Blog

The original story in The Guardian by Ryan Gallagher was about multinational security firm Raytheon has developed a scrape-and-dump program called RIOT (for Rapid Information Overlay Technology), which gathers huge amounts of information about people from social media, and uses it to predict their movements.  There are all sorts of problems with this.

In a separate piece in The Guardian, James Ball points out that even the most innocuous information can be damaging in the wrong hands:

It’s easy to believe those with nothing to hide have nothing to fear – and most of us are essentially decent people, with frankly boring social network profiles. But, of course, to (say) a petty official with a grudge, almost anything is enough: a skive from work, using the wrong bins, anything. Everyone’s got something someone could use against them, even if only for a series of annoyances.

and it’s all too easy to to just forget that it can be taken out of context, a point also made by Jay Stanley at the ACLU:

When we post something online, it’s all too natural to feel as though our audience is just our friends—even when we know intellectually that it’s really the whole world. Various institutions are gleefully exploiting that gap between our felt and actual audiences (a gap that is all too often worsened by online companies that don’t make it clear enough to their users who the full audience for their information is).

Furthermore, Ball reminds us that one’s online privacy depends a great deal on other people’s technological ability and awareness:

It’s also tempting to believe that with good privacy settings and tech savvy, we can protect ourselves. Other people might be caught, but we’re far too self-aware for that. But stop and think. Do you trust every friend you have to lock their privacy settings down? Your mum? Your grandad? Do they know to strip location data from photos? Not to tag you in public posts? Our privacy relies on the weakest point of each of our networks – and that won’t hold.

But for me the heart of the matter is the misuse of social network analysis. Gallagher writes: “Using Riot it is possible to gain an entire snapshot of a person’s life – their friends, the places they visit charted on a map – in little more than a few clicks of a button.“ 

This vastly overstates the case: you cannot get a snapshot of the person’s life, only their social media trail.  The software also creates a “network” from these scraped connections, with every link treated as equally meaningful.  This creates two related problems: 1) it’s sold as a complete package, and its end users believe the hype; 2) it is used to create profiles of “suspects” who have no real relationship to the original subject of investigation.  Forbes writer Michael Peck hit that nail on the head:

There is no mention of violence in the video. Yet it’s worth noting that software that assembles a profile of someone’s movements would also be useful for government agencies who arrange for appointments between suspected terrorists and drone-launched Hellfire missiles.    

Context matters in network analysis.  I follow the National Intelligence Council (@ODNI_NIC) and @BronxZoosCobra as well as @OccupyWallSt on Twitter.  I see no evidence that this program is able to differentiate among my relationships to any of these entities at all, let alone better than a human analyst.  Am I a closet Slytherin, perhaps, plotting to take over the revolution (and thence the world)?  Then how does the fact that I also follow @BettyMWhite figure in?  An example I often use to demonstrate how meaningless “closeness” can be in a network is this: my thesis adviser could introduce me to the Secretary General of the U.N., who could introduce me to the President of the U.S.  So I’m three links away from the president.  What does that mean for my input on policy? Absolutely nothing.  I’m “close” (whatever that means), but it has no meaning, because I don’t have any impact at all.

People are not one-dimensional, and incredible amounts of data in one dimension do not (and cannot) predict behavior or thoughts in other dimensions. The incredible amounts of data that are becoming available need more theoretical underpinning, more thought and judgement applied, and more empirical hypothesis testing.  Just gathering data and dumping it in a blender will find even more spurious correlations than ever, otherwise.  Given how many people are already “collateral damage” because they were in the wrong place at the wrong time, it behooves us to be more careful about positing meaningful relationships, not less.

In the meantime, as Peck notes, programs that scrape-and-dump can be countered by two simple tactics: either stay off social media altogether, or spoof it.  Spoofing it could be a lot more fun – after all, on the Internet, nobody knows you’re a dog.

February 19th, 2013 6:07pm

Just a few quick thoughts prompted by the almost-panicked response to the fuel shortage caused by Hurricane Sandy (see these stories from Reuters).

Just-In-Time inventory management can be a great thing for both businesses and customers:  it can save money by streamlining the manufacturing or delivery process so that you don’t have to pay oodles of overhead to store unused or unwanted components or products.  In a perfect world, with all other things being equal, everything is delivered just as the next step in the chain needs it, or just as the customer orders it.  That’s the up side.

The downside is that the world is not perfect, and all other things never stay equal.  If supply is disrupted, you may only have hours worth of supply to deal with in an emergency, and after that badness ensues.  Quoting Jim Lawton, head of supply management solutions at consultant Dun & Bradstreet and a former procurement chief for Hewlett-Packard in The Downside of Just-in-Time Inventory:

Only about 10 percent of companies have detailed plans to deal with supply disruptions, says Lawton, who calls logistics the fastest-growing piece of Dun & Bradstreet’s business.

As Charles Atkinson has noted, there are several risks that have to be planned for:

1. Which firms are dependent upon particular suppliers, and what is their character? A supplier that knows you have no buffer has you over a barrel.  UPDATE: In Sandy, franchisees of Big Oil were SOL, left to deal with the disaster on their own. In that story, an operator is quoted as saying “Mobil helps no one, that’s why they are the richest company in the world.”
2. What are the internal conditions at your supplier? For example, is their workforce going to strike?  UPDATE: And to take another example from Sandy, local and regional gas retailers like Hess Corp. not only had internal disaster response plans (and generators!) in place, they helped out competitors and did a great job of informing the public^.pdf.

Let me add that you also have to take note of external conditions like weather (ha!), but also take into account political shenanigans, and social unrest if you want to be resilient.  If on the other hand you want to fold like a house of cards, by all means, carry on.  UPDATE: And don’t forget that real incompetence faces the threat of being taken over by the government if you can’t seem to pull it out – see Nassau County Executive Ed Mangano’s request for the U.S. to take over LIPA (the Long Island Power Authority).

The connection to security ought to be clear: any time people decide that they are but two meals from barbarism (or a tank away from the end of civilization), the institutions of governance are in danger of being overrun.  And anyone who’s ever read “Extraordinary Popular Delusions and the Madness of Crowds” knows that can happen quicker than you think, on the basis of very little in the way of facts.

November 3rd, 2012 6:38pm

For this inaugural post, I’ve chosen to contemplate a subject dear to my heart: Buffy the Vampire Slayer.  I love Buffy for many reasons, not least of which is the wit of the scripts or the chemistry of the actors, but also because of the very premise of the show. The fluffy little blond who’s usually the first to get hacked to death/eaten/buried alive/whatever-horrible-fate-befalls-the-characters in most horror movies is in fact the Chosen One – the protector.

This is why Buffy is so beloved: she’s a powerful female character in a popculture world that is too often devoid of examples.

Overcoming societal obstacles and breaking gender barriers is not a power fantasy for me. In fact, a lot of the time, it’s part and parcel of my day-to-day reality. My power fantasy takes place in a world where those issues are gone, where I can be a champion without any red tape… Give me a smart, brave woman who already has the respect of the world she’s trying to save, and I will throw my wallet at you.

(from “What Women Want (In Female Video Game Protagonists)”)

Rule 1: Every Slayer needs a Scooby Gang

Why? Because Scooby Gangs are force multipliers.  Scooby Gangs do research.  They hit the library/internet so the Slayer has some clue what she’s up against. Scooby Gangs also provide critical back up.  Even a Slayer can’t be everywhere and do everything at once.  It helps to have some people who can take care of the minor stuff, allowing the Slayer to focus on the big bad.  Furthermore, the Slayer’s Scooby Gang must have at least one person who can hold down a job and fix the broken stuff.  Having a grown-up, responsible adult who can take care of the administrative overhead and logistics (and who can pay for it) may not be glamorous, but it’s really important.  Finally, the Scooby Gang to Slayer ratio should be about 5 to 1.  It may seem like too much tail, too little dog, but Slayers without good-sized, resilient support systems are very short-lived.

What does this mean for security, and especially for defense/military policy? I’m hoping it’s obvious: it takes a lot of support to keep an army in the field, and skimping on any one aspect means you’re not really serious about winning.

Rule 2: Everything is a potential weapon.  It just depends on how you use it.

Remember, anything is a weapon if you can swing it hard enough. 

You can spend billions on weapons systems, but innovative use of a boxcutter can still break through.   The solution is not to spend more (or to outlaw boxcutters) but to learn to be innovative yourself – resilience = robustness.

Unfortunately, this also means that anyONE can be a weapon: little sisters, ex-boyfriends, etc. If it hurts, it hurts, and it doesn’t have to be material.  This is where the constructivist turn in International Relations theory rears its head: anything that affects an actor’s perceptions of their interests and identity can then affect their behavior.

Rule 3: Be prepared to pay the cost.

Being the Chosen One is a great responsibility.  There’s a lot of danger, there’s a lot of expense, there’s a lot of loneliness, and hardly anyone ever says thank you.  Sound like the United States complaining about its role as global police officer?  Tough.  Superpowers have interests that need to be protected, and those interests are worldwide.  Which equals dangerous, expensive, lonely, and no gratitude from people who just wish both the problem and its solution would go away.

Rule 4: Go in properly armed. 

Even if it’s only with your keen fashion sense.  

October 8th, 2012 2:00pm

I’ve chosen to create a girly skull and crossbones from Wikimedia Commons public domain images to represent this blog because I want to emphasize that this is not going to be the usual international security blog.  Bombs-n-bullets is a part of security, but not the whole of it – issues of gender, ecology, technology, development, and finance all come into play.  Security considered on a global basis is a complex, dynamic system, and if all you look at is weapons and conflict you won’t see most threats coming.

September 6th, 2012 8:15pm