Jeff Jonas

NSA Superheroes Help Fix Everyone’s Internet #WildIdeas #SpyReboot

I do believe it is game over for business as usual for those in the intelligence business.  Radical reinvention of the US intelligence community is in order.  What we need now are big, creative, wild ideas as we re-create our next generation, world-class, trusted, hyper-efficient, and globally admired intelligence apparatus.  I explained this thinking here #SpyReboot.

With this in mind … how about this crazy idea for starters:

Maybe one of the NSA’s new roles would include: timely and vigilant disclosure of every zero-day exploit, design weakness or other discovered vulnerability they find in the world’s information and communications technology infrastructure.  These discreet disclosures would be made to manufacturers globally – US and foreign companies alike, including for example the Chinese company Huawei.  Why?  Well, most of the world is friend, not foe … and lots of our friends use other people’s stuff.

While patching these hardware and software deficiencies is the responsibility of the manufacturer; just because they are notified is no guarantee they act.  So maybe one way to compel manufacturers to take action would involve publishing some specific statistics about how many discovered/disclosed vulnerabilities remain un-answered- all in the name of transparency, of course.  If manufacturers competed for security and trust around these public statistics, maybe everybody wins.

The NSA will still be sneaky.  And if this sneaky work uncovers new vulnerabilities being eyed by foreign governments or criminal organizations, these too will be revealed.

True, we will be shooting ourselves in the foot with respect to our ability to penetrate some significant, hard to reach adversaries.  But balance this cost with the many upsides: (1) The world’s infrastructure is more secure; 2) Global banking is less at risk; (3) There are fewer data breaches as it becomes harder for bad guys to steal data; (4) Average citizens world-wide will have more confidence in the security of their private communications; (5) Dissidents in oppressive countries will be less at risk when speaking up; (6) The amount of stolen US intellectual property over cyber channels will see all-time lows; (7) US technology manufacturers will recover much of the world’s trust in its ability to produce safe and secure products.  Outcomes of such significance may well be worth the loss of some intelligence collection.  Oh and by the way, I think foreign intelligence organizations will be at least as disadvantaged as the US, as their exploited foreign (and domestic) pipes that they currently enjoy also begin to dry up.

This one shift in mission would help level the cyber playing field in a way that the US could lead with credibility – yes, in part because the world now knows (thanks to the leaked documents) just how superior the NSA is, offensively.

The word ‘loved’ might be too strong, but do not underestimate the goodwill and trust towards the USA that would come from the free, voting people of the world as the NSA takes on the mission to help secure the Internet for everyone.

The NSA will still be expected to carry out offensive espionage, including SIGINT collection against foreign targets.  And just because they have discretely disclosed the vulnerability to a manufacturer does not mean they won’t exploit the hell out of it until someone patches it.  The NSA will also surely be investing in and using other clever (secret) methods – methods other than weakened, commercially available technology.

This might actually be a horrible idea.  I don’t know.  The devil is in the details.  How would this be implemented?  What is the new oversight mechanism?  What kind of transparency would accompany this mission?  Would publishing the total number of disclosed vs. fixed vulnerabilities by manufacturer and product really compel companies to make fixes faster?

Oh, and while I am thinking about it: to maximize this Jiu-jitsu move, maybe this white hat team of NSA geniuses should be moved from the NSA to a different organization, e.g., National Institute of Standards and Technology (NIST), National Telecommunications & Information Administration (NTIA) at the Department of Commerce, or Federal Communication Commission (FCC).

This idea might be too wild, or God forbid, not wild enough.  One thing is clear – we need to break out of the old ways of thinking.  Instead, let’s all start focusing on wild ideas in general, ideally hundreds of such ideas, as we envision a next generation, trusted, world-class, hyper-efficient, and globally admired intelligence apparatus.

Lots of law and policy have to be fixed too – wait till you hear my wild idea about what to do about the problematic “3^rd Party Doctrine.”

RELATED POSTS:

#SpyReboot

 

 

#SpyReboot

When the captain of the Titanic learned five compartments of its hull had been breached by the iceberg, he knew what was going to happen next.  When thinking about the scope of Snowden’s disclosed documents (e.g., NSA’s ANT Division Catalog of Exploits), it seems to me one could come to a pretty quick conclusion about what happens next: Game over for business as usual for the US intelligence community.  It is time to reboot the US intelligence community – doing this will require big, creative, wild ideas.

The intelligence community is already in a monster pickle and the world has only seen a fraction of the documents, if the reported number of stolen documents is true.

From the 80,000 foot view I can foresee so many second and third order effects in the future – it’s quite mind numbing.  Sure, we now have a bigger chunk of the US population that does not trust our government; a growing concern over the erosion of our 4^th Amendment in the name of national security; and a global outcry saying ”foul.” Important debates around these things are happening now.  But this is not even remotely half the problem for the US intelligence community.

Foreign manufacturers of information and communications technology (ICT) are surely going to use these revelations to undermine US products in their sales pitches.  US industry is at risk of losing billions in business over coming years, whether they were called out in the Snowden documents or not.

Foreign intelligence organizations may look upon these documents as roadmaps and best practices.  If these organizations point these new capabilities inward, especially in less democratic countries, the citizens of these countries will be subject to unprecedented levels of government surveillance.  So the US becomes more transparent and our 300 million US citizens benefit from less wholesale surveillance all the while several billion people experience exactly the opposite.  Unremedied, we, the US, will bear responsibility for this.

On the current trajectory, trust at home and abroad is going to shake the rafters, economically and otherwise.  All the while our intelligence apparatus is going to see ever-shrinking yields on the money we spend.  Said another way, on the current heading, given the vessel, current weather and coming forecast, the risk to the crew (our democracy) is unacceptably high while at the same time the previous well-traveled route will now prove to be an epic waste of energy.

While the recent recommendations by the President’s Review Group on Intelligence and Communications Technologies cover a wide range of things worth considering and/or fixing, these are incremental tweaks (e.g., where the metadata lives).  Even if all of these recommendations are followed, a major ‘methods of operations’ reboot is still in order.  From my point of view, making incremental tweaks at this point is akin to the Titanic captain proposing to preserve ship power by re-wiring the electrical system, while the vessel will still, no matter what, be going nose-down.

Radical reinvention of US intelligence community is in order.  What we need now are big, creative, wild ideas as we re-create our next generation, world-class, trusted, hyper-efficient, and globally admired intelligence apparatus.

I plan on posting some of my own wild ideas soon.

I encourage you to propose your own wild ideas too – use the #SpyReboot #WildIdeas hash tags so folks can find them.

Big Data Flows vs. Wicked Leaks

I was invited to deliver a short keynote about "big data" at today's OECD roundtable focused on the economics of personal data and privacy.  My presentation here.

Most big data flows by design.  But when big data leaks the consequences can be wicked. 

That said … protecting big data from wicked leaks is not going to be easy.  Defending against external cyber penetrations and insider threats are both hard problems.

Now with the Wikileaks disclosures it is clear the game has changed.  Historically, public disclosure of classified data has been limited and infrequent – let’s even say, to a degree, tolerable.  Contrast that with the scope of the recently leaked cables.  At some point it may become intolerable.  In which case, I will not be surprised if a number of governments around the world attempt to enact new, wide-sweeping, anti-leak legislation directed at not only those engaged in the initial theft of the data, but the distribution points (e.g., Wikileaks) and the publishers (e.g., the media).  The principle being if one knowingly receives and benefits from stolen property, they are accomplices.  This pendulum could swing so far (backwards) the future will have far fewer media leaks than the historical (tolerable) volumes – i.e., this whole fiasco resulting in less transparency and accountability.

BTW: I suppose it could have been worse.  What if the 250,000 classified cables where selectively and quietly passed around to various foreign intelligence services?  What if the US thought these were secrets?  Imagine believing one has a certain security posture … when one does not.  Would that be worse? 

Organizations with big data worth protecting must employ extraordinary controls to reduce the risk of unintended disclosure.  On that note, I closed with a few ideas related to protecting big data from wicked leaks, including:

Central indexes.  There are actually a number of scenarios where a single, central catalog of pointers is better than lots of copies of the same data scattered all over the place – the advantage being fewer copies of the data and uniform access controls and audit logs.

Anonymization.  Despite the imperfections of data anonymization, when it comes to reducing the risk of unintended disclosure, most would agree that data anonymization is still better than clear text.

Immutable audit logs.  Tamper resistant audit logs can be used to help prove the users of the system are complying with law and policy.

Real-time active audits.  It is now going to be essential that user activity be more rigorously analyzed, in real-time, for inappropriate behavior.  Audit logs have actually been part of the problem – just another big pile of data – evidence of misuse hiding in plain sight against the backdrop of millions and millions of benign audit records.

 

RELATED POSTS:

Big Data. New Physics.

More Death Cheaper in Future

How Many Copies of Your Data? Is Somewhat Like Asking: How Many Licks to the Center of the Tootsie Pop?

It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness

"Need to Know" vs. "Need to Share" – A Very Fine Line Indeed

To Anonymize or Not Anonymize, That is the Question

Immutable Audit Logs (IAL’s)

Using Transparency As A Mask

The Christmas Day Intelligence Failure – Part III of III: Deadly Transparency

In Part I I boiled down what went wrong.  In Part II I commented on the fix.  And now finally, I think it is important to point out what scares me most.

Sometimes transparency will get you dead.

If you had an arch enemy that was working feverishly to locate and kill you, would you publish your travel schedule, security strengths and weaknesses … down to the hour of the night you will be sleeping and the closest window?

Press accounts like this make me want to throw up.

Excerpt: “About four months before the attempted bombing on December 25, the NSA intercepted telephone conversations in which the leaders of al Qaeda in the Arabian Peninsula talked about the possibility of using an unidentified "Nigerian" bomber in an attack, according to intelligence officials.”

Every al Qaeda operative (big fish or little fish) in the Arabian Peninsula that said anything on the phone about this attack is going to think they were overheard.  As such, they are ALL going to be more careful next time.

Consequences: Bad guys improve their tradecraft.  US intelligence loses signal – going deaf is a bad thing.  Net net, the likelihood of bad things happening in future, without detection, increases.

Well this is just [expletive ending in ‘ing’ omitted] great news … for the enemy!

I am a big fan of transparency, but when it is details from our play book … we are going to have to have some better judgment.

RELATED POSTS:

Transparency, Privacy and Responsibility

The Christmas Day Intelligence Failure – Part II: Jeff Jonas’ Christmas Wish List

A few days ago I blogged a high-level synopsis of went wrong (enterprise amnesia) versus what our national security community needs (enterprise intelligence).  In short, a smart system, among other things, would be expected to recognize if someone with an active visa later becomes a subject of concern.  In such a system, the visa would be immediately reviewed for possible revocation.

As a “systemic failure” a number of things may need to be fixed.

Focusing on the technology issues, there are two things that absolutely must happen to not only catch more idiots, but more importantly arm the nation with the tools necessary to detect and preempt very sophisticated bad guys.

I am making my specific technical recommendations as a Christmas wish list.  When thinking about a Christmas list, it is important to ensure the list is well thought out … as there is only so much money, and some toys last longer than others.  And, like my kids eventually figured out, if one only asks for a few things that are within the budget, this dramatically increases the odds that they will get everything they ask for (as long as I can order it on-line, aka COTS).

Jeff Jonas’ Christmas Wish List

1. An identity resolved card catalog.  Analysts (and/or their systems) at organizations like NCTC should be able to take one look in one place and determine what is known about someone – much in the same way the library has one card catalog.  However, unlike the library, because this card catalog is identity resolved, cards about the same person are rubber-banded together.  This is worth wishing for because it means when one searches and finds a card, they very well may find a bundle – a handful of related cards, each pointing to enterprise documents.  Imagine that!  Search for a name and date of birth, find a person, and find records in the enterprise related to them that had neither a name nor a date of birth, (e.g., only an email address). What is the value of this type of enterprise “discoverability”?  Priceless. More here: It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness.

Not to be greedy, but this index needs to be updated in real time and provide real-time responses when queried.  Otherwise, the next item on the wish list will not work so well.  Fortunately, real-time indexes like this are actually more efficient than batch systems.  More about this here: Accumulating Context: Now or Never.

Fortunately, the policy calling for “discoverability” in the intelligence community is already in place. See: ICD501 - Intelligence Community Directive 501.

2. The data must find the data and the relevance must find the user.  Every time an organization receives a new piece of data … the organization has just learned something.  With each new arriving piece of data, the system must immediately ask: “How does this relate to what is already known?” This discoverability question is handled by wish list item #1.  This is data finds data – the new data discovers if the enterprise has other related data.  This happens as data arrives.  For example, if a new subject is added to a bad guy database, the system automatically discovers that this person has a visa, and publishes this insight e.g., sending an alert to the organization that investigates and revokes visas.  Of course, for this to work the identity resolved catalog would also need to contain active visas.  Yes, I am saying the index contains pointers to both subjects of interest, and visa holders, among many other things – much in the same way a library card catalog would contain books on anthropology, travel, science, and so on.  This is not difficult.  More here: Data Finds Data.

With just these two (2) items, at least an organization will be able to make some sense of what it knows … and in time to do something about it.

BONUS SECTION for prudent Christmas shoppers.  Here are some toys not worth placing on your wish list as these will likely break, get discarded and/or may contain unsafe levels of lead:

1. Profiling the behavior of air travelers.  Modifying existing systems to do a better job profiling based on one-way tickets, no checked luggage, and paying by cash is a waste of time.  For one thing, it is too widely talked about in the press.  And to avoid detection a terrorist will no doubt be willing to pay an extra $1,200 for a round trip ticket, will waste a $40 suitcase, and will find a way to use a credit card (like get a debit card or steal your identity).  Worse, so many folks purchase one-way tickets (like me) and check no luggage (like me) the number of false positives will be impressive.

2. Investment in middleware that automates federated search.  The federated search approach is somewhat akin to roaming the library halls looking for a book, instead of using the index.  Today, analysts often face this dilemma – manually selecting which system to search, one hallway at a time. Note: There is no army of any size big enough to solve this problem.  Unfortunately, this leads some folks to wish they had a smart middleware layer that would take a user’s query and perform the federated search automatically, bringing the results of all these disparate systems together into a single consolidated user response.  Be advised, no amount of investment can fix federated search.  While there are a number of show stoppers that make this a bad idea, one of them is: for data to find data this means that every piece of arriving data is the query.  Imagine hammering countless enterprise systems with that kind of volume while these systems are busy doing their day job.  More specifics about why this is nothing to wish for is explained here:  Federated Discovery vs. Persistent Context – Enterprise Intelligence Requires the Later.

3. A point-specific solution to fix this recent lapse.  If the current system is “upgraded” to specifically address this latest scenario, it should catch this one type of low hanging fruit.  Bad news.  We need a system that detects sophisticated plots, not just idiots.  What we really need is a more general solution designed to commingle data from all-source intelligence collections, weaving this data together into context, enabling enterprise discovery and insight. Such a system not only finds the obvious (idiots and similar circumstances), more importantly, it is the only way to find very weak signal and the non-obvious signatures of highly skilled bad actors. 

On a related note: Have you heard of the Darwinian Awards?  Terrorists dumb enough to use a match to light a fuse in public will also likely run out of gas on the way to the operation.  Point being, the system must be able to detect and preempt very smart bad guys with ever changing tradecraft and attack vectors.

4. Standardization of existing systems and data.  This will take forever and cost too much in part because there are too many systems to reengineer, and if that is not hard enough, how are we going to get our foreign partners to adopt our standard?  Be assured that standardizing everything first is not required.  More about this thinking here: Scalability and Sustainability in Large Information Sharing Systems.

5. Just more analysts.  If analysts feel overwhelmed by data today, just wait until next year and see how much harder it is.  We must change the paradigm.  With more advanced analytics making sense of the data, analysts will be substantially more efficient, maybe 10x, maybe 100x – a true force multiplier. Only then, after the analysts are truly enabled, will an organization be able to properly determine the number of analysts needed. 

These five (5) wish list items, and a probably a slew of others, are not worth much attention as the cost/benefit will not impress anyone (except the bad guys).

 

RELATED PAPERS:

Markle Foundation – Nation At Risk: Policy Makers Need Better Information to Protect the Country

CATO Institute – Effective Counterterrorism and the Limited Role of Predictive Data Mining  

IEEE – Threat and Fraud Intelligence: Las Vegas Style 

OTHER RELATED POSTS:

The Christmas Day Intelligence Failure – Part I: Enterprise Amnesia vs. Enterprise Intelligence

Nation At Risk: Policy Makers Need Better Information to Protect the Country

Intelligent Organizations – Assembling Context and The Proof is in the Chimp!

Enterprise Intelligence – My Presentation at the third Annual Web 2.0 Summit

Enterprise Intelligence: Conference Proceedings from TTI/Vanguard (December 2006)

Data Finds Data

What Do You Know? Introducing Perpetual Analytics

You Won’t Have to Ask -- Data Will Find Data and Relevance Will Find the User

Sensing Importance: Now or Never

More Data is Better, Proceed With Caution

Scalability and Sustainability in Large Information Sharing Systems

Big Breakthrough in Performance: Tuning Tips for Incremental Learning Systems

The Christmas Day Intelligence Failure – Part I: Enterprise Amnesia vs. Enterprise Intelligence

I have been watching the public statements from our leadership, media reports, the blogosphere, and emails galore related to the failed December 25th, 2009 terrorist attempt.

In my opinion, this recent intelligence failure has more to do with a lack of imagination than anything else.  I am not talking about the imagination of the intelligence analysts – they have been begging for help, instead they face endlessly deep alert queues where the top item is clearly not the most important of the day.  And I am not talking about a lack of imagination of our senior leadership – they have been dedicating a vast amount of money for years now toward programs that should have already addressed this recent intelligence failure. Lawmakers even have been changing policy following advice from such organizations as the Markle Foundation’s Task Force of National Security in the Information Age (of which I am a proud member).  Our leadership is rightfully miffed by the state of the union despite these substantial investments.  Don’t blame the analysts or the leadership this time.  The blame belongs elsewhere.

What happened? 

Boiling down the Christmas event to its most simple form – Abdulmutallab applies for a multi-entry visa. The terrorist database (TIDE) is checked and found to contain no such record.  The State Department issues a visa.  Later, a TIDE record for Abdulmutallab is added to TIDE.   Abdulmutallab gets to keep his visa, although his renewal in a few years would have been a problem. 

Systems that assume the data will show up before the query are flawed. More about this here: What Came First, the Query or the Data? 

The December 25th event is a classic case of enterprise amnesia.  Enterprise Amnesia is the condition of knowing something on one hand and knowing something on another hand and never the two data points meet.  This disease presents this way: after something bad happens everyone looks in their pile of puzzle pieces and brings to the boardroom table a small, hand-culled selection of data points.  And right there before your eyes, it is so obvious.  So obvious it can make an organization look incompetent or worse … negligent.

Contrast enterprise amnesia with Enterprise Intelligence.  In this model, every time a new record is added, changed or deleted the organization has learned something.  At that very split-second one must ask: how does this relate to what the organization already knows (its historical observations) and now that this is known, does it matter, and if so to whom? 

Enterprise intelligence roughly translates to making sense of the situation (situational awareness) and then appropriately reacting at that moment (situational reaction).  Jump.  Duck.  Sell it something. Shoot it with a laser from space. 

What would analysts and policy makers expect from an "intelligent" system?  Abdulmutallab applies for a multi-entry visa.  The terrorist database (TIDE) is checked and found to contain no such record.  The State Department issues a visa.  Later, a TIDE record for Abdulmutallab is added to TIDE. The split-second this record is added to TIDE, the State Department is notified the visa may need reconsidered.  (Was there enough evidence for revocation?)  I believe when the dust settles and the forensics analysis is completed, whether it is open source or other intelligence collection, it will be clear Abdulmutallab would not have made it onto that plane, so long as this additional fodder was made discoverable. 

Devil in the details.  For all this to work, the system needs to realize that despite name variations and inconsistent data, the identity in the terrorist database is the identity in the visa system.  Recognizing when two people are the same despite having been described differently is sometimes called Identity Resolution or Entity Resolution or more broadly Semantic Reconciliation.  Whether one is solving national security challenges, identity theft faced by the financial institutions, or improving health care outcomes, figuring out two identities are the same within and across piles of data is essential to make sense out of the data.  Hence my lifelong obsession with such technology.

As for the “Nigerian in Yemen”: Hardly a signal at all.  To know if these fragments really mattered, one first must understand the entire universe of weak signal at that time, and how these weak signals have been changing.  Gut tells me on any given day there are thousands upon thousands of such dots hovering around.  While such chatter has some value – it will rarely, by itself, be a basis for immediate promotion to top-of-queue for the analysts.  While this chatter was not essential to detecting and preempting this event, next time, when the signal is truly weak; such chatter may make the difference.

Now what?  We must envision systems whereby analysts are not hopelessly pinned down in apathy by information overload … rather as volumes of data increase and signal gets weaker, the analysts get more efficient – producing higher quality and faster decision-making.

Question: Why is it when you put a puzzle together at home the last few pieces are as easy as the first few, despite the fact there is more data in front of you than ever before? More about this interesting phenomenon here: The Fast Last Puzzle Piece and how it is done here: Puzzling: How Observations Are Accumulated Into Context.  

And it ain’t no Manhattan project.  Let’s get ‘er done right this time, people.

OTHER RELATED POSTS:

Enterprise Intelligence – My Presentation at the third Annual Web 2.0 Summit

Entity Resolution Systems vs. Match Merge/Merge Purge/List De-duplication Systems

Puzzling: How Observations Are Accumulated Into Context

The Fast Last Puzzle Piece

What Do You Know? Introducing Perpetual Analytics

Federated Discovery vs. Persistent Context – Enterprise Intelligence Requires the Later

Streaming Analytics vs. Perpetual Analytics (Advantages of Windowless Thinking)

It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness

To Know Semantic Reconciliation is to Love Semantic Reconciliation

Algorithms At Dead-End: Cannot Squeeze Knowledge Out Of A Pixel

Context: A Must-Have and Thoughts on Getting Some …

More Data is Better, Proceed With Caution

How to Use a Glue Gun to Catch a Liar

It Turns Out Both Bad Data and a Teaspoon of Dirt May Be Good For You

There Is No Such Thing As A Single Version of Truth

Sequence Neutrality in Information Systems

Big Breakthrough in Performance: Tuning Tips for Incremental Learning Systems

Your Movements Speak for Themselves: Space-Time Travel Data is Analytic Super-Food!

It doesn’t matter who you say you are!  Where you are (space), when you’re there (time), and your movements over time (travel) are closer to the truth.

I’ve seen a lot of data in my life, and I’d like to think I have a decent grip on what can be accomplished with data and analytics.  However, I recently stumbled upon some facts that have radically reshaped my understanding of the world we are living in.  What I thought was years away is already here! Our toes are dangling over the edge of a very different future.

Now, before you get all worked up, remember: You have helped create this, most folks love this, and most will continue to eat this up despite the obvious consequences.

Mobile devices in America are generating something like 600 billion geo-spatially tagged transactions per day.  Every call, text message, email and data transfer handled by your mobile device creates a transaction with your space-time coordinate (to roughly 60 meters accuracy if there are three cell towers in range), whether you have GPS or not.  Got a Blackberry?  Every few minutes, it sends a heartbeat, creating a transaction whether you are using the phone or not.  If the device is GPS-enabled and you’re using a location-based service your location is accurate to somewhere between 10 and 30 meters.  Using Wi-Fi?  It is accurate below10 meters.

Fancy.

It should be no surprise that all this data lives in the coffers of the cell providers.  Lots of people know that.  What is new, at least to me, is that this data is being provided to third parties that are leveraging specially designed analytics to make sense of our space-time-travel data. 

With the data out and specialized analytics emerging, this infant industry is already doing some pretty amazing work. Your space-time-travel data makes where you live and where you work self-evident, and it reveals your most frequent, periodic, infrequent and rare destinations. 

The data reveals the number of co-workers that join you Thursdays after work for a beer, and roughly where you all go. It knows where these same co-workers call home, and just exactly what kind of neighborhood they come from (e.g., average income, average home price) … information certainly useful to attentive direct marketing folks.

Large space-time data sets combined with advanced analytics enable a degree of understanding, discovery, and prediction that may be hard for many people to fully appreciate. Better prediction means a more efficient enterprise and nifty consumer services. 

Cellular companies are now receiving essential insight about their customers (e.g., to better understand and predict customer churn).  Major retailers can now better understand changes in consumer behavior (e.g., how far their customers are traveling on average this month compared to previous months).  Consumers are benefiting by getting real-time traffic information so they can avoid congested roads.  (I have a colleague that thinks he is saving two to four hours a week in commute time due to this service!)

Tip o’ the iceberg.

I can barely get my mind around the ramifications. My concept about what comes next shifts almost daily now.  A government not so keen on free speech could use such data to see a crowd converging towards a protest site and respond before the swarm takes form –  detected and preempted, this protest never happens.  Or worse, it could be used to understand and then undermine any political opponent.

A stalker might be questioned just days after he starts and before his victim is personally aware of it – detection previously beyond human capacity.  Maybe it’s not a crime in this case, and it turns out to be just a private investigator with poor tradecraft hired by a suspicious husband.

Such a surveillance intensive future is inevitable, irreversible and as I have said before here … irresistible.

Why?  Companies must be competitive to survive and consumers have quite the appetite for almost anything that optimizes their life, especially if it’s cheap or free.  For example:

Tuesday afternoon your [free] Gmail account advises you that your buddy Ken is going to be 15 minutes late to the pool hall this coming Thursday, unless he leaves work 15 minutes early … which he has only done twice in seven years.  Brilliant!

Your Starbucks drink of choice (a grande vanilla soy latte in my case) is handed to you the instant you pull up, and you did not call ahead nor did they ask.  Priceless!

When powerful analytics commingle space-time-travel data with tertiary data, the world we live in will fundamentally change.  Organizations and citizens alike will operate with substantially more efficiency.  There will be less carbon emissions, increased longevity, and fewer deaths.

I think people should know about this imminent new age we are marching into.

[Theatrical pause.  Breathe.]

Now I’m going to step back and address some questions you may have, using the good news/bad news format.

Good news: The space-time-travel collected by the cellular network carriers is de-identified when provided to these third parties for privacy reasons in that it does not include your name, address, phone number, etc.; rather, unique identifiers are assigned to transactions from the same device so that trends can be measured.

Bad news: If you were to provide your home, work and one other address (e.g., gym, school) in most cases, with just these data points, you are re-identified.  With just a few days of space-time-travel activity, your top three or four more frequently visited destinations become self-evident, and without a whole hell of a lot of effort you could be re-identified through a tertiary data set like a credit header.

Good news: There is so much data being produced, a lot of transactions are tossed aside, are sampled and summarized to make the computational effort feasible.  Historical data also falls off the back of the wagon (ages off the system) rather quickly.

Bad news: The competitive nature of this emerging business model will likely require these organizations to make more sense of more data faster.  Cloud computing and new classes of algorithms will make it possible to keep more transaction detail, keep it longer, and commingle it with other large and very interesting secondary data sets (e.g., phone books and property records).

Good news: So far there are only a handful of companies already entrusted with this data.

Bad news.  It may not be good news that only a few companies do this.  If only one company can monitor the consumer foot traffic of all Nordstrom stores in near real time,  this would be an unfair advantage in terms of predetermining its financial condition before anyone else.  As I learned from countless conversations with my friends at the ACLU, very powerful tools in the hands of a few is not often a good idea without one hell of a lot of oversight and accountability. And even then, this is no panacea.

Good news: Some of the organizations holding space-time-travel data are fully aware of the privacy consequences and are offering consumers the ability to opt-out – meaning, if they get a transaction about you it will be permanently removed from the system and all future correlation.

Bad news: If by chance a snapshot of sufficient detail had been sold off to another party before the opt-out request, then the toothpaste is out of the tube.  Data tends to replicate, more about this here.

Good news: Not any old mom and pop operation can get into this business.

Bad news: That won’t be true for long.  Suppose an aspiring entrepreneur makes a compelling proposition to a number of parties holding space-time-travel data.  Anticipating free analytics and a cut of the future action, the parties work a deal. For computing power this entrepreneur simply hops onto Amazon’s EC2 cloud and partners with a data aggregator to get some tertiary data and what do they have?  An ultra-sexy prediction engine.

Good news: People tend to appreciate location-based services, which is why they are opting in.

Bad news: Sensitive information about people is no longer under their own control.  As well, a number of well held secrets (e.g., your hideout) evaporate overnight.

Good news: If you want to escape the consequences of having your space-time-travel being graphed by others, here are some options that come to mind:

(a) Stop using mobile devices;

(b) Use multiple devices e.g., use one device only at work, and only a land line at home – all mobile devices being off at all other times (never moving around with a device on) – being sure these mobile devices are registered to someone other than you – and if you need to use some kind of device while on the move or at other locations. see (c) below;

(c) Unregistered, cash-purchased, disposable devices – used once then discarded (or recycled!) – although in some cases you can use the device a few times, but you better let some fancy software (which I may have to invent) advise you what is safe usage and what is not.

(d) If you can figure out locations on earth where only one cell tower exists (and you are not moving between towers and never using GPS or Wi-Fi) you will probably live safely under the radar – unless you are a way bad mofo and others know it, in which case, you are ‘going down’ anyway because there are more tricks (expensive) which will be levied against you.

Bad news: Few are willing to be this inconvenienced.  And if only a handful of innocent, clean living folks go to this same effort that the bad guys MUST employ … well crap, that in itself may be considered by some to be signal.

Net Net: My guess is most consumers don’t fully realize how their space-time-travel data is accumulating and congealing.  I hope consumers come to appreciate how all of these nice conveniences of life are delivered. And I hope they will continue to enjoy these while they make better informed decisions, especially with respect to their privacy.

However, without a feedback loop consumers may never fully appreciate what can be gleaned from their space-time-travel trail. Therefore, one way to enlighten the consumer would involve holders of space-time-travel data to permit an owner of a mobile device the ability to also see what they can see:

(a) The top 10 places you spend the most time (e.g., 1. a home address, 2. a work address, 3. a secondary work facility address, 4. your kids school address, 5. your gym address, and so on);

(b) The top three most predictable places you will be at a specific time when on the move (e.g., Vegas on the 215 freeway passing the Rainbow exit on Thursdays 6:07 - 6:21pm -- 57% of the time);

(c) The first name and first letter of the last name of the top 20 people that you regularly meet-up with (turns out to be wife, kids, best friends, and co-workers – and hopefully in that order!)

(d) The best three predictions of where you will be for more than one hour (in one place) over the next month, not counting home or work.

I think Google’s Android and Latitude products might be able to move on something like this first.  It would then be cool if other holders of space-time-travel data followed.

On the subject of privacy and civil liberties consequences, privacy by design is essential.  And for those of you with ideas in the area of policy or technology, I would be most appreciative if you would share these thoughts with me … sooner rather than later.

I will continue sharing perspectives about these ideas and the apparent consequences with my many friends in the privacy community, the defense/intelligence community, and media.  (Surprisingly, their feedback so far has been quite similar.)  I am also speaking with the organizations amassing and analyzing this space-time-travel data to learn more about what is possible.  From the perspective of the analytic engines I create, this space-time-travel data looks like “super food.”

USEFUL REFERENCE:

Internet Society: Wireless Location Privacy: Las and Policy in the US, EU, and Japan

 

RELATED POSTS:

Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society

Prediction: Channel Consolidation

More Data is Better, Proceed with Caution

How to Use a "Glue Gun" to Catch a Liar

Nation At Risk: Policy Makers Need Better Information to Protect the Country

Last Tuesday, March 10, The Markle Foundation Task Force on National Security in the Information Age released a report titled: Nation At Risk: Policy Makers Need Better Information to Protect the Country. (PDF here)

Members of the Task Force who prepared this report included: William Crowell, Bryan Cunningham, Jim Dempsey, John Gordon, Slade Gorton, Jeff Jonas (me!), Judith Miller, Jeffrey Smith, Abraham Sofaer, Rick White, and Richard Wilhelm.

We made the following five recommendations, calling for the accelerated creation of an information sharing framework:

1. Reaffirm Information Sharing as a Top Priority

2. Make Government Information Discoverable and Accessible to Authorized Users by Increasing the Use of Commercially Available Off-the-Shelf Technology

3. Enhance Security and Privacy Protections to Match the Increased Power of Shared Information

4. Transform the Information Sharing Culture with Metrics and Incentives

5. Empower Users to Drive Information Sharing by Forming Communities of Interest

The report is relatively short and to the point, just 27 pages long. It includes a handy four page appendix summarizing all of the recommendations (pages 22-25).

Here are a few elements I would like to bring to the attention of my readers:

Recommendation 2 speaks to "Discoverability." Our Task Force built on our earlier recommendations (in prior reports) to use data indices – much like the card catalog at the library. Using indices, users can locate data in the enterprise and if qualified for authorized use, they can limit access to the records of relevance. Notably, this model means less data is being transferred around, therefore less data must be kept in synch. The risk of unintended disclosure is mitigated to a degree because fewer copies of data are being made. In short, indices allow users to locate just what they need and no more.

In recommendation 3, the Task Force makes a number of specific security and privacy recommendations. One of my favorite examples is:

"… including implementation of real-time audits of user compliance and behavior and immutable audit logs that record how a system has been used …"

These Immutable Audit Logs are clever little inventions that allow oversight and accountability groups to see exactly how a system has been used. Even a system administrator cannot secretly change the past by altering the log. Imaging every time someone peeks into the card catalog whether they find something, or not, this is recorded in an indelible manner. What cards they saw, what books they looked at, and so on … all accounted for with no way to hide the facts.

The use of the term "metrics" in recommendation 4 is also worth special mention. One such metric the Task Force would like to see is reporting what percent of a system’s information is discoverable i.e., percentage of records that have corresponding cards in the card catalog. Case in point; what is the value of a book on the shelf at the library if there is no related card in the catalog?

Finally, as indices are going to be the way information sharing gets accomplished … in my opinion, the essential policy debate must immediately begin considering the following:

1. How many indices? There are benefits for fewer. And there are different benefits for more. One index for law enforcement and one for intelligence? Or, one index for foreign collections and another for open source? One index, 20 indices, or 100?

2. Where will these indices physically reside? At Google? (Note: Google is an index already used for open source).

3. Which key attributes will be placed in the index? While the library uses subject, title and author … maybe one index will need to contain who, what, where, when.

4. How much latency between data changes in source systems and their corresponding change in the index? For example, if a watch list record is deleted in a source system, what is the maximum amount of time one would want to wait until the same record is redacted from the card catalog?

5. When a user searches the card catalog, who do you notify when an index card is found?

a. Only the inquirer?

b. Only the owner?

c. Both?

d. Neither, only a third party is notified?

e. No one can be told?

6. When there is any notification, what information is revealed about the index card to the inquirer and/or data owner?

a. All the attributes related to the index card?

b. Some of the other attributes on the card (e.g., search author and see title)?

c. No other attributes are revealed?

d. The custodian organization of the data record?

e. The custodian source system of the record?

f. The actual record number used to identify this piece of data in the source system?

g. The user, if any, associated with this record, e.g., the analyst’s name and phone number?

7. When there is a notification to a data owner, what information is revealed about the inquirer?

a. All the attributes related to the search?

b. Some of the other attributes on the search?

c. No other attributes are revealed?

d. The inquirer’s organization?

e. The inquirer’s source system?

f. The actual session number used to initiate the inquirer’s search?

g. The inquirer’s name and phone number?

8. What user audit standards and processes will be required to ensure the system is being used in accordance with law and policy?

9. What metrics will be kept and who can see which metrics?

RELATED POSTS:

Discoverability: The First Information Sharing Principle

Information Sharing: Got Directory?

No Need to "Over Share" – Thoughts on Information Sharing

It’s All About the Librarian! New Paradigms in Enterprise Discovery and Awareness

Federated Discovery vs. Persistent Context – Enterprise Intelligence Requires the Later

Immutable Audit Logs (IAL’s)

Found: An Immutable Audit Log

Full Attribution, Don’t Leave Home Without It

Out-bound Record-level Accountability in Information Sharing Systems

Data Tethering: Managing the Echo

To Anonymize or Not Anonymize, That is the Question

“Macro Trends: The Privacy and Civil Liberties Consequences … and Comments on Responsible Innovation” – My DHS DPIAC Testimony, September 2008

On Wednesday, September 17th, 2008 I testified before the DHS Data Privacy and Integrity Advisory Committee (DPIAC).  The testimony transcripts were recently posted on the DHS web site.

Transcript Here  (My testimony starts on the bottom of page 9.)

In this testimony I covered a number of topics including:

I. Macro Trends

1. The world is not a more dangerous place – average lifespan continues to increase (More here: The World is Not a More Dangerous Place)

2. Fewer people can create bigger effects faster … in both directions – destruction or value creation (More here: More Death Cheaper in Future, Ludicrous Speed Billionaires)

3. Competition is driving technology adoption – notably the organization who receives the data first has the advantage (More here: Ubiquitous Sensors? You Have Seen Nothing Yet)

4. Data is being created faster than organizations can make sense of it – to this degree organizations are getting dumber (More here: Why Faster Systems Can Make Organizations Dumber Faster)

5. Commingling data for enhanced context will drive a new generation of smarter systems (More here: Smart Systems Flip-Flop)

6. The surveillance society continues to build momentum as consumers find it irresistible (More here: Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society)

II. Las Vegas: What Can Be Learned

1. Las Vegas is one of the fastest growing cities in the Unites States of America (before the economic crash of course)

2. Casinos have a minimal security and surveillance budget

3. Casinos have a legal obligation, in some circumstances, to determine your identity (e.g., under age gambling, crossing a winnings threshold which necessitates IRS reporting)

4. Public and private watch lists are used – some compulsory, some elective

5. There are a fair number of scams that are tried on casinos – some scam artists are using false identities and disguises (More here: The Vegas Asymmetric Threat, Takin’ Vegas, Be Anyone in Las Vegas, Get Help Creating a Cover Story Here)

6. When employees go bad, this is particularly problematic

7. Most ‘tripwires’ are generated by alert employees who are watching, not by computers

8. An organization called Griffin Investigations provides information sharing of cheaters and advantage players (e.g., card counters) – they system is called Griffin GOLD (My old SRD company build this system)

9. One example of a watch list and insider-threat detection system known as Non-Obvious Relationship Awareness (NORA) was built for the industry (My old SRD company build this system too) (More here: IEEE Spectrum Story: Vegas 911, IEEE Paper: Threat and Fraud Intelligence – Las Vegas Style)

10. A patron can still enter a casino and enjoy a degree of activity without exposing their identity

11. There is no “predictive data mining” to spot unwanted behavior

12. Most vulnerabilities are remedied with processes not additional electronic surveillance

13. Humans are in the security decision loop – computer systems do not make security decisions, rather only promote items of interest

14. Facial recognition technology is not used at doors looking for watch listed persons

III. Towards Responsible Innovation

1. Technologists should more regularly engage the privacy community (More here: Responsible Innovation: Staying Engaged with the Privacy Community) 

2. Information sharing systems must have information attribution (More here: Full Attribution, Don’t Leave Home Without It, Out-bound Record-level Accountability in Information Sharing Systems) 

3. Data destruction requires careful planning and execution (More here: Decommissioning Data: Destruction of Accountability) 

4. Limit data transfers and use indexes to make information discoverable (More here: Discoverability: The First Information Sharing Principle) 

5. If data changes in a source system replicate this change through the information eco system (More here: Data Tethering: Managing the Echo) 

6. Where possible obfuscate data (More here: To Anonymize or Not Anonymize, That is the Question) 

7. Build high assurance accountability into systems (More here: Immutable Audit Logs (IAL’s), Found: An Immutable Audit Log) 

8. Data mining is not always good or bad, it depends on the circumstances (More here: Effective Counter-Terrorism and the Limited Role of Predictive Data Mining, Data Mining, Predicate Triage and NSA Domestic Surveillance) 

9. Link analysis, especially predicate-based, has some usefulness – although it is also wise to ‘prune’ early (More here: Hunting Bad Guys, Phone Records, and a Few Good Dead Men, Predicate-based Link Analysis: A Post 9/11 Analysis (1+1= 13), Sometimes a Big Picture is Worth a 1,000 False Positives) 

10. Low fidelity watch list entries (identities with few attributes, e.g., name only) are problematic (More here: Precision in TSA’s Terrorist Watch List, Comments on the TSA No-Fly and Selectee Watch List Process)

IV. Closing Statements

1. There are going to be more sensors, more data.  This data will be commingled for greater accuracy to serve consumers and to protect countries.  What data is collected and when … will be the debate.  Once data has been collected, the holder has the obligation to make sense of it.

2. The most fundamental principle I have synthesized from my many conversations with folks in the privacy advocacy community is this one point: “Avoid consumer surprise.”  (More here: Where Possible … Avoid Consumer Surprise)

3. Finding professional bad actors involves the detection of weak signal.  The computational remedy for weak signal involves observing and commingling transactions that are unanticipated by the bad actors.

4. Hence the tension.

[End of Testimony] 

I wish I would have also made this point:   

I am concerned.  If organizations don’t start implementing more privacy-enhancing technology I think research and productization in this area will decrease in coming years.  This would be a bad thing. 

RELATED POSTS: 

My Testimony Before The DHS Data Privacy and Integrity Advisory Committee (2005) 

RELATED PAPERS: 

Giannino Bassetti Foundation: Jeff Ubios

Transparency, Privacy and Responsibility: An Interview with Jeff Jonas 

Heritage Foundation: Paul Rosenzweig/Jeff Jonas

Correcting False Positives: Redress and the Watch List Conundrum 

Cato Foundation: Jeff Jonas/Jim Harper

Effective Counterterrorism and the Limited Role of Predictive Data Mining  

Steptoe & Johnson: Stewart Baker

Anonymization, Data-Matching and Privacy: A Case Study  

IEEE Security and Privacy: Jeff Jonas

Threat and Fraud Intelligence: Las Vegas Style 

When Risk Assessment is the Risk

It is risky business to use risk assessment systems which produce alarms at a pace faster than the organization can evaluate and handle them.  

The problem often takes one of these two forms: giant batch reports with so many pages it is an almost impossible task for analysts to manage each scored risk item; or real-time alerts that pile up in queues whereby analysts pick off the top while the backlog keeps growing.

All of these potential alarms lying around in reports or queues – each possibly a smoking gun – really must be viewed as potential evidence that could be used against you if stuff goes wrong.  These unhandled alarms each evidence that the organization did not take a risk seriously and evidence that suggests someone was incompetent or negligent for not amassing the necessary resources to evaluate each and every alarm in a reasonable timeframe.  Judgment day arrives after something bad happens when this incriminating – or even just suspect – evidence comes to light during forensic analysis.  “Look the bad actor is right here on page 32,912 … had you appropriately staffed, this disaster would have never happened!”

I have a few suggestions for those organizations dealing with this problem already and those that would like to avoid this dilemma in the first place.

1. Favor the false negative – wherever possible don’t err on the side of alarm.  While, obviously, you can’t ignore what appears to be a real, serious threat, err on the side of innocent behavior.  Let new observations catch the false negatives.  More about this here: How to Use a Glue Gun to Catch a Liar.

2. How one calculates relevance and when to register an alarm is crucial.  On the technology side the objective is: the very next item in an alarm queue is the most important item for review.  And in this model, no matter what … there is no reason to produce more alarms than there are available resources (e.g., analysts, systems) to deal with them.  Therefore, especially on day one, configure your risk assessment engine to produce alarms appropriate to your individualized risk, staffing, and ability to respond. Then, as your resources have increasing bandwidth, consider increasing the alarm sensitivity.

3. When it comes to addressing the unresolved ambiguity that percolates under the alarm sensitivity, use tertiary data for automated disposition.  Instead of having an army of analysts wrestling each “maybe” to the ground it makes more sense to locate what data is needed and let that data disambiguate these low grade risks en masse.  Most risk ambiguity will be released as harmless, while a far smaller percentage will promote up to an actionable alarm.  Example, if the phone book holds the evidence necessary to resolve some risk ambiguity (i.e., to learn the middle names are different thus concluding two identities are unrelated) – and a person would normally look here – then maybe the system can look there on its own. Lots of ambiguity can be solved with lots of data – but the question is what data and with what legal and policy justification?

4. The most “bulletproof” approach involves ... lawyers.  In this case, one would contract with a law firm with expertise in information security law to bring expert engineers aboard for the analysis, technical testing and findings, and the ensuing debate which results in new corporate policy.  All ‘discovery’ – including of negative findings that could be used against an organization in the future are then protected by attorney-client privilege and, therefore, are most likely to be protected from disclosure.  And by the way, this also creates an “advice of counsel” defense to any future litigation.  If you want to go this route I’ve got a few names, just ask.

My advice: Rarely is it a good idea to ask for a detailed report of every possible risk.  So be careful what you ask for.

OTHER RELATED PAPERS:

Correcting False Positives: Redress and the Watch List Conundrum

RELATED POSTS:

Consequences of False Positives in Government Surveillance Systems

Sometimes a Big Picture is Worth a 1,000 False Positives