Asset Protection BLOG - Mark Nestmann

Fingering Big Government's (and Big Businesses') Obsession with Fingerprinting

Could you be forced to submit your fingerprints for the offense of "driving while Latino?"  To apply for a job?  Or even as a condition to enter a Disney theme park? 

If you live in the United States, the answer is "yes."  And that's got me pointing my finger at some serious problems with these developments. 

Last night I had dinner with some friends here in Phoenix.  One of my friends—I'll call her Mary—has a friend named Roberto. 

Roberto is a native-born American, but comes from a Hispanic family.  And he received the shock of his life a few days ago when sheriff's deputies in Maricopa County, Arizona pulled him over while he was driving.

Roberto wasn't intoxicated or driving erratically.  In fact, it appears the reason he was pulled over—and detained for nearly an hour—was because he has a Hispanic appearance.

During the encounter, the deputies grilled Roberto about his immigration status.  They didn't believe his claims that he was a native-born U.S. citizen.  To add insult to injury, the deputies fingerprinted him.  Not subjecting to fingerprinting, they told him, would subject him to arrest. 

Maricopa County is hardly alone in this regard.  Police in Hawaii, Kansas, New York, Wisconsin, and perhaps other state as well, now routinely scan fingerprints when they stop motorists for traffic infractions.  At the same time, the FBI is investing US$1 billion in a national database that will combine fingerprint data with retinal scans, and even tattoos.

What's more, if you want to apply for a job, you may have to submit your fingerprints along with your job application.  Both state and federal laws now require fingerprinting for many types of jobs, particularly those involving contact with children, security, or with large sums of money.

But what really makes my finger wag is a policy instituted in 2006 at Walt Disney World in Orlando, Florida.  To enter the "Magic Kingdom," you must now submit to a fingerprint scan.  This is to prevent you from sharing or re-selling your admission tickets. 

However, as with many other surveillance technologies, fingerprinting is in many cases essentially "security theater."  The FBI claims a "zero error rate" in its fingerprint identification.  But that's simply not true. 

One problem is false matches.  A false match on a fingerprint left on a bag linked to a 2004 bombing in Spain that left 191 dead led to the arrest and detention of Portland attorney Brandon Mayfield.  After Mayfield spend two weeks in jail, prosecutors finally released him after realizing that "zero error rate" doesn't necessarily mean, well, "zero error rate."

Fingerprint readers can also be spoofed.  In 2005, Japanese cryptographer Tsutomu Matsumoto designed a system to trick biometric fingerprint readers.  Matsumoto's system involves duplicating an actual fingerprint through digital photo editing software and other advanced technology.  His design apparently fools fingerprint readers about 80% of the time. 

In other words, in the not-distant future, someone could hack the FBI biometric database, steal your fingerprints, duplicate them using Matsumoto's techniques or even more advanced methods, and then leave them at the scene of various crimes.  Guess who would be arrested? 

What routine fingerprinting is effective for is conditioning all of us to accept surveillance and routine searches and identity checks as a routine part of life.  And that has me pointing my finger…skyward.

Copyright © 2008 by Mark Nestmann

Is "Real ID" Dead—or Just Waiting for the Next Terrorist Crisis?

Are there limits beyond which Americans will refuse to go in the so-called "War on Terrorism?" 

Apparently so.  Legislators in more than two-dozen states have enacted laws refusing to go along with an unfunded federal mandate that imposes security, authentication, and issuance standards for driver's licenses and state ID cards. 

The initial deadline for compliance with this "Real ID initiative" is May 11, 2008.  After that date, residents of states that haven't promised to issue Real ID-compliant identity documents won't be able to use their drivers' licenses to board a domestic airline flight, enter a federal courthouse, or for other official government purposes. 

Only, it appears that the Department of Homeland Security isn't that serious about enforcing the Real ID mandate.  To avoid a May 11 showdown, it has issued extensions to compliance with Real ID to every state that passed laws refusing to comply with it!  The DHS merely received assurances that these states will "eventually" comply with the requirements. 

Supporters of the Real ID initiative—part of a 2005 military spending bill—claim that it merely establishes common-sense standards to insure identity documents can't be counterfeited or falsified.  That, in turn, they say, will reduce terrorism, illegal immigration, and a host of other social ills.

If only that were true—it's not.  Harder-to-forge IDs won't stop terrorism, because making sure someone is who they claim to be doesn't prove they won't conduct a terrorist act.   

Most terrorists have no previously known links to terrorism.  Many of the 9/11 hijackers had no previous links to terrorism.  For that matter, neither did Oklahoma City bomber Timothy McVeigh.

Then there's the matter of whether Real IDs will actually be, well, real.  Proponents say the high-tech identity documents produced under the initiative will be tamperproof and impossible to counterfeit. 

But this claim is a bald-faced lie.  We need look no further than the newest generation of U.S. passports—those equipped with a supposedly tamper-proof radio frequency identification (RFID) chip similar to the one slated to be inserted in all Real ID compliant identity documents.  Last August, a computer security actually cloned a RFID passport.  Is it too much to imagine that clever hackers will similarly find a way to hack Real IDs?

But the most threatening aspect of the Real ID initiative is its creation of the equivalent of a national database to include details on nearly 250 million licensed drivers.  Each state must provide electronic access to all other states to information contained in its motor vehicle database. 

An interlinked system is a far greater security risk than a decentralized one with each state issuing ID cards according to its own rules.  That's because if hackers manage to penetrate it, they'll have access to identity documents in all 50 states—not just one. 

Moreover, since there's no requirement that the data on your Real ID be protected in any way, private companies can use the information in it at will.  Every retailer that requires identification will swipe your Real ID and then sell the data to information aggregators to be data mined at will.

Does the current standoff over Real ID mean the end of efforts to establish a national ID card?  Not at all.  If a lie is repeated often enough, people will believe it's true.  That's particularly true when it comes to the War on Terror.  If there is another terrorist attack on U.S. soil, the trend toward a national identity card—and national ID database—may be unstoppable. 

Copyright © 2008 by Mark Nestmann

U.K. National ID Card Proposal Delayed

The Nazis had one, and so did the Soviets and apartheid South Africa.  Communist China has one.  And an increasing number of "free" countries have them as well.  Residents of Hong Kong, Singapore and even the Netherlands now have to carry their cards at all times.

What I'm referring to, of course, is a national ID card.  When the authorities ask for it, you MUST present it.  If you don't, you can be fined and in some countries, even imprisoned.

Without your national ID card, you can't leave your home.  In some countries, you can't shop without it.  In others, you need to present your national ID to obtain medical treatment.  Naturally, it's used to track all your financial transactions, your electronic communications, your travel history, etc. 

Governments that promote national ID cards say they're needed as an "anti-crime" measure.  Only, it turns out that the security surrounding any centralized database is often so poor that crime—especially identity theft—rises exponentially.

The United Kingdom is a case in point.  In just the last six months, the U.K. government:

• Lost two CDs containing bank details and addresses of 9.5 million parents and the names, dates of birth and National Insurance numbers of all 15.5 million children in the country;
• Sent 7.25 million parents an apology letter for this breach, with the letter containing much of the same sensitive personal data! 
• Had a Royal Navy officer's laptop stolen which contained personal identifying details of more than 600,000 people.

Not surprisingly, these losses, and similar ones, are causing an explosion in identity theft.  Even the chairman of banking giant Barclays isn't immune.  Earlier this month, the bank announced that a con man had stolen the equivalent of US$20,000 from his personal account in a credit card scam.

Who's taking responsibility for these losses?  Naturally, it's not the government.  Indeed, the U.K. Revenue & Customs agency actually blamed parents for letting their children's details fall into the wrong hands!

Despite its shameful efforts to blame parents for government data losses, the U.K. government has apparently come to realize that forcing a national ID card into existence isn't politically expedient.  A national identity "White Paper" recently proposed delaying the mandatory identification cards until at least 2012.  A voluntary scheme will begin in 2009 for U.K. citizens renewing their passports.

When that happens, you can count on an explosion in crimes, especially identity theft and forgery.  As security expert Bruce Schneier, author of Beyond Fear: Thinking Sensibly About Security in an Uncertain World, observes:

"ID cards will not reduce crime, fraud or illegal immigration.  Instead, ID cards encourage criminals to attempt forgeries, potentially exacerbating crime rather than reducing it.  Every credential has been forged.  As you make a credential more valuable, there is more impetus to forge it.  And even if we could guarantee that everyone who issued national ID cards couldn't be bribed, initial cardholder identity would be determined by other identity documents ... all of which would be easier to forge.

"But the main problem with any ID system is that it requires the existence of a database.  In this case it would have to be an immense database of private and sensitive information on every citizen -- one widely and instantaneously accessible from airline check-in stations, police cars, schools, and so on.  And when the inevitable worms, viruses, or random failures happen and the database goes down, what then?  Is the whole country supposed to shut down until it's restored?"

National ID cards are also a bad idea not only because the potential for abuse, but because of "surveillance creep:" a technology or law intended for one purpose, winds up being used for many others.

A classic example is the U.S. Social Security card.  Once stamped "not for identification," the number on your Social Security card is now required to file a tax return, open a bank account and to obtain a driver's license.  Does anyone really think national ID cards--including the U.S. "Real ID" initiative--will be any different?

Copyright © 2008 by Mark Nestmann

What's Worse than a National ID? How About a Global One?

Quietly, the infrastructure for a global identification system is being put in place by a consortium of commercial entities, and government agencies, and non-profit organizations.

A nearly-invisible organization called the Federation for Identity and Cross-Credentialing Systems (http://www.fixs.org) has created what it calls the first "worldwide, interoperable identity and cross-credentialing network." Now installed at numerous U.S. military installations and government offices, the FIXS network is now ready for global deployment.

What might bring about the adoption of a global identification system? The threat of terrorism, naturally. Jim Williams, former director of the US VISIT program within the U.S. Department of Homeland Security, says a global ID would help fight terrorism, and also cut wait times, reduce government fees for travelers, and deter illegal immigration.

Progress in other countries promises to make a global ID system a reality sooner, rather than later. In the EU, the European Health Insurance Card sets up a framework by which travelers from one EU country who fall ill in another EU country can obtain health care there. The final phase of this effort will add a "smart chip" containing a range of data, including health files and records of treatment received. It's hardly a stretch to imagine that this card could evolve into a EU-wide identification card.

On another front, the International Civil Aviation Organization (ICAO) has issued a series of "best practice" standards for biometric passports and the transfer of airline passenger data. Resolutions adopted by ICAO's governing council of government representatives require all members to begin issuing machine-readable passports by 2010. Another ICAO standard requires the new high-tech passports to contain sufficient spare memory to house a "biometric identifier" such as face recognition (the initial standard) or fingerprinting. Again, it's easy to imagine how this information could be woven into a global travel database that is an integral part of a future global identification scheme.

However, national ID cards, much less a global ID system, won't bring the promised benefits. As Bruce Schneier, founder and chief technical officer of BT-Counterpane, an Internet security company, observes:

"ID cards will not reduce crime, fraud or illegal immigration. Instead, ID cards encourage criminals to attempt forgeries, potentially exacerbating crime rather than reducing it. As you make a credential more valuable, there is more impetus to forge it. And even if we could guarantee that everyone who issued national ID cards couldn't be bribed, initial cardholder identity would be determined by other identity documents ... all of which can be forged.

"But the main problem with any ID system is that it requires the existence of a database. In this case it would have to be an immense database of private and sensitive information on every citizen—one widely and instantaneously accessible from airline check-in stations, police cars, schools, and so on. And when the inevitable worms, viruses, or random failures happen and the database goes down, what then? Is the whole country [Nestmann note—or world] supposed to shut down until it's restored?"

What a global ID system will be effective in doing is to bring the world one step closer to global totalitarianism, with law-abiding citizens forbidden to work, travel, open bank accounts, or conduct the most basic life activities without approval from faceless bureaucrats.

Perhaps that's why, according to FIXS, the primary obstacle for a global ID system is political, not technical. "The cultural gap with the public in general is still too wide," says Dr. Mike Mestrovich, president of FIXS. "I think there would have to be a public consensus to move us in that direction and I don't see that happening until at least 2009 or beyond."

However, that public consensus isn't as far away as you might think. For instance, an opinion poll last month in Canada revealed that 72% of respondents would have "no problem" with the introduction of a national identification card which would include a person’s photograph and fingerprint.

Clearly, if we are to stop a global ID system, much less national ID systems, we must develop a global consensus against the idea. The Canadian opinion poll reveals we have a long way to go.

High-tech passports, no-fly lists, and other privacy intrusions have made private travel much more difficult than it once was. But it's still possible to travel privately—click here for more information.

Copyright © by Mark Nestmann