Profiling Makes Us Less Safe
By Bruce Schneier
There are two kinds of profiling. There's behavioral profiling based on how someone acts, and there's automatic profiling based on name, nationality, method of ticket purchase, and so on. The first one can be effective, but is very hard to do right. The second one makes us all less safe. The problem with automatic profiling is that it doesn't work.
Terrorists don't fit a profile and cannot be plucked out of crowds by computers. They're European, Asian, African, Hispanic, and Middle Eastern, male and female, young and old. Umar Farouk Abdul Mutallab was Nigerian. Richard Reid, the shoe bomber, was British with a Jamaican father. Germaine Lindsay, one of the 7/7 London bombers, was Afro-Caribbean. Dirty bomb suspect Jose Padilla was Hispanic-American. The 2002 Bali terrorists were Indonesian. Timothy McVeigh was a white American. So was the Unabomber. The Chechen terrorists who blew up two Russian planes in 2004 were female. Palestinian terrorists routinely recruit "clean" suicide bombers, and have used unsuspecting Westerners as bomb carriers.
Without an accurate profile, the system can be statistically demonstrated to be no more effective than random screening.
And, even worse, profiling creates two paths through security: one with less scrutiny and one with more. And once you do that, you invite the terrorists to take the path with less scrutiny. That is, a terrorist group can safely probe any profiling system and figure out how to beat the profile. And once they do, they're going to get through airport security with the minimum level of screening every time.
As counterintuitive as it may seem, we're all more secure when we randomly select people for secondary screening -- even if it means occasionally screening wheelchair-bound grandmothers and innocent looking children. And, as an added bonus, it doesn't needlessly anger the ethnic groups we need on our side if we're going to be more secure against terrorism.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.