NEWS that AT&T, Verizon and BellSouth gave customer records to the National Security Agency has set off a heated debate over the intricacies of espionage law. But legal or not, this sort of spying program probably isn't worth infringing our civil liberties for -- because it's very unlikely that the type of information one can glean from it will help us win the war on terrorism.

If the program is along the lines described by USA Today -- with the security agency receiving complete lists of who called whom from each of the phone companies -- the object is probably to collect data and draw a chart, with dots or "nodes" representing individuals and lines between nodes if one person has called another.

Mathematicians who work with pictures like this are called graph theorists, and there is an entire academic field, social network analysis, that tries to determine information about a group from such a chart, like who the key players are or who the cell leaders might be.

But without additional data, its reach is limited: as any mathematician will admit, even when you know everyone in the graph is a terrorist, it doesn't directly portray information about the order or hierarchy of the cell. Social network researchers look instead for graph features like "centrality": they try to identify nodes that are connected to a lot of other nodes, like spokes around the hub of a bicycle wheel.

But this isn't as helpful as you might imagine. First, the "central player" -- the person with the most spokes -- might not be as important as the hub metaphor suggests. For example, Jafar Adibi, an information scientist at the University of Southern California, analyzed e-mail traffic among Enron employees before the company collapsed. He found that if you naïvely analyzed the resulting graph, you could conclude that one of the "central" players was Ken Lay's ... secretary.

And even if you manage to eliminate all the "central players," you may well still leave enough lesser players that the cell retains a complete chain of command capable of carrying out a devastating terrorist attack.

In addition, the National Security Agency's entire spying program seems to be based on a false assumption: that you can work out who might be a terrorist based on calling patterns. While I agree that anyone calling 1-800-ALQAEDA is probably a terrorist, in less obvious situations guilt by association is not just bad law, it's bad mathematics, for two reasons.

The simplest reason is that we're all connected. Not in the Haight-Ashbury/Timothy Leary/late-period Beatles kind of way, but in the sense of the Kevin Bacon game. The sociologist Stanley Milgram made this clear in the 1960's when he took pairs of people unknown to each other, separated by a continent, and asked one of the pair to send a package to the other -- but only by passing the package to a person he knew, who could then send the package only to someone he knew, and so on. On average, it took only six mailings -- the famous six degrees of separation -- for the package to reach its intended destination.

Looked at this way, President Bush is only a few steps away from Osama bin Laden (in the 1970's he ran a company partly financed by the American representative for one of the Qaeda leader's brothers). And terrorist hermits like the Unabomber are connected to only a very few people. So much for finding the guilty by association.

A second problem with the spy agency's apparent methodology lies in the way terrorist groups operate and what scientists call the "strength of weak ties." As the military scientist Robert Spulak has described it to me, you might not see your college roommate for 10 years, but if he were to call you up and ask to stay in your apartment, you'd let him. This is the principle under which sleeper cells operate: there is no communication for years. Thus for the most dangerous threats, the links between nodes that the agency is looking for simply might not exist.

If our intelligence agencies are determined to use mathematics in rooting out terrorists, they may consider a profiling technique called formal concept analysis, a branch of lattice theory. The idea, in a nutshell, is that people who share many of the same characteristics are grouped together as one node, and links between nodes in this picture -- called a "concept lattice" -- indicate that all the members of a certain subgroup, with certain attributes, must also have other attributes.

For formal concept analysis to be helpful, you need much more than phone records. For instance, you might group together people based on what cafes, bookstores and mosques they visit, and then find out that all the people who go to a certain cafe also attend the same mosque (but maybe not vice versa).

While researchers at Los Alamos National Laboratory have used this tool to sift through hundreds of terrorism-related reports -- and find connections that human analysts could not have found easily -- it's still dangerous to rely on the math.

This is because, as Kennedy and Lincoln assassination buffs know, two people can be a lot alike without being the same person. Even if there is only a 1 in 150 million chance that someone might share the profile of a terrorist suspect, it still means that, in a country the size of the United States, two people might share that profile. One might be a terrorist, or he might be Cat Stevens.

This isn't to say that mathematicians are useless in fighting terrorism. In September 2004  10 months before the bombing of the London Underground -- Gordon Woo, a mathematician and risk-assessment consultant, gave a speech warning that London was a hotbed of jihadist radicalism. But Dr. Woo didn't anticipate violence just using math; he also used his knowledge of London neighborhoods. That's what law enforcement should have been doing then and should be doing now: using some common sense and knowledge of terrorists, not playing math games.

Math is just a tool. Used wisely, math can indeed help in warfare: consider the Battle of Britain, won in part by breaking the German codes. But use it unwisely -- as seems to be the case here -- and your approval ratings might just hit a new all-time low.

Several models have been proposed for the dose-response function and the incubation period distribution for human inhalation anthrax. These models give very different predictions for the severity of a hypothetical bioterror attack, when an attack might be detected from clinical cases, the efficacy of medical intervention and the requirements for decontamination. Using data from the 1979 accidental atmospheric release of anthrax in Sverdlovsk, Russia, and limited nonhuman primate data, this paper eliminates two of the contending models and derives parameters for the other two, thereby narrowing the range of models that accurately predict the effects of human inhalation anthrax. Dose-response functions that exhibit a threshold for infectivity are contraindicated by the Sverdlovsk data. Dose-dependent incubation period distributions explain the 10-day median incubation period observed at Sverdlovsk and the 1- to 5-day incubation period observed in nonhuman primate experiments.

Part I of this article looks at the American institution of legal controls on the executive branch and their subsequent erosion post-9/11. It explores three changes incorporated in the USA PATRIOT Act: alterations to the Foreign Intelligence Surveillance Act; the introduction of Delayed Notice Search Warrants; and the expansion of National Security Letters. Outside of this legislation, the weakening of the Attorney General guidelines

increased the FBI's ability to collect information. The article highlights the Department of Defense's ("DOD") movement into the domestic surveillance realm. It discusses a number of operations both inside and outside the DOD, such as TALON, Echelon, Carnivore, Magic Lantern, TIPS, and the use of watch lists. Part I concludes with a discussion of the data mining efforts underway. The article argues that Total Information Awareness, ADVISE, and other projects catapult surveillance into another realm. Moreover, while any one program, such as the NSA initiative, may be considered on narrow grounds, the sheer breadth of current powers raises important concerns.

Part II notes that, until recently, no laws governed police and intelligence service information-gathering authorities in the UK. Extraordinary stop and search powers for terrorist-related offences, and warrants for police interference with property provided exceptions. But physical searches of property conducted by the intelligence services, the interception of communications by law enforcement and intelligence agencies, the use of covert surveillance or "electronic bugs," and the running of covert human intelligence sources operated under the legislative and judicial radars. Beginning in the mid-1980s, the European Court began to raise objections to the lack of safeguards and statutory framework. But each time the Court handed down a significant finding against the United Kingdom, the state responded not just by, at least on the surface, meeting the demands of the European Convention of Human Rights, but, it appears, by expanding executive surveillance authorities. Moreover, the warrant system introduced retained control within the executive branch. Not subject to judicial review, the standard applied is reasonable suspicion--considerably less robust than probable cause. Like the United States, Britain draws on new technologies; the country leads the world in its use of public surveillance systems.

Having laid out legal developments on both sides of the Atlantic, Part III moves to policy concerns: it begins by briefly exploring the substantive, political, legal, social, and economic risks posed by such measures. It then considers six approaches that would help to mitigate the risks. First is the possibility of creating a property right in personal information. The second centers on the regulation of access, transfer, use, and retention of data. Such efforts would satisfy demands for accountability and transparency in both the public and private sector. A third possibility centers on scaling back the existing powers of the state. Fourth, both countries may contemplate placing limits on what constitutes national security. Fifth, alternative safeguards and oversight structures deserve attention - such as reporting requirements, random audits, the creation of ombudspersons, the insertion of the judiciary, and (in the UK) allowing intercepted communications to be used as evidence. Sixth, preventing countries from introducing ever greater powers of surveillance under the claim that they are only temporary in nature would force legislatures to consider the long-term impact of provisions beyond the immediate terrorist threat.