Schneier on Security

Anоnymous • September 23, 2010 6:34 AM

Basically, this is a terrible idea. It’s extremely difficult to decide if declassification of a document might give an enemy an advantage in excess of whatever social advantage accrues from declassifying it. An extremely difficult problem for even an expert human, and the agencies resist it because it’s so hard to get right. Essentially, this is another expression of the AI problem: but one where the application is tested on a corpus so vast that it is infeasible to check its results, and the consequences of error are potentially worse that life and death.

So why are they doing this? Because the US government has mandated that they declassify tons (literally) of documents at a break neck pace, and has not provided funding for the millions of man-hours of work required to do it. In order to comply with both government policy and practical possibility, they need to automate the process. Even though it is an idiotic thing to do. I think this is known as the law of unintended consequences.

@paul:

There’s an awful lot of low-hanging fruit. Think about just how much paper (or data) military projects generate and how much is nonthreatening once a project is over.

Having worked on such a project, I don’t think there’s nearly as much as you think. For example, in munitions development, everything related to developmental methods and technologies, testing, qualification for service, operations, maintenance, training etc. remains potentially damaging throughout the service life of the equipment, and frequently long after. Hence it is not “low hanging fruit.”

Pretty well everything else is pulped as soon as the customer accepts delivery, because it is too costly to store, to costly to declassify, and basically worthless to the company.

And some of that information could be useful to have out in the public domain — for example, staffing levels, vacation time and sick days taken on classified projects could be great for case studies.

That stuff usually isn’t classified to begin with; in aggregate it’s usually reported in Congressional budget papers. At the personally identifiable (PII) level it’s CUI (“controlled unclassified information”) that is unlikely to be released within the lifetime of the person whose privacy is affected by the data. In fact the modern tendency is that when it’s no longer required for tax audit purposes, it is destroyed. (It costs a lot of money to keep data confidential for decades, especially when there is absolutely no benefit to you to retain it.)