Jeff Jonas

Your Movements Speak for Themselves: Space-Time Travel Data is Analytic Super-Food!

It doesn’t matter who you say you are!  Where you are (space), when you’re there (time), and your movements over time (travel) are closer to the truth.

I’ve seen a lot of data in my life, and I’d like to think I have a decent grip on what can be accomplished with data and analytics.  However, I recently stumbled upon some facts that have radically reshaped my understanding of the world we are living in.  What I thought was years away is already here! Our toes are dangling over the edge of a very different future.

Now, before you get all worked up, remember: You have helped create this, most folks love this, and most will continue to eat this up despite the obvious consequences.

Mobile devices in America are generating something like 600 billion geo-spatially tagged transactions per day.  Every call, text message, email and data transfer handled by your mobile device creates a transaction with your space-time coordinate (to roughly 60 meters accuracy if there are three cell towers in range), whether you have GPS or not.  Got a Blackberry?  Every few minutes, it sends a heartbeat, creating a transaction whether you are using the phone or not.  If the device is GPS-enabled and you’re using a location-based service your location is accurate to somewhere between 10 and 30 meters.  Using Wi-Fi?  It is accurate below10 meters.

Fancy.

It should be no surprise that all this data lives in the coffers of the cell providers.  Lots of people know that.  What is new, at least to me, is that this data is being provided to third parties that are leveraging specially designed analytics to make sense of our space-time-travel data. 

With the data out and specialized analytics emerging, this infant industry is already doing some pretty amazing work. Your space-time-travel data makes where you live and where you work self-evident, and it reveals your most frequent, periodic, infrequent and rare destinations. 

The data reveals the number of co-workers that join you Thursdays after work for a beer, and roughly where you all go. It knows where these same co-workers call home, and just exactly what kind of neighborhood they come from (e.g., average income, average home price) … information certainly useful to attentive direct marketing folks.

Large space-time data sets combined with advanced analytics enable a degree of understanding, discovery, and prediction that may be hard for many people to fully appreciate. Better prediction means a more efficient enterprise and nifty consumer services. 

Cellular companies are now receiving essential insight about their customers (e.g., to better understand and predict customer churn).  Major retailers can now better understand changes in consumer behavior (e.g., how far their customers are traveling on average this month compared to previous months).  Consumers are benefiting by getting real-time traffic information so they can avoid congested roads.  (I have a colleague that thinks he is saving two to four hours a week in commute time due to this service!)

Tip o’ the iceberg.

I can barely get my mind around the ramifications. My concept about what comes next shifts almost daily now.  A government not so keen on free speech could use such data to see a crowd converging towards a protest site and respond before the swarm takes form –  detected and preempted, this protest never happens.  Or worse, it could be used to understand and then undermine any political opponent.

A stalker might be questioned just days after he starts and before his victim is personally aware of it – detection previously beyond human capacity.  Maybe it’s not a crime in this case, and it turns out to be just a private investigator with poor tradecraft hired by a suspicious husband.

Such a surveillance intensive future is inevitable, irreversible and as I have said before here … irresistible.

Why?  Companies must be competitive to survive and consumers have quite the appetite for almost anything that optimizes their life, especially if it’s cheap or free.  For example:

Tuesday afternoon your [free] Gmail account advises you that your buddy Ken is going to be 15 minutes late to the pool hall this coming Thursday, unless he leaves work 15 minutes early … which he has only done twice in seven years.  Brilliant!

Your Starbucks drink of choice (a grande vanilla soy latte in my case) is handed to you the instant you pull up, and you did not call ahead nor did they ask.  Priceless!

When powerful analytics commingle space-time-travel data with tertiary data, the world we live in will fundamentally change.  Organizations and citizens alike will operate with substantially more efficiency.  There will be less carbon emissions, increased longevity, and fewer deaths.

I think people should know about this imminent new age we are marching into.

[Theatrical pause.  Breathe.]

Now I’m going to step back and address some questions you may have, using the good news/bad news format.

Good news: The space-time-travel collected by the cellular network carriers is de-identified when provided to these third parties for privacy reasons in that it does not include your name, address, phone number, etc.; rather, unique identifiers are assigned to transactions from the same device so that trends can be measured.

Bad news: If you were to provide your home, work and one other address (e.g., gym, school) in most cases, with just these data points, you are re-identified.  With just a few days of space-time-travel activity, your top three or four more frequently visited destinations become self-evident, and without a whole hell of a lot of effort you could be re-identified through a tertiary data set like a credit header.

Good news: There is so much data being produced, a lot of transactions are tossed aside, are sampled and summarized to make the computational effort feasible.  Historical data also falls off the back of the wagon (ages off the system) rather quickly.

Bad news: The competitive nature of this emerging business model will likely require these organizations to make more sense of more data faster.  Cloud computing and new classes of algorithms will make it possible to keep more transaction detail, keep it longer, and commingle it with other large and very interesting secondary data sets (e.g., phone books and property records).

Good news: So far there are only a handful of companies already entrusted with this data.

Bad news.  It may not be good news that only a few companies do this.  If only one company can monitor the consumer foot traffic of all Nordstrom stores in near real time,  this would be an unfair advantage in terms of predetermining its financial condition before anyone else.  As I learned from countless conversations with my friends at the ACLU, very powerful tools in the hands of a few is not often a good idea without one hell of a lot of oversight and accountability. And even then, this is no panacea.

Good news: Some of the organizations holding space-time-travel data are fully aware of the privacy consequences and are offering consumers the ability to opt-out – meaning, if they get a transaction about you it will be permanently removed from the system and all future correlation.

Bad news: If by chance a snapshot of sufficient detail had been sold off to another party before the opt-out request, then the toothpaste is out of the tube.  Data tends to replicate, more about this here.

Good news: Not any old mom and pop operation can get into this business.

Bad news: That won’t be true for long.  Suppose an aspiring entrepreneur makes a compelling proposition to a number of parties holding space-time-travel data.  Anticipating free analytics and a cut of the future action, the parties work a deal. For computing power this entrepreneur simply hops onto Amazon’s EC2 cloud and partners with a data aggregator to get some tertiary data and what do they have?  An ultra-sexy prediction engine.

Good news: People tend to appreciate location-based services, which is why they are opting in.

Bad news: Sensitive information about people is no longer under their own control.  As well, a number of well held secrets (e.g., your hideout) evaporate overnight.

Good news: If you want to escape the consequences of having your space-time-travel being graphed by others, here are some options that come to mind:

(a) Stop using mobile devices;

(b) Use multiple devices e.g., use one device only at work, and only a land line at home – all mobile devices being off at all other times (never moving around with a device on) – being sure these mobile devices are registered to someone other than you – and if you need to use some kind of device while on the move or at other locations. see (c) below;

(c) Unregistered, cash-purchased, disposable devices – used once then discarded (or recycled!) – although in some cases you can use the device a few times, but you better let some fancy software (which I may have to invent) advise you what is safe usage and what is not.

(d) If you can figure out locations on earth where only one cell tower exists (and you are not moving between towers and never using GPS or Wi-Fi) you will probably live safely under the radar – unless you are a way bad mofo and others know it, in which case, you are ‘going down’ anyway because there are more tricks (expensive) which will be levied against you.

Bad news: Few are willing to be this inconvenienced.  And if only a handful of innocent, clean living folks go to this same effort that the bad guys MUST employ … well crap, that in itself may be considered by some to be signal.

Net Net: My guess is most consumers don’t fully realize how their space-time-travel data is accumulating and congealing.  I hope consumers come to appreciate how all of these nice conveniences of life are delivered. And I hope they will continue to enjoy these while they make better informed decisions, especially with respect to their privacy.

However, without a feedback loop consumers may never fully appreciate what can be gleaned from their space-time-travel trail. Therefore, one way to enlighten the consumer would involve holders of space-time-travel data to permit an owner of a mobile device the ability to also see what they can see:

(a) The top 10 places you spend the most time (e.g., 1. a home address, 2. a work address, 3. a secondary work facility address, 4. your kids school address, 5. your gym address, and so on);

(b) The top three most predictable places you will be at a specific time when on the move (e.g., Vegas on the 215 freeway passing the Rainbow exit on Thursdays 6:07 - 6:21pm -- 57% of the time);

(c) The first name and first letter of the last name of the top 20 people that you regularly meet-up with (turns out to be wife, kids, best friends, and co-workers – and hopefully in that order!)

(d) The best three predictions of where you will be for more than one hour (in one place) over the next month, not counting home or work.

I think Google’s Android and Latitude products might be able to move on something like this first.  It would then be cool if other holders of space-time-travel data followed.

On the subject of privacy and civil liberties consequences, privacy by design is essential.  And for those of you with ideas in the area of policy or technology, I would be most appreciative if you would share these thoughts with me … sooner rather than later.

I will continue sharing perspectives about these ideas and the apparent consequences with my many friends in the privacy community, the defense/intelligence community, and media.  (Surprisingly, their feedback so far has been quite similar.)  I am also speaking with the organizations amassing and analyzing this space-time-travel data to learn more about what is possible.  From the perspective of the analytic engines I create, this space-time-travel data looks like “super food.”

USEFUL REFERENCE:

Internet Society: Wireless Location Privacy: Las and Policy in the US, EU, and Japan

 

RELATED POSTS:

Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society

Prediction: Channel Consolidation

More Data is Better, Proceed with Caution

How to Use a "Glue Gun" to Catch a Liar

Nation At Risk: Policy Makers Need Better Information to Protect the Country

Last Tuesday, March 10, The Markle Foundation Task Force on National Security in the Information Age released a report titled: Nation At Risk: Policy Makers Need Better Information to Protect the Country. (PDF here)

Members of the Task Force who prepared this report included: William Crowell, Bryan Cunningham, Jim Dempsey, John Gordon, Slade Gorton, Jeff Jonas (me!), Judith Miller, Jeffrey Smith, Abraham Sofaer, Rick White, and Richard Wilhelm.

We made the following five recommendations, calling for the accelerated creation of an information sharing framework:

1. Reaffirm Information Sharing as a Top Priority

2. Make Government Information Discoverable and Accessible to Authorized Users by Increasing the Use of Commercially Available Off-the-Shelf Technology

3. Enhance Security and Privacy Protections to Match the Increased Power of Shared Information

4. Transform the Information Sharing Culture with Metrics and Incentives

5. Empower Users to Drive Information Sharing by Forming Communities of Interest

The report is relatively short and to the point, just 27 pages long. It includes a handy four page appendix summarizing all of the recommendations (pages 22-25).

Here are a few elements I would like to bring to the attention of my readers:

Recommendation 2 speaks to "Discoverability." Our Task Force built on our earlier recommendations (in prior reports) to use data indices – much like the card catalog at the library. Using indices, users can locate data in the enterprise and if qualified for authorized use, they can limit access to the records of relevance. Notably, this model means less data is being transferred around, therefore less data must be kept in synch. The risk of unintended disclosure is mitigated to a degree because fewer copies of data are being made. In short, indices allow users to locate just what they need and no more.

In recommendation 3, the Task Force makes a number of specific security and privacy recommendations. One of my favorite examples is:

"… including implementation of real-time audits of user compliance and behavior and immutable audit logs that record how a system has been used …"

These Immutable Audit Logs are clever little inventions that allow oversight and accountability groups to see exactly how a system has been used. Even a system administrator cannot secretly change the past by altering the log. Imaging every time someone peeks into the card catalog whether they find something, or not, this is recorded in an indelible manner. What cards they saw, what books they looked at, and so on … all accounted for with no way to hide the facts.

The use of the term "metrics" in recommendation 4 is also worth special mention. One such metric the Task Force would like to see is reporting what percent of a system’s information is discoverable i.e., percentage of records that have corresponding cards in the card catalog. Case in point; what is the value of a book on the shelf at the library if there is no related card in the catalog?

Finally, as indices are going to be the way information sharing gets accomplished … in my opinion, the essential policy debate must immediately begin considering the following:

1. How many indices? There are benefits for fewer. And there are different benefits for more. One index for law enforcement and one for intelligence? Or, one index for foreign collections and another for open source? One index, 20 indices, or 100?

2. Where will these indices physically reside? At Google? (Note: Google is an index already used for open source).

3. Which key attributes will be placed in the index? While the library uses subject, title and author … maybe one index will need to contain who, what, where, when.

4. How much latency between data changes in source systems and their corresponding change in the index? For example, if a watch list record is deleted in a source system, what is the maximum amount of time one would want to wait until the same record is redacted from the card catalog?

5. When a user searches the card catalog, who do you notify when an index card is found?

a. Only the inquirer?

b. Only the owner?

c. Both?

d. Neither, only a third party is notified?

e. No one can be told?

6. When there is any notification, what information is revealed about the index card to the inquirer and/or data owner?

a. All the attributes related to the index card?

b. Some of the other attributes on the card (e.g., search author and see title)?

c. No other attributes are revealed?

d. The custodian organization of the data record?

e. The custodian source system of the record?

f. The actual record number used to identify this piece of data in the source system?

g. The user, if any, associated with this record, e.g., the analyst’s name and phone number?

7. When there is a notification to a data owner, what information is revealed about the inquirer?

a. All the attributes related to the search?

b. Some of the other attributes on the search?

c. No other attributes are revealed?

d. The inquirer’s organization?

e. The inquirer’s source system?

f. The actual session number used to initiate the inquirer’s search?

g. The inquirer’s name and phone number?

8. What user audit standards and processes will be required to ensure the system is being used in accordance with law and policy?

9. What metrics will be kept and who can see which metrics?

RELATED POSTS:

Discoverability: The First Information Sharing Principle

Information Sharing: Got Directory?

No Need to "Over Share" – Thoughts on Information Sharing

It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness

Federated Discovery vs. Persistent Context – Enterprise Intelligence Requires the Later

Immutable Audit Logs (IAL’s)

Found: An Immutable Audit Log

Full Attribution, Don’t Leave Home Without It

Out-bound Record-level Accountability in Information Sharing Systems

Data Tethering: Managing the Echo

To Anonymize or Not Anonymize, That is the Question

“Macro Trends: The Privacy and Civil Liberties Consequences … and Comments on Responsible Innovation” – My DHS DPIAC Testimony, September 2008

On Wednesday, September 17th, 2008 I testified before the DHS Data Privacy and Integrity Advisory Committee (DPIAC).  The testimony transcripts were recently posted on the DHS web site.

Transcript Here  (My testimony starts on the bottom of page 9.)

In this testimony I covered a number of topics including:

I. Macro Trends

1. The world is not a more dangerous place – average lifespan continues to increase (More here: The World is Not a More Dangerous Place)

2. Fewer people can create bigger effects faster … in both directions – destruction or value creation (More here: More Death Cheaper in Future, Ludicrous Speed Billionaires)

3. Competition is driving technology adoption – notably the organization who receives the data first has the advantage (More here: Ubiquitous Sensors? You Have Seen Nothing Yet)

4. Data is being created faster than organizations can make sense of it – to this degree organizations are getting dumber (More here: Why Faster Systems Can Make Organizations Dumber Faster)

5. Commingling data for enhanced context will drive a new generation of smarter systems (More here: Smart Systems Flip-Flop)

6. The surveillance society continues to build momentum as consumers find it irresistible (More here: Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society)

II. Las Vegas: What Can Be Learned

1. Las Vegas is one of the fastest growing cities in the Unites States of America (before the economic crash of course)

2. Casinos have a minimal security and surveillance budget

3. Casinos have a legal obligation, in some circumstances, to determine your identity (e.g., under age gambling, crossing a winnings threshold which necessitates IRS reporting)

4. Public and private watch lists are used – some compulsory, some elective

5. There are a fair number of scams that are tried on casinos – some scam artists are using false identities and disguises (More here: The Vegas Asymmetric Threat, Takin’ Vegas, Be Anyone in Las Vegas, Get Help Creating a Cover Story Here)

6. When employees go bad, this is particularly problematic

7. Most ‘tripwires’ are generated by alert employees who are watching, not by computers

8. An organization called Griffin Investigations provides information sharing of cheaters and advantage players (e.g., card counters) – they system is called Griffin GOLD (My old SRD company build this system)

9. One example of a watch list and insider-threat detection system known as Non-Obvious Relationship Awareness (NORA) was built for the industry (My old SRD company build this system too) (More here: IEEE Spectrum Story: Vegas 911, IEEE Paper: Threat and Fraud Intelligence – Las Vegas Style)

10. A patron can still enter a casino and enjoy a degree of activity without exposing their identity

11. There is no “predictive data mining” to spot unwanted behavior

12. Most vulnerabilities are remedied with processes not additional electronic surveillance

13. Humans are in the security decision loop – computer systems do not make security decisions, rather only promote items of interest

14. Facial recognition technology is not used at doors looking for watch listed persons

III. Towards Responsible Innovation

1. Technologists should more regularly engage the privacy community (More here: Responsible Innovation: Staying Engaged with the Privacy Community) 

2. Information sharing systems must have information attribution (More here: Full Attribution, Don’t Leave Home Without It, Out-bound Record-level Accountability in Information Sharing Systems) 

3. Data destruction requires careful planning and execution (More here: Decommissioning Data: Destruction of Accountability) 

4. Limit data transfers and use indexes to make information discoverable (More here: Discoverability: The First Information Sharing Principle) 

5. If data changes in a source system replicate this change through the information eco system (More here: Data Tethering: Managing the Echo) 

6. Where possible obfuscate data (More here: To Anonymize or Not Anonymize, That is the Question) 

7. Build high assurance accountability into systems (More here: Immutable Audit Logs (IAL’s), Found: An Immutable Audit Log) 

8. Data mining is not always good or bad, it depends on the circumstances (More here: Effective Counter-Terrorism and the Limited Role of Predictive Data Mining, Data Mining, Predicate Triage and NSA Domestic Surveillance) 

9. Link analysis, especially predicate-based, has some usefulness – although it is also wise to ‘prune’ early (More here: Hunting Bad Guys, Phone Records, and a Few Good Dead Men, Predicate-based Link Analysis: A Post 9/11 Analysis (1+1= 13), Sometimes a Big Picture is Worth a 1,000 False Positives) 

10. Low fidelity watch list entries (identities with few attributes, e.g., name only) are problematic (More here: Precision in TSA’s Terrorist Watch List, Comments on the TSA No-Fly and Selectee Watch List Process)

IV. Closing Statements

1. There are going to be more sensors, more data.  This data will be commingled for greater accuracy to serve consumers and to protect countries.  What data is collected and when … will be the debate.  Once data has been collected, the holder has the obligation to make sense of it.

2. The most fundamental principle I have synthesized from my many conversations with folks in the privacy advocacy community is this one point: “Avoid consumer surprise.”  (More here: Where Possible … Avoid Consumer Surprise)

3. Finding professional bad actors involves the detection of weak signal.  The computational remedy for weak signal involves observing and commingling transactions that are unanticipated by the bad actors.

4. Hence the tension.

[End of Testimony] 

I wish I would have also made this point:   

I am concerned.  If organizations don’t start implementing more privacy-enhancing technology I think research and productization in this area will decrease in coming years.  This would be a bad thing. 

RELATED POSTS: 

My Testimony Before The DHS Data Privacy and Integrity Advisory Committee (2005) 

RELATED PAPERS: 

Giannino Bassetti Foundation: Jeff Ubios

Transparency, Privacy and Responsibility: An Interview with Jeff Jonas 

Heritage Foundation: Paul Rosenzweig/Jeff Jonas

Correcting False Positives: Redress and the Watch List Conundrum 

Cato Foundation: Jeff Jonas/Jim Harper

Effective Counterterrorism and the Limited Role of Predictive Data Mining  

Steptoe & Johnson: Stewart Baker

Anonymization, Data-Matching and Privacy: A Case Study  

IEEE Security and Privacy: Jeff Jonas

Threat and Fraud Intelligence: Las Vegas Style 

When Risk Assessment is the Risk

It is risky business to use risk assessment systems which produce alarms at a pace faster than the organization can evaluate and handle them.  

The problem often takes one of these two forms: giant batch reports with so many pages it is an almost impossible task for analysts to manage each scored risk item; or real-time alerts that pile up in queues whereby analysts pick off the top while the backlog keeps growing.

All of these potential alarms lying around in reports or queues – each possibly a smoking gun – really must be viewed as potential evidence that could be used against you if stuff goes wrong.  These unhandled alarms each evidence that the organization did not take a risk seriously and evidence that suggests someone was incompetent or negligent for not amassing the necessary resources to evaluate each and every alarm in a reasonable timeframe.  Judgment day arrives after something bad happens when this incriminating – or even just suspect – evidence comes to light during forensic analysis.  “Look the bad actor is right here on page 32,912 … had you appropriately staffed, this disaster would have never happened!”

I have a few suggestions for those organizations dealing with this problem already and those that would like to avoid this dilemma in the first place.

1. Favor the false negative – wherever possible don’t err on the side of alarm.  While, obviously, you can’t ignore what appears to be a real, serious threat, err on the side of innocent behavior.  Let new observations catch the false negatives.  More about this here: How to Use a Glue Gun to Catch a Liar.

2. How one calculates relevance and when to register an alarm is crucial.  On the technology side the objective is: the very next item in an alarm queue is the most important item for review.  And in this model, no matter what … there is no reason to produce more alarms than there are available resources (e.g., analysts, systems) to deal with them.  Therefore, especially on day one, configure your risk assessment engine to produce alarms appropriate to your individualized risk, staffing, and ability to respond. Then, as your resources have increasing bandwidth, consider increasing the alarm sensitivity.

3. When it comes to addressing the unresolved ambiguity that percolates under the alarm sensitivity, use tertiary data for automated disposition.  Instead of having an army of analysts wrestling each “maybe” to the ground it makes more sense to locate what data is needed and let that data disambiguate these low grade risks en masse.  Most risk ambiguity will be released as harmless, while a far smaller percentage will promote up to an actionable alarm.  Example, if the phone book holds the evidence necessary to resolve some risk ambiguity (i.e., to learn the middle names are different thus concluding two identities are unrelated) – and a person would normally look here – then maybe the system can look there on its own. Lots of ambiguity can be solved with lots of data – but the question is what data and with what legal and policy justification?

4. The most “bulletproof” approach involves ... lawyers.  In this case, one would contract with a law firm with expertise in information security law to bring expert engineers aboard for the analysis, technical testing and findings, and the ensuing debate which results in new corporate policy.  All ‘discovery’ – including of negative findings that could be used against an organization in the future are then protected by attorney-client privilege and, therefore, are most likely to be protected from disclosure.  And by the way, this also creates an “advice of counsel” defense to any future litigation.  If you want to go this route I’ve got a few names, just ask.

My advice: Rarely is it a good idea to ask for a detailed report of every possible risk.  So be careful what you ask for.

OTHER RELATED PAPERS:

Correcting False Positives: Redress and the Watch List Conundrum

RELATED POSTS:

Consequences of False Positives in Government Surveillance Systems

Sometimes a Big Picture is Worth a 1,000 False Positives

 

Virtual Reality: There Is No Place Like Home

Increasingly over the last year, I have been asked to share my thoughts about virtual worlds (e.g., Second Life and World of Warcraft).  After repeated provocation, I took a peek into these interactive 3D La-La-Lands to see what is up.  Here are a few of my core conclusions:

1.    Virtual realities will end up consuming the attention of a substantial number of humans and this will happen more quickly than most may think.
2.    Data synchronization between the real world and virtual worlds will increase the relevance of virtual worlds.
3.    Along with the eyeballs of transacting consumers will come increased corporate investment thus driving more relevance and more growth.
4.    Investors in virtual world physics re-engineering will possess a distinct advantage in virtual worlds.
5.    As with any tool, a very small percentage of the population will use virtual worlds for criminal activities.

Here are a few details related to these points.

Virtual reality: soon serving the masses.  As these alternate worlds become more immersive (i.e., ability to hold ones attention when in the virtual space) and accessible (think One Laptop Per Child), I think it is possible that a half billion people show up.  How soon?  In six to ten years – maybe faster.  Why?  Because there are a lot of people on Earth that would rather exist in a synthetic world as opposed to their real world.  Hmmm … shanty town, nagging spouse, or insurmountable odds versus a stimulating environment with near limitless potential to reinvent oneself.

Cross-reality synchronization.  Imagine taking heat sensors in a real-world data center and publishing these into a virtual space which is physically configured like the real data center.  The difference being that the immersed person can now physically visualize the temperature distribution in the data center.  This is already being done.  Then move something in the physical world and it moves in the virtual world at the same time, automatically.  I wouldn’t be surprised if this is already happening in some context, somewhere.  As well, the inverse: There is supposedly a fellow who has an island in Second Life with a surveillance mechanism implemented that sends him a real-world email or text message whenever someone steps foot onto his island.  Long story short, if one wants to look at something specific, if the real and virtual worlds are synchronized, it’s going to be cheaper, faster and will burn less carbon if one takes the virtual option.

Real economic growth in unreal worlds.  Have you heard about the real estate developer in Second Life that has made $1,000,000 (real) US dollars?  True.  Linden dollars, the monetary unit in Second Life, have their own currency exchange to US dollars called the LindeX – a currency market apparently moving millions of dollars a month between the virtual and real worlds.  Point being, if a billion people show up in virtual spaces, each on average spending only eleven cents ($0.11) a month – this amounts to a real growth market which will trigger further industry investment.  Consequently: more people arrive. 

Virtual world physics re-engineering.  Through serendipity, careful study, and/or experimentation it is possible to develop capabilities within virtual reality that other participants, or in some cases even the creator, cannot fathom.  The first such instance I heard of five or six years ago involved a player who figured out he could climb walls by mounting deactivated explosive devices on a wall.  Placing one above the other, the avatar cleverly scaled the wall.  He climbed so high that he moved beyond the rendered space … into a region of the game where all that was visible was texture-less grid lines.  In a more recent example, in Second Life an individual created a covert listening device the size of a single pixel -- then placed this pixel inside some object.  Later when the object was near a conversation, all communications were echoed to a third party unbeknownst to the victims.  Prior to this event many players in Second Life would not have considered this possible.  Game physics re-engineering is also happening in World of Warcraft (where it is called "Theorycraft").  In this virtual world, one expert explained it to me this way “[we are] unwrapping the mathematics and developing a perception of space and time in relation to the virtual world, that determines which combination of attacks or defenses have the greatest efficacy.”  This info is then shared with colleagues in password protected chat rooms.  Using this knowledge delivers extraordinary advantage, namely lethality per second optimizations, hence the importance of keeping this specialized knowledge to a privileged few as long as possible.  By the way, let’s not forget that we are re-engineering the physics here on Earth in a similar manner.  Heck, ten thousand years ago, who would have conceived of the possibility that spaceships could be devised to take man to the moon and back! 

Tools are tools.  Are virtual spaces dangerous?  Well, is a phone, the Internet and email dangerous?  Nope, not for the most part, in fact the opposite, as the social and economic values of these technologies far outweigh the consequences of misuse.  Sure bad actors will continue to use the best tools they can get their hands on too.  And with this behavior, as more bad actors show up … the folks paid to “protect” us will venture into these virtual spaces in an effort to detect and preempt.  Hence some of my quotes in this recent Washington Post story “Spies Battleground Turns Virtual.”

And finally, how will you know virtual worlds are starting to collide with your own real world?  Watch for this sign: someone wants to chat with you while showing you something and they explain the best way to do this efficiently is for you to “step in” [to the virtual world that is].

RELATED POSTS:
Ghost in the Machine?

The Vegas Asymmetric Threat

If you have not already seen my post entitled Takin’ Vegas, I recommend you read it first.

Guns don’t kill people. People kill people. And so it is. In Vegas, behind every scam there is a "who" … and it is always a who (or many whos) that lays out strategies, develops plans, recruits actors, trains, adapts, rehearses and ultimately executes the mission – all in hopes of taking home some loot. Undetected.

How do they do this?

For starters, if the actor believes he has already become known to casinos as a subject of interest, he will attempt to defeat recognition through the use of a disguise e.g., changing his hair style, growing a beard, sporting a bandana, slipping into some motorcycle apparel, etc. Some go so far as cross-dressing or pretending to be wheelchair-ridden.

Beyond a new look, opportunists will claim false identities and carry false credentials. There is one particular subject I am familiar with that has used over 30 very different aliases and a handful for different social security numbers and dates of birth. [On a funny but related note, check this out: Be Anyone in Vegas: Get Help Creating a Cover Story Here]

When actors want to expand their business, they recruit. Recruitment can be local or distant. New recruits are trained in rogue facilities so that by the time these new actors appear on the scene, they have superb tradecraft despite having never laid foot in a casino.

One insidious form of recruitment is the recruitment of a casino’s longstanding, high roller to participate in a coordinated covert scheme … or worse, the recruitment of the casino’s own employees. I know of one case where a dealer was coerced into assisting the scammers after being told his wife and children were going to be hurt.

The more significant the opportunity, the more organized the group, which means strategy meetings, business plans, capital raising, operating procedures, training guides, and so on. Attention to detail is essential to increased revenues and the sustainability of the group effort.

Larger teams may establish counter-intelligence measures to reduce the risk of being infiltrated by the establishment or scammed themselves by scammers. Their own team members may be placed under covert surveillance to ensure these trusted insiders have not gone bad over time as trust has a half-life.

Large teams have cells, sub-units that are expected to work together. Some cell members are members of several cells. As with any organization there are conflicting purposes and ideologies, thus membership in cells tend to morph over time.

Often, there is no apparent center of power. New groups emerge simply based on the inspiration of a movie, book, online chat rooms, etc. Groups form, merge, split and dissolve. Some groups just specialize in card counting while others specialize in a certain cheating methods e.g., "bet pressing" – adding to a bet after the outcome is known or the manufacturing of illegal cheating devices. Some groups start with one particular brand of cheating and then branch out into other specialties.

Imagine coordinating a team with 50, 100 and sometimes even more actors! What a challenge!

Well, actually, thanks to the Internet … training, recruitment, soft targets, etc. are at one’s fingertips. Some web sites maintain a level 1 area with limited revelation and benign chat rooms. There are level 2 areas which require the user first undergo a background check before being provided access. At level 3 the member is not only required to have a background check but is also required to have committed a felonious activity. And it is this group that shares even more sensitive information … for argument’s sake this might be viewed as equivalent to a government "Top Secret" clearance. Above this level, much like a military’s Special Access Program, very specialized knowledge is controlled to a minimum and known universe of folks. When the identities of the 12 Nevada dealers with subtle procedural defects in how they dealt hand held blackjack were discovered, such secrets are worthy of such extraordinary controls. The principle: if too many people knew about this weakness, it may be exploited at a pace that would have resulted in casino defection, prompting the casino to quickly close this vulnerability.

The latest challenge? Poker.

Poker is the problem these days. You think you are playing at a table with a fair shot. But unbeknownst to you, there is a team on that table working together against you – even though they make no outward appearance of knowing each other.

Is that slight twitch in the eye "natural" or "a signal"?

RELATED POST:

Takin’ Vegas

IEEE Spectrum Story: Vegas 911

IEEE Paper: Threat and Fraud Intelligence – Las Vegas Style

Web 2.0 – Al Qaeda’s Most Effective Force Multiplier

Found: An Immutable Audit Log

An immutable audit log is a tamper-resistant recording of how a system has been used – everything from when data arrives, changes, departs, to how users interacted with the system. Each event is recorded in an indelible manner - even the database administrator with the highest level of system privileges cannot alter the past … kinda like the paper tape on an adding machine tape, etched in stone … only more high-tech.

I think (and hope) tamper-resistant audits will become common place in settings ranging from health care patient records to government surveillance systems. The primary value being twofold:

a) Accountability. Enable policy folks charged with oversight and accountability to validate that a computer system has been used within policy and law: and,

b) Deterrence. The "chilling effect" caused by the knowledge that a tamper resistant audit log is in place – deterring a corrupt person or two from bad behavior.

Well, good news. I stumbled onto a software company in Spain called Kinamik which has been dedicating its technical resources towards the creation of … a tamper-resistant audit log!

Now what? What if no one wants to pay for one? Will tamper resistant audit logs need to be built-in to commercial off-the-shelf systems to reach the market? If so, will organizations actually pay for the additional disk space and processing requirements to turn such a log on? Or, will they simply turn the feature off?

This is important technology and one that really needs to see the light of day, especially in conjunction with non-transparent government systems.

If any of my readers have thoughts as to what kind of incentives or levers will be needed to make such audit logs a reality, I would love to hear from you. As well, if you discover any other companies selling tamper-resistant logs, please let me know. I would like to compile a list.

RELATED POSTS:

Yesterday’s Technology Review Story: Blinding Big Brother, Sort of

Immutable Audit Logs (IAL’s)

More Death Cheaper in Future

The difficulty and cost of delivering death and mayhem are dropping so fast, there will come a time in which the ill-will of a few evil men could ruin the day for millions.

Technological advances in physics, engineering and biology coupled with the Internet and the dynamics of Web 2.0 have contributed to unprecedented social progress and overall improvement of the human condition. In many ways … and in most places … it is better now than ever before; hence my recent post "The World is Not a More Dangerous Place." At the same time, these same phenomena are accelerating the lethality potential per unit of human effort.

Example 1: The difficulty required to build and deliver the first few 10-kiloton nuclear devices in the 1940’s involved 130,000 people and cost two billion dollars ($23B in 2007 dollars). Today, graduate students are building viable detonation systems … albeit lacking the enriched uranium or plutonium. But unlike the 1940’s when enriched uranium did not exist – every ounce having to be produced – today this nuclear material exists in stockpiles all over the world.

Example 2: Recent biological advances have made it possible to reanimate the 1918 Spanish Influenza. Did I say "possible?" Sorry, I meant to say "this has already been done!" Between a couple of tissue samples left over in a military hospital and a deceased Alaskan Eskimo preserved in the permafrost, the virus has been successfully reconstructed and its DNA sequenced. Researchers then proceeded to inject this virus into mice with the human immune system. The result – unprecedented death – the most deadly flu virus ever tested. [story here] While nuclear material is hard to acquire, I was told the DNA sequence of the 1918 Spanish Influenza was already in the public domain. Hard to believe, so I asked a friend in the biological community for a copy of this DNA sequence. So it appears that I now have a copy on my laptop, but what would I know!

While advances in technology are a big part of this trend, other factors contribute as well including population density, dependence on mobility, the tightly coupled interdependencies in which the world operates (e.g., from just-in-time supply chains to your just-in-time access to cash and food) and media-driven sensationalism. Factors such as these have a force multiplying and amplification effect even upon traditional means for mayhem. For example, consider the death and mayhem created by Malvo and Muhammad, the two Washington DC-area gunmen. They were able to turn an investment of a few thousand dollars (car, gas, gun, bullets) into an instrument of terror which not only killed a number of people but also created so much panic the regional economy lost an estimated half a billion dollars ($500,000,000).

And so it seems, as time marches forward fewer people are able to create more damage cheaper and faster.

RELATED POSTS:

The World is Not a More Dangerous Place

The Only Way to Actually Win the (Long) War on Terror

Web 2.0 – Al Qaeda’s Most Effective Force Multiplier

The World is Not a More Dangerous Place

Back in the days when I had my company, Systems Research & Development (SRD), I prevented anyone from pitching my software using "the world is a more dangerous place" as the set up pitch.

Two reasons: (A) I think it is safer to be alive now than ever before and (B) I hate the idea of using the "fear card" to sell.

Before you call me crazy, consider the following: In the 1300’s the Black Death killed an estimated 75 million people – including a third to two thirds of Europe’s population. The 1918 Spanish Flu killed 50 – 100 million in just 18 months making by far the most destructive pandemic on record.

The average life span at the end of the nineteenth century in Western Europe was thirty seven. Today the average lifespan in the world is sixty seven! [Ref: Life Expectancy]

In short, you are more likely to grow older today than any time in the history of man.

Here is another point of reference: Even if America sunk into the ocean the 300 million deaths would be ~4.5% of the world’s current population (~6.7B). The 75 million lives lost to black death amounted to ~17.4% of the world’s population at that time (~432MM). Thus, if you were standing in America and discovered it was going to suddenly fall off into the ocean in the next few minutes, although this makes for a very bad day for you personally, overall the world still would be a less dangerous place as compared to the mid-1300’s.

Nukes complicate this equation. The two primary nuke scenarios being: a) one-se-two-se nuclear detonations carried out by stateless criminals; and b) a full scale global nuclear war causing the annihilation of mankind.

While periodic unscheduled 10-kiloton nuclear detonations would be very very bad, until such events exceed a few a year (or they go thermonuclear) – in the grand scheme of things us Earthlings are still safer than the 1,300’s. (True. If all of these events happen in a single geography, then while the world at large would still not be a more dangerous place, that specific geography would certainly be a more dangerous place!)

The scenario involving a full-scale nuclear exchange of large numbers of thermonuclear weapons deserves special attention. True, the risk of global nuclear annihilation was absolute zero before the 1900’s and today this risk is no longer zero. But, this risk ebbs and flows. One way to consider how this risk changes over time is the Doomsday Clock. Remember that? The idea being, the closer this clock is to midnight, the greater the risk of global annihilation. Its keepers calculated the time period 1953-60 as the closest the world has yet come to a doomsday event (2 minutes till midnight). [Note: the Doomsday clock was not adjusted in 1962 during the Cuban Missile Crisis as this incident came and went faster than the group reconvened and reset the clock.] Then from 1991 to 1995 the Doomsday Clock was rolled back to 17 minutes until midnight suggesting times were the safest since the inception of this clock in 1947. Notably, the clock shows that since 1995 the safety of the world has been declining. Nonetheless, at this point in time even when considering nuclear Armageddon, the world is less dangerous today than 1953-1960.

So in all fairness, when considering whether the world is a more dangerous place one would also have to ask "as compared to when?" and "as compared to where?" For example, if you called Chernobyl home on April 27th, 1986" you were definitely in a more dangerous place.

And one more thing … when the world seems like an incredibly dangerous place ... you can probably thank some of the media for that. The media’s ability to take every bad thing that happens on the planet and package it up for maximum sensation plays a huge role in spreading fear. It’s not their fault of course it is yours (and mine) as sensational news is what draws us into the media. And as our attention gives them higher ratings they justifiably work even harder at finding, packaging and delivering up even more of this bad news for us. [So, I propose we fix this by only directing our attention to "good news" stories from now on ok? Wait, is that a smoke plume on CNN … get out of my way … I gotta see this!]

Honestly, if you could pick another time to live, would you really trade living in this age for an earlier century? I wouldn’t. Oh, and I wouldn’t want to trade it for 100 years in the future either – I think the future has a chance of being really messy.

These could be the golden years!

PS: Before you get too excited one way or the other about this post, take this into account: This is my Yin post. Stay tuned for my forthcoming Yang post which will be entitled something like "More Death in Future Cheaper."

RELATED POSTS:

The Only Way to Actually Win the (Long) War on Terror

Web 2.0 – Al Qaeda’s Most Effective Force Multiplier

How to Use a "Glue Gun" to Catch a Liar

"People lie. How are you going to account for that?"

This question used to make me crazy. I always wanted to blurt out, "And the sun is going to consume the earth someday – deal with it!"

I never said this, of course.

Anyway, I have a more thoughtful response these days.

Try this on for size. Yep. People are going to falsify information. In fact, you may have experienced this in your life. Let’s say you had a friend – or so you thought. Over time you discovered that this person was in fact dishonest. How did you discover this? The answer is simple: you collected more observations over time.

Observations add up.

I have seen this play out in real data. For example, there was this very big database (billions of table rows describing hundreds of millions of unique people). In this particular database there was this one fellow who was repeatedly lying about his identity. He did a good job, in fact such a good job that despite Semantic Reconciliation processing he appeared to be six different people.

The guy was a liar and no one knew ... that is until future observations (created by his own actions) flushed him out.

[Skip this next paragraph, if you are speed reading or want to stay out of the weeds.]

Here is how this happened. Imagine six apparently discrete identities. Some name similarity, but that never matters at this scale. Then one day this fellow decides to use one of these identities (using previously reported features e.g., same name, phone, SSN, date of birth, etc.), except this time he introduces a new address, one that had never been previously associated with this identity. So this new record is identity resolved to the existing identity – the identity he wanted to present). This caused context accumulation – in this case the new address enhanced what was known about the person he was being today. Sequence Neutrality processing then fires-up to make sure earlier identity resolution events are still valid. During this process another identity was located that shared the new address (the one just learned) and other matching features (e.g., similar names and more). The identity he was trying to be had now become conjoined to one of his other identities – one he was trying to distance himself from. [Technical note: I am specifically using the term conjoined as opposed to merged. Think of conjoined like being rubber-banded together versus merged where two records become one. This is essential for many reasons e.g., retaining the ability to change one’s mind later. More about this in a future post.]

When two identities collapse into one identity – this new conjoined identity now has more context. As something new had just been learned, sequence neutral processing immediately determines if there are any further assertions of the past to fix (e.g., more identities that can be conjoined, or in some cases, disjoined).

Long and short, his six discrete identities collapsed into one … thanks to the arrival of two new records.

Knowing this, one thinks about what data sources are better than others. Some data sources are so good … they work like "glue guns."

From a national security and privacy point of view, it is the above behavior that makes it so important to debate what perceptions (observations) are fair game for context construction, and when.

RELATED POSTS:

More Data is Better, Proceed with Caution

Ubiquitous Sensors? You Have Seen Nothing yet

Accumulate Context: Now or Never

To Know Semantic Reconciliation is to Love Semantic Reconciliation