Feds Still Shrugging People Onto Terrorist Watchlists Based On Hunches

from the you-might-be-a-terrorist-IF...-we-decide-you-might-be-a-terrorist-WHEN dept

The US government's desire to keep terrorists off airplanes has resulted in heavily-populated "watchlists" -- lists short on due process and long on hunches.

The TSA, in particular, has embraced a mixture of borrowed ideas and junk science to staff airports with Behavioral Detection Officers, who attempt to keep terrorists from boarding planes by looking for any number of vague indicators. The end result is a billion-dollar program with the accuracy of a coin flip.

That's the physical version of the government's "predictive policing" security efforts. The same sort of vague quasi-science is used to populate its "no fly" list.

The U.S. government’s reliance on “predictive judgments” to deprive Americans of their constitutionally protected liberties is no fiction. It’s now central to the government’s defense of its no-fly list—a secretive watch list that bans people from flying to or from the United States or over American airspace—in a challenge brought by the American Civil Liberties Union.

Court filings show that the government is trying to predict whether people who have never been charged, let alone convicted, of any violent crime might nevertheless commit a violent terrorist act. Because the government predicts that our clients—all innocent U.S. citizens—might engage in violence at some unknown point in the future, it has grounded them indefinitely.

The court itself found the "no fly" list's redress processes (or lack thereof) to be unconstitutional, as it was basically unchallengeable by listed travelers. (And the only sure way for a person to discover they were on the "no fly" list was to buy a ticket to somewhere and attempt to board a plane.) According to the court, the list and its lack of proper redress was a perfect storm of civil liberties violations.

In summary, on this record the Court concludes the DHS TRIP process presently carries with it a high risk of erroneous deprivation in light of the low evidentiary standard required for placement on the No-Fly List together with the lack of a meaningful opportunity for individuals on the No-Fly List to provide exculpatory evidence in an effort to be taken off of the List.

While the DHS has slightly improved its redress process for those who find themselves on the list, it hasn't made any changes to its dubious selection standards. In fact, it's made this part of the process worse.

[T]he U.S. government launched its predictive judgment model without offering any evidence whatsoever about its accuracy, any scientific basis or methodology that might justify it, or the extent to which it results in errors.

In our case, we turned to two independent experts to evaluate the government’s predictive method: Marc Sageman, a former longtime intelligence community professional and forensic psychologist with expertise in terrorism research, and James Austin, an expert in risk assessment in the criminal justice system. Neither found any indication that the government’s predictive model even tries to use basic scientific methods to make and test its predictions.

As Sageman says, despite years of research, no one inside or outside the government has devised a model that can predict with any reliability if a person will commit an act of terrorism.

And there go any redress improvements. To get off the list, a person must convince the government he or she won't commit a criminal act that its "predictive model" has determined they might. At least in the FBI's terrorist "investigations," there's a minimum of intent and activity. In the case of would-be travelers like the ACLU's clients, there's nothing more than a predictive model spitting out probabilities.

In all likelihood, the predictive model used by the US government is based on more than faulty science. It's also based on faulty reasoning. As Doug Saunders at the Globe and Mail points out, analysts researching tracking and surveillance of would-be terrorists are finding the usual presumptions are mostly wrong.

Analysts began looking at the work of Paul Gill, a criminologist at the University College of London. In a highly influential 2014 paper titled “Bombing Alone: Tracing the Motivations and Antecedent Behaviours of Lone-Actor Terrorists,” Dr. Gill and his colleagues analyzed known terrorists not by what they thought or where they came from, but by what they did.

In the weeks before an attack, terrorists tend to change address (one in five) or adopt a new religion (40 per cent of Islamic terrorists and many right-wing terrorists did so). And they start talking about violence: 82 per cent told others about their grievance; almost seven in 10 told friends or family that they “intended to hurt others.”

A huge proportion had recently become unemployed, experienced a heightened level of stress or had family breakdowns. And most had done things that looked like planning – including contacting known violent groups.

Predictive modeling often looks like "thought policing," but that is of little use, apparently. There are other indicators that are far more telling, but these factors aren't being given proper weight by the models in use. Saunders notes that there has been a shift in modeling over the past couple of years, thanks to research from analysts like Paul Gill, but that shift in predictive factors hasn't slowed legislators from demanding even more futile, invasive "thought policing."

Unfortunately, governments, including Canada’s, are behind the curve: Just as their terrorism experts and security employees have abandoned policies which resemble the policing of thoughts, they're passing disturbing laws to make such obsolete practices easier.

The DHS may be using smarter modeling now, but it's not as though it's been examining its existing list to remove those who don't match the vague criteria. Instead, it's only responding to challenges made by travelers who find themselves on the list, and even then, it may still withhold information a listed flyer could use to challenge their status if the agency deems the release of such info a threat to national security. The nod to due process leads to an exchange of information and paperwork with the government, but there's nothing adversarial about the redress procedure. It's your word against theirs, with the agency -- not a court -- making the final determination as to whether a person can ever board an airplane.

Filed Under: behavioral targeting, doj, hunch, junk science, no fly list, terrorist watchlist, tsa

Behavioral Targeting May Be Illegal

from the smells-like-wiretapping dept

A bunch of ISPs have been experimenting with systems such as Phorm and NebuAd that monitor their users' online behavior and create profiles that help third parties create more targeted advertisements. Back in March we noted that behavioral advertising may be illegal under UK law. And last week we reported that Congress was asking some tough questions about the plans. CNet's Declan Declan McCullagh has an in-depth look at American law, and concludes that such systems are probably illegal here too. The problem is that what Phorm and NebuAd do sounds a lot like wiretapping, and wiretapping is illegal under several federal laws. At least three federal laws govern when electronic communications providers can disclose their customers' communications to third parties. One of the key questions Declan looks at is consent: the law generally allows eavesdropping with customer consent, but the exact nature of the consent isn't clear. ISPs have tended to be very secretive about their use of these systems, so at the very least, privacy laws would require that ISPs disclose what they're doing and give consumers a way to opt out. But Declan suggests that this might not be sufficient. Some of the legal experts he talked to think the law would require the ISPs to obtain the affirmative consent of customers before commencing the use of these programs. Since it's hard to imagine customers being enthusiastic about having their ISPs eavesdrop on them, such a requirement might make these programs non-starters.

Filed Under: behavioral targeting, clickstream data, privacy, wiretapping
Companies: nebuad, phorm

Should Facebook Users Worry About Ad Snooping?

from the probably-not dept

The New York Times's Bits blog points us to an interview with Esther Dyson in which she raises questions about the way social networking sites (especially Facebook) are planning use customers' data. She seems like she might be lumping together two different issues that ought to be kept separate. If she's simply saying that Facebook should get permission before sharing private user data with advertisers, it's hard to argue with that. But she seems to be making the broader claim that Facebook shouldn't even use private information to choose ads on its own site without getting the user's permission first. That doesn't make a whole lot of sense to me. The information is already on Facebook's servers, so it's not likely to create new security risks to have the advertising algorithm take the information into account. Moreover, targeted ads can be chosen without ever giving advertisers access to anybody's private information. A shoe store might, for example, ask to have its advertising displayed to every Facebook user who's under 35, female, and within 50 miles of the 63105 area code. The shoe store would never get a list of Facebook users who met that criteria, nor would they be given the specific age or zip code of people who click on the ad. Rather, Facebook's own software would automatically display those ads and then bill the shoe store based on the number of impressions or clicks that were generated.

Filed Under: advertising, behavioral targeting, esther dyson
Companies: facebook

Do Not Track List Won't Make Advertisers Happy

from the resistance-is-futile dept

Just as Facebook is looking to launch its own behavioral advertising network, AOL and some privacy groups are pitching the idea of a "Do Not Track" list that would effectively let people opt-out of behavioral advertising tracking. It's a challenging issue to deal with. Advertisers, obviously, want more data and information about who is viewing their ads, as well as having the ability to better target those ads. At the same time, the theory is that people are much more receptive to highly targeted, relevant ads. The problem, though, is that many internet surfers have no idea how much information they're handing over and how it's being used (and many would argue that the more relevant ads aren't actually appearing). If they knew how much data was being collected, however, many would probably be quite upset. The purpose of the Do Not Track list would be to give them back some control. Advertisers, of course, won't like this idea at all, as they often feel it's their divine right to have as much information as possible. They'll also complain that without this data, advertisements will actually be less relevant and less useful -- which might actually be true. In the end, though, it seems like while a "Do Not Track" may get lots of publicity, but how many people will actually sign up? Certainly I'd expect techies who are more concerned about this kind of thing to sign up -- but the average consumer? Unlike the "Do Not Call" list, most people don't even realize that they're being tracked, and so are much less likely to have the incentive to opt out of being tracked.

Filed Under: advertising, behavioral targeting, do not track
Companies: aol