N.Y. bomb plot highlights limitations of data mining

Computerworld - Saturday's botched bombing attempt in New York City provides an example of why the use of data mining approaches to uncover potential terrorism plots is a little like weather forecasting.

"You definitely need to do it, because it gives you warning of major storms," said John Pescatore, an analyst with Gartner Inc. and a former analyst with the National Security Agency. "But it's not going to tell you about individual raindrops."

Faisal Shahzad, a naturalized U.S. citizen of Pakistani descent was arrested Monday at New York's John F. Kennedy International airport in connection with an attempt to detonate a car bomb in Times Square. Shahzad, who is scheduled to be indicted on terrorism-related charges in Manhattan today, was pulled off a plane bound for Dubai, minutes before the jetliner was scheduled to take off.

Shahzad is alleged to have parked an explosives-laden vehicle in Times Square, apparently with the intention of blowing it up. Media reports quoting the FBI and other authorities said the bomb could have caused a substantial number of deaths and injuries had it detonated.

The anti-terrorism task force was quickly able to identify Shahzad as the prime suspect in the case thanks to a series of mistakes the would-be bomber made. But for the moment, there is little to show that authorities had any inkling of either Shahzad or of his plot beforehand.

Effectiveness questioned

That fact is likely to provide more fodder for those who question the effectiveness of using data mining approaches to uncover and forecast terror plots. Since the terror attacks of Sept. 11, the federal government has spent tens of millions of dollars on data mining programs and behavioral surveillance technologies that are being used by several agencies to identify potential terrorists.

The tools work by searching through mountains of data in large databases for unusual patterns of activity, which are then used to predict future behavior. The data is often culled from dozens of sources, including commercial and government databases, and meshed together to see what kind of patterns emerge.

In January 2007, there were nearly 200 data mining programs planned or already operating throughout the federal government. Among them were the Automated Targeting System at the DHS for assigning "terror scores" to U.S. citizens and the Transportation Security Administration's Secure Flight program analyzing data about airline passengers. The FBI has several data mining initiatives under way, including some that target terrorists.

One of the most controversial programs was the Total Information Awareness (TIA) initiative, which was quietly launched in 2002 by the Defense Advanced Research Projects Agency but then abandoned in 2003 after Congress stopped funding it following a public outcry. Components of the program are, however, thought to be still alive and well within the U.S. Department of Defense.