For counterterrorism (ct) I would say that much of their activity is not outliers, especially as they learn denial and deception techniques (ie. move to England/Germany with easier accessibility to the US.). But there are certain activities that could be an indicator (travel to certain countries and known associations).

Unfortunately a lot of people assume that all of the data mining occurs in a vacuum outside of other intelligence sources. Based on that additional intelligence, the goal is to narrow the haystacks down to hay bales that can be looked at using other investigative methods.

In my opinion, you would be hard pressed to find any analyst in the IC who would say they have a big red Easy button that says “Find Terrorist” on their desktop. It just isn’t that simple but data mining techniques do help.

But imagine that you’re gathering data by whatever means available in places where terrorist activities are likely to be planned. To get a sense of what means are available, take a look at http://en.wikipedia.org/wiki/List_of_intelligence_gathering_disciplines

If you do a decent job of data gathering, then you’ll have too much data to analyze manually. You need some way to focus your attention on the most likely data of interest.

That’s where my intuition tells me that machine learning will be useful.

With the caveat that I know very little about such intelligence matters, it seems to me that a lot of behaviors are not really anomalous at all, as they’re happening. Farmer buys lots of fertilizer. Not an anomaly — farmers buy fertilizer all the time. Friend of farmer rents a yellow moving van. Not an anomaly — people rent moving vans all the time…even people that are friends of farmers.

Suddenly, farmer and friend pack the moving van with fertilizer..and..kablooey.

Even in hindsight, the trail itself is not very anomalous.. until you get to the very day, the very act itself. But by then it’s too late for any sort of data mining.

Similarly with the box-cutter fellow. He’s just going to buy the round-trip ticket. Nothing anomalous there at all. Nor is buying box-cutters. Nor is even buying box-cutters, and then flying. (Think of all the people moving to new jobs around the country.. packing their belongings before flying. I’ll bet lots of people buy box-cutters and then fly.)

So nothing about that is an anomaly, until the act itself. Even in hindsight.

Right? I’m still trying to wrap my head around it, too, and am thinking out loud right now.

There is a danger that terrorist activities are all what Nassim Nicholas Taleb calls “black swans”: outliers that are predictable only in retrospect. It’s actually a problem I’m trying to get my head around.

More about black swans here: http://www.frankvoisin.com/?p=128

So to me that’s the real question: Do we truly believe that critical terrorist behavior is characterized by anomalies? Let’s not worry again (for the moment at least) about the false positives. How well do we do with the false negatives?

Counterterrorism is obviously harder than cyber attacks. I can use data mining to quickly analyze firewall logs and determine patterns, frequencies and attacker locations very quickly.

As far as analyzing intelligence, a good reference to read is http://zz.gd/20fec8 which focuses on human biases/thinking about thinking/etc.

There’s still the problem of false positives from anomaly detection algorithms because of underestimating the variation in the signals they measure. Still, it’s an approach that can work in principle.

Besides, doesn’t human intelligence operate only under the assumption that similar patterns of behavior will happen again and again, and that through repetitive exposure to positive training examples you can discover the features or contexts under which those patterns operate?

Doesn’t machine learning operate only under the assumption that similar patterns of behavior will happen again and again, and that through repetitive exposure to positive training examples you can discover the features or contexts under which those patterns operate?

Online shopping has millions and millions of patterns to learn from, so machine learning makes sense. But terrorism only has.. what.. dozens? How can one reasonably construct any kind of machine learning system with only a few dozen training examples?

Forget the issue with false positives. How do you even train it, to begin with? Especially when terrorists probably aren’t going to repeat their behaviors, the same way that online shoppers do? Aren’t terrorists purposely going to be trying to change their own methods, all the time? So even if you could learn something by training on a few dozen examples, there is no guarantee that the next instance of terrorism is going to “behave” anything like any of those previous instances. Right?

This is something that has always confused me about machine learning, as applied to counter-terrorism. Am I missing something fundamental here? Does someone want to explain it to me?

That said, I think the key word here is “inappropriately” as opposed to “inadvertently”. We expect our government to act in good faith. As long as it does so, people will accept the rare accidents as tragic but forgivable.

“Counterterrorism programs should provide meaningful redress to any individuals inappropriately harmed by their operation. ”

Imagine if the banking industry which utilizes data mining and algorithms to identify potential home buyers would have to have to provide redress to any individuals they inadvertantly harmed. I’m sure there were significant number of false positives among people who could meet their mortgage payment.

I understand that AI and machine learning have a bad rap for overpromising and underdelivering in the past. And much of my work at Endeca is about building better tools to leverage human intelligence, rather than over-relying on the artificial sort.

But I still don’t like seeing overly simplistic attacks on technology that seem more motivated by ideology than by informed analysis. I can’t comment on the report itself, but McCullagh’s piece reads a bit too editorially for my taste.

So, it is not as simple as saying that you have to do it carefully. By choosing to do machine learning, you also to choose to ignore other techniques which might be more productive.

How many billions were invested in AI since the 70s? How many broken promises?

Of course, this report will probably have the effect of generating even larger investments in machine learning for tracking terrorists.

Do not get me wrong. I am convinced that computers are smarter and better than human beings at many tasks, including several tasks involved in tracking terrorists. However, the bad guys also have AI on their side (think about spammers).

It could very well be that more machine learning is not the way to go.