Michi’s blog

Michi’s blog » FRA-Lagen och falska positiver

FRA-Lagen och falska positiver

June 18th, 2008
9:56 am

Jag har varit en god medborgare. Jag har b�rjat emaila politiker. Anledningen �r g�rdagens debatt och dagens �terremittering av FRA-Lagen.

K�rnan i mitt email, efter en personaliserad inledning d�r jag �terknyter till vardera riksdagsledamots insats i debatten, �r f�ljande argumentation.

Tanken med signalspaningen �r att analysera trafikm�nster, l�sa inneh�ll,
och hitta allm�nna m�nster. Dock �r inga av dessa metoder 100%
tillf�rlitliga, och det man vill hitta �r v�ldigt ovanliga f�reteelser.

Problemen h�rvid �r framf�r allt:
1) m�nster �r v�ldigt l�tta att d�lja. Det finns m�nga och relativt
v�lk�nda metoder att bygga upp sina kommunikationer s� att trafikanalys
blir i det n�rmaste v�rdel�st: man kan se till att alltid skicka massa
data �t alla m�jliga h�ll, och d�rvid skicka mycket skr�pdata, s� att
n�r det v�l skickas v�rdefull data s� �r det ingen skillnad i
trafikfl�det.
2) kryptering �r l�tt att anv�nda. Det finns m�nga mjukvarupaket f�r att
kryptera all m�jlig elektronisk kommunikation. Vi anv�nder det f�r
bank�renden, f�r f�retagsintern kommunikation, och det �r l�tt att
anv�nda f�r privata �ndam�l. D�rigenom kan den som vill g�mma sig
v�ldigt l�tt g�ra all sin kommunikation ol�sbar.
3) imperfekta metoder kommer dr�nka �vervakaren i falska anklagelser.
Den internationellt k�nde s�kerhetsexperten Bruce Schneier har
diskuterat det h�r fenomenet utf�rligt i sitt nyhetsbrev. En av de
b�sta genomg�ngarna jag k�nner till finns h�r:

http://www.schneier.com/blog/archives/2006/03/data_mining_for.html

Kontentan av den artikeln �r att �ven en v�ldigt l�g f�rekomst av
falska positiver ger ohyggligt m�nga falsklarm om datam�ngden �r stor,
och m�ngden sanna positiver v�ldigt liten. Just terrorismbek�mpning �r
Schneier’s kardinalexempel: och han argumenterar med trov�rdiga
uppskattningar att �ven en absurt l�g sannolikhet f�r falsklarm –
0.00001% – kommer generera m�nga tusen falsklarm per dag med ett
automatiserat kommunikations�vervakningssystem.

Med andra ord, inte bara �r FRA-lagen ett ohyggligt djupt intr�ng i den
personliga integriteten och friheten. Det finns heller ingen m�jlighet f�r
de angivna �ndam�len att n�gonsin faktiskt infrias.

MvH,
Mikael Vejdemo Johansson
Matematiker

Jag r�knar visserligen inte med att det hj�lper, men det �r ingen urs�kt f�r att inte f�rs�ka.

Politics, Privacy, Svenska

9 People had this to say...

Bra gjort! Visst kommer det troligen inte att g�ra n�gon skillnad, men �nd�…

Det jag reagerade mest p� �r den unders�kning som tv4 gjorde vars resultat var att 56% av befolkningen var emot f�rslaget. Endast 56 ynkliga procent.

Pirater, terrorister och pedofiler kommer att anv�ndas som sk�l n�r vi slutligen f�rbjuder “obeh�rigt anv�ndande av slumptal”.

Niclas: Jag kan f�rst� siffran 56%, �ven om jag tycker r�tt illa om den. Det handlar mycket om hur, exakt, man presenterar situationen.

Bet�nk f�ljande tv� presentationer:
1. Om vi genomf�r FOO s� kommer vi kunna gripa fler terrorister, pedofiler och allehanda hemskheter. VILL du verkligen att Sverige ska angripas av terrorister???

2. Om vi genomf�r FOO s� kommer all din kommunikation kunna l�sas av tj�nstem�n utan kontrollinstanser. De kommer kunna registrera allt du g�r. Kom ih�g IB-aff�ren.

Presentation 1 �r alla ganska �verens om g�r FOO till en bra sak: vi �r i princip alla f�r lag och ordning. Presentation 2 kommer f� en hel del m�nniskor att reagera negativt mot FOO – men l�ngt ifr�n alla. Det finns en v�ldigt utbredd tendens att h�nvisa till rena mj�lp�sar och andra dumheter.

Och medierapporteringen har inte haft s� fasligt m�nga andra presentationer. Hur ska Agda veta vad problemet �r om ingen n�gonsin talar om det f�r henne?

Jag �r starkt kritisk mot FRA-lagen (naturligtvis), men jag undrar �nd� om inte den d�r argumentationen �r lite av en halmdocka.
S� som jag f�rst�tt det hela borde �vervakningen ungef�r g� till s� h�r:
1) Kartl�gg n�tverket av alla riktade kommunikationer (ALLA!) genom Sverige (eller vad de kallar “�ver sveriges gr�nser”)

2) Anv�nd n�gon form av klusteranalys f�r att uppt�cka uteliggande grupper av noder, avseende tid, rum, inneh�ll och/eller intensitet.

3) Anv�nd dessa data f�r att h�lla koll olika trender, s�som antalet intensivt debatterande islamister, storleken p� Ryssland underr�ttelsetj�nst, nya etableringar av knarkligor/maffia eller vad som nu kan tyckas vara intressant.

4) Om man �r intresserad, �ven unders�ka inneh�llet i de framvaskade kommunikationerna.

Eftersom man inte g�r en analys av varje meddelande f�r sig utan h�ller p� med megavariat analys, �r det fel att multiplicera en falskt-positiv siffra som �r tagen ur luften med samtliga kommunikationer. J�mf�r g�rna med bioinformatik med �tskilliga hundratusen gener, ett 50-tal kovariater, kanske 1000 samples (om du har tur), och m�let att identifiera intressanta sjukdomsfaktorer. Det g�rs enkelt p� en vanlig PC.
Jag �r r�tt s�ker p� att jag skulle kunna plocka ut en hel massa intressanta upplysningar om jag fick tillg�ng till FRAs data samt en superdator eller tv�. Och FRA-folket �r betydligt b�ttre �n jag skulle vara.

Det h�r tror jag �r orsaken till att FRA-folket suckar h�gt och tycker att debatten �r helt felriktad- den absolut st�rsta m�ngden data som f�s ut kommer att vara aggregerad, och inte handla om inneh�llet i ett enskilt mail utan om aggregerad info.

Det h�r hindrar inte att skeendet fortfarande �r en integritetskr�nkning, och att FRA *kan* avlyssna vad som helst av ren k�ttja, och av den anledningen b�r man ha j�vligt ordentligt med s�kerhetsapparat och elaka typer som bevakar dom. Men att avlyssningen inte skulle ge intressanta upplysningar �r fel.

/Gustaf (som kanske �r lite yrkesskadad som statistiker – alla data �r intressanta )

V�lkommen hit, Gustaf.

Po�ngen �r v�l att, till skillnad fr�n i genetisk sjukdomsanalys, s� �r positiverna otroligt f�, men v�rderas otroligt h�gt. Om man f�r lite brus i en megavariat data-analys efter kluster som kan peka p� sjukdomsfaktorer s� �r det v�l inte hela v�rlden. Brus i terrorbek�mpning (som anf�rs, g�ng p� g�ng, i debatten) dock inneb�r att falska negativer blir extremt skadliga, och falska positiver v�ldigt m�nga i f�rh�llande till de sanna positiverna.

Jag �r sj�lv inte s�rskilt mycket av en statistiker, utan f�rlitar mig i �tergivandet av analysen p� Bruce Schneiers expertis; som dock i s�kerhetsfr�gor kan anses vara r�tt v�lbevisad.

Jag misst�nker att Bruce �r just s�kerhets- och inte analysexpert. Med andra ord har han helt r�tt om man ser hela massan av kommunikation som homogen, och vill hitta ett enskilt “vi spr�nger nu”-meddelande.

Och jag h�ller helt med om att man aldrig(eller i alla fall med v�ldig l�g sannolikhet) kommer att kunna uppt�cka konkreta planerade attentat.

Min po�ng var att enbart detta att se allm�nna m�nster i trafiken ger v�rdefull info. Och n�r man v�l identifierat kluster har man en betydligt mindre m�ngd data att g� igenom och analysera. M�let med verksamheten torde inte vara att f�rhindra enskilda attacker,utan att hitta indikatorer som korrelerar med f�rh�jd risk eller andra “yttre hot”.
Det �r faktiskt r�tt m�rkligt att det �r utifr�n det enskilda attack-scenariot som Riksdagen st�r och argumenterar, och inte s� lite talande om deras tekniska f�rst�else.
Om vi tar hela FRA-debatten som exempel, s� skulle det vara v�ldigt tydligt i �vervakningsdatan att en stark integritetslobby har seglat upp. P� samma s�tt skulle en �kad pro-militant-Jihad opinion i den svenskbosatta irakkontingenten att m�rkas av, eller en st�rre etablering av vitrysk maffia.

FRA fungerar isf (om jag har r�tt) fr�mst som en varningstermometer, och f�rst i s�llsynta fall som ett inbrottslarm.

Jag tyckte FRA-lagen var on�dig om inte annat, d� med tanke p� ovan n�mnda felmarginalens paradox.

Dina motargument g�r mig bara mer r�dd. Visst att en on�dig �vervakning �r obehaglig och integritetskr�nkande, men en �vervakning som faktiskt fungerar s�d�r bra �r skr�mmande. Att stoppa terrorattentat �r f�rst�s bra, men vem tror att det kommer sluta d�r?

F�r det f�rsta kanske man redan idag tycker m�nga lagar �r skit, exempelvis alla lagar som f�rbjuder handlingar som egentligen inte sk�rdar n�gra offer (“Victimless crime”). Dessutom kan man inte veta vilka lagar som skapas i framtiden. �siktsreglering �r nog bara en tidsfr�ga.

Och makten har d� ett vapen mot folket som �r s� kraftfullt att det med enkelhet kan identifiera “�siktsf�rbrytare”.

Jag f�redrog att tro att �vervakningen bara var kr�nkande men egentligen verkl�s. Vissa kanske skulle tycka att effektiviteten du f�rklarar �r en tr�st i sorgen, men jag blir bara r�dd.

Dag: Notera att jag sj�lv inte p� n�got s�tt tycker att integritetsintr�nget inherent i FRA-lagen. Anledningen till att jag argumenterar om effektivitet �r att det �r dessa argument jag ser anf�ras. Och om argumenten F�R FRA-lagen �r att det skulle bli m�jligt att g�ra X, Y och Z, och det finns solida argument f�r att det faktiskt inte kommer att bli m�jligt att g�ra X, Y eller Z – s� �r argumentet f�r ogiltigt oavsett huruvida det �r moraliskt.

Michi: jag syftade p� Gustafs f�rklaringar.

F�rresten �r det ju p� g�ng med ordentlig �siktsreglering p� EU-niv� nu, de vill registrera och reglera bloggar.

How to organise a major terrorist scare
The Big Dummy�s guide to security booga-booga

By Gavin Gatenby, Possum News Network
15 August 2006

How easy is it to organise a major terrorist scare like the one that�s
currently gridlocking the world�s airports? Dead easy. If you follow a
few simple points you can panic the populace and stampede the media with
virtually no risk of getting caught. All it takes is a little
confidence. Here�s a simple �how-to� for aspiring top-level spooks:

1. The politicians don�t want to know

Have confidence that the government really doesn�t want to know what it
is you�re getting up to, as long as the effect benefits them. By their
very nature, secret police intelligence and espionage organizations
operate in secret and often do, �in the national interest�, illegal
things or stuff which ordinary folk would regard as grossly unethical �
things that would embarrass the government if they were to be exposed.
If anything goes wrong the politicians want to be able to �plausibly
deny� they were involved. This relationship hands enormous,
uncontrolled, power to your small, ultra-secretive, self-governing elite
clustered at the top of the nation�s security �service�. Your colleagues
are invariably drawn from the upper reaches of the political and
economic elite and of course you know better than anybody what�s in �the
national interest� and you have a God-given right to rule. Breaking
ranks and talking isn�t in your colleagues� class nature.

2. Keep things on a need-to-know basis

Keep your security organization compartmentalised and discourage
specialist sections from talking to each other. You can plausibly plead
security reasons for this. Make sure all information gets passed up the
line to your small group at the top who compile and �assess� the overall
threat and decide when to act. Thus you control the �narrative� and the
timing of the scam. The foot soldiers may shake their heads and wonder
at some of the things you come up with, but they�ll be in no position to
contradict you. And if they do, it�s a very serious offence. It�ll ruin
their careers and could land them a very long stretch in gaol.

3. At the right time, get the president or prime minister involved

When you�ve decided on the optimum time for your security scare and
sorted out who your �plotters� will be, it�s important to involve the
head of the government. He�ll want to broadcast to the nation, taking
credit for keeping the people safe from the terrible plot. He�ll
automatically be followed by the leaders of the mainstream opposition
parties, all eager to prove their credibility, responsibility and
patriotism. As soon as you�ve made the official line clear, the media
and the state apparatus will fall into line.

4. �Prove that we lie�

Always remember: it�s breathtakingly easy to claim you�ve �thwarted�
something horrible and almost impossible for sceptics to prove that you
haven�t. This applies especially if you �thwart� the plot in its early
stages. Invariably you�re acting against individuals from a group that�s
already been demonised and will be scared to speak up or fight back. The
majority will be inclined to give you the benefit of the doubt.
Questioning the government in a time of �national emergency� isn�t an
easy gig.

5. Don�t worry, they�ll all play their part

Complex conspiracies involving lots of people are entirely unnecessary.
All that�s needed is for your close knit, unaccountable group to order
those lower down the chain to act on �information received�. They don�t
even have to know what the information was. They just have to know the
addresses to raid and who to arrest. When they do, they�re sure to find
some political or religious literature, or something on the hard drives,
or some household chemicals that will, under the circumstances you�ve
created, look suspicious. If you�re using agents provocateur, they�ll be
able to plant �evidence� and report suspicious conversations to �sex-up�
the case. Of course, details will never be available officially or in a
verifiable form, but fragments and hints of purported �evidence� can be
leaked to selected journalists (see below).

6. Feed the chickens

Keep information in official news releases to an absolute minimum.
There�s a plausible excuse for this: more information will harm ongoing
investigations and might prejudice the case when it gets to court. In
place of any hard attributable facts, provide a steady stream of small
leaks �under condition of anonymity� to selected journalists from
politically reliable mainstream news organizations. These people are
carefully selected for political conservatism and journalistic
�responsibility�. Even if they weren�t, they need a story and they�re
totally reliant on you for one. It doesn�t matter if the leaked details
are outrageously illogical. Even if they�re suspicious of the story,
your contacts will run it rather than lose a scoop. In this way you�ll
establish an unofficial official narrative that most members of the
public will be inclined to accept as something like the truth. They�ve
already been conditioned by the media attack-dogs to thoroughly distrust
the group from which your victims come so they�ll figure that if the
charges are a fit-up the victims are probably guilty of something and it
would be prudent to put them away.

7. Politicians who aren�t 100 per cent with you are friends of terrorists

No politician enjoys being attacked as �irresponsible� or accused of
being unpatriotic or soft on terrorists. Very few will dare question the
allegations in case they�re proved wrong. Most are venal politics
junkies making a very good living doing something they enjoy. It�s safer
for them to join the chorus condemning terrorism and congratulating you
on your vigilance. With any luck, some politicians will show their
credentials by loudly criticising you for not acting sooner and more
ruthlessly. Those few who are troubled will probably just say nothing.

8. Don�t worry about proving links to real terror groups

Once upon a time, not so long ago, it was felt necessary to show that
your local �terrorist cell� was recruited by, and in communication with,
al-Qaeda, or some group with actual form some time in the
not-too-distant past. This requirement brought its own problems, since
evidence of the links often failed to convince, or, worse still,
unearthed shady figures with a track record of collaboration with the
CIA or MI6 or Mossad.

It�s still a good idea to hint at such links but it isn�t de rigueur
because the problem disappeared with the happy invention of the
�spontaneously-forming, self-activating� (SFSA) terror cell theory in
the aftermath of the 7/7 London bombings. According to the SFSA theory,
terrorists don�t have to be recruited or trained. Wherever any three
integrated, happy, and successful young Muslim men get together to
discuss politics or religion or even just to play cricket, they
spontaneously decide to set up a do-it-yourself terror cell. They scour
the internet for recipes for powerful but highly unstable explosives
made from sports drinks, peroxide, hair gel, acetone and baby formula.
Without outside direction they select targets and decide the day. All
you need to �prove� conspiracy was that they met, discussed politics and
had in their possession common household chemicals, fizzy drinks and a
mobile phone. It doesn�t matter if their conversations show nothing
explicit. Just say they were talking in code. If you can show at least
one of them has travelled overseas, that�s a plus. If not, assert that
they �investigated� booking airline tickets or showed an interest in
travelling overseas.

The SFSA theory not only relieves you of having to prove connections to
international terror groups, there�s a bonus: it also increases public
fear. Any group of young Muslims kicking a ball around in the park is
actually planning to blow up trains. Or airliners. Anything you do to
these people is likely to be �overlooked�, if not vocally supported by
patriotic simpletons.

9. It doesn�t really matter if a court finds them innocent

Your victims won�t get their day in court for months, maybe years, and
if you�ve organised things well, you�ll be operating under laws that
ensure that the public and your tame media are prevented from reporting
key details or even excluded from court altogether. By the time your
victims get to court, the scare you used them to create will have done
its job. Even if your victims are found innocent, that fact will get
little press attention from a media who are embarrassed by their role in
such an obvious scam, and anyway, the accused terrorists� acquittal will
be lost in the next big scare.
Good luck, and have fun.
——————————————
Kolla �ven hur man man kan g�ra snygga sociogram �ver spioner med javascript p� http://www.namebase.org-om tv� personer omn�mns i samma dokument blir det ett str�ck mellan dom p� sk�rmen.Prova att knappa in “Henry Kissinger”.En riktig spindel!

FRA-Lagen och falska positiver

9 People had this to say...

Want your say?

About me

Travel plans

Blogroll

Family

Mathematician blogs

Archives

Michi’s blog

FRA-Lagen och falska positiver

9 People had this to say...

Want your say?

About me

Travel plans

Categories

Blogroll

Family

Mathematician blogs

Archives