Risk profiling software tackles the terrorist threat

[Eugen Leitl]

(Excellent reason to not fly into UK)

http://www.bbc.co.uk/news/technology-20412478

Risk profiling software tackles the terrorist threat

By Frank Gardner BBC security correspondent

Risk profiling software

Frank Gardner is shown how SAS's risk profiling software works

The UK branch of an American company has developed a hi-tech software
programme it believes can help detect and prevent potentially dangerous
passengers and cargo entering the UK using the technique known as "risk
profiling".

Executives at SAS Software, based in Buckinghamshire, say the use of such a
programme could well have prevented the so-called "underpants bomber" being
able to board a flight to Detroit in 2009 with explosives sewn into his
underwear.

So, what exactly is risk profiling and can it really reduce the risk of
international terrorism?

Risk profiling is a controversial topic. It means identifying a person or
group of people who are more likely to act in a certain way than the rest of
the population, based on an analysis of their background and past behaviour.

When it comes to airline security, some believe this makes perfect sense.

Why, for example, hold up the queue at immigration to cross question or
search the proverbial "little old lady" who is statistically less likely to
be a threat than the 24-year old male flying in from a country with security
problems?  Graphic of face as data points Data entries about a person's past
actions are used to determine if they pose a potential threat

Others, though, say this smacks of prejudice and would inevitably lead to
unacceptable racial or religious profiling - singling out someone because,
say, they happen to be Muslim or born in Yemen.

Threat detection

SAS Software, a British-based company with an annual global turnover of
B#1.7bn and which has absolutely nothing to do with the British Army's Special
Air Service, stress that their software is "blind" to such prejudices.

Joanne Taylor, the company's director of public security, says: "The risk
profiling utilises lots and lots of different variables. Every piece of data
available has nothing to do with racial profiling in its own right or where
they happen to have come from.

"It's the same techniques that are used by banks or insurance companies to
determine whether you should be given a mortgage; are you a high risk of
defaulting?"

The programme works by feeding in data about passengers or cargo, including
the Advanced Passenger Information (API) that airlines heading to Britain are
obliged to send to the UK Border Agency (UKBA) at "wheels up" - the exact
moment the aircraft lifts off from the airport of departure.

Additional information could include a combination of factors, like whether
the passenger paid for their ticket in cash, or if they have ever been on a
watch list or have recently spent time in a country with a known security
problem.  Continue reading the main story	

    "Border agencies have got vast amounts of information available to them
that they are not fully exploitingb

Ian Manocha SAS Software

The data is then analysed to produce a schematic read-out for immigration
officials that shows the risk profile for every single passenger on an
incoming flight, seat by seat, high risk to low risk.

'Exported' borders

It may sound a bit Orwellian - a further example of state surveillance in a
country already awash with CCTV cameras and where some senior intelligence
officials are pushing to have access to everyone's internet traffic.

So is this sort of risk profiling justified? Do the results justify the
means?

Last year, a pilot scheme for similar "intelligence-led border controls" was
run, after which Damian Green, the Immigration Minister, concluded: "It is
early intelligence, before people get on a plane, that will keep our borders
more secure. I want to export our borders so they start at airports around
the world."

Ian Manocha, vice president at SAS Software, says the principle works just as
much for cargo as it does for passengers.

He says South Korean Customs, which have bought the programme, report a 20%
higher detection rate of illegal goods.

"Border agencies have got vast amounts of information available to them that
they are not fully exploiting," says Mr Manocha.

"They have to make decisions about freight coming into the country and
looking for high risk scenarios.

"Whether it be a bomb threat or potentially a more mundane and routine
challenge. For example passage of contraband cargo, drugs or human
trafficking.

Security search Profiling software can spot threats that might otherwise be
missed

"All of these challenges are a needle in the haystack problem. And smart
technology can really get to find that needle in the haystack that much
quicker".  

Early warnings

So could such a programme have prevented the printer ink toner-cartridge
bombs being placed on a plane from Yemen bound for the US in 2010?

Probably not, admits Mr Manocha, as that plot was stopped not by technology
but by a tip-off from a human informant inside Al-Qaeda in Yemen.

But when asked if it would have stopped Omar Farouk Abdulmutallab, the
Nigerian "underpants bomber", from boarding his flight to Detroit with hidden
explosives next to his body in 2009, Peter Snelling, the company's principal
technical consultant, says: "I think it's fairly confident to say that yes we
would have matched it up."

Risk profiling programmes are definitely not to everyone's liking.

They also carry an inherent danger that innocent individuals could be pulled
over and questioned, searched and delayed, although the programmes'
proponents would argue they help reduce this risk by feeding in a wide range
of known facts.

But whether we are aware of them or not, risk profiling programmes are
already in use all over the world and with the volume of air traffic set to
expand even further, they look set to become an ever more common part of the
invisible scenery around us.