3 July 2008

In his keynote speech today at the Homeland & Border Security Conference 2008 in London, Tom Black, Chief Executive of Detica, sets out a new approach to intelligence to better seek out the digital footprints laid down by those who threaten the security of the state, the safety of the public, or who seek to commit serious and organised crime. In the face of a massive explosion in online activity, data volumes, data complexity and social networking — all of which are growing in volume, velocity and variety — Black advocates a radical new approach that both identifies these digital footprints and anticipates serious threats ahead of time so that they can be prevented.

Black says: "Due to the Internet, criminals ranging from minor offenders to international extremists can now threaten our individual well-being and national security on a scale and with a reach that was simply not possible in the past, radically improving their operations. The bottom line is that there is simply too much data to look at. It's moving too fast and it is too varied. The digital universe is expanding faster than the intelligence community has the capacity to monitor and analyse.

"This new threat environment is so different from the old world order that we need to develop a new understanding and response. However, we should recognise that while the threat is new, so too are the opportunities for detection and intervention. This actually presents us with an exceptional intelligence opportunity because it's impossible for criminals who present a serious threat to operate within the world today without leaving some fragments of digital information — digital footprints — which can be found. But to track them down, we have to turn the current intelligence paradigm on its head."

Detica believes that today's conventional approaches to intelligence gathering and criminal investigation do not fully take account of the way in which cyberspace and the physical world now intersect, providing almost limitless opportunities for criminals to carry out their crimes in both spheres. Criminals are simply doing what legitimate businesses have been doing for years, such as improving their business models by exploiting the Internet. For instance, the digital world is now used as a matter of course to plan and facilitate crimes in the physical world such as terrorism, radicalisation, sabotage, espionage, counterfeiting and drug trafficking.

Black believes that a new approach is required to defend the digital frontline: "We don't need to sift through all of the data to find the needle in the haystack; that's crude, brute force analysis, and it requires us to know what we are looking for ahead of time. Realising this, we are now watching for anomalies — exceptions to normal behaviours and events. This will buy us time, but does not solve the real problem brought about by the information explosion. Instead, the more significant innovation will come when we advance beyond anomaly detection, shifting our focus from digital footprints to threat blueprints — or 'threatprints' — which we anticipate ideally before the terrorist or criminal has been radicalised or recruited. These hypothetical threatprints can be broken down into component anomalies and exceptions, enabling us to prevent the threat ever materialising. The system will continually envisage and incorporate new threatprints, learning as it goes. It's quicker, it's smarter and it's the only way forward."

Black also believes this new approach will address increasing concerns about privacy. "We are increasingly aware of the need to protect the privacy of our citizens, even as we safeguard their security and way of life. The current approach does nothing but stir up such concerns by encouraging the accumulation of information. The new approach advocated here — focusing on anomalies and threatprints rather than people — is far better placed to protect privacy without compromising effectiveness. Essentially, this is justified investigation rather than 'just-in-case' monitoring."

Black concludes: "We are now at a crossroads. We can spend increasing sums of money on more of the same — sifting through more haystack, and hardwiring more targets and triggers — but we will never catch up with the increasing data volume and complexity. Or we can recognise the opportunity we have to truly innovate, to make use of exception analysis and hypothetical threatprints. Achieving this wholesale change of approach will require radical and ongoing innovation and a reprioritisation of investment. But we believe that this is an opportunity of such significance to our future security and way of life that we cannot afford to let it slip."

Sally Clift or Rachel Ringstead Porter NovelliTel: +44 (0)207 853 2222email: or