Schneier on Security
A blog covering security and security technology.
« Is Sears Engaging in Criminal Hacking Behavior? |
| Lessons from the Ft. Dix Terrorist Plotters »
January 3, 2008
Airport Behavioral Profiling Leads to an Arrest
I'm generally a fan of behavioral profiling. While it sounds weird and creepy and has been likened to Orwell's "facecrime", there's no doubt that -- when done properly -- it works at catching common criminals:
On Dec. 4, Juan Carlos Berriel-Castillo, 22, and Bernardo Carmona-Olivares, 20, were planning to fly to Maui but were instead arrested on suspicion of forgery.
They tried to pass through a Terminal 4 security checkpoint with suspicious documents, Phoenix police spokeswoman Stacie Derge said.
The pair had false permanent-resident identification, and authorities also found false Social Security cards, officials say.
While the pair were questioned about the papers, a TSA official who had received behavior-recognition training observed a third man in the area who appeared to be connected to Berriel-Castillo and Carmona-Olivares, Melendez said.
As a result, police later arrested Samuel Gonzalez, 32. A background check revealed that Gonzalez was wanted on two misdemeanor warrants.
TSA press release here.
Security is a trade-off. The question is whether the expense of the Screening Passengers by Observation Techniques (SPOT) program, given the minor criminals it catches, is worth it. (Remember, it's supposed to catch terrorists, not people with outstanding misdemeanor warrants.) Especially with the 99% false alarm rate:
Since January 2006, behavior-detection officers have referred about 70,000 people for secondary screening, Maccario said. Of those, about 600 to 700 were arrested on a variety of charges, including possession of drugs, weapons violations and outstanding warrants.
And the other social costs, including loss of liberty, restriction of fundamental freedoms, and the creation of a thoughtcrime. Is this the sort of power we want to give a police force in a constitutional democracy, or does it feel more like a police-state sort of thing?
This "Bizarro" cartoon sums it up nicely.
Posted on January 3, 2008 at 12:49 PM
• 43 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Suppose we citizens applied the law to the authorities the same way the authorities apply the law to us. Those 70,000 false positives translate legally to 210,000 criminal offenses of false arrest, kidnapping, and false imprisonment.
With the screeners subject to the law, very quickly the screening jobs would be vacated, and with nobody willing to do the work, the government would have to change their approach to evidenced-based methods.
As you said, a 99% false alarm rate.
The first question I would ask is whether randomly picking people off the street would yield a higher or lower percentage of people arrested "on a variety of charges".
What's the goal and what is the effectiveness of this approach in achieving that goal?
And is this approach any better than random sampling?
If not, why not start random sampling ... everywhere. And that is a police state.
Quite a Bizarro cartoon. How is an American to know whether a couple of guys in suits with plastic-encased "badges" are legit? It's likely rare that they're impersonated, but with more than 50 federal law enforcement agencies (with suited agents) operating in the U.S., could you recognize a deprecated badge? Or a forged one?
The false alarm rate isn't 99%, it's 100%. The point is to increase transport security and catch people who are trying to attack the means of transport by hijack. At that it's an utter failure.
This is similar to the utter failure of CCTV cameras in the UK, for which there's no evidence they prevent terrorist attacks, or even crime, but are primarily used as a way to hassle petty criminals.
@2 Suits and a Forged Badge:
About a month ago, US Diplomatic Security agents took away my neighbors.
I had no idea there were such agents until that day.
Not that I miss my neighbors... ;)
'The first question I would ask is whether randomly picking people off the street would yield a higher or lower percentage of people arrested "on a variety of charges".'
I don't know if it is a valuable comparison, but something like 1% of the adult population in the U.S. is in prison. Assuming this number is similar, I would guess this is very much like random chance. Another assumption I would make is that they would try very hard to find something to charge a passenger with when they get to the point of an interrogation. I would guess that the TSA would have a strong incentive to prove their interrogations are worthwhile (i.e. charge for anything they can: pocket knife, big scissors, whatever). If true, many of those actual 'crimes' may be pretty weak.
'What's the goal and what is the effectiveness of this approach in achieving that goal?'
If it is to catch terrorists, it fails at with apparent 0% success rate. 70,000 people intruded upon for no apparent gain. It boggles my mind that this is touted as a success.
If it is to make us feel safer, I don't know. I certainly am far, far more afraid of our (U.S.) government (TSA, Customs, Police) than I am of any terrorist activity within the U.S. I'm not sure my opinion is average or median though.
If it is to catch random criminals, I'd say it's as close to (or less than) random chance as should just be considered random chance. I don't see any more advantage to this activity at airports than at any other place (malls, gas stations, grocery stores, ...).
And yes, police powers without oversite is pretty much the definition of a police state.
(rant) It is a rule of force rather than the rule of law. I don't expect the law to protect me at airports from being physically, emotionally, and fiscally harmed to a lesser (annoyance is a given) or greater degree (innocent death has happened) without any recourse. Customs is even worse. And I'm a U.S. citizen. We apparently don't grant non-citizens the same rights our constitution ostensibly claims of all human kind. At the airport, I'm surrounded by an organized group of people that can do anything they want to me (shoot me for wearing a nametag?), at gunpoint, without repercussions (to them anyway). I feel so warm, fuzzy, and safe.(/rant)
As Brandioch pointed out - as far as we know, that 99% false-positive rate may be no better than random. I would be surprised to learn that any double-blind test had been done to compare these rates with the placebo effect.
Personally I can't imagine being in a room with 99 other people, no matter how respectable the circumstances, in which there is not a single person either wanted for or currently committing some minor crime (particularly given all our narcotics laws).
The figures I've seen suggest the US has about 0.6% of its population in prison at all times, with about 2.5% of the population imprisoned at some time in their lives - little surprise that a randomly selected 1% of the population is found to be imprisonable...
Bruce .. why do you feed sharks .. I thought you were into squids .. so stay there.
Statements like "loss of freedom" .. first it's unquantifiable estimate, second you don't say that all those who were questioned a bit more lost ANYTHING.
Statistical sampling is used in every process in the world, profiling is a bit more advanced sampling .. it doesn't say you are bad .. it just says that based on some criteria I am going pick a few to check more.
Those who jump up and down on this blog routinely about police state and loss of privacy and freedom are jump ignorant buffoons and you keep feeding them .. stop this and let's talk evil Sears/Kmart
I thought the whole point of the TSA schtick was to catch potential terrorists, not forgers!
This is just what good, successful customs officials have always done. Look for those passengers who didn't "look right".
The problem is, the TSA will make it's usual mess of the idea by arresting some child who is "acting unusual."
I'd have to agree that the success rate was zero -- they found no people planning transport-related crimes or terrorism.
They coincidentally found some people with wanted for other crimes; it sounds like those other crimes were quite minor. Plus they were able to charge some people with offenses on things like small quantities of drugs or nail clippers or whatever, none of which have any connection with transportation security. But they shouldn't get to count those people as "successes" of profiling; those people aren't their targets.
Oh, and "soothsayer"--when they come for you, will there be anybody left to stand up and object?
Even a broken clock is right twice a day.
They first arrested him, and then they checked whether there was anything that would justify an arrest?
I'm honestly not comfortable with that.
It looks a lot as though the TSA is expanding the definition of probable cause to include non-standard facial micro-expressions.
I *think* we've got plenty of constitutional background prohibiting this. I'm not so sure about the political will to do so, though.
I know someone (a young mother, with 4 year old child) who was falsely identified as someone else, and interrogated about her travel in cuba - which she has never visited. In the end the agents let her in, but only gave her a 2 week visa (& IIRC, she had other restrictions).
So, that 700 is still 'best case', for catching the people they are not intended to catch, and may be in line with random sampling in the street outside the airport.
In a similar stupid inference:
The UK government passed a law prohibiting explosion of a nuclear device on UK soil. The law has worked fantastically - no explosions so far.
So we have two men arrested by the TSA for not having their papers in order, and one arrested for something the government won't even tell us. How very Soviet of them.
Fortunately our government protects us against people with Islamic-looking names, aides to foreign rulers, and drunk Icelandic chicks.
At least that last example will generate a Senate inquiry... the rest, well, don't seem to be able to get a foothold in the mainstream press. Wonder why not? Could it be that the press is owned by the same companies profiting off the Occupation of Iraq?
Bruce, are you finally coming around to the idea that "acting hinky" is not a crime? (If not, the War on the Unexpected certainly ought to convince you!)
The trouble with the TSA looking for fear, anger, surprise or contempt is that they themselves are frightening, annoying, arbitrary and despicable.
I think its all a waste of time, and I'm so tired of everyone bickering about police state while doing nothing to organize a fight against it. I myself blog about this extensively. I think that law enforcement is good, but I've never liked that we have people "looking" to put people in jail for petty stuff. Its a waste of our tax dollars and we're in debt america, so get over it and stop spending on "what's cool" and start spending one "what we need".
Do something about all this....
"while doing nothing to organize a fight against it....."
Vote early, Vote Often.
partdavid1 speaks of the uselessness of the ubiquitous CCTV cameras in Britain. No doubt this is true, but they're not *utterly* useless: without them, would we ever have known what how appalling the police execution of de Menezes was? We had an eyewitness, after all to how fine a job of protecting the public it was.
You're forgetting the most important part of the press release: The offenders the BDOs spotted might not be terrorists and might not be a threat to aviation, but they're CRIMINALS. Just because they're not terrorists doesn't mean the TSA should just let them get on a plane and go commit more crimes. Any kind of criminal needs to be taken off the street and punshied to the maximum extent of the law so they can't do any more damage. So I say, "You're doing a heck of a job, BDOs," even if it's not the specific job they're employed to do. At least we're getting SOMETHING for what they're costing us in dollars, inconvenience, and loss of freedom. Even if they're not currently protecting us from the terrorist threat, they're clearly protecting us from all sorts of other threats. That can only be a Good Thing, unless you're a criminal.
If there aren't enough terrorists around to keep the BDOs fully occupied, why not let them earn their money by catching forgers, deadbeat dads, possessors of excessive cash, liberals, and any other kind of criminal their five days of training enables them to spot? Keep it up-- and maybe some day one of them will happen upon the Big Break that will earn him or her a real merit-based promotion in the Career Progression Program!
Here is a prime example how random airport analysis (or "behavioral profiling") doesn't work: http://www.boingboing.net/2007/10/29/...
I am confident this happens more often than the kind of successes Schneier is referring to.
"...without them, would we ever have known what how appalling the police execution of de Menezes was?"
This is incorrect, the on-platform cameras at Stockwell station were allegedly non-functional.
The reality is that police have always used a variation of "behavioural profiling" - its called "suspicious behaviour". I'm sure that some police, being more socially intuitive, are probably far better at this than others. However, isn't this just like giving formalized training in what constitutes "suspicious behaviour". The real problem, IMHO is that what constitutes suspicious behaviour is largely dependent on context. Since airport security personnel have a culture of fear and suspicion, on the presumption that terrorists are everywhere, they will naturally have a huge false positive rate. This is similar to the story of the two men who were thought to be behaving "suspiciously" by glancing repeatedly at their watches:
I'm sure there is some social context where that behaviour is suspicous - but in normal life it is not, as there are far too many legitimate reasons for doing so. The problem is that passengers and security personnel have become so paranoid that their automatic interpretation is that this is suspicious.
Wait... isn't Bruce the guy who was holding up the El Al model of anti-terror interviewing as the correct way to ensure airplane security? So what's the friggin' problem if we're doing it? It's not El Al? It's not highly-trained quasi-Mossad agents? Expound on your exact problem with this, Bruce, please, because it's not readily apparent.
Umm, doesn't this sort of dovetail with your war on non-conformity posts? It seems like this kind of process reenforces the notion that we must be suspicious of the unusual, strange, unique. So people who act "suspicious" are harassed. Let's all make sure to goosestep in unison.
Maybe we should cut the TSA some slack. After all, they have proven 100% effective at keeping pink elephants, Bigfoot, the tooth fairy, demons, and space aliens from blowing up airplanes.
The question is, do we have a "right" as citizens to travel anonymously? Should airline travel be allowed to be used as a federal dragnet for petty criminals at such extreme cost to taxpayers, personal privacy, and basic human dignity? If we're going to troll the airline public for petty criminals, can we not weed out illegal aliens too?
I agree that it may not be worth it, particularly due to the psychological cost in perception of liberty -- I don't want to live in a country where people going about their private business are routinely questioned by authorities.
However, as I discussed a couple months back on my blog (http://perimetergrid.com/wp/2007/10/26/the-inevitability-of-false-positives/), a 99% false positive rate is inevitable in every terrorist-detecting mechanism, just because of how the statistics work out.
"Even a broken clock is right twice a day."
but there is no way to verrify when it is correct.
"Just because they're not terrorists doesn't mean the TSA should just let them get on a plane and go commit more crimes. Any kind of criminal needs to be taken off the street and punshied to the maximum extent of the law so they can't do any more damage."
Given that the US already has the highest incarceration rate in the world (not the first world or the "civilized world", but the entire world - greater than Syria's, Libya's, N. Korea's...), do you really think the best thing you can focus on is putting even more Americans in prisons?
Come to think of it, it might make the rest of the world a better place - if every desperate criminal in the States, from downloaders of movies, to sellers of merchandise without a permit, all the way up to those dastardly possessors of marijuana, were imprisoned to the maximum extent of the law, that would pretty much tie up the US's ability to bother the rest of us - with probably 40% of Americans imprisoned, 20% constructing bigger prisons, and 15% running the prisons, the remaining 25% would barely be enough to keep the prison system in food, electricity and running water. There'd be nobody left to meddle in other countries' affairs!
Hollywood could be shut down first of all - just get probably cause out of the way long enough to search every actor, director and producer's house for narcotics, and you could get rid of the lot, before they do any more damage.
My basic problem with this profiling is that it's still being done by uneducated minimum wage boffins with chips on their shoulders. Yes, it's great they caught a criminal "gang." They did NOT however, catch a terrorist gang. And isn't that their purpose? How did their apprehension of a forger make my flight more secure? And, if you process several hundred thousand warrantless searches in ANY circumstance, you'll find some percentage of illicit activity. Maybe we should give the power of this warrantless search to paperboys all across America. Probably get a better than 1% return on criminal activity.
While I'm certainly not going to put words in Bruce's mouth, the difference between this situation and the El Al 'security interviews', as I see it, is that one is designed to catch "criminals" while the other is designed to actually catch terrorists and threats to the transportation network.
It's a question of specificity. I'm all for behavioral profiling that's aimed towards reducing real threats, and has profiles that are backed up by evidence, and are constantly tested and refined to minimize false positives (where a false positive is detention or delay of anyone who isn't actually intending to blow up / hijack the plane, not just someone who isn't a criminal -- catching 'criminals' isn't airport security's job). But it seems like the "SPOT" stuff here in the U.S. is just more of the 'War on the Unexpected.'
The biggest problem is that we haven't decided, it seems, what the airport security people really *are*. Are they a specialist profession, tasked with safeguarding planes and nothing else, or are they generic law enforcement? Very little progress can be made, in my view, until we resolve that.
"The offenders the BDOs spotted might not be terrorists and might not be a threat to aviation, but they're CRIMINALS."
That's right, George. They are wicked, evil, CRIMINALS. Not only are they trying to fly on airplanes, but they are driving cars, buying food, and even breathing air.
How dare they!
I have no problem with behavioral profiling even if it catches mostly misdemeanor criminals - as long as the system is resilient in both directions. That is, when a false positive occurs, the system needs to be set up to make every victim whole as quickly and conveniently as possible -- and to learn from its mistakes so that the error rate decreases over time.
Roy also has a good point: enforcement people should be accountable, the same as you or I, for any loss or threat to innocent persons -- plus an extra penalty for violating the trust we've placed in them. This doesn't mean a cop shouldn't have some latitude to use his judgment -- but it does mean that a jury's judgment must be presumed to be better than the cop's.
It'd be interesting to see how many of those charged were charged for their reaction to being detained. I know I get a bit cranky if I lose my connecting flight.
I'm sure they catch some real criminals in there (after all, they must screen millions), but the example of a couple of hardened forgers trying to get on a vacation doesn't sound like much of a menace. Ask yourself if this would make the news at all if the government hadn't spent so many billions to catch them.
I am one of those "wicked" BDOs. Go ahead, start slinging. I find it highly amusing that everyone can have such a strong opinion about a program that they know very little about and have not worked in on a regular basis. I mean, C'mon, I don't go to work with you and criticize the way you salt the fries. All of the opinions have come from releases from news media. WOW. We know how reliable that is. Please take the time to think for yourselves instead of allowing the media to tell you what to think. Next time you're at an airport, talk to us, ask us questions. We'd be glad to tell you as much as we're allowed, and I think you will find that most of us are well-spoken, professional, and dedicated to our jobs. These "boffins" (Nimby, did you mean Bofoons?) are my co-workers and I am proud of the work we do everyday. Ask yourself this-- if the behaviors they are displaying are in response to fear of detection, like for an outstanding warrant, or drug possession, which lead to these misdemeanor charges, then wouldn't the "bigger fish", i.e. terrorist certainly have some behaviors, because they are also fearing detection? Please, take the time to think about what you THINK you know. I can recall back to my middle school days where the school's motto was "do not criticize another indian until you have walked a mile in his moccasins". Guess maybe it may take a 7th grader to see the forest for the trees in this program.
BDO, it is us who suffer being stopped, interrogated, this leaves us feel insecure, observed, and affraid that any of you could just do whatever you want with us. I would prefer to let the petty criminals go if this was the price to pay for me not having to cope with the police state.
pls mail me the clarity for the gols of profiling .profiling is clear but its goals are not clear in the above said paragraph.
waiting for a reply
keep helping by providing informations.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.