Sunday, March 06, 2005

The ID Wars

The New York Times reports about the arms race in fake IDs.
Using Internet resources and sophisticated computer graphics software, college students are forging drivers' licenses of startlingly good quality, complete with shimmering holograms, special inks and data encoding that can fool the police and even occasionally the latest generation of scanners. To hear law enforcement officers tell it, in the fake-ID arms race the kids are winning. …

The nation's fixation with security cards and ID systems has also been a boon for manufacturers of fake ID's. The widespread use of corporate ID's has created a large pool of people who know the inner workings of the security features in the cards. In online chat rooms dedicated exclusively to the manufacture of fake ID's, unscrupulous members of this pool - including some drivers' license bureau workers, the police say - share or sell information about security features and even run a black market in the more sophisticated components of ID's.

"There are guys online who manufacture the bar codes and holograms," said the Columbia student who made fake ID's. "The hologram like on a Texas will glow. I can order that."

For students who prefer to make their own ID's, the Web offers all the raw materials. High-quality graphics templates for most state drivers' licenses - with accurate renderings of intricate background patterns and color schemes - can be found online. High-tech driver's license plastics and laminates that were once available only to drivers' license bureaus are now easily available online as well at legitimate office supply sites and specialty sites.
It's hard to imagine that it will ever be possible to eliminate fake IDs. After all,
  1. There must be some mechanisms that checks an ID to determine whether it is genuine.
  2. There must be some mechanism that generates IDs that satisfy the test.
So how is it possible to prevent people from using the same mechanisms used by a real generator to create a fake version of the same thing that will pass the testing mechanism?

How many levels of forgery must one prevent?
  • the ID object, i.e., the piece of paper or whatever it is that one carries around;
  • the information on the ID object;
  • the connection between that information and the person carrying it.
For currency we use special paper. Why don't they do something similar for IDs? States seem to use holograms these days. But that seems no longer to be hard enough to forge.

To ensure the validity of the information on the ID object, the only thing I can think of is to have an independent (e.g., online or onsite but regularly updated) database of encrypted information that against which the ID must be validated.

But even if one could certify the validity of pieces of paper and ensure that there are no forgeries, one would still be stuck with ensuring that the person presenting the ID object is the person the ID object presumably identifies.

It would seem that the only solution is to use biometric identifiers (iris scans, etc., perhaps even on-the-spot DNA analyzers from a sample of hair) that could be checked with a centralized database of people. If we went that far, we wouldn't need IDs at all. Everyone's biometric markers would be ID enough. Are we willing to go that far? Even if so, the centralized database would still be a point of vulnerability.

What I find fascinating about all this is the seeming impossibility of ever ensuring meta information. I'm working on an analysis of emergence and related phenomena. I believe that one of the features of the world that is central to emergence is just the impossibility of fully segmenting the world into two disjoint worlds, i.e., that there is only one world and no matter how hard one tries, it is impossible to build a second world that is so partitioned from the object world that it can't be gamed.

A second thing that I find fascinating about this is that the forgery business has, in fact, become a business, like all other businesses.
Some ID mills are offshore and sell online. Many sites purporting to sell fake ID's are scams set up to take advantage of gullible under-age drinkers, but Michael Cawthon, the special agent in charge of the Nashville district of the Tennessee Alcoholic Beverage Commission, said that others offer forgeries of drivers' licenses. Mr. Cawthon said some offshore counterfeiting outfits solicit students to market for them on campuses and even conduct background checks on their American liaisons to make sure they are not the law.
So there are even fake forgers! And since some forgers hire people to act as their marketing agents, they must investigate those people to ensure they are legitimately dishonest!

1 comment:

Matthew said...

One possibility for preventing ID forgeries would be to digitally encode important samples of data on the card (name, perhaps a JPEG image, license number, etc.) alongside an electronic signature of that data. This is similar to the public key cryptography technology behind SSL, S/MIME, PGP, and SSH today. The card would be impossible to forge without the private key, which the government would keep in strict confidence and cycle regularly. A swipe through a card-reading device would verify the authenticity of the card and display the signed information to the individual examining the card.