Big Data and Big Security Problems

Congress’ concern is the inability of different subdivisions to be managed by or to communicate with and mix agency data. They want fewer entry points for potential security attacks. But the more severe reverse problem is that one external or internal penetration can reveal everything.

My sensitivity is that my old agency the U.S. Office of Personnel Management was penetrated by Chinese intelligence a few years back and retrieved 20 million plus highly sensitive personnel files. The Washington Post called the theft a “serious external threat” that “could easily be leveraged to blackmail or pressure federal workers, including those who handle classified information.”

In fact, China knows more about U.S. top leaders than we do, even after losing a recent spy at the Central Intelligence Agency.

The dream for centralized information goes back to the 1996 Information Technology Act imposing a centralized IT process to reduce costs, improve effectiveness, and integrate agency information. After 9/11, the 2002 IT Act put the Department of Homeland Security in charge of a project to assure efficiency, confidentiality, and security which unfortunately failed to prevent multiple data record thefts including the CIA, Senate, the International Monetary Fund in government and in the private sector Target, Home Depot, MorganChase, among many others.

Even beyond security per se more data in a single location does not necessarily make it useful. Under the 2015 Surveillance Act, the National Security Agency was for the first time given the power to collect domestic telephone information on Americans. In 2017 it collected 534,396,285 call records and realized there was too much to study effectively. The next year, it gave up collecting it.

NSA’s was a smaller example of the fact that too much data are overwhelming. No computer can store much less analyze all the sub-atomic information collected by the Large Hadron Collider.

The Human Genome Project promised to manipulate genes not only for universal good health but even to design perfect human beings. Over 13 years it sequenced all 3.2 billion base gene pairs, now housed at the National Institutes for Health promising accelerated scientific breakthroughs with this “incredibly detailed blueprint for building every human cell.”

NPR science correspondent Richard Harris deserves a Pulitzer for ignoring NIH press releases and actually interviewing gene experts. After a Chinese scientist manipulated genes for “designer babies” the U.S. genome society recommended a NIH moratorium on cosmetic genetic manipulation. But Harris concluded that “The reality is that biologists probably couldn't produce designer babies even if they wanted to. It turns out that the genetics underlying desirable traits such as athleticism, intelligence and beauty are so complicated it may not ever be possible to make targeted changes.” Rather than the prevailing assumption of linking genes to specific human traits, it turns out that many genes act in concert to affect such traits.

Matthew Keller of the University of Colorado told him, "When we look at the 20 most studied genes investigated for schizophrenia, we find basically no evidence that any of those are associated at levels greater than we'd expect due to chance," which he says is true of depression too. "You could have done just as well by throwing a dart at the genome.”

Stanford University’s Jonathan Pritchard said pretty much the same for height. "We have estimated that it's probably something like 100,000 variants across the genome, so most of the genome affects height by a small amount." Common traits might involve all of our genes.

The European Bioinformatics Institute’s Ewan Birney was more hopeful things could clarify in the future and made a distinction between designing new genes and fixing flaws where there was a specific broken gene that could be edited, although even there other options carry less risk. Yet, even he concluded, "If anybody thinks we can understand how to change genomes to improve things, they don't have an appreciation for the lack of knowledge that we have."

The fact is we know very little about these big data sources and often even less how to use or benefit from them, very much including safeguarding them. Certainly the government does not.

One private expert sets the first principle of data security as not placing sensitive data on the cloud in the first place. It is probably impossible to guarantee large systems remaining impenetrable over long periods of time. There are even some records too sensitive for electronic storage at all and decentralization must remain an option among normal anti-penetration tools.

Hopefully the Pentagon will not have to go to China in the future to find any missing data.

Donald Devine is senior scholar at the Fund for American Studies. He is the author of "America’s Way Back: Reclaiming Freedom, Tradition, and Constitution" and "Reagan’s Terrible Swift Sword: Reforming and Controlling the Federal Bureaucracy." He served as President Reagan’s director of the U.S. Office of Personnel Management. He can also be followed on Twitter @donalddevineco1. For more of his reports, Go Here Now.