How to Create the Perfect Fake Identity (Bruce Schneier)

http://www.wired.com/politics/security/commentary/securitymatters/2008/09/securitymatters_0904

by bdfh42 • 18 years ago

76 32 18 years ago

jrockway3• 18 years ago

I don't really see the point of identity. Why do I need a social security number to have a driver's license? Why don't they just photograph the person who shows up and passes the test? Why does my name need to be on my passport? (What difference does it make? If I am a threat to the free world, why am I not in prison?)

stcredzero• 18 years ago

Without some form of identity, you can claim that the other guy who blew up the airplane wasn't you. Likewise, what's to keep the state from bringing you to trial for the same crime N times? Without identity, how does Habeas Corpus work? In fact, how does most of the legal system work?

Your proposal is that the photograph constitute identity. This isn't valid anymore. It wasn't even valid in the pre Photoshop days.

shawndrost• 18 years ago

If a license photo or an ideal passport uniquely identifies the bearer, you're not really proposing any change. If it doesn't, what does a license/passport mean? Someone, somewhere, filled out a form?

jrockway3• 18 years ago

Isn't that what it means now?

mdasen2• 18 years ago

Work credentials. If I know of graduates of a prestigious institution and can get a license in their name, I could easily get jobs I didn't earn and cause companies to loose money by paying me for a position I'm not qualified for.

Delinquency history. People screw up. I'm a big fan of forgiveness. At the same time, the state has an interest in knowing whether this is the first time you've been convicted of a crime of the 20th.

Self-protection. Yes, identity (can) protect you from the state as much as it protects the state from you. Without identity, the government could (conceivably) steal you away in the night. With identity, that becomes harder as your relatives have documents proving your existence.

Those are just a few cases. To address your issues: your name must be on your passport because while your home country may perceive you as no threat, another country might perceive you as a risk. Usually that's simply an issue of politics, but let's say that it's 2008 and you're an upstanding citizen so you just grab yourself a shiny new passport; 2009 comes and you rob a dozen banks; it's in the state's interest to be able to differentiate between your passport and the passports of others at all times and not simply make the ok/not ok determination at issuance. With driver's licenses, an SSN requirement prevents someone who lost their license due to several counts of drunk driving from simply applying for a new one under a new name - drunk drivers can pass the exam, but they still aren't people I'd like on the road.

For better or worse, we're becoming a dossier society. On the better side, people who shouldn't be able to escape their past have a harder time (drunk drivers can't just go to the RMV and pass a test). On the worse side, people can't escape their past even when it's not that important - and I would say that a lot of people create a lot of anxiety over the fact that they have such a dossier following them around.

DenisM2• 18 years ago

How about interviews? It should help with work stuff. References are good, too.

mechanical_fish2• 18 years ago

If I am a threat to the free world, why am I not in prison?

Oh, man, we've got enough indefinite imprisonment without charges going on as it is. Please don't encourage it.

Once upon a time, people's "data shadows" were very thin indeed. In The Fatal Shore, a truly awesome history book about Australia, they talked about policing in Georgian England. The identification of criminals relied primarily on verbal descriptions of their looks:

Official crime records and registers of criminals were primitive, and there would be no fingerprinting until 1885. Artists made sketches, for popular consumption, of famous offenders... but one could no more recognize a felon from such semi-devotional effigies than pick St. Paul from a crowd by consulting a Byzantine icon. Identification of wanted men had to be made from verbal descriptions in the police gazettes, circulated to mayors and magistrates after the early 1770s... Sketchy as they were, such descriptions did produce some arrests, mainly in villages where people noticed strangers. Some officers of the law had long memories. Henry Fielding's sightless half-brother John, a magistrate known in Bow Street as the "Blind Beak," was said to be able to identify 3000 different malefactors by their voices alone. But on the whole, it was easier for criminals to escape scot-free in the 1780s than it would ever be again.

This meant that, once you had caught a suspected criminal, there was no way to release them temporarily without them disappearing, quite possibly forever. So a lot of crimes were punishable by fines (which could be collected on the spot), or by immediate imprisonment (which is what you got if you couldn't pay the fine), or by death. You couldn't really put people on probation, or parole, or release them on bail.

The result, in practice, was that every person who stole a loaf of bread risked indefinite imprisonment or even death. It was so inhumane (and so expensive -- there weren't enough jails) that the English legal system leapt at the opportunity to solve the problem in a novel way: Transport criminals to the colonies, where they would never bother homelanders again even when they were freed. Until 1776 the favorite colonial destination was the American colonies, but after that the English had to invent the Australian penal colonies...

anamax• 18 years ago

> Some officers of the law had long memories. Henry Fielding's sightless half-brother John, a magistrate known in Bow Street as the "Blind Beak," was said to be able to identify 3000 different malefactors by their voices alone.

How did they know that he was correctly identifying them?

jrockway3• 18 years ago

Oh, man, we've got enough indefinite imprisonment without charges going on as it is. Please don't encourage it.

Well, assuming our society is radical enough to discard identity, I think we can fix the prison system. The first step is to rethink what "crimes" are. Smoking marijuanna is not a crime. Selling it is not a crime. We should reserve prison for people that have proven they can't be in the "normal society" anymore. That basically means murders, rapists, "real criminals".

The next step is to make prisons centers for removal from society, not a place where we throw "undesirables" and let them rot (like the current system). We should give people in prison freedom to have a job, freedom to buy things, etc. We shouldn't force someone to live in a 16 square foot concrete box with 3 other people for 25 years. That's torture, not rehabilitation. (Other countries do a much better job than the US in this respect -- so this isn't just pie-in-the-sky. It could work.)

So anyway, I'm idealizing, not suggesting a policy. If someone is a danger to society, it doesn't benefit society to give them an identity document. Unless they are completely stupid, they are just going to fake the document to get what they want. (Example in real life: college students. It's illegal for them to buy alcohol, but they want it anyway. So they just get a fake ID. Problem solved. But why make them criminals for this? Why not just let them buy the beer legally?)

ph0rque• 18 years ago

Hmmm, if one could write programs to manage these data shadows, then this would be a perfect startup opportunity...

jonknee• 18 years ago

Except that it would be illegal. There are a lot more profitable illegal "startups" out there.

dangoldin• 18 years ago

Reminds me of Shawshank Redemption. If he can create a whole new identity for himself from prison using mail I don't see why we can't using our freedom.

maxklein• 18 years ago

How do you fake your photograph though? All these fake identity scams fall through as soon as you have to show a photograph of yourself. And considering how good software is getting at recongizing faces, soon it will be near to impossible.

aneesh• 18 years ago

> "All these fake identity scams fall through as soon as you have to show a photograph of yourself."

Because no one's ever used a fake photo ID to, say, get into a bar.

staunch• 18 years ago

How many people would get into the bar if US Customs was running the door? Certainly some would, but probably 98% less. Most of the time the reason fake IDs work is because bouncers just don't care. As long as you give them plausible deniability they're happy enough to let you pay them money.

DougBTX• 18 years ago

   How do you fake your photograph though?

RTFA, you just don't get any photo ID for the identity until you sell that identity to someone - who you then take a photo of.

sammyo• 18 years ago

Me and my shadow Strolling down the avenue Me and my shadow Not a soul to tell our troubles too

And when it's twelve o'clock We climb the stair We never knock For nobody's there

run4yourlives2• 18 years ago

I suppose there aren't any Frank or Sammy fans on this board.

Nice try though.

boredguy8• 18 years ago

"twenty-five years is too distant a payoff horizon"

And -this- mentality is what's disastrous to security planning. I hope people actually inside NatSec / InfoSec take a long-term view of things.

ivey• 18 years ago

I trust Schneier's take on this type of calculation more than I trust the people inside NatSec/InfoSec.

dkokelley• 18 years ago

Why not just link link our identities to DNA, thumb prints, and other unique features of us? You want to withdraw money? Scan your eye here. You would like to apply for a driver's license? Spit into this jar. Someone will contact you in a week (or however long it takes to process DNA samples).

That way, the shadow can never really be separated from the person (or at least the difficulty increases). BTW, I recommend watching the movie Gattaca for an interesting take on identity theft of the future, when people are engineered and DNA is checked everywhere you go.

blurry• 18 years ago

If someone wants to rob me, I'd rather they take my id than my thumb...

ryanmahoski• 18 years ago

If someone wants to rob you, they too prefer your id to your thumb. The average sentence for aggravated assault in the U.S. is 30 to 90 years per count. http://en.wikipedia.org/wiki/Assault#Aggravated_assault

run4yourlives2• 18 years ago

Why not just link link our identities to DNA, thumb prints, and other unique features of us?

Because the thing is that modern western society doesn't want a system of identity to be perfect, we just want it to be good enough.

The reason for this is quite simply a history lesson. Every single time the controllers of identity are able to do it really well, the rest of us get royally screwed.

derefr• 18 years ago

Well, we just need to decentralize identity, then. Basically, PGP signing of our more "regular" identification mechanisms using our DNA and a password as the biometric key for the private keyring--other people won't know who you are unless, and until, you want them to.

How to Create the Perfect Fake Identity (Bruce Schneier)

Related Stories