6 ms·

That's a rather simplistic model. What happens when a non-terrorist is scanned twice? Does he have the same 1% probability of being a false positive (e.g.: fa

That's a rather simplistic model. What happens when a non-terrorist is scanned twice? Does he have the same 1% probability of being a false positive (e.g.: false positive due to limitations of the camera, direction he's facing, atmospheric conditions, etc.) or 100% chance of being a false positive every time? (e.g.: he looks identical to one of the terrorists) The problem as stated suggests that there's an equal chance of being a false positive every time. In that case, the simple solution would be to place cameras at regular intervals - when an alarm goes off, wait a minute or two. If an alarm for an adjacent camera goes off, compare the two photos and see if it's the same guy. You've now significantly reduced both your false positive rate and false negative rate. One of the thing that always bugs me is that whenever privacy/security issues come up is that everyone seems to assume that the authorities are naturally going to gravitate to the least efficient, most invasive means of carrying out their job, simultaneously implying that it's preferable to have (in this example) 100 terrorist operating amongst us and not do anything than to put our heads together and propose an intelligent solution.

DanBC 12y ago
> One of the thing that always bugs me is that whenever privacy/security issues come up is that everyone seems to assume that the authorities are naturally going to gravitate to the least efficient, most invasive means of carrying out their job, Have you flown in the past 10 years? Shuffling through TSA checkpoints in my socks makes me feel like authorities do gravitate to stupid measures.
- dm2 12y ago
  In all fairness, that was in direct response to some idiot getting on a plane with a shoe bomb. I don't think it's necessary, but if they didn't require that then people would be blaming them for not taking enough action. The times I've flown it hasn't been too much of a hassle, though I suppose it's highly dependent on the airports you pass through and whether or not it's an international flight coming into the US.
- csandreasen 12y ago
  I was thinking more along the lines of things like speed cameras - they capture more speeding violations, don't discriminate based on race/gender/whether or not you're driving an expensive car/etc., and they note only the fact that the driver violated the speed limit. The driver gets a fine in the mail shortly after. It improves on the model where the police only pull over a fraction of violators, and you spend 15 minutes waiting, subject to intimidation, further questioning by the officer, the officer gets to glance in your windows to see if there's anything else that violates the law, and in the end you still get a fine. Yet, almost everyone I've talked to about speed cameras hates them and sees them as invasive, sometimes going so far as calling them Orwellian. I agree about the TSA checkpoints, though. There are plenty of examples on both sides of the arguments. My point is that the general assumption seems to gravitate to "they'll implement it stupidly, so they shouldn't have that capability at all". It's not necessarily a binary choice between no security and stupid implementation.
  - pwg 12y ago
    > and they note only the fact that the _vehicle_ violated the speed limit. The _vehicle's owner_ gets a fine in the mail shortly after. There, fixed that for you. Now, I'll admit, a large part of the time the owner is also the driver, but with speed cameras it is not the "driver" who receives the fine, but the _owner of the vehicle_. The one difference with "speed cameras" and the NSA's data mining is that measurement of the rate of travel of a vehicle (assuming a properly calibrated and non-malfunctioning speed measurement device) is so close to 100% accurate as to be considered 100% accurate. No "connect the dots, infer here, infer there" data mining in the NSA's dataset will ever be even within several orders of magnitude of accurate as compared to a properly functioning, properly calibrated, speed measurement device. And that underlying, non zero, error rate is what triggers the base rate fallacy issue in statistical analysis. When an occurrence of X is extremely rare in a very large population without X, then the test for X has to be impossibly accurate for the results to not be swamped by false positives. And this is a completely counter intuitive result, which is why it is so often overlooked. Pertinent quote from the Shiner article at https://www.schneier.com/blog/archives/2006/03/data_mining_for.html https://www.schneier.com/blog/archives/2006/03/data_mining_f...: "Let's look at some numbers. We'll be optimistic. We'll assume the system has a 1 in 100 false positive rate (99% accurate), and a 1 in 1,000 false negative rate (99.9% accurate). Assume one trillion possible indicators to sift through: that's about ten events -- e-mails, phone calls, purchases, web surfings, whatever -- per person in the U.S. per day. Also assume that 10 of them are actually terrorists plotting. This unrealistically-accurate system will generate one billion false alarms for every real terrorist plot it uncovers. Every day of every year, the police will have to investigate 27 million potential plots in order to find the one real terrorist plot per month. Raise that false-positive accuracy to an absurd 99.9999% and you're still chasing 2,750 false alarms per day -- but that will inevitably raise your false negatives, and you're going to miss some of those ten real plots. This isn't anything new. In statistics, it's called the "base rate fallacy," and it applies in other domains as well. For example, even highly accurate medical tests are useless as diagnostic tools if the incidence of the disease is rare in the general population. Terrorist attacks are also rare, any "test" is going to result in an endless stream of false alarms."
bobcostas55 12y ago
Are you trying to imply that's an unreasonable assumption?

DanBC 12y ago

> One of the thing that always bugs me is that whenever privacy/security issues come up is that everyone seems to assume that the authorities are naturally going to gravitate to the least efficient, most invasive means of carrying out their job, Have you flown in the past 10 years? Shuffling through TSA checkpoints in my socks makes me feel like authorities do gravitate to stupid measures.

dm2 12y ago
In all fairness, that was in direct response to some idiot getting on a plane with a shoe bomb. I don't think it's necessary, but if they didn't require that then people would be blaming them for not taking enough action. The times I've flown it hasn't been too much of a hassle, though I suppose it's highly dependent on the airports you pass through and whether or not it's an international flight coming into the US.
csandreasen 12y ago
I was thinking more along the lines of things like speed cameras - they capture more speeding violations, don't discriminate based on race/gender/whether or not you're driving an expensive car/etc., and they note only the fact that the driver violated the speed limit. The driver gets a fine in the mail shortly after. It improves on the model where the police only pull over a fraction of violators, and you spend 15 minutes waiting, subject to intimidation, further questioning by the officer, the officer gets to glance in your windows to see if there's anything else that violates the law, and in the end you still get a fine. Yet, almost everyone I've talked to about speed cameras hates them and sees them as invasive, sometimes going so far as calling them Orwellian. I agree about the TSA checkpoints, though. There are plenty of examples on both sides of the arguments. My point is that the general assumption seems to gravitate to "they'll implement it stupidly, so they shouldn't have that capability at all". It's not necessarily a binary choice between no security and stupid implementation.
- pwg 12y ago
  > and they note only the fact that the _vehicle_ violated the speed limit. The _vehicle's owner_ gets a fine in the mail shortly after. There, fixed that for you. Now, I'll admit, a large part of the time the owner is also the driver, but with speed cameras it is not the "driver" who receives the fine, but the _owner of the vehicle_. The one difference with "speed cameras" and the NSA's data mining is that measurement of the rate of travel of a vehicle (assuming a properly calibrated and non-malfunctioning speed measurement device) is so close to 100% accurate as to be considered 100% accurate. No "connect the dots, infer here, infer there" data mining in the NSA's dataset will ever be even within several orders of magnitude of accurate as compared to a properly functioning, properly calibrated, speed measurement device. And that underlying, non zero, error rate is what triggers the base rate fallacy issue in statistical analysis. When an occurrence of X is extremely rare in a very large population without X, then the test for X has to be impossibly accurate for the results to not be swamped by false positives. And this is a completely counter intuitive result, which is why it is so often overlooked. Pertinent quote from the Shiner article at https://www.schneier.com/blog/archives/2006/03/data_mining_for.html https://www.schneier.com/blog/archives/2006/03/data_mining_f...: "Let's look at some numbers. We'll be optimistic. We'll assume the system has a 1 in 100 false positive rate (99% accurate), and a 1 in 1,000 false negative rate (99.9% accurate). Assume one trillion possible indicators to sift through: that's about ten events -- e-mails, phone calls, purchases, web surfings, whatever -- per person in the U.S. per day. Also assume that 10 of them are actually terrorists plotting. This unrealistically-accurate system will generate one billion false alarms for every real terrorist plot it uncovers. Every day of every year, the police will have to investigate 27 million potential plots in order to find the one real terrorist plot per month. Raise that false-positive accuracy to an absurd 99.9999% and you're still chasing 2,750 false alarms per day -- but that will inevitably raise your false negatives, and you're going to miss some of those ten real plots. This isn't anything new. In statistics, it's called the "base rate fallacy," and it applies in other domains as well. For example, even highly accurate medical tests are useless as diagnostic tools if the incidence of the disease is rare in the general population. Terrorist attacks are also rare, any "test" is going to result in an endless stream of false alarms."

bobcostas55 12y ago

Are you trying to imply that's an unreasonable assumption?