Border Biometrics: “Zero Benefit”?

by on November 12, 2008 · 16 comments

ZDnet ran a story last week citing how security guru Bruce Schneier slams the US-VISIT program, which collects biometrics from people entering the country, saying that it has “zero benefit.”

I respect and like Bruce – he will be a participant in a major counterterrorism strategy conference we are having at the Cato Institute in January – but I have to voice my disagreement with him on this score. My belief is that border biometrics have an extremely small benefit – a benefit that rounds to zero, and one that is more than cancelled out by the costs. But not zero.

As of 2006, US-VISIT had cost about $15 billion and been responsible for the apprehension of about 1,000 criminals.

“Take that $15 billion number,” wrote Schneier in a 2006 blog post. “One thousand bad guys, most of them not very bad, caught through US-Visit. That’s $15 million per bad guy caught. Surely there’s a more cost-effective way to catch bad guys?”

He’s right, but that’s an illustration of the costs overshadowing the benefits, not zero benefit. (Net benefits are actually negative. We’d be better off letting those 1,000 criminals free to do their hundreds of thousands in damage or using conventional law enforcement methods than spending $15 million each to catch them.)

In defense of border biometrics, the article cites Robert Jamison, undersecretary at the Department of Homeland Security’s National Protection and Programs Directorate, which oversees US-VISIT:

“There have been several instances of someone applying for entry under one name, being denied, applying under another name, and again being denied [due to biometrics records],” said Jamison. “In a few cases, criminal activity and, in some cases, terrorist activity have been prevented.” Jamison declined to say exactly how many terrorists had been caught as a direct result of the program, saying the information was “classified”.

Rather than granting Jamison’s assertions and accepting the existence of benefits, Schneier has probably done in shorthand what any good judge in a court would do: find unproven a fact that a party won’t present reliable evidence for. Though the average American (and reporter) probably does, Schneier doesn’t grant as proven whatever a self-interested national security bureaucrat claims to be true but secret.

But for the sake of argument, let’s grant that a few people with some level of terrorist intent were turned back by border biometrics. This is prevention of “terrorist activity” in the sense that a person with terrorist intent was prevented doing something they wanted to do. But entering the country is only a small part of doing any damage once inside the country.

There’s a terrific example written up here of a man turned away at the U.S. border (not by US-VISIT but by a program called ATS-P) who later became a suicide bomber in Iraq. The implication DHS officials would like you to take from this is that preventing his entry into the country prevented a suicide bombing in the United States. In fact, it’s just as likely, if not more, that this individual became suicidal because of being turned away – he had already lived in California for two years without incident. And one can’t exclude the possibility that he was coerced to commit a bombing through threats, a hostage-taking of a family member, or some other way.

Anyway, turning someone away from the border is a trivial security against terrorism because terrorists are fungible. Turning away a known terrorist merely inconveniences a terrorist group, which just has to recruit someone different. The 9/11 attacks were conducted for the most part by people who had no known record of terrorism and who arrived on visas granted to them by the State Department. Biometric border security would have prevented none of them entering.

(Another option is physical avoidance of the border – crossing into the United States from Canada or Mexico at an uncontrolled part of the border. I know if no instance of this occuring (successfully), but it could. And, most importantly, there’s no cost-effective way to prevent it.)

In summary, border biometrics have some benefit! They are at best a mild inconvenience to terrorists – an inconvenience that the 9/11 attacks mostly anticipated. But that’s not zero benefit! It’s just negligible benefit.

In May 2007, I testified in the Senate Judiciary Committee about the costs and benefits of the REAL ID Act, a similar identity-based security system – and similarly expensive at about $17 billion. Because avoidance of identity-based security is so easy, its benefits are quite small, though I allowed it generous assumptions at every turn:

Assuming . . . that a future attack would be on the scale of a 9/11 — an exaggerated assumption unless all the rest of our security efforts have done nothing — REAL ID might be assumed (generously) to delay such an attack by six months. The value of delaying such an attack, and thus the security value of REAL ID, ranges from $2.24 billion to $13.1 billion. REAL ID offers less in benefits than it does costs — even using very generous assumptions.

But, again, that’s not zero benefit. It’s a very small benefit, a benefit that is far outstripped by costs. We’re doing ourselves more harm than we’re preventing with border biometrics – and that’s just on a static dollar-for-dollar basis, not accounting for lost tourism, trade, and goodwill.

  • MikeRT

    A better use for this program would be to track illegal immigrants in police custody. The police are more likely to have a need to track illegal immigrants than people who come into this country through normal channels like airports, since illegal immigrants tend to commit more crime than legal vistors and immigrants.

  • Jim Harper

    I agree that using biometrics on law violators is more appropriate. I don't think the assumption that illegal immigrants commit more crime (beyond the illegal entry) holds up, however. Here's a Reuters story from earlier this year about a study that touched on that question.

    Among other findings in the report, non-citizen men from Mexico 18 to 40 — a group disproportionately likely to have entered the United States illegally — are more than eight times less likely than U.S.-born men in the same age group to be in a correctional institution (0.48 percent vs. 4.2 percent).

    “From a public safety standpoint, there would be little reason to further limit immigration, to favor entry by high-skilled immigrants, or to increase penalties against criminal immigrants,” the report said.

    If you have countervailing evidence to share, that would be welcome, of course.

  • crack

    I think there may be some poetic license involved.

  • RH

    There may be something “simpler” involved. Engineers (and others) are trained to simplify their equations. In general, we strike out anything which is “close enough to zero” and go back later if we find out that wasn't a fair assumption. While there is definitely a difference between zero and “almost zero,” my experience is that supporting solutions which depend on them being different tends to result in solutions which are creaky at best =) though some situations do call for it.

    In the case for government spending, I argue epsilon = 0 because making that (slightly false) statement makes it SO much easier for a senator to weigh his decision.

  • x

    Follow the money. Lots of money has been made by companies selling hardware and software for programs such as US-VISIT, etc.

  • Pingback: tadhg.com » Blog Archive » $15 Billion in Biometrics

  • Urs

    You forgot or neglected the visitors who won't visit your country because of this measure. People who decide to spend their money somewhere else. The number of such people might be negligible as well, but I am one of them. When my friend in the States ask me, when I will visit them again, I tell them: “not as long as I have to give my fingerprints at the border!”.

  • Massimo

    I am another potential visitor in the same situation.
    Citizen of a big EU member state, international civil servant and computing professional, I will not travel to the US unless I will receive assurances not to be treated as a common criminal.
    You won't change your policy? Tough-I will not endure the useless humiliation.
    Like me, literally thousands of EU citizens.
    Already your border guards were uncivilised, even before 9/11.
    Now it is just too much.

  • foufa

    Humilation? Come on now, on what extent are you being humiliated by biometric security??
    Using VISA as if we dont belong in the EU isnt that humiliation?
    I believe tha someone would feel uncomfortable with biometrics only if he is afraid of disclosing smt about his ID.
    When you enter your company by using fingerprints , why dont u feel then humilated?!
    It is all a matter of security. That means it's more efficient and effective to preclude incidents than accepting them and try to improve them after the incident has taken place! What if another 11/9 like event was to happen but was prohibited by the biometric system in place?! Maybe we would never be in the position to know whether the system was the one to inhibit the attack but i believe that even if there's a slight chance it would work like that, then we should accept it.
    And OFCOURSE if there was another successful 11/9 like event then all of you would say that TSA and others didnt do what they should do, didnt employ strict policies even if these policies would be on the citizen's expense! It wouldnt matter how citizens feel about the security measures that are in place, you would say that what matters is the incident NOT TO TAKE PLACE!

    “Like me, literally thousands of EU citizens.” by Massimo

    Yes but you do neglect many more thousands of EU citizens that MONTHLY travel to US and that's because they just feel secure with the new employed security systems.

  • foufa

    Humilation? Come on now, on what extent are you being humiliated by biometric security??
    Using VISA as if we dont belong in the EU isnt that humiliation?
    I believe tha someone would feel uncomfortable with biometrics only if he is afraid of disclosing smt about his ID.
    When you enter your company by using fingerprints , why dont u feel then humilated?!
    It is all a matter of security. That means it's more efficient and effective to preclude incidents than accepting them and try to improve them after the incident has taken place! What if another 11/9 like event was to happen but was prohibited by the biometric system in place?! Maybe we would never be in the position to know whether the system was the one to inhibit the attack but i believe that even if there's a slight chance it would work like that, then we should accept it.
    And OFCOURSE if there was another successful 11/9 like event then all of you would say that TSA and others didnt do what they should do, didnt employ strict policies even if these policies would be on the citizen's expense! It wouldnt matter how citizens feel about the security measures that are in place, you would say that what matters is the incident NOT TO TAKE PLACE!

    “Like me, literally thousands of EU citizens.” by Massimo

    Yes but you do neglect many more thousands of EU citizens that MONTHLY travel to US and that's because they just feel secure with the new employed security systems.

  • foufa

    Humilation? Come on now, on what extent are you being humiliated by biometric security??
    Using VISA as if we dont belong in the EU isnt that humiliation?
    I believe tha someone would feel uncomfortable with biometrics only if he is afraid of disclosing smt about his ID.
    When you enter your company by using fingerprints , why dont u feel then humilated?!
    It is all a matter of security. That means it's more efficient and effective to preclude incidents than accepting them and try to improve them after the incident has taken place! What if another 11/9 like event was to happen but was prohibited by the biometric system in place?! Maybe we would never be in the position to know whether the system was the one to inhibit the attack but i believe that even if there's a slight chance it would work like that, then we should accept it.
    And OFCOURSE if there was another successful 11/9 like event then all of you would say that TSA and others didnt do what they should do, didnt employ strict policies even if these policies would be on the citizen's expense! It wouldnt matter how citizens feel about the security measures that are in place, you would say that what matters is the incident NOT TO TAKE PLACE!

    “Like me, literally thousands of EU citizens.” by Massimo

    Yes but you do neglect many more thousands of EU citizens that MONTHLY travel to US and that's because they just feel secure with the new employed security systems.

  • Pingback: The Technology Liberation Front Turns 5 Today!

  • Pingback: DDOS Protected Hosting

  • Pingback: football fantasy

  • Pingback: best gym equipment

  • Pingback: Wake Up Now

Previous post:

Next post: