the actions of the driver made it less likely that he would cause as much harm as he intended to. In this case, the driver opted for a course of action that seemed reasonable to him, removed himself from danger and reported the potential threat. This is probably the best any random person could be expected to do.
If the person was definitely a suicide bomber, a reasonable course of action would be to have a sniper neutralize the individual in a relatively safe location, cordon off the area and have the bomb squad handle the explosive device on their own schedule. That only works if you have the right kind of people deployed in the right places at the right time, for a very rare type of scenario.
This is very reasonable if the guy is definitely a suicide bomber, but a very bad course of action if some random citizen just reported that this guy doesn't seem right. Shooting someone in the head for bad fashion sense (wearing a coat on a warm day) isn't the kind of press most law enforcement agencies want.
Given that the guy already had the bomb and was in public, I don't think there was likely to be a good outcome from the situation. It was just too late for a good outcome, so less bad is the best one can hope for.
> Off-topic, but when can we expect commentary on the Adult Swim
> scare in Boston, Bruce? I'm really looking forward to it.
He's probably waiting to finish his list of "dumb quotes attributed to: [fill in the blank]." There are so many...
Check out a movie called "Paradise Now" gives a good inside look into how these attacks are carried out, mentality of the bombers, and how they might stand out.
"Profiling based on "hinkiness" doesn't scale. It relies on social norms which on a world wide scale presents problems as what's acceptable in one place is often a little odd elsewhere."
When was the last "terrorist attack" you heard of taking place on a "world wide scale"? These things are localized events, regardless that their impact may be nonlocal. The globalists have not yet succeeded homogenizing World Society to the point that would give your argument any force. It is precisely this "locality of social norms" that enabled the detection of the evildoer who chose a story and a footbal jersey that were incompatible.
And in response to the folks who want a peer reviewed presentation of empirical evidence, bwahaha! You're idiots if you need a peer-reviewed study to tell you that human beings are very good at pattern recognition, even when insufficient data are available. Use your own senses!
"If the person was definitely a suicide bomber, a reasonable course of action would be to have a sniper neutralize the individual in a relatively safe location, cordon off the area and have the bomb squad handle the explosive device on their own schedule."
Unfortunatly as we know in London you cannot be definate about bombers and even when you are certain you still get wrong ID leading to inoccents being shot.
The Israelis tried a Shot To Kill policy for a number of years with suspected bombers (it is unknown how many non bombers they shot). It was from this that Met Cheif Stevens came up with the ill fated system that went disastrously wrong on it's first use.
However one of the results well known to the Israelis (long before the de Menzies shooting) was that the bombers moved first to tilt switches, and then remote radio detonation.
So as a policy it has been proved to be a compleate non starter even before it was implemented in London.
Forget about being able to identify a suicide bomber, we need officials in the US who can recognize a cartoon character in lights is unlikely going to be a bomb, rather than shutting everything down in fear that it could be.
The US continues to lead in fear, timidity and panic. Where did bravery go? Where did common sense go?
Isn't the solution obvious?
All backpacks should be transparent :-)
Actually only half a smiley, around here, whenever there is a security alert, all the black plastic bags in the litter bins are replaced by transparent plastic bags (the litter bins are wire mesh so it makes more sense than you might think.)
"But isn't profiling racist and wrong?"
More to the point, it's ineffective.
That's why I like examples like this that demonstrate how to spot terrorists without profiling.
"Several people have already mentioned this, but it bears repeating: Profiling based on 'hinkiness' doesn't scale. It relies on social norms which on a world wide scale presents problems as what's acceptable in one place is often a little odd elsewhere. Within the US the challenge is somewhat amplified because of our populations' ethnic and social diversity."
Agreed. And many like computer-based profiling precisely because it does scale. But hinky-based profiling is much more effective.
I never said that the answers were easy or cheap, or that you would like them.
It wasn;t racila profiling -- the first give away was that the person was wearing (heavy) clothing inconsistent with the weather conditions.
One of the clues police, social workers, and trauma workers use to detect a person in distress is that they tend to wear heavy clothing such as parkas, heavy vests, etc., during hot weather -- basically they are trying to hide or cocoon themselves. And, yes, there are exceptions but it generally holds true and for the trained eye is a good indicator of other concerns...
> In the US however where the likley hood of a
> bomber is quite low, first of the Taxi driver is less
> likley to be belived so the chance that his report
> will be taken seriously is by the security services
> is less. But more importantly the "falsly identified"
> person is likley to raise all kinds of hell against the
> taxi driver, even possibly litigation against him and
> his employer.
Have you seen the new ad for Aqua Teen Hunger Force that ran in Boston 1/31?
"Looks like even the suicide bombers sometimes do have nerves."
Well, if you were going to have to deal with 72 virgins, you'd have nerves, too. Let's have some compassion here, folks.
Repeated questions about false-positive rates on 'hinkiness' are relelvant, but there have at least been some studies on behavioral profiling that have given decent results. My question is: detecting 'hinkiness' requires integrating a lot of information, either via training (professional) or personal observation (amateur)...what if applying this method correctly demands an above average intelligence? That could complicate both studies of effectiveness and attempts at implementation.
I regularly take the bus from Jerusalem to Tel Aviv (and back) for work, and I have a rule, if I notice any 'hinkiness' among the other passengers, I am out on the next bus stop. Even if I have to lose my bus fare and wait for another one, and though EVERY time so far has been a false positive, I will take multiple false positives for the one time I (may) be correct.
Just a few days ago (which was the first time something of this sort has occured in several months), there was a twenty-something year old man who got on the bus, went to the back of the bus and pulled his hat over his face. The bus driver while driving started yelling out to the passenger to come back and pay. The passenger just sat there with his hands in his coat pocket and refused to answer. Then, after a minute of this, he said in hebrew (but with an non-hebrew accent), that he wasn't going to pay.
I called the bus driver to stop, and got off and waited another 20 min for the next bus.
Didn't hear any news reports of any incident that evening, so another false positive...
What can you do? (rhetorical question), one only has their gut instincts to go on in these situations. Which is 'fine' when the consequences are merely that I take the burden of my guesswork and only I lose my fare and time.
I would hate to see, however, that there is profiling of this sort done through 'official' channels, which would obviously make some specific groups lives miserable through constantly being 'false positived' (which is actually what goes on regularly in Israel, contributing to the manifestation of a racist police state).
I like 'hinky'.
I've been subjected to 2 (mild) drug inspections at airports but let go without extensive search simply because I wasn't 'hinky'.
On both occasions, I'd been 'profiled' because I'd boarded the plane in a city notorious for its drug policy and Customs diverted me to their search facility only when they noticed the city I'd come from on the landing card (we were living there at the time)
The first time they came over with dogs to sniff our baggage after a chaotic trip involving multiple tickets and switched planes. The second they were about to wave me through when they noticed the departure city on the card. I was 'profiled' because of where I was living.
Both times I was relaxed and helped them inspect my baggage - one time volunteering that they select at random, inspect, and possibly destroy one of three identical souvenirs that couldn't be effectively X-rayed. The other time I opened pockets in my bags they hadn't asked to see.
Both times they let me go after a few minutes of cursory search, because I wasn't 'hinky'
"That's why I like examples like this that demonstrate how to spot terrorists without profiling."
I bet the ACLU would disagree with you.
Was the suspect Arab? If yes, then there is no doubt if this were in the US, the ACLU would be suing the driver for racial profiling.
Clive Robinson is spot on.
I'd like to know how many cab drivers got suspicious about *their* passenger, only to find that nothing happened, they weren't a terrorist, and that it was just a weird-looking guy. Trouble is we can't know, because those non-events don't get reported (unless perpetrated by "the authorities, and then reported by folk like the excellent Mr. Schneier).
In a sense, this story is just like the Boston blinking lights one, but where the suspicious Boston authorities *just happened* to turn out looking silly, while the suspicious cab driver *just happened* not to.
I can't see any systematic lesson to be learned other than sometimes suspicion has benefits. We already knew that. The core debate is, what are those benefits compared with its costs. I don't think this story tells us much in that respect.
Despite what you see on "24", the suicide bombers' IEDs are not big blocks of play-doh with "C4" stenciled on the side nor is a large LED clock-radio sitting on top. Some of these "vests" are form-fitting enough that a jacket wouldn't be necessary.
The suicide bombers' chosen victims are often simply crowds of people, which unfortunately makes the blundering TSA's security lines a rather easy target.
For some reason, this blog entry was just showing up as a blank page for me, so I'm reading it through the Google cache. Hopefully, the attempt to post will also work.
"Juan Carlos de Menezes was slandered after his death. He was variously accused of wearing a coat on a hot day ("acting hinky"), running from police, and associating with terrorists. None of that turned out to be true, but those making the hinkiness accusation were confident that, if it were believed that he were indeed acting hinky, the killing would be that much closer to acceptable."
The way you phrase this quote makes it sound as if you think that all these accusations of suspicious behaviour were made by the police. In fact, none of them were. The first two of these reports came from members of the public being interviewed by the press shortly after the tragedy, and the police in fact _denied_ them all right from the outset. (The third accusation I have never heard before.) If anything, this segues into Bruce's post about the unreliability of eyewitnesses.
"An empirical way to look at this would be to look at the false positive rate for tips when police put out a public request to identify a criminal based on a sketch."
The simple answer is that police continue to do this, at least for serious crimes; hence, the cost of the false positives is obviously manageable, and less than the benefit at least in the case of serious offences. More specifically, my anecdotal experience is that the false positive rate goes really high (but still manageable) after a media frenzy, the rest of the time it just isn't an issue.
"Looks like even the suicide bombers sometimes do have nerves."
Yes. The Israeli experience has been that suicide bombers are usually sweating with fear during their attacks. The extreme nervousness is a strong indicator that something is going on -- it may not be a suicide bombing, but if not it is most likely some other criminal offence. The idea that suicide bombers have made their peace with God and go to their (empty) graves calm as saints is nonsense. (They are also badly afected by the fear of failure, and ridicule. Whenever a bomber fails in a particularly embarrassing way, recruitment drops for some time afterward.) The one significant exception is that in recent years some "suicide" bombers have been simpletons who likely did not understand they were carrying a bomb.
"However one of the results well known to the Israelis (long before the de Menzies shooting) was that the bombers moved first to tilt switches, and then remote radio detonation."
Do you have any reliable reference for that? The first idea (tilt switches) is, to be blunt, disastrously silly. Dead man's switches have been experimented with but are avoided because they score too many "own goals". Tilt switches would be even worse in this regard (what do you do, recruit on the basis of good posture?!?) I'm sure we would be ecstatically happy if suicide bombers would be foolish enough to adopt them.
As for remote control detonation, I have heard of this being done, but it wasn't a countermeasure to bombers getting shot; it was to detonate bombs strapped to mentally deficient "volunteers" who likely had no idea they were carrying bombs.
Neither is an effective countermeasure anyway, since part of the idea of shooting a bomber is that the bomb may still go off, but even in that event, shooting him causes the detonation to be at a place not of his own chosing (and hence, likely to minimise rather than maximise casualties.) After all, the whole point of suicide bombing is that it provides a poor man's terminal guidance system. If the detonation will be at some random location, why bother to sacrifice a jihadi to do it?
Various comments re racial profiling: it's worth pointing out that race _was_ one -- although only one -- of the elements in Woltinsky's "profile". It may be unpopular to say it, but the fact is that there is no fundamental law that says that it is impossible for race to be a valid parameter, and this is one example whre it was: suicide bomb attacks against Israelis in Israel are almost exclusively performed by Arabs. If it makes you more comfortable, say that not being an Arab would lower the likelihood that the guy was a bomber -- but that is, in fact, exactly the same as saying that being an Arab increased that likelihood.
@Too Scared to Say:
"I can't see any systematic lesson to be learned other than sometimes suspicion has benefits. We already knew that. The core debate is, what are those benefits compared with its costs."
The answer is that on balance, the benefits of suspicion -- at about the levels of suspicion/trust balance most people actually have -- are positive. We conclude this from the fact that it has evolved this way, with a very fast acting selective pressure (people who are too trusting get murdered in their beds, people who are too suspicious never fall in love and have a family.)
It's interesting that the driver could tell something was wrong. There's a good book on this type of instantaneous, and accurate, perception called "Blink" by Malcolm Gladwell.
However, I think there's more to the suicide bomber phenomenon. How often have you read about "suicide car bombers" in Iraq? Who is to say their vehicles were not loaded with explosives by someone else?
First of all, any Israel male over 22 and less than mid 50s is in the reserves post initial service with some knowledge of explosives, guns and dangerous signs. Living in a threat zone is one way to learn about threats. It's sort of Darwinian. A hotel person would also likely gain an enhanced sense of strangers being strange. But this did not take a genius - heavy clothes in hot weather and Israel is a small place, so even 40 miles out of the way will put you outside of the country in most places. And it is a place that seems to have 2 degrees of separation a the maximum. BTW, anybody noticed that virtually no airport security measures since 9/11 would actually have prevented 9/11? Guess the idea is to suffer one risk and then defend against something else. Sort of hinky in itself. Profiling is neither racist nor evil. To the degree indicators and general patterns exist it is another form of identification, albeit not a certain one. Using profiles to harass people is the ethically dubious practice. Giving out tickets for driving while black is not very nice, but investigating organized crime figures associated by one nationality or another is looking at the world as it is. The Russian mafia is largely a bunch of Russian criminals acting together, so do the Italian ones, and so do the Triads. Don't believe it, step on some of the wrong toes...
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.