Tuesday, October 10, 2017

Domestic Security Implications of Las Vegas: Cold Takes

I've waited a few days to write. Nothing sensational here or grand theories. No hot takes.

First, the terrible events in Las Vegas cannot, at this point, be described as terrorism. They may be terrible and terrifying, but the Federal definition of terrorism includes a social or political objective. So far, there is no evidence that this event had a political motive - that could change if new evidence comes to light. While everyone seeks some kind of explanation, it will bring at least a tiny amount of coherence to the horror and in a time like this we take what comfort we can.

While the event was not terrorism, it was a security crisis and raises new issues for consideration. I will leave tactical response issues to others with the appropriate expertise. It did appear that the new procedures for integrating police and fire units during the incident were effective and allowed the extrication of victims during the incident. This allowed the wounded to receive more timely medical treatment, saving lives.

The classic terrorist is a male between late teens and early thirties. Dylan Roof and Omar Mateen are classic cases, there are of course outliers. Years ago, working on a very different project, I was examining the files of violent incidents kept by the Southern Poverty Law Center. While many of the perpetrators were the classic disaffected young men, I also noted a lot of much older men involved in incidents as well. This was not the purpose of the project, but the information stayed with me.

I do not have hard data, but it is worth noting that - particularly among right-wing extremists - there are a fair number of much older perpetrators. The 2009 attack on the Holocaust Museum in which a security guard was killed was carried out by 88 year old James W. von Brunn. Glenn Frazier Cross, who killed three at a Jewish Community Center in Kansas in 2014, was 73. On the left, James T. Hodgkinson, who attacked the GOP Congressional baseball team practice, was 66.

The Vegas gunman was also in his sixties.

More study is needed. These incidents might simply be outliers. The vast majority of terrorists and violent criminals will continue to be between their late teens and early thirties. But those are also the populations most likely to be monitored. Even a small uptick in violence from a population generally assumed to be non-violent could have a significant impact on public safety.

It is not my intention to wade into the question of gun control. People who are passionate about gun ownership know the law back and forth. I don't. I cannot accept either mass tragedies such as Las Vegas and Orlando or the steady and endless stream of deaths and injuries by firearms. I don't know what policies would necessarily be effective in achieving this. But I will make two tentative observations.

First, plenty of people make good livings spinning out dramatic terrorist attacks scenarios. It is kind of fun, and if you can sell it, you can become a consultant and/or peddle technological solutions. Drones are the nightmare du jour. Let's be clear, drones are being used by state and non-state U.S. adversaries on battlefields. But terrorists using drones to strike within the U.S., such as described in this article, is actually not that easy. The scenario is a drone dropping a thermite grenade on a gas tank. This might be very bad. But the focus in these and other scenarios is on how terrorists would use drones to deliver explosives or toxins. Putting aside that - as I've written elsewhere - this may not be that easy, the assumption is that the terrorists have explosives or toxins. But in fact explosives and toxins are not that easy to obtain. The chokepoint in preventing these attacks is not the drones, it is the weapon.

So while experts are obsessing about hard to pull off drone attacks, tools with proven death dealing capabilities are easily and readily available.

Second, there is a question of broader politics. Lobbyists for firearm ownership have been extraordinarily successful. Politics changes. Public opinion is shifting against them and eventually politics will follow. When they start losing, they will start losing big - sliding down the slippery slope they worry so much about.

The vast majority of gun owners, who are law-abiding and safety conscious will accept these new inconveniences. For a small number, gun ownership is about much more than a hobby, it is about identity in a very profound way that sometimes aligns with radical causes (do I really need to say more about this?) Overall smart policies (not necessarily laws) could reduce gun violence substantially. At the same time, it may spark a violent counter-reaction.

Monday, August 21, 2017

Afghanistan Agonistes 1: No Good Choices

Quick note, I have two blogs - this one, which started out on terrorism and has expanded to international affairs, technology, and ideas in general. Then I have Veepcritique, which started out as sort of the commentary track to my dissertation on the vice president, but now is more broadly on presidents, politics, and White House process. This particular rant is unique because part 1 is at here at TerrorWonk because it is about the policy aspects of Afghanistan. Part 2 is about the struggles in actually making policy on Afghanistan and the Vice President's increasingly significant role.

Also, I was originally going to entitle this Sympathy for the Donald, but my sympathy for the President has evaporated.

Readers will have no doubts about my thoughts on that man in the White House. But the intractable problem of Afghanistan is not his doing and based on most of the reporting he is truly wrestling with the problem. And that is the ugly secret of the presidency (and of really most foreign policy issues) there are no good choices. You have to decide what costs you can live with.

In a nutshell, the president is wondering why we have been there for over 16 years and aren't winning? If we aren't winning with the current troop levels of 8400, and we just had 100,000 troops there, why will adding a few thousand now be anything more than a stop-gap?

These are very good questions. The president is right to ask them. And coming to the conclusion that we should remove our forces and leave Afghanistan to its fate is a perfectly valid conclusion. It is proving increasingly expensive in blood and treasure. It is proving a bad investment, time to cut our losses.

But, this comes at a pretty high cost. If the U.S. allied government falls, it will be a strategic defeat for the U.S. (although not truly fatal to U.S. power.) It will also be very, very bad for the people of Afghanistan - who have suffered terribly over the past several decades. An Afghanistan under Taliban control could again become a center for cultivating and exporting radical Islam.

The alternatives are to throw a huge number of troops to Afghanistan and really try nation-building. The problem is that it is hideously expensive and will involve significant casualties. Also, we just did that and it didn't work.

Instead of going big in space with huge numbers of troops, we could go big in time - that is make a long-term commitment to a more modest force in Afghanistan. There the argument is that if the Taliban know we are not leaving so that they cannot ultimately win, they will be forced to come to the table. It is a good argument, and while expensive it is not inconceivable. Politically the American people want wars to end and a presence in Afghanistan keeps us wrapped up with neighboring Pakistan.

It appears the president will choose to send about 3800 more troops. This will buy some time for the government in Kabul. Will it be enough for that government to develop the capacity to defeat the Taliban or at least force them to the negotiating table? Perhaps, it's a gamble. It has the political advantage that it removes any really hard decisions to a few years in the future. Presidents often like that.

It is this lousy set of options that led the president to seriously consider hiring mercenaries to do the job in Afghanistan. Most presidential aspirants campaign arguing that there are simple, easy solutions that only they know about. But, most politicians know quite well, that magic is not real.

Our first amateur president is learning this in real time, the hard way. Most hard problems are about deciding what kind of pain you can live with - defeat, endless commitment, or huge expense. The default is usually incrementalism and that appears to be the path chosen. It is understandable, but it too has costs. Incrementalism can lead to greater costs down the line as commitments slowly increase without a clear decision. A hard expensive decision at the beginning often leads to better policy. But here I do have some sympathy for anyone faced with such a decision.

Sunday, June 11, 2017

The Data Story-Teller

Data scientist is now officially the hip cool job. I remember laughing at the scene a couple seasons ago in House of Cards where thegenius data scientist stood shirtless in a soundproof room, blared music andscreamed as he came up with deep insights to help the Underwoods use data to win the election.

The reality is a bit more prosaic. Surveys show most data scientists spend most of their time cleaning and preparing data. They aren’t data scientists. They are data janitors. Of course a lot of science is like that (talk to anyone who has worked in a lab.)

Anyway, I’ve been hanging around people doing big data for over a decade now. I don’t write code and can’t do much math. So what am I?

There was a terrific article from Deloitte about the light quant. That is someone who knew enough data science and was a skilled communicator who could translate between the data science time and the C-suite decision-makers.

But I play a much broader role in the process than communicating results (not that that isn’t really important!) I help conceptualize the project. What are the problems people are trying to solve? This is sometimes not obvious. People don’t know what they don’t know. In discussing the surface problem, bigger problems can emerge.

I think a lot about the format and nature of the data. In many, many cases the really interesting information is unstructured or qualitative. What does it really mean and how do we best incorporate it? In some projects I have played a key role in collecting the data, but in the case of terrorism research much of the information is narrative – how do we meaningfully describe this numerically.

Then of course, when we do have results, we have to describe them and balance them against what is already known or believed.

We understand the world through stories. In addressing abstract problems, I often find myself asking for examples. At the core of the process I have described are stories. There is the story of the client. What are they saying about their workflow and challenges?

On so many interesting problems, the challenge is turning a story with fascinating details into a number or group of numbers. In my decade at UMIACS, I worked on projects modeling terrorist groups. Some things, like terrorist attacks were relatively easy to turn into numerical data (how many killed, codes for targets etc.) Other things, like information on the terrorist group’s public statements or their internal dynamics, were a bit more challenging to quantify. It is worth noting that computer scientists (and data scientists) tend to be interested in type. The analysts and SMEs tend to be interested in instance. The instance is a story, how to categorize the instance to a type without losing too much critical information is a hard challenge. The decisions about how this is done will shape the results – that too is part of the story.

When there are results, they must be considered in light of what is already known. What stories do we tell ourselves about this issue? How does the analysis inform these stories? Does it upend them, modify them, or confirm them. How confident can we be in the new findings? What are the broader organizational impacts of these findings for the client?

Making policies incorporate a combination of facts and values. Values are expressed through stories. Relying only on cold hard facts will not result in acceptable policies – values have to be part of the equation.

Answering any and all of these questions requires listening to and telling stories.

I guess I am a Data Storyteller.

Sunday, June 4, 2017

Will you need a Chief Roboticist or a Chief Robotics Officer

As I've mentioned elsewhere, your humble blogger is thinking a bit about technology policy issues and, in particular, robotics. So here's a little musing about the different role of the chief robotics officer (CRO) and chief roboticist.

First, a critical definition. A robot is system using the sense/think/act paradigm. That is it takes in information about the world, can process that information (and learn from it), and then act on it. In processing the information it is using nondeterministic algorithms which is a complicated way of saying we cannot predict exactly what it will do in a given situation. It will learn from data it has collected and determine the best course of action. This is what makes robots particularly interesting - it is the difference between automated (which is predictable) and autonomous. The classic example is if a self-driving car causes an accident, who is at fault? The vehicle itself had autonomy, it may not have been the programmer's error.

While self-driving cars and Rosie from the Jetson's are examples of robots in the public consciousness, potential items falling under the definition described above are vast. Lots of IoT. A smart home systems that took in data about people's comings and goings and the weather might learn to adjust temperature, likes etc. That would be a robot.

The CRO would be inward facing, overseeing the organization's robots, while the Chief Roboticist would be outward facing, making policy decisions facing the broader world. There would be significant overlapping expertise and in some agencies the two hats might be worn by the same person. But in most large agencies, the jobs would be very different. Consider two examples.

FDA as a Case Study
The FDA regulates drugs, medical devices, and (in conjunction with the Department of Agriculture) oversees the safety of the nation's food supply. The FDA will, as robots become more ubiquitous, almost certainly employ them in various tasks ranging from building maintenance and security, to laboratory work, and in conducting inspections. The Chief Robotics Officer will need to think deeply about establishing frameworks for purchasing robots that can best serve the agency's mission. Some of these systems will be highly specialized, say for food inspection. Others, such as custodial systems, will probably be commercial (with certain modifications.) One critical issue will be the proprietary nature of the data these systems might handle (robots are inherently big data systems). Regulating the pharmaceuticals and other industries, the FDA has access to very valuable corporate data that must be handled securely and with discretion. In short it will be a hard, complicated job.

The FDA's real role with robotics however, will be in regulating medical devices - many of which will be robots. Imagine a smart insulin pump or surgical system? The FDA's Chief Roboticist will be advising the agency on how to determine if these systems are safe and effective. As mentioned above, these are non-deterministic systems - it cannot be known exactly how the system will react in a given situation. The challenge of validating this type of system, devising a testing regime that ensures it is safe and effective. This will also entail considering cyber-security and privacy issues (among a whole host of other challenges.) In doing so, she will also be considering how this shapes the medical robotics industry as a whole.

One person might be able to do this job. But it seems unlikely. There is overlap between the skills needed (a deep knowledge of robotics) but also a lot of variation. There may be smaller agencies where one individual handles both roles. In the FDA there may not need to be a CRO - although some organizational expertise in managing the robot pool seems appropriate. But, the Chief Roboticist would play a pretty significant role as robotics played an increasing role in health-care.

Other Examples
An even more extreme case might be the Federal Trade Commission. In its mission to protect American consumers, the FTC may need to develop significant expertise in robotics and require a seasoned Chief Roboticist. (They have recruited deeply experienced Chief Technologists.) Their need for a Chief Robotics officer will be far more limited (although not negligible - robots may be useful in their investigations, for example.)

For a counter example, consider the EPA. In monitoring and protecting the environment, the EPA may run a pretty extensive fleet of robots. The Chief Robotics Officer will have a critical role in understanding the agency's mission (current events aside) and working with manufacturers to build systems to fulfill this mission. The EPA may not need a Chief Roboticist. There could be environmental concerns about the manufacture and disposal of robots (which will have all kinds of complicated parts involving rare and toxic materials). But the Chief Roboticist role will probably not be central to the agency.

Large police departments and agencies (like the FBI or a big-city or state police department) may be an example where the CRO and Chief Roboticist are equally important. Police departments may deploy robots for a vast range of issues to ensure public safety (as well as internal uses in logistics and forensics.) Because of the sensitivity of the police role, ensuring these systems operate lawfully and safely will be a critical issue. To take one example, robotic law enforcement systems may not be able to exercise the discretion that human police officers can (consider speed cameras - or don't, I hate them.) Presumably police robots will not be given access to lethal force, but establishing policies around use of non-lethal force (tear gas or restraints) will be a multi-faceted challenge. The Police CRO will have a tough job.

The Police Chief Roboticist will also have a tough gig. Robots will be damaged in crimes, gather evidence of crimes, and be used to commit crimes. Robo-forensics will be a field and it will require extensive technical knowledge but also a grasp of the legal issues. Further, police will need to make policy around robots in public spaces that could endanger or otherwise impact public safety. Can one person do both of these jobs? In a large organization that seems difficult.

Private Sector Needs
Your humble blogger does not know much about the private sector. But this framework may be apt. Consider an automobile manufacturer: the CRO would have the challenging technical role of obtaining autonomous manufacturing robots, while the Chief Roboticist would wrestle with the vast complexities around self-driving vehicles. These are two very different jobs.

Just as with government agencies, many companies may not need both positions. A hospital will need a CRO, but outward facing policies on robotics may not be an issue. Alternately, an advisory firm may not have much need for robots internally, but may develop expertise to better inform their clients.

Concluding Thoughts

First, I have to observe that there is another possible position: Chief Robot. This will be the senior robot in the organization, elected to represent robotic needs. This is... a long way off.

But seriously who cares? In my paper on robotics governance I observed:
Bureaucracies are bundles of programs and routines, carrying out systematic operations. Bureaucracies, given broad goals, have the ability to act autonomously and develop programs and responses.
This raises an interesting question: are bureaucracies robots? Bureaucracies take in information about the world. They process that information. They can then act on that information, sometimes in surprising and unexpected (and occasionally counter-productive) ways.
If organizations are sort of giant robots, thinking through their configuration is important. What kinds of capabilities will they need? Robotics has the potential to be a profoundly transformative technology. Many organizations (public and private) will approach it in a haphazard manner. Government IT has often suffered from this approach (I imagine plenty in the private sector have as well). Thinking through these issues and developing the appropriate capabilities beforehand would only be prudent.

Finally, in response to my observation about bureaucracies being giant robots my boss wrote in the margin: "The world's slowest robot."


Sunday, March 26, 2017

Middle Age 2: Lessons from Physical Therapy

I have, for years now, been going to physical therapy (PT). Bad shoulders, bad knees, and other parts of me creak. Much of this self-inflicted from years of lifting weights, running, and generally trying to keep this aging meat sack fit and capable.

At the core of physical therapy is the concept that around the large muscles are a number of smaller muscles that support and stabilize them.  Exercising the large muscles may not adequately exercise the little muscles and, when stressed, they become tight and ineffective. This of course can lead to pain elsewhere I now have golfer’s elbow (and I would NEVER play golf). This is partially from not exercising my forearm muscles and partly as a consequence of stresses in my back and shoulders.

My rotator cuff is getting stronger, thank you.

But my recent rounds of PT have made me think about it as a metaphor for other things.

Organizational Perspective
Organizations usually have core functions, but also lots of auxiliary functions. Depending on the organization these auxiliary functions may be given the attention they require, but sometimes not. This is where private sector organizations have a huge advantage over government agencies (on which I have a bit more expertise.) Corporate leaders have a great deal more freedom to deploy resources than their public sector leaders. If a corporate head believes human resources is critical and wants to build a great human resources department that can think strategically about the organization’s needs and future and how to build the human capital to meet them – they can do it. They will ultimately have to justify this to their board of course, but if they can demonstrate that this is important to the revenue line they can earn the necessary support.

(There is a significant argument within organizational studies as to whether private sector firms are in fact better at adapting than public sector agencies. It is also possible that rather, private sector firms can go out of business, so that when one becomes too inefficient to survive it dies. Public sector agencies are almost never eliminated.)

In the government, output is more complicated. It is not simply about making money; it is providing a range of services that cannot be withdrawn. Often the service outputs must be balanced against an enormous range of other values – environment, diversity, transparency etc.

Taxpayers and legislatures really like to fund the tip of the spear – Navy ships, law enforcement officers etc. But supporting the back end: human resources, facilities, IT, and logistics are less exciting. These support functions become like my rotator cuff: cramped and unresponsive – ultimately inhibiting the function of the total limb.

This can be extended on a larger scale. A weightlifting champion friend of mine explained that in the U.S. we emphasize the front muscles (particularly the pectorals on the chest.) The Russians in contrast emphasize the back muscles, the latissimus dorsi and rhomboids. Of course both are essential. Bench presses without rows will lead to a major imbalance. In current terms one can think of the perennial State-Defense wrangling. We build one capacity, but not the other. This ultimately leaves us weaker.

Mind as Muscle
But since I’m sliding into middle age, I’m also thinking a bit about you know, me.

In the Robertson Davies (my favorite author) novel World of Wonders, a carnival fortuneteller explains that everyone who comes to her asks essentially the same thing, “Is this all that life has for me?”

Our minds and psyches are similar to our bodies. They contain capabilities we like to exercise and which grow stronger. But th

ey also have capabilities that are less exercised and become weaker. This is something writers think about a great deal since the core ability is so very hard, but leaves little energy for anything else. So that many of our other capabilities are cramped and it is painful to use them.

Someone who diligently does their personal budget, but does not exercise their imagination may find as they enter middle age a certain lapse. With more time and freedom, and a decline in pleasure from whatever was enjoyed before, imagination is needed more than ever – but is too weak for the task. The alternative is also true, an active imagination but inattention to finances could lead one to face a different set of problems.

Of course, someone might have both of these aspects of life in good stead, but there will always be a deficit and weakness. It is inevitable that some part of the person has been underused and in middle age it is cramped, stressed, and needs exercise.

Wouldn’t it be great if there were some sort of PT for the mind and the soul?

Tuesday, March 14, 2017

Drones as Cheap WMD? A Skeptical Take

So this blog is the TerrorWonk, but I don't seem to be writing much about terrorism these days. Hell I don't seem to be writing much of anything lately. (I've done a bunch of academic writing that I need to post, but we'll get to that later.)

A lot of terrorism analysis (is lousy, but that's another issue) focuses on groups. I'm not so deeply embedded in following ins and outs that I have so much to say anymore. But I do still think about terrorism conceptually and in particular applying my maxim that counter-terrorism is the practical application of Murphy's Law.

So, with the throat clearing out of the way...

The Scenario
I was at a workshop and a speaker discussed how, with advances in AI, small commercial drones could be fitted with a small amount of explosives and then autonomously target people - one drone/one person. A million of these drones could fit in a cargo container and, on arrival, be set loose on the city devastating it.

It seemed a little sensational to me and the more I thought about it, the less likely it appeared.

Technical Challenges
First, the engineering would be non-trivial. Assuming AI (and in particular computer vision) could fly around a city and identify people as people, there would still be a some pretty tough problems to solve. The drone involved is pretty small, loading it with processors, sensors, and explosives (people over-estimate the ease of engineering explosives) is going to add weight. That will limit range and speed (or you need a bigger drone - and thus more cargo containers - more on why that is an issue below.)

Building a small drone that can find and kill a person is theoretically possible, but not easy. (Here's what DOD is doing with experimental micro-drones). Let's assume this complex engineering feat can be overcome, actually deploying it will present a lot of other difficulties.

Deployment Dilemmas
How is this million swarm of killer drones (WMDrone) to be delivered? We have it in a cargo container, but then what? This very nice (and not so tiny) drone has about 30 minutes of flying time. So, how does this work? Do you just release them from the port authority? Will 30 minutes flying time get them to their targets? Won't people notice the swarm of drones flying around the city? What if people go inside?

Also, will the drones need to be packed during shipping? They have explosives and stuff. Unpacking a million drones is a non-trivial endeavor. It requires time, space, and people.

For this to work, the drones need to start near their targets. They need to be transported, hidden, and prepared. This requires having a logistical base and personnel. The problem is that people do stupid stuff (like get pulled over or really insist on getting their deposit back) and get caught. The more moving parts, the more possibilities for something going wrong.

Let's imagine an adversary has a reliable network of supporters and can secure the necessary safe houses.

Logistics Limitations
So in a quick search the least expensive drone I found was this mini quadcopter. It only flies for five minutes and weighs 2 ounces. It is small enough that large numbers could be transported and hidden. Let's imagine with technology improvements it can have enough of a sensor and explosive to do the job, and a network exists to keep large numbers close to a crowd until the right moment.

The drone costs $20, so for a million of them (plus the additional engineering, tens of thousands of pounds of explosives, testing, transportation, acquiring space, paying personnel) and this becomes a pretty expensive project. Even if money were no object, carrying out a project on this scale would have a pretty significant footprint. There would be thousands of tests to ensure the things worked. There would be a pretty extensive supply chain. How does one order a million drones? Where would the testing take place?

Some of these problems could be overcome, the critical question would be about the adversary.

Capabilities and Motivation
A nation-state could overcome a lot of these challenges. A hundred million dollar project is not inconceivable. The drones could be transported over time through diplomatic pouch to the nation's Embassy and then released when everything was in place.

But would this be an effective tool for advancing national interest? Nations pursue WMD for deterrence, but as we all know from Dr. Strangelove, you cannot deter if the other player does not know you possess the system. The WMDrone could not be revealed, otherwise counter-measures could be deployed, rending the system useless for deterrence.

Maybe a nation would choose to use the WMDrone for a decapitation strike. But it might not work. First, given all of these technical challenges, the things could just fail. Also, given the logistical and operational footprint of the project it could be discovered beforehand. The nation building the WMDrone would need to construct facilities, hire experts, and write analysis papers. The intelligence agencies of its adversaries might notice. Even if they got to deployment, nations tend to spy on the Embassies and diplomatic personnel of their adversaries as well. The costs of being caught carrying out this plot would also be high.

Terrorists might find the WMDrone quite appealing. They would have the desire, but the capability would be lacking. First, it is expensive. Terrorists usually do not have tens of millions of dollars for R&D. Second, because they act clandestinely, extensive testing would be difficult. Also, the mechanics of purchasing and assembling a million of these devices for a secret group would be very, very challenging. Finally, in the actual delivery phase, they would not benefit from an official tolerated infrastructure the way a nation-state would.

Terrorists might find a much smaller deadly drone attack - say a few hundred - possible. But this would not be easy to do. Let's emphasize, right now the technology needed does not exist. Frankly a terrorist group that can get hold of a couple dozen pounds of high quality explosives has much simpler and sure-fire options.