Jeff Jonas: National security

Sun	Mon	Tue	Wed	Thu	Fri	Sat
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31

December 01, 2010

Big Data Flows vs. Wicked Leaks

I was invited to deliver a short keynote about "big data" at today's OECD roundtable focused on the economics of personal data and privacy. My presentation here.

Most big data flows by design. But when big data leaks the consequences can be wicked.

That said … protecting big data from wicked leaks is not going to be easy. Defending against external cyber penetrations and insider threats are both hard problems.

Now with the Wikileaks disclosures it is clear the game has changed. Historically, public disclosure of classified data has been limited and infrequent – let’s even say, to a degree, tolerable. Contrast that with the scope of the recently leaked cables. At some point it may become intolerable. In which case, I will not be surprised if a number of governments around the world attempt to enact new, wide-sweeping, anti-leak legislation directed at not only those engaged in the initial theft of the data, but the distribution points (e.g., Wikileaks) and the publishers (e.g., the media). The principle being if one knowingly receives and benefits from stolen property, they are accomplices. This pendulum could swing so far (backwards) the future will have far fewer media leaks than the historical (tolerable) volumes – i.e., this whole fiasco resulting in less transparency and accountability.

BTW: I suppose it could have been worse. What if the 250,000 classified cables where selectively and quietly passed around to various foreign intelligence services? What if the US thought these were secrets? Imagine believing one has a certain security posture … when one does not. Would that be worse?

Organizations with big data worth protecting must employ extraordinary controls to reduce the risk of unintended disclosure. On that note, I closed with a few ideas related to protecting big data from wicked leaks, including:

Central indexes. There are actually a number of scenarios where a single, central catalog of pointers is better than lots of copies of the same data scattered all over the place – the advantage being fewer copies of the data and uniform access controls and audit logs.

Anonymization. Despite the imperfections of data anonymization, when it comes to reducing the risk of unintended disclosure, most would agree that data anonymization is still better than clear text.

Immutable audit logs. Tamper resistant audit logs can be used to help prove the users of the system are complying with law and policy.

Real-time active audits. It is now going to be essential that user activity be more rigorously analyzed, in real-time, for inappropriate behavior. Audit logs have actually been part of the problem – just another big pile of data – evidence of misuse hiding in plain sight against the backdrop of millions and millions of benign audit records.

February 12, 2010

The Christmas Day Intelligence Failure – Part III of III: Deadly Transparency

In Part I I boiled down what went wrong. In Part II I commented on the fix. And now finally, I think it is important to point out what scares me most.

Sometimes transparency will get you dead.

If you had an arch enemy that was working feverishly to locate and kill you, would you publish your travel schedule, security strengths and weaknesses … down to the hour of the night you will be sleeping and the closest window?

Press accounts like this make me want to throw up.

Excerpt: “About four months before the attempted bombing on December 25, the NSA intercepted telephone conversations in which the leaders of al Qaeda in the Arabian Peninsula talked about the possibility of using an unidentified "Nigerian" bomber in an attack, according to intelligence officials.”

Every al Qaeda operative (big fish or little fish) in the Arabian Peninsula that said anything on the phone about this attack is going to think they were overheard. As such, they are ALL going to be more careful next time.

Consequences: Bad guys improve their tradecraft. US intelligence loses signal – going deaf is a bad thing. Net net, the likelihood of bad things happening in future, without detection, increases.

Well this is just [expletive ending in ‘ing’ omitted] great news … for the enemy!

I am a big fan of transparency, but when it is details from our play book … we are going to have to have some better judgment.

Transparency, Privacy and Responsibility

02:07 PM in Information management, National security | Permalink | Comments (3) | TrackBack (0)

January 19, 2010

The Christmas Day Intelligence Failure – Part II: Jeff Jonas’ Christmas Wish List

A few days ago I blogged a high-level synopsis of went wrong (enterprise amnesia) versus what our national security community needs (enterprise intelligence). In short, a smart system, among other things, would be expected to recognize if someone with an active visa later becomes a subject of concern. In such a system, the visa would be immediately reviewed for possible revocation.

As a “systemic failure” a number of things may need to be fixed.

Focusing on the technology issues, there are two things that absolutely must happen to not only catch more idiots, but more importantly arm the nation with the tools necessary to detect and preempt very sophisticated bad guys.

I am making my specific technical recommendations as a Christmas wish list. When thinking about a Christmas list, it is important to ensure the list is well thought out … as there is only so much money, and some toys last longer than others. And, like my kids eventually figured out, if one only asks for a few things that are within the budget, this dramatically increases the odds that they will get everything they ask for (as long as I can order it on-line, aka COTS).

Jeff Jonas’ Christmas Wish List

1. An identity resolved card catalog. Analysts (and/or their systems) at organizations like NCTC should be able to take one look in one place and determine what is known about someone – much in the same way the library has one card catalog. However, unlike the library, because this card catalog is identity resolved, cards about the same person are rubber-banded together. This is worth wishing for because it means when one searches and finds a card, they very well may find a bundle – a handful of related cards, each pointing to enterprise documents. Imagine that! Search for a name and date of birth, find a person, and find records in the enterprise related to them that had neither a name nor a date of birth, (e.g., only an email address). What is the value of this type of enterprise “discoverability”? Priceless. More here: It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness.

Not to be greedy, but this index needs to be updated in real time and provide real-time responses when queried. Otherwise, the next item on the wish list will not work so well. Fortunately, real-time indexes like this are actually more efficient than batch systems. More about this here: Accumulating Context: Now or Never.

Fortunately, the policy calling for “discoverability” in the intelligence community is already in place. See: ICD501 - Intelligence Community Directive 501.

2. The data must find the data and the relevance must find the user. Every time an organization receives a new piece of data … the organization has just learned something. With each new arriving piece of data, the system must immediately ask: “How does this relate to what is already known?” This discoverability question is handled by wish list item #1. This is data finds data – the new data discovers if the enterprise has other related data. This happens as data arrives. For example, if a new subject is added to a bad guy database, the system automatically discovers that this person has a visa, and publishes this insight e.g., sending an alert to the organization that investigates and revokes visas. Of course, for this to work the identity resolved catalog would also need to contain active visas. Yes, I am saying the index contains pointers to both subjects of interest, and visa holders, among many other things – much in the same way a library card catalog would contain books on anthropology, travel, science, and so on. This is not difficult. More here: Data Finds Data.

With just these two (2) items, at least an organization will be able to make some sense of what it knows … and in time to do something about it.

BONUS SECTION for prudent Christmas shoppers. Here are some toys not worth placing on your wish list as these will likely break, get discarded and/or may contain unsafe levels of lead:

1. Profiling the behavior of air travelers. Modifying existing systems to do a better job profiling based on one-way tickets, no checked luggage, and paying by cash is a waste of time. For one thing, it is too widely talked about in the press. And to avoid detection a terrorist will no doubt be willing to pay an extra $1,200 for a round trip ticket, will waste a $40 suitcase, and will find a way to use a credit card (like get a debit card or steal your identity). Worse, so many folks purchase one-way tickets (like me) and check no luggage (like me) the number of false positives will be impressive.

2. Investment in middleware that automates federated search. The federated search approach is somewhat akin to roaming the library halls looking for a book, instead of using the index. Today, analysts often face this dilemma – manually selecting which system to search, one hallway at a time. Note: There is no army of any size big enough to solve this problem. Unfortunately, this leads some folks to wish they had a smart middleware layer that would take a user’s query and perform the federated search automatically, bringing the results of all these disparate systems together into a single consolidated user response. Be advised, no amount of investment can fix federated search. While there are a number of show stoppers that make this a bad idea, one of them is: for data to find data this means that every piece of arriving data is the query. Imagine hammering countless enterprise systems with that kind of volume while these systems are busy doing their day job. More specifics about why this is nothing to wish for is explained here: Federated Discovery vs. Persistent Context – Enterprise Intelligence Requires the Later.

3. A point-specific solution to fix this recent lapse. If the current system is “upgraded” to specifically address this latest scenario, it should catch this one type of low hanging fruit. Bad news. We need a system that detects sophisticated plots, not just idiots. What we really need is a more general solution designed to commingle data from all-source intelligence collections, weaving this data together into context, enabling enterprise discovery and insight. Such a system not only finds the obvious (idiots and similar circumstances), more importantly, it is the only way to find very weak signal and the non-obvious signatures of highly skilled bad actors.

On a related note: Have you heard of the Darwinian Awards? Terrorists dumb enough to use a match to light a fuse in public will also likely run out of gas on the way to the operation. Point being, the system must be able to detect and preempt very smart bad guys with ever changing tradecraft and attack vectors.

4. Standardization of existing systems and data. This will take forever and cost too much in part because there are too many systems to reengineer, and if that is not hard enough, how are we going to get our foreign partners to adopt our standard? Be assured that standardizing everything first is not required. More about this thinking here: Scalability and Sustainability in Large Information Sharing Systems.

5. Just more analysts. If analysts feel overwhelmed by data today, just wait until next year and see how much harder it is. We must change the paradigm. With more advanced analytics making sense of the data, analysts will be substantially more efficient, maybe 10x, maybe 100x – a true force multiplier. Only then, after the analysts are truly enabled, will an organization be able to properly determine the number of analysts needed.

These five (5) wish list items, and a probably a slew of others, are not worth much attention as the cost/benefit will not impress anyone (except the bad guys).

January 12, 2010

The Christmas Day Intelligence Failure – Part I: Enterprise Amnesia vs. Enterprise Intelligence

I have been watching the public statements from our leadership, media reports, the blogosphere, and emails galore related to the failed December 25th, 2009 terrorist attempt.

In my opinion, this recent intelligence failure has more to do with a lack of imagination than anything else. I am not talking about the imagination of the intelligence analysts – they have been begging for help, instead they face endlessly deep alert queues where the top item is clearly not the most important of the day. And I am not talking about a lack of imagination of our senior leadership – they have been dedicating a vast amount of money for years now toward programs that should have already addressed this recent intelligence failure. Lawmakers even have been changing policy following advice from such organizations as the Markle Foundation’s Task Force of National Security in the Information Age (of which I am a proud member). Our leadership is rightfully miffed by the state of the union despite these substantial investments. Don’t blame the analysts or the leadership this time. The blame belongs elsewhere.

What happened?

Boiling down the Christmas event to its most simple form – Abdulmutallab applies for a multi-entry visa. The terrorist database (TIDE) is checked and found to contain no such record. The State Department issues a visa. Later, a TIDE record for Abdulmutallab is added to TIDE. Abdulmutallab gets to keep his visa, although his renewal in a few years would have been a problem.

Systems that assume the data will show up before the query are flawed. More about this here: What Came First, the Query or the Data?

The December 25th event is a classic case of enterprise amnesia. Enterprise Amnesia is the condition of knowing something on one hand and knowing something on another hand and never the two data points meet. This disease presents this way: after something bad happens everyone looks in their pile of puzzle pieces and brings to the boardroom table a small, hand-culled selection of data points. And right there before your eyes, it is so obvious. So obvious it can make an organization look incompetent or worse … negligent.

Contrast enterprise amnesia with Enterprise Intelligence. In this model, every time a new record is added, changed or deleted the organization has learned something. At that very split-second one must ask: how does this relate to what the organization already knows (its historical observations) and now that this is known, does it matter, and if so to whom?

Enterprise intelligence roughly translates to making sense of the situation (situational awareness) and then appropriately reacting at that moment (situational reaction). Jump. Duck. Sell it something. Shoot it with a laser from space.

What would analysts and policy makers expect from an "intelligent" system? Abdulmutallab applies for a multi-entry visa. The terrorist database (TIDE) is checked and found to contain no such record. The State Department issues a visa. Later, a TIDE record for Abdulmutallab is added to TIDE. The split-second this record is added to TIDE, the State Department is notified the visa may need reconsidered. (Was there enough evidence for revocation?) I believe when the dust settles and the forensics analysis is completed, whether it is open source or other intelligence collection, it will be clear Abdulmutallab would not have made it onto that plane, so long as this additional fodder was made discoverable.

Devil in the details. For all this to work, the system needs to realize that despite name variations and inconsistent data, the identity in the terrorist database is the identity in the visa system. Recognizing when two people are the same despite having been described differently is sometimes called Identity Resolution or Entity Resolution or more broadly Semantic Reconciliation. Whether one is solving national security challenges, identity theft faced by the financial institutions, or improving health care outcomes, figuring out two identities are the same within and across piles of data is essential to make sense out of the data. Hence my lifelong obsession with such technology.

As for the “Nigerian in Yemen”: Hardly a signal at all. To know if these fragments really mattered, one first must understand the entire universe of weak signal at that time, and how these weak signals have been changing. Gut tells me on any given day there are thousands upon thousands of such dots hovering around. While such chatter has some value – it will rarely, by itself, be a basis for immediate promotion to top-of-queue for the analysts. While this chatter was not essential to detecting and preempting this event, next time, when the signal is truly weak; such chatter may make the difference.

Now what? We must envision systems whereby analysts are not hopelessly pinned down in apathy by information overload … rather as volumes of data increase and signal gets weaker, the analysts get more efficient – producing higher quality and faster decision-making.

Question: Why is it when you put a puzzle together at home the last few pieces are as easy as the first few, despite the fact there is more data in front of you than ever before? More about this interesting phenomenon here: The Fast Last Puzzle Piece and how it is done here: Puzzling: How Observations Are Accumulated Into Context.

And it ain’t no Manhattan project. Let’s get ‘er done right this time, people.

August 16, 2009

Your Movements Speak for Themselves: Space-Time Travel Data is Analytic Super-Food!

It doesn’t matter who you say you are! Where you are (space), when you’re there (time), and your movements over time (travel) are closer to the truth.

I’ve seen a lot of data in my life, and I’d like to think I have a decent grip on what can be accomplished with data and analytics. However, I recently stumbled upon some facts that have radically reshaped my understanding of the world we are living in. What I thought was years away is already here! Our toes are dangling over the edge of a very different future.

Now, before you get all worked up, remember: You have helped create this, most folks love this, and most will continue to eat this up despite the obvious consequences.

Mobile devices in America are generating something like 600 billion geo-spatially tagged transactions per day. Every call, text message, email and data transfer handled by your mobile device creates a transaction with your space-time coordinate (to roughly 60 meters accuracy if there are three cell towers in range), whether you have GPS or not. Got a Blackberry? Every few minutes, it sends a heartbeat, creating a transaction whether you are using the phone or not. If the device is GPS-enabled and you’re using a location-based service your location is accurate to somewhere between 10 and 30 meters. Using Wi-Fi? It is accurate below10 meters.

Fancy.

It should be no surprise that all this data lives in the coffers of the cell providers. Lots of people know that. What is new, at least to me, is that this data is being provided to third parties that are leveraging specially designed analytics to make sense of our space-time-travel data.

With the data out and specialized analytics emerging, this infant industry is already doing some pretty amazing work. Your space-time-travel data makes where you live and where you work self-evident, and it reveals your most frequent, periodic, infrequent and rare destinations.

The data reveals the number of co-workers that join you Thursdays after work for a beer, and roughly where you all go. It knows where these same co-workers call home, and just exactly what kind of neighborhood they come from (e.g., average income, average home price) … information certainly useful to attentive direct marketing folks.

Large space-time data sets combined with advanced analytics enable a degree of understanding, discovery, and prediction that may be hard for many people to fully appreciate. Better prediction means a more efficient enterprise and nifty consumer services.

Cellular companies are now receiving essential insight about their customers (e.g., to better understand and predict customer churn). Major retailers can now better understand changes in consumer behavior (e.g., how far their customers are traveling on average this month compared to previous months). Consumers are benefiting by getting real-time traffic information so they can avoid congested roads. (I have a colleague that thinks he is saving two to four hours a week in commute time due to this service!)

Tip o’ the iceberg.

I can barely get my mind around the ramifications. My concept about what comes next shifts almost daily now. A government not so keen on free speech could use such data to see a crowd converging towards a protest site and respond before the swarm takes form – detected and preempted, this protest never happens. Or worse, it could be used to understand and then undermine any political opponent.

A stalker might be questioned just days after he starts and before his victim is personally aware of it – detection previously beyond human capacity. Maybe it’s not a crime in this case, and it turns out to be just a private investigator with poor tradecraft hired by a suspicious husband.

Such a surveillance intensive future is inevitable, irreversible and as I have said before here … irresistible.

Why? Companies must be competitive to survive and consumers have quite the appetite for almost anything that optimizes their life, especially if it’s cheap or free. For example:

Tuesday afternoon your [free] Gmail account advises you that your buddy Ken is going to be 15 minutes late to the pool hall this coming Thursday, unless he leaves work 15 minutes early … which he has only done twice in seven years. Brilliant!

Your Starbucks drink of choice (a grande vanilla soy latte in my case) is handed to you the instant you pull up, and you did not call ahead nor did they ask. Priceless!

When powerful analytics commingle space-time-travel data with tertiary data, the world we live in will fundamentally change. Organizations and citizens alike will operate with substantially more efficiency. There will be less carbon emissions, increased longevity, and fewer deaths.

I think people should know about this imminent new age we are marching into.

[Theatrical pause. Breathe.]

Now I’m going to step back and address some questions you may have, using the good news/bad news format.

Good news: The space-time-travel collected by the cellular network carriers is de-identified when provided to these third parties for privacy reasons in that it does not include your name, address, phone number, etc.; rather, unique identifiers are assigned to transactions from the same device so that trends can be measured.

Bad news: If you were to provide your home, work and one other address (e.g., gym, school) in most cases, with just these data points, you are re-identified. With just a few days of space-time-travel activity, your top three or four more frequently visited destinations become self-evident, and without a whole hell of a lot of effort you could be re-identified through a tertiary data set like a credit header.

Good news: There is so much data being produced, a lot of transactions are tossed aside, are sampled and summarized to make the computational effort feasible. Historical data also falls off the back of the wagon (ages off the system) rather quickly.

Bad news: The competitive nature of this emerging business model will likely require these organizations to make more sense of more data faster. Cloud computing and new classes of algorithms will make it possible to keep more transaction detail, keep it longer, and commingle it with other large and very interesting secondary data sets (e.g., phone books and property records).

Good news: So far there are only a handful of companies already entrusted with this data.

Bad news. It may not be good news that only a few companies do this. If only one company can monitor the consumer foot traffic of all Nordstrom stores in near real time, this would be an unfair advantage in terms of predetermining its financial condition before anyone else. As I learned from countless conversations with my friends at the ACLU, very powerful tools in the hands of a few is not often a good idea without one hell of a lot of oversight and accountability. And even then, this is no panacea.

Good news: Some of the organizations holding space-time-travel data are fully aware of the privacy consequences and are offering consumers the ability to opt-out – meaning, if they get a transaction about you it will be permanently removed from the system and all future correlation.

Bad news: If by chance a snapshot of sufficient detail had been sold off to another party before the opt-out request, then the toothpaste is out of the tube. Data tends to replicate, more about this here.

Good news: Not any old mom and pop operation can get into this business.

Bad news: That won’t be true for long. Suppose an aspiring entrepreneur makes a compelling proposition to a number of parties holding space-time-travel data. Anticipating free analytics and a cut of the future action, the parties work a deal. For computing power this entrepreneur simply hops onto Amazon’s EC2 cloud and partners with a data aggregator to get some tertiary data and what do they have? An ultra-sexy prediction engine.

Good news: People tend to appreciate location-based services, which is why they are opting in.

Bad news: Sensitive information about people is no longer under their own control. As well, a number of well held secrets (e.g., your hideout) evaporate overnight.

Good news: If you want to escape the consequences of having your space-time-travel being graphed by others, here are some options that come to mind:

(a) Stop using mobile devices;

(b) Use multiple devices e.g., use one device only at work, and only a land line at home – all mobile devices being off at all other times (never moving around with a device on) – being sure these mobile devices are registered to someone other than you – and if you need to use some kind of device while on the move or at other locations. see (c) below;

(c) Unregistered, cash-purchased, disposable devices – used once then discarded (or recycled!) – although in some cases you can use the device a few times, but you better let some fancy software (which I may have to invent) advise you what is safe usage and what is not.

(d) If you can figure out locations on earth where only one cell tower exists (and you are not moving between towers and never using GPS or Wi-Fi) you will probably live safely under the radar – unless you are a way bad mofo and others know it, in which case, you are ‘going down’ anyway because there are more tricks (expensive) which will be levied against you.

Bad news: Few are willing to be this inconvenienced. And if only a handful of innocent, clean living folks go to this same effort that the bad guys MUST employ … well crap, that in itself may be considered by some to be signal.

Net Net: My guess is most consumers don’t fully realize how their space-time-travel data is accumulating and congealing. I hope consumers come to appreciate how all of these nice conveniences of life are delivered. And I hope they will continue to enjoy these while they make better informed decisions, especially with respect to their privacy.

However, without a feedback loop consumers may never fully appreciate what can be gleaned from their space-time-travel trail. Therefore, one way to enlighten the consumer would involve holders of space-time-travel data to permit an owner of a mobile device the ability to also see what they can see:

(a) The top 10 places you spend the most time (e.g., 1. a home address, 2. a work address, 3. a secondary work facility address, 4. your kids school address, 5. your gym address, and so on);

(b) The top three most predictable places you will be at a specific time when on the move (e.g., Vegas on the 215 freeway passing the Rainbow exit on Thursdays 6:07 - 6:21pm -- 57% of the time);

(c) The first name and first letter of the last name of the top 20 people that you regularly meet-up with (turns out to be wife, kids, best friends, and co-workers – and hopefully in that order!)

(d) The best three predictions of where you will be for more than one hour (in one place) over the next month, not counting home or work.

I think Google’s Android and Latitude products might be able to move on something like this first. It would then be cool if other holders of space-time-travel data followed.

On the subject of privacy and civil liberties consequences, privacy by design is essential. And for those of you with ideas in the area of policy or technology, I would be most appreciative if you would share these thoughts with me … sooner rather than later.

I will continue sharing perspectives about these ideas and the apparent consequences with my many friends in the privacy community, the defense/intelligence community, and media. (Surprisingly, their feedback so far has been quite similar.) I am also speaking with the organizations amassing and analyzing this space-time-travel data to learn more about what is possible. From the perspective of the analytic engines I create, this space-time-travel data looks like “super food.”

USEFUL REFERENCE:

Internet Society: Wireless Location Privacy: Las and Policy in the US, EU, and Japan

Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society

Prediction: Channel Consolidation

More Data is Better, Proceed with Caution

How to Use a "Glue Gun" to Catch a Liar

05:13 PM in Information management, National security, Privacy | Permalink | Comments (33) | TrackBack (0)

March 16, 2009

Nation At Risk: Policy Makers Need Better Information to Protect the Country

Last Tuesday, March 10, The Markle Foundation Task Force on National Security in the Information Age released a report titled: Nation At Risk: Policy Makers Need Better Information to Protect the Country. (PDF here)

Members of the Task Force who prepared this report included: William Crowell, Bryan Cunningham, Jim Dempsey, John Gordon, Slade Gorton, Jeff Jonas (me!), Judith Miller, Jeffrey Smith, Abraham Sofaer, Rick White, and Richard Wilhelm.

We made the following five recommendations, calling for the accelerated creation of an information sharing framework:

1. Reaffirm Information Sharing as a Top Priority

2. Make Government Information Discoverable and Accessible to Authorized Users by Increasing the Use of Commercially Available Off-the-Shelf Technology

3. Enhance Security and Privacy Protections to Match the Increased Power of Shared Information

4. Transform the Information Sharing Culture with Metrics and Incentives

5. Empower Users to Drive Information Sharing by Forming Communities of Interest

The report is relatively short and to the point, just 27 pages long. It includes a handy four page appendix summarizing all of the recommendations (pages 22-25).

Here are a few elements I would like to bring to the attention of my readers:

Recommendation 2 speaks to "Discoverability." Our Task Force built on our earlier recommendations (in prior reports) to use data indices – much like the card catalog at the library. Using indices, users can locate data in the enterprise and if qualified for authorized use, they can limit access to the records of relevance. Notably, this model means less data is being transferred around, therefore less data must be kept in synch. The risk of unintended disclosure is mitigated to a degree because fewer copies of data are being made. In short, indices allow users to locate just what they need and no more.

In recommendation 3, the Task Force makes a number of specific security and privacy recommendations. One of my favorite examples is:

"… including implementation of real-time audits of user compliance and behavior and immutable audit logs that record how a system has been used …"

These Immutable Audit Logs are clever little inventions that allow oversight and accountability groups to see exactly how a system has been used. Even a system administrator cannot secretly change the past by altering the log. Imaging every time someone peeks into the card catalog whether they find something, or not, this is recorded in an indelible manner. What cards they saw, what books they looked at, and so on … all accounted for with no way to hide the facts.

The use of the term "metrics" in recommendation 4 is also worth special mention. One such metric the Task Force would like to see is reporting what percent of a system’s information is discoverable i.e., percentage of records that have corresponding cards in the card catalog. Case in point; what is the value of a book on the shelf at the library if there is no related card in the catalog?

Finally, as indices are going to be the way information sharing gets accomplished … in my opinion, the essential policy debate must immediately begin considering the following:

1. How many indices? There are benefits for fewer. And there are different benefits for more. One index for law enforcement and one for intelligence? Or, one index for foreign collections and another for open source? One index, 20 indices, or 100?

2. Where will these indices physically reside? At Google? (Note: Google is an index already used for open source).

3. Which key attributes will be placed in the index? While the library uses subject, title and author … maybe one index will need to contain who, what, where, when.

4. How much latency between data changes in source systems and their corresponding change in the index? For example, if a watch list record is deleted in a source system, what is the maximum amount of time one would want to wait until the same record is redacted from the card catalog?

5. When a user searches the card catalog, who do you notify when an index card is found?

a. Only the inquirer?

b. Only the owner?

c. Both?

d. Neither, only a third party is notified?

e. No one can be told?

6. When there is any notification, what information is revealed about the index card to the inquirer and/or data owner?

a. All the attributes related to the index card?

b. Some of the other attributes on the card (e.g., search author and see title)?

c. No other attributes are revealed?

d. The custodian organization of the data record?

e. The custodian source system of the record?

f. The actual record number used to identify this piece of data in the source system?

g. The user, if any, associated with this record, e.g., the analyst’s name and phone number?

7. When there is a notification to a data owner, what information is revealed about the inquirer?

a. All the attributes related to the search?

b. Some of the other attributes on the search?

c. No other attributes are revealed?

d. The inquirer’s organization?

e. The inquirer’s source system?

f. The actual session number used to initiate the inquirer’s search?

g. The inquirer’s name and phone number?

8. What user audit standards and processes will be required to ensure the system is being used in accordance with law and policy?

9. What metrics will be kept and who can see which metrics?

Discoverability: The First Information Sharing Principle

Information Sharing: Got Directory?

No Need to "Over Share" – Thoughts on Information Sharing

It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness

Federated Discovery vs. Persistent Context – Enterprise Intelligence Requires the Later

Immutable Audit Logs (IAL’s)

Found: An Immutable Audit Log

Full Attribution, Don’t Leave Home Without It

Out-bound Record-level Accountability in Information Sharing Systems

Data Tethering: Managing the Echo

To Anonymize or Not Anonymize, That is the Question

02:51 PM in National security, Privacy | Permalink | Comments (5) | TrackBack (0)

February 27, 2009

“Macro Trends: The Privacy and Civil Liberties Consequences … and Comments on Responsible Innovation” – My DHS DPIAC Testimony, September 2008

On Wednesday, September 17th, 2008 I testified before the DHS Data Privacy and Integrity Advisory Committee (DPIAC). The testimony transcripts were recently posted on the DHS web site.

Transcript Here (My testimony starts on the bottom of page 9.)

In this testimony I covered a number of topics including:

I. Macro Trends

1. The world is not a more dangerous place – average lifespan continues to increase (More here: The World is Not a More Dangerous Place)

2. Fewer people can create bigger effects faster … in both directions – destruction or value creation (More here: More Death Cheaper in Future, Ludicrous Speed Billionaires)

3. Competition is driving technology adoption – notably the organization who receives the data first has the advantage (More here: Ubiquitous Sensors? You Have Seen Nothing Yet)

4. Data is being created faster than organizations can make sense of it – to this degree organizations are getting dumber (More here: Why Faster Systems Can Make Organizations Dumber Faster)

5. Commingling data for enhanced context will drive a new generation of smarter systems (More here: Smart Systems Flip-Flop)

6. The surveillance society continues to build momentum as consumers find it irresistible (More here: Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society)

II. Las Vegas: What Can Be Learned

1. Las Vegas is one of the fastest growing cities in the Unites States of America (before the economic crash of course)

2. Casinos have a minimal security and surveillance budget

3. Casinos have a legal obligation, in some circumstances, to determine your identity (e.g., under age gambling, crossing a winnings threshold which necessitates IRS reporting)

4. Public and private watch lists are used – some compulsory, some elective

5. There are a fair number of scams that are tried on casinos – some scam artists are using false identities and disguises (More here: The Vegas Asymmetric Threat, Takin’ Vegas, Be Anyone in Las Vegas, Get Help Creating a Cover Story Here)

6. When employees go bad, this is particularly problematic

7. Most ‘tripwires’ are generated by alert employees who are watching, not by computers

8. An organization called Griffin Investigations provides information sharing of cheaters and advantage players (e.g., card counters) – they system is called Griffin GOLD (My old SRD company build this system)

9. One example of a watch list and insider-threat detection system known as Non-Obvious Relationship Awareness (NORA) was built for the industry (My old SRD company build this system too) (More here: IEEE Spectrum Story: Vegas 911, IEEE Paper: Threat and Fraud Intelligence – Las Vegas Style)

10. A patron can still enter a casino and enjoy a degree of activity without exposing their identity

11. There is no “predictive data mining” to spot unwanted behavior

12. Most vulnerabilities are remedied with processes not additional electronic surveillance

13. Humans are in the security decision loop – computer systems do not make security decisions, rather only promote items of interest

14. Facial recognition technology is not used at doors looking for watch listed persons

III. Towards Responsible Innovation

1. Technologists should more regularly engage the privacy community (More here: Responsible Innovation: Staying Engaged with the Privacy Community)

2. Information sharing systems must have information attribution (More here: Full Attribution, Don’t Leave Home Without It, Out-bound Record-level Accountability in Information Sharing Systems)

3. Data destruction requires careful planning and execution (More here: Decommissioning Data: Destruction of Accountability)

4. Limit data transfers and use indexes to make information discoverable (More here: Discoverability: The First Information Sharing Principle)

5. If data changes in a source system replicate this change through the information eco system (More here: Data Tethering: Managing the Echo)

6. Where possible obfuscate data (More here: To Anonymize or Not Anonymize, That is the Question)

7. Build high assurance accountability into systems (More here: Immutable Audit Logs (IAL’s), Found: An Immutable Audit Log)

8. Data mining is not always good or bad, it depends on the circumstances (More here: Effective Counter-Terrorism and the Limited Role of Predictive Data Mining, Data Mining, Predicate Triage and NSA Domestic Surveillance)

9. Link analysis, especially predicate-based, has some usefulness – although it is also wise to ‘prune’ early (More here: Hunting Bad Guys, Phone Records, and a Few Good Dead Men, Predicate-based Link Analysis: A Post 9/11 Analysis (1+1= 13), Sometimes a Big Picture is Worth a 1,000 False Positives)

10. Low fidelity watch list entries (identities with few attributes, e.g., name only) are problematic (More here: Precision in TSA’s Terrorist Watch List, Comments on the TSA No-Fly and Selectee Watch List Process)

IV. Closing Statements

1. There are going to be more sensors, more data. This data will be commingled for greater accuracy to serve consumers and to protect countries. What data is collected and when … will be the debate. Once data has been collected, the holder has the obligation to make sense of it.

2. The most fundamental principle I have synthesized from my many conversations with folks in the privacy advocacy community is this one point: “Avoid consumer surprise.” (More here: Where Possible … Avoid Consumer Surprise)

3. Finding professional bad actors involves the detection of weak signal. The computational remedy for weak signal involves observing and commingling transactions that are unanticipated by the bad actors.

4. Hence the tension.

[End of Testimony]

I wish I would have also made this point:

I am concerned. If organizations don’t start implementing more privacy-enhancing technology I think research and productization in this area will decrease in coming years. This would be a bad thing.

My Testimony Before The DHS Data Privacy and Integrity Advisory Committee (2005)

September 25, 2008

When Risk Assessment is the Risk

It is risky business to use risk assessment systems which produce alarms at a pace faster than the organization can evaluate and handle them.

The problem often takes one of these two forms: giant batch reports with so many pages it is an almost impossible task for analysts to manage each scored risk item; or real-time alerts that pile up in queues whereby analysts pick off the top while the backlog keeps growing.

All of these potential alarms lying around in reports or queues – each possibly a smoking gun – really must be viewed as potential evidence that could be used against you if stuff goes wrong. These unhandled alarms each evidence that the organization did not take a risk seriously and evidence that suggests someone was incompetent or negligent for not amassing the necessary resources to evaluate each and every alarm in a reasonable timeframe. Judgment day arrives after something bad happens when this incriminating – or even just suspect – evidence comes to light during forensic analysis. “Look the bad actor is right here on page 32,912 … had you appropriately staffed, this disaster would have never happened!”

I have a few suggestions for those organizations dealing with this problem already and those that would like to avoid this dilemma in the first place.

1. Favor the false negative – wherever possible don’t err on the side of alarm. While, obviously, you can’t ignore what appears to be a real, serious threat, err on the side of innocent behavior. Let new observations catch the false negatives. More about this here: How to Use a Glue Gun to Catch a Liar.

2. How one calculates relevance and when to register an alarm is crucial. On the technology side the objective is: the very next item in an alarm queue is the most important item for review. And in this model, no matter what … there is no reason to produce more alarms than there are available resources (e.g., analysts, systems) to deal with them. Therefore, especially on day one, configure your risk assessment engine to produce alarms appropriate to your individualized risk, staffing, and ability to respond. Then, as your resources have increasing bandwidth, consider increasing the alarm sensitivity.

3. When it comes to addressing the unresolved ambiguity that percolates under the alarm sensitivity, use tertiary data for automated disposition. Instead of having an army of analysts wrestling each “maybe” to the ground it makes more sense to locate what data is needed and let that data disambiguate these low grade risks en masse. Most risk ambiguity will be released as harmless, while a far smaller percentage will promote up to an actionable alarm. Example, if the phone book holds the evidence necessary to resolve some risk ambiguity (i.e., to learn the middle names are different thus concluding two identities are unrelated) – and a person would normally look here – then maybe the system can look there on its own. Lots of ambiguity can be solved with lots of data – but the question is what data and with what legal and policy justification?

4. The most “bulletproof” approach involves ... lawyers. In this case, one would contract with a law firm with expertise in information security law to bring expert engineers aboard for the analysis, technical testing and findings, and the ensuing debate which results in new corporate policy. All ‘discovery’ – including of negative findings that could be used against an organization in the future are then protected by attorney-client privilege and, therefore, are most likely to be protected from disclosure. And by the way, this also creates an “advice of counsel” defense to any future litigation. If you want to go this route I’ve got a few names, just ask.

My advice: Rarely is it a good idea to ask for a detailed report of every possible risk. So be careful what you ask for.

OTHER RELATED PAPERS:

Correcting False Positives: Redress and the Watch List Conundrum

Consequences of False Positives in Government Surveillance Systems

Sometimes a Big Picture is Worth a 1,000 False Positives

04:11 PM in Information management, National security | Permalink | Comments (1) | TrackBack (0)

February 18, 2008

Virtual Reality: There Is No Place Like Home

Increasingly over the last year, I have been asked to share my thoughts about virtual worlds (e.g., Second Life and World of Warcraft). After repeated provocation, I took a peek into these interactive 3D La-La-Lands to see what is up. Here are a few of my core conclusions:

1. Virtual realities will end up consuming the attention of a substantial number of humans and this will happen more quickly than most may think.
2. Data synchronization between the real world and virtual worlds will increase the relevance of virtual worlds.
3. Along with the eyeballs of transacting consumers will come increased corporate investment thus driving more relevance and more growth.
4. Investors in virtual world physics re-engineering will possess a distinct advantage in virtual worlds.
5. As with any tool, a very small percentage of the population will use virtual worlds for criminal activities.

Here are a few details related to these points.

Virtual reality: soon serving the masses. As these alternate worlds become more immersive (i.e., ability to hold ones attention when in the virtual space) and accessible (think One Laptop Per Child), I think it is possible that a half billion people show up. How soon? In six to ten years – maybe faster. Why? Because there are a lot of people on Earth that would rather exist in a synthetic world as opposed to their real world. Hmmm … shanty town, nagging spouse, or insurmountable odds versus a stimulating environment with near limitless potential to reinvent oneself.

Cross-reality synchronization. Imagine taking heat sensors in a real-world data center and publishing these into a virtual space which is physically configured like the real data center. The difference being that the immersed person can now physically visualize the temperature distribution in the data center. This is already being done. Then move something in the physical world and it moves in the virtual world at the same time, automatically. I wouldn’t be surprised if this is already happening in some context, somewhere. As well, the inverse: There is supposedly a fellow who has an island in Second Life with a surveillance mechanism implemented that sends him a real-world email or text message whenever someone steps foot onto his island. Long story short, if one wants to look at something specific, if the real and virtual worlds are synchronized, it’s going to be cheaper, faster and will burn less carbon if one takes the virtual option.

Real economic growth in unreal worlds. Have you heard about the real estate developer in Second Life that has made $1,000,000 (real) US dollars? True. Linden dollars, the monetary unit in Second Life, have their own currency exchange to US dollars called the LindeX – a currency market apparently moving millions of dollars a month between the virtual and real worlds. Point being, if a billion people show up in virtual spaces, each on average spending only eleven cents ($0.11) a month – this amounts to a real growth market which will trigger further industry investment. Consequently: more people arrive.

Virtual world physics re-engineering. Through serendipity, careful study, and/or experimentation it is possible to develop capabilities within virtual reality that other participants, or in some cases even the creator, cannot fathom. The first such instance I heard of five or six years ago involved a player who figured out he could climb walls by mounting deactivated explosive devices on a wall. Placing one above the other, the avatar cleverly scaled the wall. He climbed so high that he moved beyond the rendered space … into a region of the game where all that was visible was texture-less grid lines. In a more recent example, in Second Life an individual created a covert listening device the size of a single pixel -- then placed this pixel inside some object. Later when the object was near a conversation, all communications were echoed to a third party unbeknownst to the victims. Prior to this event many players in Second Life would not have considered this possible. Game physics re-engineering is also happening in World of Warcraft (where it is called "Theorycraft"). In this virtual world, one expert explained it to me this way “[we are] unwrapping the mathematics and developing a perception of space and time in relation to the virtual world, that determines which combination of attacks or defenses have the greatest efficacy.” This info is then shared with colleagues in password protected chat rooms. Using this knowledge delivers extraordinary advantage, namely lethality per second optimizations, hence the importance of keeping this specialized knowledge to a privileged few as long as possible. By the way, let’s not forget that we are re-engineering the physics here on Earth in a similar manner. Heck, ten thousand years ago, who would have conceived of the possibility that spaceships could be devised to take man to the moon and back!

Tools are tools. Are virtual spaces dangerous? Well, is a phone, the Internet and email dangerous? Nope, not for the most part, in fact the opposite, as the social and economic values of these technologies far outweigh the consequences of misuse. Sure bad actors will continue to use the best tools they can get their hands on too. And with this behavior, as more bad actors show up … the folks paid to “protect” us will venture into these virtual spaces in an effort to detect and preempt. Hence some of my quotes in this recent Washington Post story “Spies Battleground Turns Virtual.”

And finally, how will you know virtual worlds are starting to collide with your own real world? Watch for this sign: someone wants to chat with you while showing you something and they explain the best way to do this efficiently is for you to “step in” [to the virtual world that is].

December 16, 2007

The Vegas Asymmetric Threat

If you have not already seen my post entitled Takin’ Vegas, I recommend you read it first.

Guns don’t kill people. People kill people. And so it is. In Vegas, behind every scam there is a "who" … and it is always a who (or many whos) that lays out strategies, develops plans, recruits actors, trains, adapts, rehearses and ultimately executes the mission – all in hopes of taking home some loot. Undetected.

How do they do this?

For starters, if the actor believes he has already become known to casinos as a subject of interest, he will attempt to defeat recognition through the use of a disguise e.g., changing his hair style, growing a beard, sporting a bandana, slipping into some motorcycle apparel, etc. Some go so far as cross-dressing or pretending to be wheelchair-ridden.

Beyond a new look, opportunists will claim false identities and carry false credentials. There is one particular subject I am familiar with that has used over 30 very different aliases and a handful for different social security numbers and dates of birth. [On a funny but related note, check this out: Be Anyone in Vegas: Get Help Creating a Cover Story Here]

When actors want to expand their business, they recruit. Recruitment can be local or distant. New recruits are trained in rogue facilities so that by the time these new actors appear on the scene, they have superb tradecraft despite having never laid foot in a casino.

One insidious form of recruitment is the recruitment of a casino’s longstanding, high roller to participate in a coordinated covert scheme … or worse, the recruitment of the casino’s own employees. I know of one case where a dealer was coerced into assisting the scammers after being told his wife and children were going to be hurt.

The more significant the opportunity, the more organized the group, which means strategy meetings, business plans, capital raising, operating procedures, training guides, and so on. Attention to detail is essential to increased revenues and the sustainability of the group effort.

Larger teams may establish counter-intelligence measures to reduce the risk of being infiltrated by the establishment or scammed themselves by scammers. Their own team members may be placed under covert surveillance to ensure these trusted insiders have not gone bad over time as trust has a half-life.

Large teams have cells, sub-units that are expected to work together. Some cell members are members of several cells. As with any organization there are conflicting purposes and ideologies, thus membership in cells tend to morph over time.

Often, there is no apparent center of power. New groups emerge simply based on the inspiration of a movie, book, online chat rooms, etc. Groups form, merge, split and dissolve. Some groups just specialize in card counting while others specialize in a certain cheating methods e.g., "bet pressing" – adding to a bet after the outcome is known or the manufacturing of illegal cheating devices. Some groups start with one particular brand of cheating and then branch out into other specialties.

Imagine coordinating a team with 50, 100 and sometimes even more actors! What a challenge!

Well, actually, thanks to the Internet … training, recruitment, soft targets, etc. are at one’s fingertips. Some web sites maintain a level 1 area with limited revelation and benign chat rooms. There are level 2 areas which require the user first undergo a background check before being provided access. At level 3 the member is not only required to have a background check but is also required to have committed a felonious activity. And it is this group that shares even more sensitive information … for argument’s sake this might be viewed as equivalent to a government "Top Secret" clearance. Above this level, much like a military’s Special Access Program, very specialized knowledge is controlled to a minimum and known universe of folks. When the identities of the 12 Nevada dealers with subtle procedural defects in how they dealt hand held blackjack were discovered, such secrets are worthy of such extraordinary controls. The principle: if too many people knew about this weakness, it may be exploited at a pace that would have resulted in casino defection, prompting the casino to quickly close this vulnerability.

The latest challenge? Poker.

Poker is the problem these days. You think you are playing at a table with a fair shot. But unbeknownst to you, there is a team on that table working together against you – even though they make no outward appearance of knowing each other.

Is that slight twitch in the eye "natural" or "a signal"?

Takin’ Vegas

IEEE Spectrum Story: Vegas 911

IEEE Paper: Threat and Fraud Intelligence – Las Vegas Style

Web 2.0 – Al Qaeda’s Most Effective Force Multiplier

01:28 PM in Las Vegas, National security | Permalink | Comments (4) | TrackBack (0)

Jeff Jonas

A collection of thoughts on information management and privacy in the information age, injected with a few personal stories.

About

January 2013

Archives

Become a Fan