A Common-Sense Framework for Assessing Information-Based Counterterrorist Programs Fred H. Cate Distinguished Professor and Director Center for Applied Cybersecurity Research, Indiana University Herbert Lin Chief Scientist, Computer Science and Telecommunications Board National Academies
PROTECTING INDIVIDUAL PRIVACY IN THE STRUGGLE AGAINST TERRORISTS: A FRAMEWORK FOR PROGRAM ASSESSMENT National Research Council National Academy of Sciences October 2008
Among the report s premises and conclusions: Terrorist challenges do not warrant fundamental changes in our level of privacy protection. Science and technologies are important dimensions of counterterrorism efforts. Program deployment and use must be based on criteria more demanding than it s better than doing nothing. Government agencies using information-based programs for counter-terrorist purposes should follow a systematic process such as the one described in the committee s framework to evaluate the desirability and feasibility of any given program before such a program is set into motion.
The Core of the Report A Framework for Evaluating Information-Based Programs for Effectiveness and Consistency with U.S. Laws and Values Applicable to all information-based programs for specific government purposes, such as counterterrorism, both classified and unclassified. To be applied before systems are deployed and regularly thereafter.
Effectiveness Programs should have or be: Clearly stated purpose-what are you trying to achieve? Rational Basis why should we even think it might work? Sound Experimental Basis is there empirical demonstration that it can work? Scalable will it work at scale? Operations or Business Processes how does the program work within the organization? Capable of being integrated with other systems how does it interact with other elements outside of the organization?
Effectiveness (cont d) Robust is it resistant to countermeasures? Appropriate and Reliable Data are the data good? Data Stewardship are the data protected properly? Objectivity in testing who evaluates the program? (not program advocates!) Ongoing Assessment programs evolve, and evolved version requires examination as well Documented are effectiveness and compliance documented, or merely asserted?
Consistency with U.S. Laws and Values Data Need why are personal data needed? Sources where do data come from? Is it legal? Appropriateness are data appropriate for the intended use? Third-Party Data require additional protections Repurposing of data should be explicit and thoughtful, especially if subsequent use is inconsistent with original purpose for collection Leave data in place if possible
Consistency with U.S. Laws and Values (cont d) Programs Objective of program clear and lawful? Compliance with existing law Effectiveness scientifically demonstrated to be effective? Frequency of false positives acceptable? Reporting and redress of false positives How to report? How to correct? Impact on individuals Data minimization are data in excess of what is necessary? Audit trail can users of the data be held individually accountable for abuse or non-compliance? Security and access are unauthorized users kept out? Transparency are the impacts and operation of the program understood by those affected by it?
Consistency with U.S. Laws and Values (cont d) Administration and Oversight Training are users properly trained to use the program? Agency authorization is the program actually authorized by a senior agency official? External authorization Sensitive PII Surreptitiously collected PII PII obtained for third party without individual consent Repurposed PII Auditing for compliance is compliance reviewed at least annually? Privacy Officer is a policy-level officer in place to manage privacy issues? Reporting are relevant policy makers and, where possible, the public informed about program operation?
The Committee believes this framework: Is realistic; Broadly applicable; Consistent with U.S. laws and values; Based on common sense, best practice, and lessons learned; Leads to continuous improvement and accountability; and Is necessary to win public support and predictable compliance, while providing government officials with appropriate protection.
Application to Syndromic Surveillance Effectiveness
Effectiveness Clearly stated purpose-what are you trying to achieve? Early warning of bioattack may provide more time to deploy countermeasures and to conduct investigations into where the attack occurred and who is at risk. Rational Basis why should we even think it might work? Disease case reports traditionally the leading indicator of onset of epidemic. More potentially relevant data streams available today (e.g., OTC drugs, electronic health records, absentee rates from work/school) More computer power to detect subtle signals hidden in these data; easier to do signal correlations. Common sense suggests that mining other data may provide indicators earlier than disease case reports.
Effectiveness Sound Experimental Basis is there empirical demonstration that it can work? Syndromic surveillance systems can detect large disease outbreaks, but not the same as better PH response. Observable behaviors that might precede patients seeking medical care for an illness are not precisely known. Spike in syndromic signals generally prompts search for more definitive evidence rather than action. Overall net result may not be improvement over disease case reports. One simulation study compared clinical case findings to syndromic surveillance for anthrax small improvement in detection (one day) but would many false positives. NYC experience with syndromic surveillance systems is mixed. (Seasonal influenza outbreaks and gastrointestinal problems caught, West Nile Virus and anthrax cases not caught)
Effectiveness Scalable will it work at scale? Is this approach is viable for all localities of any size? Are some data streams are more important than others? Must data streams have some minimal scope to be useful Trade-offs between the number and size of different data streams and the sensitivity and specificity of the result (i.e. number of false positives and negatives). Operations or Business Processes how does the program work within the organization? Capable of being integrated with other systems how does it interact with other elements outside of the organization? Different organizations have different business processes that define how the system can be used, who the agents are, who are authorized to use it, Example S1 allows anyone above G-16 to execute a report but S2 allows only three designated individuals to do so. Business process will help determine how syndromic surveillance systems can be integrated into routine public health practice and what additional resources are required. Issues arise when private contractors or university partners operate the syndromic surveillance systems (more handoffs mean more uncertainties re quality of analysis).
Effectiveness Appropriate and Reliable Data are the data good? Data Stewardship are the data protected properly? Is the system collecting only the data necessary to detect a threat? Can syndromic data be forwarded to health departments routinely protecting privacy but exceptionally allowing identification? How do privacy protection measures (e.g., geographic aggregation) affect system utility? How accurate is the data from different sources? How long do data streams need to be retained? Can records of illness patterns be retained without individual data streams?
Application to Syndromic Surveillance Law and Values
Compliance with Laws and Values - Data Need why are personal data needed? Appropriateness are data appropriate for the intended use? Personal names not required (and not used) for SS per se, but are required for followup IAW standard public health procedures. Much greater discriminating power is possible when data are linked (e.g., individual purchases of OTC meds correlated with school absences) use only if effectiveness is improved. (Today, sales associated with stores rather than individuals.) Such linking would be unprecedented. Sources where do data come from? Is it legal? ER rooms are major source of data today re disease case reports.
Compliance with Laws and Values - Programs Objective of program clear and lawful? Public health agencies do have legal authority to personal medical data if such information is pertinent to public health. Effectiveness scientifically demonstrated to be effective? Perjaps. May not improve public health response. Frequency of false positives acceptable? False positive rate is difficult to predict before actual deployment, as it depends on how the sensitivity of the SS is tuned. Big issue how much work is doable to investigate possible warnings? More important that the frequency of FP for SSS is the existence of standing procedures for dealing with consequences of false positives.
Some framework questions not addressed in report Effectiveness Robustness and resistance to countermeasures? Objectivity in testing who evaluates the program? Ongoing Assessment programs evolve, and evolved version requires examination as well Documented are effectiveness and compliance documented, or merely asserted? Compliance with Laws and Values Program Data minimization are data in excess of what is necessary? Audit trail can users of the data be held individually accountable for abuse or non-compliance? Security and access are unauthorized users kept out? Transparency are the impacts and operation of the program understood by those affected by it? Administration and Oversight