Dr. Dobb's Journal December 2002
Medical students are traditionally taught, "When you hear hoofbeats, think horses, not zebras." In other words, rule out the common disorders before considering rare ones that are also consistent with the symptoms. It's good advice when your adversary is nature, but when you also have to consider the possibility of bioterrorist attacks, you may need to turn on the zebra detector. Anthrax and the Plague produce early symptoms that look like the flu, and detecting them requires a different kind of thinking about diagnosis. That's what medical students are being taught now.
Thinking about terrorism often requires looking at things in a different way.
Medical and law-enforcement and other authorities are deploying a wide variety of methods to identify bioterrorist attacks early on, but it may not be immediately obvious that "early on" in this context generally means something quite different from what it meant during the Cold War when applied to spotting a Soviet ICBM before it was far out of Russian airspace. The early warning for many bioterrorism identification programs today is a large number of already-infected people. Stephen Morse, who codirected DARPA's pathogen countermeasures program, says that the public health infrastructure may be not only the best but, in truth, the only component in the earliest phases of bioterror detection and response. But the public health infrastructure was set up to respond to health problems, not to prevent bad people from doing unexpected things. It's not set up to warn, but to diagnose. Past experience is not necessarily a good guide when thinking about terrorism, or about the disruptions of normal life caused by counter-terrorism measures.
In a test of a state-of-the-art airport face-recognition system in Palm Beach, Florida, last May, the system embarrassed itself by missing more than half of the target faces (airport personnel in this test, terrorist suspects if the system were actually deployed). The system vendors complained that airport personnel had set the system's sensitivity way too low. They were looking for horses, not zebras. To get an acceptable hit rate, the vendors said, the airport would have to allow more false positives—between 1 and 3 percent. I think we have enough data here to predict the near-term future of airport face-recognition.
There are three players in this game: system vendors, airport management, and the flying public. Two of the three are customers, and as in any market, the customers have all the interesting choices. For the flying public, the choice is to fly or not to fly. Airport management has two questions to consider: whether to deploy the system, and how to set its sensitivity if it is deployed. As I said, past experience can be misleading. The experience gained regarding test sensitivity in medical diagnosis may have misled some of the players in this game. A false positive on a medical test is usually no big deal: Its consequence is that another, more expensive but more conclusive, test is prescribed. The patient doesn't know whether what the first test says is correct, and is highly motivated to see the results of that second test. A false positive in airport security is entirely different. The individual in question knows for a fact that he's not a terrorist, doesn't need a second test, and considers the system and the airport personnel defective and probably racist. The result is bound to be anger, embarrassment, and probably a missed flight. And more business for Amtrak.
If airports put 1-3 percent of their customers through this, they will lose a lot of business. Their choices would seem to be:
1.Don't deploy. Result: High probability of losing potential customers because of a perceived lack of concern for safety.
2.Deploy with high sensitivity. Result: High probability of losing customers because of annoyance.
3.Deploy with low sensitivity. Result: Low probability of losing a planeload of customers, after they've paid for their flight.
My prediction: Unless face-recognition becomes almost perfect, which currently seems pretty unlikely; or is universally perceived as worthless, which seems possible but in the present hysterical climate somewhat unlikely; airports will choose Option #3. That is, they will deploy this technology but will set the sensitivity so low as to make it worthless. Just as the airport personnel did in the Palm Beach test.
Michael Swaine
editor-at-large
mike@swaine.com