ADVISE me of my rights…

The Christian Science Monitor has a story on ADVISE, a Department of Homeland Security project devoted to Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement of information across the Internet.  Bringing together information gathered from web sites and corporate databases to try to detect anomalous patterns which hint at possible terrorist activity, flagged for human analysis.

Does the linking of all of this readily available data constitute something nefarious?

Supposedly, all that a pattern match will provide is an indication for a human to give a closer look.  A closer look at what?  Well, perhaps terrorist activity.

But this automated electronic analysis is akin to psychoanalysis of the entire nation. 

Much of a person’s behavior happens in plain sight of others, but is tempered by a risk assessment that considers the consequences of exposing a narrow amount of information.

I tell people when it’s my birthday.  Don’t you?  I don’t consider my name to be a secret.  With those two pieces of information, it’s trivial to get a copy of my birth certificate.  On there is my mother’s maiden name.  My social security number has been used for everything from my student identification number at college, an identifier for health insurance companies, and been required for tax purposes by entities that were likely to have to end up sending me a 1099.  Some of those companies no longer exist.  Some have probably had data theft.

In any case, I’ve given up information about myself, sometimes naive about the risks, sometimes having considered the consequences of sharing some bit of information.

OK, so someone could steal my identity.  But anyone who’d have access to ADVISE could probably pull up far more information on me than that.

But what couldn’t they pull up all kinds of information on?

Well, let’s see what else they could do… perhaps they could pull up my medical records to see what diagnoses there have been, and what medications were used.  Creepy, but what the hell, right?  I’ve got nothing to hide.  The HIV tests I’ve had have all come back negative, and there’s no reason for them not to have.

Since the list of corporate databases they’d have access to isn’t specified, let’s assume they have access to my Amazon.com shopping cart history.  I’ve bought many books and CDs from Amazon, as well as various gadgets.  Some were for me, some were to give as gifts.  While I eventually ordered from another site, I once had in my shopping cart every Ani Difranco CD that Amazon carried.

I’ve never purchased, however, anything from Victoria’s Secret.  Nor Frederick’s of Hollywood.  A check of my Visa or Mastercard charge history may have had 3 or 4 purchases ever from a store that sells primarily women’s clothing.  What Visa will be able to tell you about is the tickets I bought to see Tori Amos.

Boy, from the data, if you were doing some kind of automated analysis of me, I’d probably be flagged as “possibly gay”.  I’ve gotten HIV tests, but don’t buy women sexy lingerie. I’ve bought music by artists that are known to have large homosexual followings.

Of course, jumping to this conclusion would require incomplete data… like missing when I paid for birth control pills with my debit card.  But what guarantees are there that the data will be complete while the computer tries to figure us out?

Why would it matter if I were gay?  It wouldn’t.  But what does matter is that the analysis of public and semi-public information to gain psychological insight a) can certainly be wrong, and b) isn’t limited to terrorist behavior.  I can’t see the results of this automated analysis requiring a warrant.  What fishing expeditions might be performed?  What political smear campaigns will get their ammunition from ADVISE?  Conversely, what if a DHS employee is a double-agent?

Might the compilation of public data on everything lead to exposing secret information about vulnerabilities in critical infrastructure?  Small weaknesses may not present a hazard individually, but the trauma caused by a thousand or a million targeted pinpricks could be devastating.  Who knows what’s been shared about all of those tiny weaknesses.  After all, exposing any one of them individually might have negligible risk.

Paralyze enough people into inaction by using the things that they didn’t realize they’d let slip a tiny piece at a time, and there’s plenty of opportunity to do unchecked evil.