20 March 2016

WOLVES, SHEEP, NEEDLES & HAYSTACKS’: THREAT INTELLIGENCE’S BIG DATA PROBLEM

March 18, 2016 · by RC Porter ·
www.fortunascorner.com
I attended a conference today (Mar. 17, 2016) at Georgetown University, on the magnitude of the big data problem — especially when it comes to discovering the lone wolf/wolves, and the difficulty of ferreting out an ISIS member or sympathizer who is hiding among the millions of refugees pouring into Europe from war torn Syria, Iraq, Afghanistan and elsewhere. The guest speaker was Andrew Borene, Senior Executive, Worldwide Strategic Initiatives with IBM, who has decades off experience working in the national security arena [Intelligence Community, DoD, DHS, etc.] and is a former Marine — to the extent anyone can be a former Marine. Mr. Borene’s talk was moderated by Col. (Ret,) David Maxwell, Associate Director of The Center for Security Studies Program/Edmund A. Walsh School of Foreign Service at Georgetown University. The title of Mr. Borene’s talk was “Wolves, Sheep, Needles, and Haystacks.

Mr. Borene highlighted the difficulty that intelligence agencies, law enforcement, and governments are having in trying to find the ‘wolf,’– the ISIS member hiding among the legitimate refugees. Over 3 million refugees have fled Syria’s civil war, flooding into Turkey, Lebanon, Jordan, and Iraq. Another 6.5 million Syrians remain displaced within their own country. A human catastrophe and the most profound mass migration of refugees since WWII. Needless to say, these kind of conditions provide a fertile recruiting pool for the Islamic State to seek new members.

The magnitude of the refugee problem in some ways, mirrors the magnitude of the big data/threat problem. Intelligence analysts are drowning in the vast amount of data, and overwhelming their ability to separate the needles from the haystack. Challenges in scale, speed, data aggregation, and discerning context in order to ID patterns and anomalies — and turn that information into actionable intelligence — are the keys to making analytical improvement versus coping and making sense of the volumes and inundation of data. Mr. Borene argues that intelligence analysts and others are simply overwhelmed and this situation requires new architectural solutions; and, underscores the need for artificial intelligence, and big data mining to help us find the needles, and quicker. IBM’s Aurora Project is but one of many in the private sector that offer some promise in moving the ball forward in this most challenging area. Aurora is an IBM research project, and the name of a traffic analysis and visualization system.

Mapping Terror Networks: Why Metadata & The Haystack Matters

So, how do we best identify “the key players {network/link analysis), and the broader network of their fundraisers [enablers], radicalizers, travel facilitators and others quickly enough so that they [these darker angels of our nature] can’t succeed,” i.e., Paris and San Bernardino, etc.?, asked Philip Mudd, former Deputy Director of the CIA’s Counter-Terrorism Center in a Dec. 30, 2014 Op-Ed in the Wall Street Journal. Mr. Mudd asked, “How do we ensure that we’ve ‘mapped’ the network enough to dismantle it?,” or stop the next San Bernardino, or worse.

“You need a haystack in order to find a needle,” he wrote. But, Mr. Borene warns that now, the haystack has many needles — now we have to find the one/s that matter more than others. As Mr. Mudd correctly observes, “HUMINT is the more desirable method of collecting this kind of information; but, gathering critical HUMINT is often difficult, and time consuming. Mapping a network of people is simple in concept;” he wrote, “but complex in practice; find the key operators, and find the support group. Map a network poorly, and you may miss peripheral players who will recreate a conspiracy after one of the core conspirators are arrested. The goal,” Mr. Mudd said, “is to eliminate the entire spider-web of conspiracy, cutting off a piece like an arm of a starfish, is a poor second choice — the starfish’s arm — regenerates.”

What the Aurora Program and others like it offer is — graph analytics — which is the “creation of a visual representation that enables the individual intelligence or security analyst to uncover connections [link analysis] that are ‘hidden in the noise,’ as well as visualize and understand the entire contextual picture,” wrote Tim White, an executive with YarcData, a data analytics firm, in a January 22, 2014 Op-Ed in the New York Times.

There is no doubt that we are drowning in data and are beyond the point of our analysts and operators being able to cognitively comprehend it all. Big data mining and the visualization techniques offered by Mr. Borene and others hold promise for helping us find that needle in a mix of needles in a haystack; but, it isn’t a silver bullet, nor a panacea for the complex data environment in which we find ourselves. One thing these programs and techniques cannot do — is account for denial, deception, bluffing, and other devious means that are unique to humans. And, in some aspects — these big data mining, algorithmic programs have had some negative effects — making some intelligence analysts intellectually lazy, and too dependent on program software, instead of insatiable curiosity and plain old “gumshoe” analytical detective work. IBM Fellow Jeff Jonas correctly observed some time ago that “even in the [intelligence] analytical community, there is a relatively small percentage of people who are really good at making sense of information that doesn’t appear to be connected [which really is]. This is a small number of analysts who fit this mold, which of course compounds our problem of coping with the deluge of data — and an adversary that is evil, devious, deceptive, and more informed about how to evade our surveillance in the aftermath of the Edward Snowden leak, among others.

So, at the end of the day, these programs/projects hold promise for helping us sort through the mountains of data that confront us; but, these same techniques can, and in some cases, do erode our intellectual curiosity — if the big data mining algorithm didn’t find it, it must not be there — and, it is difficult for these kind of techniques and programs to account for deception. Knowing the in’s and out’s of deception is a unique skill-set all its own. Marrying that skill set with an analyst who can make sense of information that does not appear connected — but is — is an even smaller, — very small number of analysts/humans who can do this well. Use these programs and big data mining as a force multiplier; but, resist at all costs ever relying too much on them. Otherwise, a Black Swan will be waiting to greet us at a time and place we least expect.

As someone long ago once said: “The greatest hindrance to progress is not ignorance; but, the illusion of knowledge.”

No comments: