Entries Tagged "forgery"

Page 13 of 13

Spelling Errors as a Counterfeiting Defense

This is a weird rumor.

ID cards in Belgium are being printed with intentional misspellings in an attempt to thwart potential fraudsters.

Four circular arcs on the ID cards show the country’s name in different languages—French, Dutch, German and English. According to the article, the German and English arcs will be spelled incorrectly, and misspellings will also appear elsewhere on the cards. The idea is that people making counterfeit cards won’t notice the misspellings on the originals and will print the fraudulent cards with the names spelled properly.

More information is here:

To trick fraudsters, the Home Office has introduced three circular arcs on the card—just beneath the identity photos—where you will find the name of the country in the official languages spoken in Belgium—French, Dutch and German, as well as in English. But instead of ‘Belgien’ in German, the ID card incorrectly uses the name ‘Belgine’ and instead of ‘Belgium’ in English, the card reads ‘Belguim’. Vanneste has promised other errors will be printed on the card to “further confuse fraudsters”. With any luck, these will not be revealed.

I’m not impressed with this as a countermeasure. It’s certainly true that poor counterfeits will have all sorts of noticeable errors—and correct spelling might certainly be one of them. But the more people that know about the misspellings, the less likely a counterfeiter will get it wrong. And the more likely a counterfeiter will get it wrong, the less likely anyone will notice.

I’m all for hard-to-counterfeit features in ID cards. But why make them grammatical?

Posted on June 1, 2005 at 7:58 AM • View Comments

ChoicePoint

The ChoicePoint fiasco has been news for over a week now, and there are only a few things I can add. For those who haven’t been following along, ChoicePoint mistakenly sold personal credit reports for about 145,000 Americans to criminals.

This story would have never been made public if it were not for SB 1386, a California law requiring companies to notify California residents if any of a specific set of personal information is leaked.

ChoicePoint’s behavior is a textbook example of how to be a bad corporate citizen. The information leakage occurred in October, and it didn’t tell any victims until February. First, ChoicePoint notified 30,000 Californians and said that it would not notify anyone who lived outside California (since the law didn’t require it). Finally, after public outcry, it announced that it would notify everyone affected.

The clear moral here is that first, SB 1386 needs to be a national law, since without it ChoicePoint would have covered up their mistakes forever. And second, the national law needs to force companies to disclose these sorts of privacy breaches immediately, and not allow them to hide for four months behind the “ongoing FBI investigation” shield.

More is required. Compare the difference in ChoicePoint’s public marketing slogans with its private reality.

From “Identity Theft Puts Pressure on Data Sellers,” by Evan Perez, in the 18 Feb 2005 Wall Street Journal:

The current investigation involving ChoicePoint began in October when the company found the 50 accounts it said were fraudulent. According to the company and police, criminals opened the accounts, posing as businesses seeking information on potential employees and customers. They paid fees of $100 to $200, and provided fake documentation, gaining access to a trove of
personal data including addresses, phone numbers, and social security numbers.

From ChoicePoint Chairman and CEO Derek V. Smith:

ChoicePoint’s core competency is verifying and authenticating individuals
and their credentials.

The reason there is a difference is purely economic. Identity theft is the fastest-growing crime in the U.S., and an enormous problem elsewhere in the world. It’s expensive—both in money and time—to the victims. And there’s not much people can do to stop it, as much of their personal identifying information is not under their control: it’s in the computers of companies like ChoicePoint.

ChoicePoint protects its data, but only to the extent that it values it. The hundreds of millions of people in ChoicePoint’s databases are not ChoicePoint’s customers. They have no power to switch credit agencies. They have no economic pressure that they can bring to bear on the problem. Maybe they should rename the company “NoChoicePoint.”

The upshot of this is that ChoicePoint doesn’t bear the costs of identity theft, so ChoicePoint doesn’t take those costs into account when figuring out how much money to spend on data security. In economic terms, it’s an “externality.”

The point of regulation is to make externalities internal. SB 1386 did that to some extent, since ChoicePoint now must figure the cost of public humiliation when they decide how much money to spend on security. But the actual cost of ChoicePoint’s security failure is much, much greater.

Until ChoicePoint feels those costs—whether through regulation or liability—it has no economic incentive to reduce them. Capitalism works, not through corporate charity, but through the free market. I see no other way of solving the problem.

Posted on February 23, 2005 at 3:19 PM • View Comments

Illegal Aliens and Driver's Licenses

Has anyone heard of the Center for Advanced Studies in Science and Technology Policy? They released a statement saying that not issuing driver’s licenses to illegal aliens is bad for security. Their analysis is good, and worth reading:

As part of the legislative compromise to pass the intelligence reform bill signed into law by the President today, the administration and Congressional leaders have promised to attach to the first ‘must pass’ legislation of the new year a controversial provision that was rightly dropped from the intelligence reform bill—this provision would effectively prevent the states from issuing driver’s licenses to illegal aliens by requiring ‘legal presence’ status for holders of licenses to be used as ‘national ID.’

Although this provision is being touted by its supporters as a security measure, its implementation in practice will be to undermine national security because it ignores three widely-recognized principles of counter-terrorism security: the shrinking perimeter of defense; the need to allocate resources to more likely targets; and the economics of fraud.

First, the very fact that 13 million illegal aliens are already within our borders means that a perimeter-based defense is porous. The proposed policy would eliminate another opportunity to screen this large pool of people and to separate ‘otherwise law abiding’ illegal aliens from terrorists or criminals by confirming identity when licenses are issued or when such licenses are presented or used for identity screening at checkpoints.

Recognizing the porous nature of perimeter defense does not mean that border security should not be improved or that additional steps to prevent illegal immigration should not be taken, however, not recognizing its porous nature is unrealistic, counter to current trends in security practice, and undermines national security. Rather than excluding 13 million people already within our borders, we should encourage non-terrorist illegal aliens to participate in internal security screening systems.

This leads to the second point. Contrary to the argument made by its supporters that denying illegal aliens licenses would prevent terrorists from ‘melting’ into society, this legislation would guarantee a larger haystack in which terrorists can hide thus making it more difficult for law enforcement to identify them. Counter-terrorism strategy is based on reducing the suspect population so that security resources can be focused on more likely suspects. Denying identity legitimacy to 13 million illegal aliens—the vast majority of whom are not terrorists or otherwise threats to national security—just increases the size of the suspect pool for law enforcement to have to sort through. Since law enforcement resources are already unable to effectively cope with the large illegal alien population why further complicate their task?

Third, the proposed legislation would increase the incentives for fraud by greatly inflating the value of a driver’s license and by creating significant new demand for fraudulent licenses by making the driver’s license actual proof of citizenship or legal status. Arguments in support of the legislation are based in part on denying illegal aliens the de facto legitimacy that a driver’s license currently confers, yet the legislation would actually make such legitimacy a matter of law, thus increasing the demand for fraudulent licenses not only among those illegal aliens wishing to drive but among all 13 million who may now see it as a way to get jobs or otherwise prove their legitimate status.

If 13 million people living within our borders can’t drive, fly, travel on a train or bus, or otherwise participate in society without a driver’s license and they cannot get a legitimate one, then the market will supply them an illegal fraudulent one. State DMV bureaucracies, no matter how well- intentioned, do not have the resources, training, or skill to prevent fraud driven by this additional demand and no federal mandate will be able to prevent organized criminal elements from responding.

On the other hand, if illegal aliens are allowed to get legitimate licenses upon thorough vetting of their identity, then the only ones who will be trying to get fraudulent documents will be terrorists or criminals—who will face increased costs and more opportunities for mistakes if there is less overall demand—and law enforcement resources can be focused on these activities.

Fourteen states currently allow driver’s licenses to be obtained without showing ‘legal presence.’ These laws were enacted for public safety reasons—to ensure that drivers meet some standard to drive and to lower insurance premiums by decreasing the pool of unlicensed and uninsured drivers. In most cases, these laws were passed with the strong support of state law enforcement officials who recognized the advantages of being able to identify drivers and discourage unlicensed drivers from fleeing from minor traffic infractions or accidents because they were fearful of being caught without a license. The analogous arguments hold for national security—the more we can encourage otherwise law abiding people within our borders to participate in the system the easier it will be to identify those that pose a true threat.

There may be legitimate reasons for cracking down on illegal immigration, there may even be reasons to deny illegal aliens driver’s licenses, but counter-terrorism security is not one. This provision was appropriately dropped from the intelligence reform bill and it should not be resurrected in the 109th Congress.

Posted on January 4, 2005 at 8:00 AM •

Hacking Faxes

Prisoner is freed from jail based on a forged fax:

In West Memphis District Court yesterday, Tristian Wilson was set to appear on the docket for a bond hearing on the charges. When he did not appear, Judge William “Pal” Rainey inquired about his release and found that a jail staff member released Wilson by the authority of a fax sent to the jail late Saturday night.

According to Assistant Chief Mike Allen, a fax was sent to the jail which stated “Upon decision between Judge Rainey and the West Memphis Police Department CID Division Tristian Wilson is to be released immediately on this date of October 30, 2004 with a waiver of all fines, bonds and settlements per Judge Rainey and Detective McDugle.”

Jail Administrator Mickey Thornton said that these faxes are part of a normal routine for the jail when it comes to releasing prisoners, however, this fax was different.

Faxes are fascinating. They’re treated like original documents, but lack any of the authentication mechanisms that we’ve developed for original documents: letterheads, watermarks, signatures. Most of the time there’s no problem, but sometimes you can exploit people’s innate trust in faxes to good effect.

Posted on November 8, 2004 at 7:12 AM • View Comments

1 … 11 12 13

Sidebar photo of Bruce Schneier by Joe MacInnis.