< Back to front page Text size +

Does PRISM really work?

Posted by Kevin Hartnett  June 12, 2013 11:36 AM

E-mail this article

Invalid E-mail address
Invalid E-mail address

Sending your article

Revelations last week that the National Security Agency has been conducting a top-secret digital surveillance program called PRISM spawned widespread outrage. They also prompted a secondary set of questions: Is blindly collecting gargantuan amounts of Internet data even an effective way to nab terrorists?

In the days since PRISM became public, a couple of blog posts have been published that come to innovative but opposite conclusions on that question.

The first, by Duke sociologist Kieran Healy, argues that PRISM is more dangerously invasive than the government has allowed. Healy takes aim at the claim that there's no great privacy intrusion when the government merely collects metadata- records of who called whom when- but doesn't actively eavesdrop on conversations. To make this point, Healy takes the entertaining position of a British security official circa 1772 trying to suss out the top leaders of the brewing America rebellion. Healy begins with a set of fictitious colonial-era metadata showing the names of prominent patriots and the civic organizations they belong to. Then he uses the modern technique of "social network analysis" to demonstrate how knowing the ways in which people are related to each other (but not what they actually talk about) makes it easy to hone in on the true ringleaders in a group (in Healy's fanciful case, Paul Revere). Healy's point is that social network analysis applied to PRISM metadata is powerful if you're trying to identify an Al-Qaeda leader but also troubling in that it gives the government the unwarranted power to monitor how citizens are organizing themselves.

A second piece of armchair analysis, however, concludes that PRISM packs a much softer (and less accurate) punch. In a piece posted on his website last Thursday, Corey Chivers, a PhD candidate in statistics at McGill University, uses Bayesian statistical analysis to show that the odds are long of a pervasive domestic digital surveillance program correctly identifying a terrorist.

Chivers begins with what he admits are some very rough guesses- that the odds of any random person being a terrorist are 1:1,000,000, and that even a very good surveillance algorithm is going to produce a false positive one-percent of the time (that is, for every 100 people the algorithm identifies as a terrorist, 1 of them is actually not). Chivers then whips up a somewhat complicated equation to show that, given his assumptions, the odds that a person tagged as a terrorist by a PRISM-esque algorithm is in fact a terrorist, are a lowly 1:10,102. Commenters on the post have been critical of Chivers's initial assumptions, but regardless of how you set the odds, his counterintuitive but very valid point remains: "whenever the rate of an event of interest is extremely low, even a very accurate test will fail very often."

In one sense, of course, the efficacy of PRISM is beside the point because Constitutional rights pertain irrespective of the perceived value of trammeling them. At the same time, though, the entirety of the "war on terror"- from drone strikes to the invasion of Iraq to the Patriot Act- has been calculated as a tradeoff between security and the blood, money, and rights we might trade to improve it. Given that, it's hard to really assess the legitimacy of PRISM without also getting a clearer look at its effectiveness.

H/T The Browser.

The author is solely responsible for the content.

E-mail this article

Invalid E-mail address
Invalid E-mail address

Sending your article










Browse this blog

by category