Behaviour Detection in Real Time (Part 1): The Problem with Humans

Introduction: why Behaviour Detection?

The concept of behaviour detection, or Behaviour Risk Assessment, as a method of detecting suspicious individuals continues to occupy the headlines. As a recognized layer of security screening that has been successfully deployed in Israel and other countries, it is part of considerable efforts worldwide focusing on reforming the existing legacy approach to security into a more risk-based system (read about Focus on Intent).

In recent years, two international bodies, IATA and ICAO, have been leading the way by advocating a transition from the current “one-size-fits-all model” of security to a model where passengers are screened based on established or perceived levels of risk. As part of a risk-based model, all passengers would be divided into Low, High, Unknown groups according to information available about them to security personnel in advance (e.g. Passenger Name Record) and identification of any suspicious indicators in real time. Various countries, such as the US, Canada, UK, France and Australia have been studying the subject very closely including in pilot projects and research studies to determine best practices and/or validate the approach.

---

Some groups of lower risk passengers, such as children, military personnel, seniors over 75 years of age and other ‘trusted travellers’ have been already introduced in the US and Europe. Passengers in these categories are assumed to present a lower risk and, as a result, are subject to less scrutiny at checkpoints. One of the unresolved security issues with low-risk groups is that despite possible prior clearance (say last month) there is no guarantee they can’t be involved in a terrorist plot today. In other words, despite a perceived lower risk they present to the system due to prior background checks, assumed innocence or loyalty, they could still be enlisted, tricked or forced to participate in carrying out a terrorist attack (and sometimes even without their knowledge). We must have a method to screen people in real time to reach a ‘Threat’ or ‘No Threat’ decision as they show up at a train station or airport terminal.

This is where behavior detection or alternative technology-based solutions that focus on Intent in real time come into the picture.

Trained officers vs. machines

The model for utilizing specially selected and trained officers to perform real-time behaviour observation and risk assessment has been developed and successfully deployed in Israel (including El-Al stations abroad) since the 1980s. After 9/11, the concept was adopted to varying degrees of depth and/or success worldwide, foremost in the US. In fact, to date worldwide, behaviour observation method remains the only screening method that has successfully intercepted would-be attackers in real time, including Ahmed Ressam (the Millennium Bomber), Richard Reid (the Shoebomber) and Umar Farouk Abdulmutallab (the Underwear Bomber).

Unfortunately, the program TSA has developed using generic Israeli security principles and Paul Ekman’s facial micro-expressions approach continues to attract criticism and negative coverage. Indeed, the program suffers from numerous shortcomings starting from how it selects and trains officers to what these officers are trained to focus on, limited performance oversight and lacking consistency in quality assurance testing. We covered some if these issues in the past.  

As a result of these and other shortcomings the US Government Accountability Office, the investigative arm of the US Congress responsible for auditing and evaluating government spending, recommended in its report on TSA’s Behavior Detection Program released in November 2013 that funding be withheld from the Behavior Detection program until TSA can prove its effectiveness.

At the same time, on page 20, the report stated that:

          “Recent research on behavior detection has identified more promising results when behavioral indicators are used in combination with certain interview techniques and automated technologies….Researchers began to develop automated technologies to detect deception, in part, because humans are limited in their ability to perceive, detect, and analyze all of the potentially useful information about an individual, some of which otherwise would not be noticed by the naked eye.”

Indeed, all behaviour detection methods in use today are heavily relying on a trained officer’s ability to detect suspicious indicators in behaviour, appearance, documents or context. While it is possible to select and train certain individuals to perform the role, it is a very specialized niche that requires considerable knowledge and skills, and of course time, on behalf of program managers. While humans can absorb and analyze information in ways modern computers still cannot, the success of such a program depends entirely on individual abilities to detect and process information that is ‘out of context’ – a subjective and risky proposition for most governments bound by public opinion.

The solution, as usual, is somewhere in the middle. There is no doubt in our minds that a robust security system must be founded on the skills and professional knowledge of specially selected and trained personnel conducting security operations and field intelligence (see Human Eye vs Technology: Who Wins?). If these activities can be reinforced by available technologies, they should be utilized where applicable to compensate for human deficiencies.

So, what kinds of technologies exist out there that could be utilized today to observe and detect suspects or various psycho-physiological indicators pointing to potential malicious intent?

In the next blog instalment, "Behaviour Detection in Real Time (Part 2): Technologies That Work and Not…Yet" we will look into such systems and discuss their effectiveness.