Schneier on Security
A blog covering security and security technology.
« Good Essay on the No-Joke Zone at Airports |
| Friday Squid Blogging: Squid Cooking Tools »
November 2, 2007
Interesting Twist on Identity Theft
Okay, this is clever.
Basically, someone arrested as a homicide suspect walked out of jail after identifying himself as someone else. The biometric system worked, but human error overrode it:
But Sauceda's fingerprints, taken by a jail employee to verify his identity, were smudged and couldn't be matched to those on file for Garcia, said Brian Menges, director of jail administration.
So Sauceda was taken for an additional fingerprint check using the jail's Live Scan technology. Menges said Saucedo's Live Scan fingerprints were never compared to those on record for Garcia.
It's a neat scam. Find out someone else who's been arrested, have a friend come and post bail for that person, and then steal his identity when the jailers come into the cellblock.
Posted on November 2, 2007 at 12:25 PM
• 17 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"Wolff said he understood the problem to be that the Live Scan check of Sauceda's fingerprints pulled up Sauceda's own profile, including a photo, and that when Sauceda matched it, he was released."
Sounds like a mismatch between system design and human factors. The system used fingerprints to call up a photo, it matched the guy who was fingerprinted so the carbon-based system element took that as affirmation of identity without confirming the name match.
"An unidentified person had posted bond for Garcia"
Does this mean that the jail administration doesn't know who posted bond, or that they didn't tell the press?
If the former, they've got another problem.
The only escape this year (so far) from a closed UK prison was from Winson Green (HMP Birmingham). They released the wrong inmate by mistake.
As far as I recall, he spent the day drinking his discharge grant (around USD90) and turned himself in that evening. He had not intended to escape, just took the opportunity gifted to him by the staff.
I remember chatting to a prisoner in the same prison a few years back when an officer dropped in and said to him: "get your things, X, you're being released."
He said: "I think you mean my brother, three cells down". And they did, otherwise, I may have seen the start of an "escape".
This technique has been described by Solchenyzin as very common in the Gulag in the USSR. Identify a fellow prisoner with a shorter (or lighter) sentence, and assume his identity at transfer points.
This often involved coercing or subduing the victim, who, by exclusion, ended up with the higher sentence. At least the latter part seems to have been overcome - not by biometrics, but by the rule of law.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.