Year: 2012

Bayesian reasoning (the application of Bayes' theorem) is incredibly important, but virtually unknown (and not understood) in the general population.  While politicians, advertisers, and salespersons take advantage of this lack of understanding to extract votes and money; doctors, lawyers, and engineers can make life-threatening mistakes if they don't apply the process correctly.  It's a concept so vital to the proper interpretation of the world around us that I believe it should be a mandatory subject during high school.

Let's start with an example to motivate the subject.  Let's say you're not feeling well and you go to your doctor.  Your doctor can't determine what's wrong and decides to run some blood tests.  The results come back and your doctor informs you that the test for a terminal disease came back positive.  Do you panic?  Probably.  Should you panic? Not necessarily.  There is vital information which we don't know and need to know in order to understand the situation properly.

First, we need to know how accurate the test is.  We need to know the rates of type I and type II errors ("false positive" and "false negative", respectively).  Let's say you ask this question and your doctor tells you the test has a false positive rate of 1 in 100,000 and a false negative rate of 1 in 200,000.  One might believe that there is a 99.999% chance that you have this rare disease, but we need to interpret these error rates correctly.  This is where Bayes' theorem comes in and to apply it we also need to know how rare the disease is.

Let's say it's an extremely rare disease, affecting 1 in 200 million people.  Knowing this you can update the probability that you have the disease to something more accurate.  Applying Bayes' theorem we can calculate that a more accurate probability of having the disease is 4.8%.  That's a pretty big difference.

There is a caveat though; we're ignoring any compounding factors that led the doctor to run the test in the first place.  This calculation assumes that we had no particular reason to run the test, so we use the occurrence rate in the general population (1 in 200 million) in our calculation.  If you have specific risk factors that narrows the base group then the probability of having the disease will increase.

For example: let's suppose that the doctor chose to run this test specifically because you have high cholesterol levels and a family history of diabetes.  Suppose that the disease occurs in roughly 1 in 1 million of people with those risk factors.  Now, instead of using the 1 in 200 million as our occurrence rate, we'd use the 1 in 1 million.  In which case the probability of having the disease rises to 9.1%.

Suppose another risk factor increases the likelihood from 1 in 1 million to 1 in 100.  Now the probability of having the disease shoots up to 99.9%.  It's really important to understand what a positive result from a medical test actually means.  If you don't understand Bayes' theorem then you can wildly misinterpret reality and make some pretty serious mistakes.

Let's do another example.  This one is a little easier to understand than the medical testing example.

When I bought my car in 2007, the dealership tried to tack on a charge for something which amounted to a small insurance policy which would pay out if the car were stolen.  The argument used to push this charge was that Honda Civics are the number one stolen car.  Of course, our questions are:  Is that true?  And does it mean what we think it means?

According to the Insurance Bureau of Canada's 2006 list of the top ten most-stolen cars, the 2000, 1999, 1996 and 1994 Honda Civics took 4 of the 10 places.  Hmmm...sounds bad, huh?  But I'm sure you can guess by now that there's a catch.

It's vitally important to our analysis to know how many 2000, 1999, 1996, and 1994 Honda Civics exist in the first place and how many actually got stolen.  But we don't have any of these numbers.  What we have is someone taking a list of stolen cars and adding up each type and declaring the Honda Civic as the most stolen car.  We need to know how many are stolen compared to how many of them exist.

Luckily for us, the Highway Loss Data Institute understands the difference and correctly reports the likelihood of a vehicle getting stolen by comparing the "'theft claim frequency,' which is the number of thefts reported for every 1,000 of each vehicle on the road."  When we look at these numbers the picture changes entirely.  This top-ten list is filled with expensive cars like the Cadillac Escalade and several high-end pickup trucks.  The Honda Civic is nowhere to be found. 

If you don't understand Bayes' Theorem you can be manipulated into making bad decisions.  This applies all over the place in our lives.  It applies in our airport security procedures, our medical exams, our insurance decisions, political decisions, and our general level of fear about life.

You can read more about Bayes' Theorem in its Wikipedia article.  I'm not going to try to teach it here (unless I hear a demand for it in the comments) because it's not an entirely intuitive concept and it's a little tricky to wrap your head around (which is why we get it wrong so often).

NPR's article, "Spate Of Bomb Threats Annoys Pittsburgh Students" got me thinking about the unintended consequences of implementing good security.  Even ignoring the other issues involved like civil rights violations and creating easily attacked lines.

Reacting to every threat has at least two detrimental effects: denial of service and complacency.

The first, and most immediate, is the ability for an adversary to shut down a system without doing anything but writing a letter, making a phone call, or posting something on the Internet.

In computer security we call this type of attack a denial of service (DOS) attack.  With a computer it is usually achieved by making legitimate requests at such a frequency as to bog down the machine and prevent it from responding to normal users.

In this case, however, it's making threats and forcing law enforcement to respond.  This has two effects.  The first is that it takes law enforcement away from legitimate calls (denying those people of the service of law enforcement).  The second is when law enforcement responds by shutting down or drastically reducing the functionality of the threatened target (denying service to customers of that target).

In the article the students are queued up waiting to go through a security checkpoint in order to get on campus.  In airports they might clear the gates and require everyone to go through security again.  In either case massive amounts of time and money are wasted.  The attacker has done nothing, but still managed to mess with their target.

In this manner terrorists could cause billions of dollars in losses to our economy simply by calling in threats to airports, shopping malls, schools, stadiums, etc.  And given our level of unwarranted fear, what law enforcement agency is going to do nothing when they receive a threat like that?  If they're wrong no one will listen to arguments about likelihood, corroborating evidence, etc.

The second detrimental effect is complacency or "the boy who cried wolf" effect.  One technique used to bypass an alarm system is to repeatedly trip the alarm, but do nothing else.  Eventually the people responding to the alarm may begin to delay responding presuming it's another false alarm.  Or in the best case (from the attacker's view) they may turn off the alarm altogether.

If they do continue responding to the alarm then they're faced with a dilemma: How many times do you respond to an alarm at cost $X per response before you can no longer afford to respond?  How many airports do you shutdown and flights do you cancel before the airlines begin going bankrupt or flying becomes so unreliable people just stop trying?

In the case of the school in the article, University of Pittsburgh, how many more of these threats are they going to evacuate buildings and run security checkpoints for before the students start leaving looking for schools that actually have time for education?

These are two of the problems that exist from treating every threat seriously and not using risk management techniques to handle threat response.  But given that everyone involved would be fired, if not prosecuted, if they were wrong, what alternative do they have?

If we shut down our society because we're afraid then haven't the terrorists won without ever doing a thing?