Monday, December 21, 2015

Better that a thousand innocents suffer than one guilty person go free...?

The Universal Declaration of Human Rights (UDHR), Article 11 states:
Everyone charged with a penal offence has the right to be presumed innocent until proved guilty according to law in a public trial at which he has had all the guarantees necessary for his defence.
The EU Charter of Fundamental Rights article 48 states:
Everyone who has been charged shall be presumed innocent until proved guilty according to law.
The presumption of innocence has been a cornerstone of English law for centuries. William Blackstone put it thus:
"the law holds it better that ten guilty persons escape, than that one innocent party suffer"
Benjamin Franklin was even more emphatic:
"it is better 100 guilty Persons should escape than that one innocent Person should suffer" 
Otto von Bismark, Pol Pot and Dick Cheney took the opposite view. It was better for them that innocents suffer than one guilty person escape.

The deadline for submitting your thoughts to the Joint Committee on the Draft Investigatory Powers Bill is today. This is probably the single most important piece of prospective legislation in a generation and the committee have been given an unconscionably short period to analyse and review this large and complex Bill.

I sent my thoughts to the Committee Friday evening last and will publish them here as soon as I'm able to do so.

In the meantime, though, I wanted to highlight something that doesn't appear to have been discussed in the context of the Bill anywhere that I'm aware of - the Bill's implicit reversal of the presumption of innocence.

The Investigatory Powers Bill is an attempt to codify permissions in law for the UK government to run a gigantic computerised multi systems communications surveillance apparatus. An apparatus that we know from the Snowden documents they have been running for some years. It also expands the scope and scale of those operations and the powers facilitating them. It is mass surveillance by any other name - collecting, retaining, processing and analysing the electronic communications of the entire population and as many of those overseas they can access.

The government is essentially creating intimate digital dossiers of every connected resident of the UK amongst others. We may decide as a society that is something we wish to accept - I don't - but there most certainly must be open, informed public debate about the direction of travel.

One of the key justifications for this mass surveillance is to find terrorists. As regular readers will be sick of hearing me say, finding a terrorist is a needle in a haystack problem and you can't find the needle by throwing infinitely more needle free hay on the stack.

The government have a stated belief that this is not mass surveillance because most of the collected data is only seen and analysed by computers not human beings. Every time I hear this mass surveillance defended or excused, I get a picture of the National Lottery's giant magic promotional hand emerging from the government's giant magic computerised terrorist catching machine, with a booming voice-over saying "it's you" as it points out the bad guys.

Now let's give them the benefit of the doubt and assume their machine could work. Assume it is 99% effective at pointing out a terrorist if the person it is watching at the time really is a terrorist. A 1% false negative rate is a pretty good hit rate. Ok so one gets away but you've found 99 baddies out of a hundred.

Unfortunately, your 99% catch-a-terrorist effectiveness has a down side. It will also show false positive results some of the time. So sometimes it will identify innocents as terrorists. The false positive rate won't necessarily (or even often) be the same as the false negative rate. If you calibrate your machine to identify 999 terrorists out of 1000 (instead of 99 from 100) it will also tend to falsely identify more innocents as terrorists.

However, to keep matters simple, lets assume the false positive rate is also 1%. So for every innocent person it looks at there is a 99% chance it correctly identifies them as innocent. One innocent is wrongly tagged but that may, to you, even if not to Ben Franklin, be an acceptable risk.

Except that again things are no so simple as they seem. When your magic machine is watching 60 million people in the UK and you don't know which comparative few are terrorists, life gets more complicated. How effective your magic machine is depends on how many terrorists and innocents there are relative to each other in the surveilled population.

I've periodically heard ministers and spokespersons for multiple successive governments over the past 15 years refer to 6,000 dangerous individuals in the UK. Let's assume that's the terrorist base rate. I don't know whether it is and we don't have enough empirical evidence to judge it but take the governments' claims at face value to give us some numbers to work with.

[Note: More generally it is to be recommended not to take claims about statistics at face value but to examine the detailed evidence critically]

6,000 out of 60 million means the population contains 0.1% terrorists, or 1 in a 1,000. Now the question is, given 1 terrorist per 1,000, how reliable or useful is your 99% reliable terrorist catching machine?

The answer which many people find surprising is: not very.

Your machine, when watching the 6,000 terrorists, will identify 5,994 of them as terrorists. (Assuming 1% false negative rate)

Your machine when watching the remaining 59,994,000 innocents (60 million minus 6,000) will identify 599,940 of these innocents as terrorists. (Assuming a 1% false positive rate)

Your 99% reliable giant computerised magic terrorist catching machine catches 5,994 terrorists but falsely accuses 599,940 innocents.

So, roughly speaking, your 99% "reliable" giant computerised magic terrorist catching machine accuses about a 100* innocents, in order to find one real terrorist. The 99% effective machine is really only 1% effective.

And even then 6 terrorists get away to perpetrate the next attack that will draw calls for even bigger more powerful magic computerised terrorist catching machines...

We have not even begun to consider here the security and law enforcement resource implications of having to investigate such a disproportionate number of innocent people; let alone the target-infested, cost-cutting cultures visited by government upon dedicated security and law enforcement services personnel, creating pressures to "get results".

I would ask you to consider one question, before getting onto the parliamentary website and sharing your views of the Draft Investigatory Powers Bill:

Do you want to live in a society where the default operational state of the security, intelligence and law enforcement services is: that it is better that a thousand innocents suffer than that one guilty person go free?

[... And... er... some terrorists will still slip through the net... shhhh...]

That reversal of the presumption of innocence is a central, if unspoken and somewhat unnoticed, tenet of the Draft Investigatory Powers Bill and the operations it seeks to protect and expand within its legal framework.

Don't be silent on something that really matters. Offer the Joint Committee your views.

Update: I made a decimal point error in original calculation, now corrected.