Screen a million people against 1,000 attributes — travel history, purchase records, communication patterns, location data. Each attribute has a 0.5% innocent match rate: for any given attribute, 1 in 200 innocent people will match the suspicious profile by coincidence.
The probability that an innocent person matches all 1,000 attributes is (0.005)^1000 — effectively zero. Finding someone who matches 15 specific attributes has probability 10^-35. These numbers are used to justify the system: the chance of a false positive is astronomically small.
But screening a million people against 1,000 attributes does not check each person against all 1,000 (arXiv:2511.12459). It checks each person against each attribute independently, generating a separate alert for each match. One million people times 1,000 attributes equals one billion checks. At 0.5% per check, that is five million individual attribute matches. Group these by person: each person matches, on average, 5 attributes. Some match 10. Some match 15. The distribution has a tail.
The result: approximately 226 false alerts per million people — innocent individuals who happen to match enough attributes to trigger investigation. Not because any single match is meaningful, but because checking many attributes across many people makes spurious multi-attribute matches inevitable. The system designed to find needles in haystacks generates its own needles.
The mathematics is not exotic. It is the birthday problem scaled up: in a room of 23 people, two likely share a birthday not because any individual is “suspicious” but because the number of pairwise comparisons is large enough. Surveillance systems perform far more comparisons than birthday parties. The false alert rate is not a bug in the implementation — it is a structural property of high-dimensional screening applied to large populations.
The system that monitors everything finds threats everywhere, because the mathematics of many comparisons guarantees it.