by Shane Harris
There were few more exclusive tickets in the circuit of the Big Thinkers, the high priests of academia, government, and industry who relished an opportunity to marinate in one another’s ideas. The Highlands Forum was created in 1994 when a Defense Department strategist named Dick O’Neill decided he couldn’t do his job locked inside the Pentagon. O’Neill was puzzling over how war would break out in the information age. But roaming the fluorescent and concrete halls, he couldn’t find a soul to talk to. Those who did approach him said something he already knew. O’Neill was uninspired.
And that was a problem, because O’Neill’s job was to find unconventional answers to big, amorphous problems. He decided to get out of town. With the checkbook of the secretary of defense in hand, he called a dozen bright lights in government and academia, ditched his suit and his tie, and bought plane tickets for the Left Coast, as he and his Pentagon colleagues liked to call it.
They landed in Carmel Highlands, on the Monterey Peninsula, at O’Neill’s brother-in-law’s house. It was a glass-walled showcase perched atop a rocky tower overlooking Big Sur. There, over good wine and perhaps better cheese, the merry band of boondogglers thought their big thoughts and invented a tradition. Every year the Highlands Forum convened to recapture that magic. The bar was high. In that first meeting atop the precipitous cliffs of Carmel, with otters’ tails lapping in the crashing waves below and the giant sun melting into the Pacific, the gatherers invented the concept of information warfare, which then defined how the military conceived of twenty-first-century conflict.
Eight years later leaders from industry, academia, government, and the arts convened on the rocky cliffs to imagine the future of fighting terrorism. Amid the backdrop of playful otters and solar splendor, and wine, Poindexter had come to talk about TIA. But for the presentation O’Neill had paired him up with an outsider, a thirty-eight-year-old computer software designer from Las Vegas named Jeff Jonas.
Jonas had been making the rounds in Washington recently. He’d designed a computer program that he thought might be useful to intelligence agencies trying to detect suspected terrorists. Jonas had hired some seasoned Washington trail guides to show him around town and make introductions. He’d managed to land an invitation to the forum, as good a sign as any that he was meeting the right people. Jonas was a techie like Poindexter, and so they made a logical pair for a panel.
But Poindexter had never heard of Jonas. And when he saw him in person, he could see why. This guy would never fit in among Poindexter’s crowd.
Jonas showed up in black pants and a tight black T-shirt in a room full of khaki-clad wise men, sporting blazers and loafers. His clothes showed off a torso well trimmed by Iron Man triathlons and power bike rides. Jonas might have looked like the entertainment. Was he a dancer? A magician? When it came time for Jonas to speak, Poindexter thought he might be a comedian. Everything about Jonas—his dress, his casual manner of speaking, and his wild eyes—told Poindexter he was nutty.
But the more Poindexter listened, the more he heard a familiar refrain.
From an early age, Jonas was a dabbler, and directionless. Growing up in Healdsburg, California, north of San Francisco, in the late 1970s, Jonas had been exposed to all manner of techie innovators. His mother was a lawyer, and once she let him tag along to a demo of the TRS-80, one of the first desktop computers, which had just been released by the Tandy Corporation. His mother hoped it could help automate her legal billing process. But during the demo Jonas watched the computer connect to other machines used by academic researchers around the world. It instantly downloaded abstracts of papers in the researchers’ files. Years later Jonas decided that the computer was probably communicating via the primordial Internet, developed by researchers at DARPA. But at that moment, standing there next to his mom and an inventor friend who had joined them, he thought this was magic.
Jonas was hooked. I get this, he thought. A singular obsession gripped him, and it ruined him for any other pursuit or profession. How could vast seas of information be harnessed and made useful?
At Jonas’s high school computer lessons were reserved for upperclassmen, but he requested an exception. Soon the sophomore was learning how to use the new Personal Electronic Transactor, or PET, a personal computer released the previous year by Commodore.
Jonas’s computing skills seemed preternatural. Over the summer he wrote a word-processing program for extra credit, which an instructor thought was so good that he sold it on Jonas’s behalf to the Los Angeles Unified School District. The budding programmer was paid two hundred dollars. He had never considered that he could make money off a hobby.
After Jonas had taken the only two computer classes in the high school curriculum, he dropped out. He took his GED and enrolled in a local community college so he could take more courses. During his second semester the owner of a computer consulting firm gave a guest lecture, and he said he was looking to hire someone to write custom software. Jonas asked for the job.
He came on as a subcontractor, and before long had hired twenty-one employees to keep up with his workload. Jonas’s business was growing faster than his boss’s. He built customized software for local companies—a chain of shoe stores that needed an inventory tracking system, a newspaper that wanted to keep track of billing for its advertisers. It was all data management work. And it was always over budget. Even what appeared to be the simplest of projects, Jonas never finished.
He amassed $200,000 in debt. Creditors called. When the checks bounced, the employees left. He worked off half the debt but thought the balance looked insurmountable. It was Christmas 1984. Jonas filed for bankruptcy.
His father kicked him out of the house, so Jonas moved into his car. He kept the bankruptcy notice with him as he drove around, a kind of talisman on his road to reinvention. It named each of the creditors he vowed to one day pay back.
Jonas was twenty years old. He was broke. As he sat in the corner of an empty office, it hit him. He needed a plan. A blueprint, in fact. For designing computer systems.
This was where he’d gone wrong, he decided. He was trying to build complex structures without specifications. (The same was true for his life.) He vowed that from now on he’d only take on custom software work when he had a detailed plan, depicting every step needed to finish the job.
Jonas sought out software customers who’d been disappointed by over-budget and undelivered products—the kind that he used to build—and he made them a deal. He offered to build the software in a fixed period of time and according to a blueprint. They would pay him six hundred dollars a day. When he saw his potential customers’ jaws drop and sensed he was being moved toward the door, Jonas finished explaining the offer. If he didn’t do the job on time, he would pay the customer a hundred dollars a day for as long as it took him to finish.
The business took off. In time, Jonas was building software systems faster than his competition, and for companies whose businesses had nothing to do with one another. He made a financial management system for the Fresno airport, a labor management program for a local fruit grower, and a genealogy system for a North American association of llama owners. And then, while still in bankruptcy, he hooked up with another unlikely customer—a credit bureau and collections agency.
The credit bureau of Tulare County was looking for a way to improve its operations. Rather than sending out five collections notices to the same person, the company preferred to send one past-due notice listing all of the debtor’s outstanding obligations.
But that wasn’t so easy. The owner explained to Jonas that debtors evaded the collections agencies by making subtle alterations to their identities. They might change one letter in their name (Smith became Smithe) or invert two digits in their Social Security number. These people weren’t untraceable, but they were more difficult to find. The credit bureau needed a way to match up the conflicting records, to predict that Smith was Smithe. Sure, Jonas said. He could do that. He called it “debtor matching.”
The credit bureau was very clear: Jonas’s system must not accuse the wrong person of owing money. If it simply merged John Smith, Jr., and John Smith, Sr., assuming they were one and the same, he could be sure that the elder Smith would start making irate phone calls, demanding to know why he was being blamed for his son’s debts. These erroneous matches, what data engineers liked to call “false positives,” would undermine the entire system and invite a slew of complaints or, worse, harassment claims.
Jonas perfected a technique for resolving people’s true identities. His system could see past the smoke screen of aliases and forged numbers. The credit bureaus loved it, but they weren’t the only industry troubled by masquerading clientele. After Jonas moved his company to Las Vegas, he discovered that casinos were having a problem keeping certain undesirables off the gaming floor.
Under state gaming regulations casinos were required to bar anyone who appeared on an official “exclusionary list,” a kind of all-points bulletin of people often known to use fake identities. These listed people ran the gamut, from scamsters to money launderers. The casinos also had their own no-entry lists, which included gamblers who stole chips from other players on the floor and gambling addicts who had explicitly asked the casino management not to let them play. While crooks and junkies were bad for business, the casinos had a second problem: casino employees who started working against the house. That kind of behavior was potentially costly and hard to detect. The management needed a way to cover themselves, finding threats from the outside and within their own organization.
In 1994, Jonas built a new software program that discovered watch-listed gamblers as well as latent connections among casino workers and gamblers. He called it Non-Obvious Relationship Awareness, or NORA. He sold the program to the Mirage, whose corporate security department fed it watch-listed parties as well as information about their employees and their customers.
Players often didn’t realize how the data they voluntarily handed over to the casino was being analyzed. Whenever they registered with the hotel, signed up for a frequent player card, and especially when they asked for credit, they left a trail. It included names, Social Security numbers, phone numbers, dates of birth, addresses. NORA went to work, ensuring the watch-listed parties weren’t the same as the trusted people—employees and customers.
The tool succeeded because it placed bad guys, like card cheats, in the exact same database as those trusted individuals. This was a kind of shortcut, and Jonas realized that it actually made the tool smarter. NORA found many interesting connections that the casinos had missed. Once NORA discovered that a pay clerk’s personnel record matched up with information about a vendor working for the casino. This meant one of two things. Either the clerk was being repaid for work performed for the casino or the employee was stealing, by setting up a dummy account for a company that didn’t exist. NORA couldn’t say which story was true, but it compelled the management to find out.
Jonas had found his direction. Years passed. He made money. He ran in marathons. He was a single dad to three kids. His life was normal. He hadn’t planned to start working for spies.
Around 8:30 on the morning of September 11, 2001, Jonas was in a cab headed to a meeting in uptown Manhattan. His hotel was next door to the Twin Towers. “Is there time to stop so I can go up to the observation deck?” he asked the cabbie. Jonas had seen the view from the top only once.
“Not if you want to make your meeting,” the driver said. They drove north. In hindsight Jonas recalled seeing people standing gob-smacked in the streets looking back behind him. He never turned around to see what had caught their attention. Over the din of the city and his own preoccupations, he hadn’t heard the explosions behind him.
Jonas rented a car and headed for home. During the drive he recalled how only a few days before the attacks he’d paid a visit in New York to the top security official for one of the stock exchanges. He had a picture of Osama bin Laden hanging behind his desk. When Jonas asked why, he replied, “This is what I’m most afraid of.”
A day into the car ride home, Jonas got another idea.
Maybe I can help, he thought.
Poindexter listened to Jonas’s entertaining stories about catching casino cheats. He told the one about seven employees who also turned out to be vendors. About some high rollers who one casino flew out to Vegas, only to find out they were scammers. The more Jonas talked, the less Poindexter noticed the black pants and T-shirt. He stopped noticing how different Jonas was from most people in the room.
Poindexter believed that the casino and the government had essentially the same problem. They were both looking for hidden connections, both on the watch for threats in their midst. Poindexter knew technology better than he did gambling, and in NORA, he saw potential.
When Jonas stepped into Poindexter’s office at DARPA headquarters, his eyes went immediately to the large photographs of Poindexter and Ronald Reagan hanging on the wall. Candid shots of an abundantly confident president and his obviously enamored aide. The pictures, snapped by the White House photographer, were a point of pride. Poindexter had hung similar photos on his family room wall, where he kept his most cherished memorabilia.
Poindexter was enamored of Jonas already. Bob Popp could see that. The question now was how to get NORA into some experiments. After a few minutes listening to Jonas’s Vegas cops-and-robbers stories, Popp could see that he was living in a world of information. Jonas spoke with a fluency and ease that Popp had never seen. He rose up and sketched out examples on a whiteboard hanging on Poindexter’s wall. He wrote names, jotted down imaginary phone numbers, and worked through the mechanics of connecting them.
Neither Popp nor Poindexter was a database expert. They understood concepts and systems. But Jonas was into the inner workings, the gears and sprockets. And he was intense. His eyes lit up and his voice took on a contagious eagerness. Jonas was like a frenzied car mechanic, hauling everyone under the chassis to explain how the engine worked. Soon they all wanted to be mechanics.
Jonas was also guileless. When someone used a word he didn’t know, he asked what it meant. He confessed that he didn’t read books and that he never finished college. No question, even the impertinent ones, stayed locked inside his head for very long. And when it came time to listen to Poindexter and his vision for TIA, Jonas didn’t bother hiding his skepticism.
In the casinos, NORA started with known bad guys and tried to sort out their relationships. The tool didn’t do pattern analysis, which was, at least in part, what Jonas believed Poindexter was after. Jonas had done that kind of work for corporate marketers, building them giant databases of consumer behavior so they could better model consumer buying habits and interests. Companies could lay their hands on reams of personal information—people’s hobbies, their income, what sports they preferred, what magazines they read—all from public sources or surveys. But even with all that raw material, Jonas knew that the ability to predict whether someone would subscribe to Golf Digest, or was likely to travel to Ireland, or would buy a brand of soda was incredibly low.
That was fine for companies making money on the margins. Even a 1 or 2 percent success rate correctly predicting someone’s shopping list could translate into millions of dollars in extra revenue. But to catch terrorists the government had to be right every time.
NORA was an investigative tool and, Jonas thought, had a much narrower application than what Poindexter seemed to envision. It started with a bad guy. But Poindexter wanted to find bad guys who no one knew existed yet.
“I don’t think you’re going to get it to work the way you want to,” Jonas said.
But the admiral was willing to roll the dice. Jonas might not have built the most sophisticated or elegant program. But at that moment, no one had come up with a better way to catch terrorists. And there was the obvious fact that Jonas understood how to live in data better than anyone. He’d come along at just the right time.
Poindexter brought Jonas on board as a consultant. H
e eventually put NORA into service, testing whether it could connect entities in those synthetic worlds, Ali Baba and Vanilla. Poindexter and Popp both thought the program showed promise, although it didn’t perform as well as they’d hoped. Still, Jonas was full of ideas, and those could be more valuable than any one tool. For the next several months Poindexter and Jonas stayed close. Jonas had good thoughts, and Poindexter admired his unconventional spirit. They were an unlikely duo. The Wizard and the Wild Man. But somehow, they worked.
By the summer of 2002, Poindexter had been getting ready to award a set of new contracts and looked forward to a series of new experiments. He was also approaching the halfway point of his presumed one-year tenure. In August, TIA would have its official “coming out,” at the annual DARPATech conference in Anaheim, California. It was Poindexter’s first big public appearance since returning to government.
But something was missing. On the critical question of privacy protection in the TIA system, he still had little to show. Just a few proposals had come back from the broad announcement. A scientist at the Palo Alto Research Center, a storied facility, had returned a promising plan, and Poindexter intended to give her a contract. But he still wasn’t making enough headway in building a privacy appliance and incorporating it into his prototype.
There was, however, a development brewing on the sidelines. Before Poindexter returned to government, DARPA was considering whether to convene a study group to look at the balancing act of privacy and security, from a technical perspective. Every summer the agency sponsored inquiries on a range of big topics, all run by outside experts. They volunteered their time to do the research and write a final paper. (The suggestion for the privacy study came from a senior researcher at Microsoft, who’d been part of the previous summer’s round.)
