From: tcmay@netcom.com (Timothy C. May)
Date: Mon, 8 Nov 93 12:43:42 PST
To: cypherpunks@toad.com
Subject: The "Nymalizer" and Shannon's Information Theory
In-Reply-To: <9311081958.AA00500@ciis.mitre.org>
Message-ID: <199311082043.MAA00486@mail.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


Curtis Frye and many others have written about the ways anonymous or
pseuodonymous posts can be identified. Graham Toal's comments were
especially cogent (even if he tweaked my for some of my characteristic
writing patterns and whatnot (hint: I use "whatnot" more than most
people here).

I want to briefly mention another way of looking at this issue, and
will use Curtis' comments to start:

> For the past few years I've looked at this issue (author identification
> through text content analysis) a bit from a psycholinguistic point of view.
...
> A 1983 paper (which I also do not have the cite handy for) by Dr. Murray
> Miron of Syracuse University gave his equations for analyzing two texts (of
> roughly similar lengths) and establishing a probability that the two
> writings were produced by the same individual.  In his paper, Dr. Miron
...
> The same idea applies here - for CUSUM or similar analysis to be valid, an
> analyst needs large volumes of messages where one of the authors is known

One can view this problem in terms of Shannon's theorem about the
transmission of a message in the presence of noise:

* Signal -- the identity of the poster (true name, pseudonym,
whatever)
- characteristic usage of words, of punctuation, and whatnot (see)
- even the ideologies expressed (which LD incorrectly used to
conclude Jamie Dinkelacker and I "must" be the same person)

* Noise -- variations in spelling, usage, etc.
- many people use similar constructions and whatnot (like this)

Now Shannon's theorem, which can be applied here if some care is taken
(that is, don't apply it too simplistically or too mechanistically),
says that no matter how much noise is present, one can extract the
signal if one samples enough.

(Caveats: for a stationary sequence, etc., whereas one's writings may
change with time, with the topic at hand, etc.)

This means that one can "communicate" the "message"--which in this
case is the message "I am Tim May" or "Jamie and Tim are distinct
posters" and so forth--if enough messages are analyzed.

But to Shannon's basic view one must also add _intereference_, whether
deliberate (spoofing) or not. If I try to emulate the style of S.
Boxx, for example, by writing in the form "I am becoming INCREASINGLY
DISGUSTED by the blatant disregard for the Cypherpunks CAUSE and ...",
then this "intereference" could greatly complicate the signal
extraction.

In fact, more obscure correlations would have to be looked at, ones
which might require many more messages to analyze...possibly more
message samples than exist.

Text analysis tools have presumably gotten a lot more powerful than
they were 30 years ago when the "Did Marlowe writes Shakespeare's
plays?" question was being computer-analyzed.

Anyway, like others have said, there are several programs available
which do this kind of analysis, and I don't think it's paranoid to say
that the CIA and the NSA must have extremely sophisticated tools for
such analysis.

An interesting area. Anybody else interested in building a "nymalizer"
which sorts posts into likely bins?

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
Note: I put time and money into writing this posting. I hope you enjoy it.