[ExI] Terrorist? Who can tell?

[Harvey Newstrom]

"Lee Corbin" <lcorbin at rawbw.com> wrote,
> Why is there
> no mention whatsoever of *probabilities*?  Or are you trying
> to tell me that a row of recent convicted terrorist bombers
> would not in fact stand out compared to a random sample
> of people from London?  That a six year old would be unable
> to tell which group was which?

Yes, that is precisely right.  Probabilities don't work as well as you would
expect, due to Bayesian statistics.  I run into this in the security field
all the time.  Someone comes up with some face-recognition program, or
terrorist detection algorithm, or threat estimation theory, that they claim
is 99% accurate.  It recognizes the terrorists 99% of the time, and only
gets a false-positive on a non-terrorist 1% of the time.  Sounds great.  It
gets implemented.  Then it fails miserably in the field.

Why?

Because for every terrorist going through an airport, there are probably a
million non-terrorists.  That means:
- 1 real terrorist gets identified (because it's 99% accurate)
- 10,000 non-terrorists get identified (because it's 1% false-positive)
... so your system only works 1/10,000th of the time.  When it identifies a
person as a terrorist, the odds are 10,000-to-1 that they're innocent.  This
terrorist detection system won't actually work in the field.

Consider:
- 99% accurate, 1% false-postive --> 10,000:1 falsely accusing the innocent
- 99.9% accurate, 0.1% false-postive --> 1000:1 falsely accusing the
innocent
- 99.99% accurate, 0.01% false-postive --> 100:1 falsely accusing the
innocent
- 99.999% accurate, 0.001% false-postive --> 10:1 falsely accusing the
innocent
- 99.9999% accurate, 0.0001% false-postive --> 1:1 falsely accusing the
innocent (50/50 chance of working)
- 99.99999% accurate, 0.00001% false-postive --> 1:10 falsely accusing the
innocent (better than even chance or working)

You would need a system that is 99.99999%  accurate with only 0.00001%
false-postive rate to have it actually catch more terrorists than innocent
people.  Nothing is that perfect with that low an error rate.  No
"probabilities" dealing with random human persnalities are that precise.
Random human variation acts as noise that obscures what you are trying to
measure.  It simply doesn't work.

--
Harvey Newstrom <www.HarveyNewstrom.com>
CISSP CISA CISM CIFI GSEC IAM ISSAP ISSMP ISSPCS IBMCP