Mitigating the Risks from Identification-based Crime - Part 2
One of the most pressing risks is that governments less frequently know the persons to whom they issue means of identification (MOI). Governments trade off diligence for cost- savings and delivery of client centric services. Although governments strive to make the security features more complex, perhaps all they are successful in doing is inconveniencing honest people and in placing a more secure document in the wrong hands. No doubt this is an overstatement, but I hardly think that the existing screening procedures present a roadblock for the more sophisticated criminal, much less a terrorist.
A verbal trigger for risk managers in assessing the level of reliance to place in government issued MOI, in particular driver’s licences and other tokens, is the language used by issuers in describing their level of confidence in their own processes. Does the language reflect an understanding of what is accomplished through their intervention strategies? The following terminology aids in your analysis:
Authentication: The testimony of court-certified forensic document examiners, or in some cases, the manufacturer, that a document is genuine and unaltered.
Validation: The process of adding the legally attributed personal identifiers and document registration number to the surface of genuine identification blanks at the time of issue – the act of ‘bringing a genuine identification document blank into being’.
Verification: The process of confirming with identification issuers that a document was issued to a person with the personal identifiers and registration number provided.
Many issuers of MOI look to conducting data exchanges as a method to “authenticate” documents. At least one calls this process ‘trusted’ registration. What in fact they do is verify that a document was issued to a person with the same personal identifiers and document registration numbers provided. This does not mean that the document itself is authentic. Seizures are consistently made of stolen or forged blanks. Neither does it mean that the person bearing a genuine MOI is the person to who it was issued.
Identification documents and tokens are not needed for the vast majority of honest people. They will tell you who they are and where they live. A root cause to consumer-centered, credit-dependent crime is business reliance on centralized credit-rating services to determine who to provide loans, mortgages and consumer credit. Businesses less frequently personally know their customers, relying more frequently on government issued MOI in determining if people are who they say, which criminals have learned to exploit.
For would-be criminals forging MOI, there are two inter-dependent challenges. The first is stealing or manufacturing identification document blanks of significant quality to pass off as genuine. This is not a significant challenge.
In 2003, the United States General Accounting Office (GAO) used off-the-shelf, desk-top publishing software, commercially available printers and other manufacturing tools to create identification documents and tokens. The commercial value of this technology is now under US $20,000.
The GAO obtained driver’s licenses in eight states. They entered the US from Canada, the Caribbean, Mexico and federal government buildings using forged travel and identification documents. There was not a single case where a driver’s licence application was refused, where someone was turned away at the port-of-entry, or refused entry to an office building. In a few cases, minor discrepancies that were noted by state driver’s licence issuing outlets were not acted on.
The second challenge is the business of unlawfully acquiring legally attributed personal identifiers to be applied to stolen or forged document blanks to commit a wide variety of crimes from dead beat dads avoiding child support to terrorism. The most insidious are concealment crimes.
Given the public concern for the abuse of their personal identifiers and the results of the GAO study, it is clear that issuing and relying on MOI is lacking integrity and risk mitigation effectiveness from a crime and security perspective.
There is a need to distinguish identification-based as a crime genre. It involves the use of stolen MOI, or the unlawful acquisition and application of legally-attributed personal identifiers to counterfeit document blanks. Fictitious personal identifiers may be used in situations where the criminal knows there is no verification process.
Public perception about the scope of identification-based crime is limited to the literature and conventional wisdom surrounding ‘identity theft’. As the stuff of pop culture, at best, the term ‘identity theft’ ought to be limited to addressing public perception and issues on consumer-centered, financial crimes. This includes attacks to personal financial accounts, a variety of credit-dependent frauds that exploit consumer credit-worthiness [e.g. loan and mortgage fraud] and the theft/counterfeiting of access devices [credit and debit cards]. It is too late to turn the clock back on a term that has entered the public arena.
Risk managers should not get distracted by the confusion generated with the term ‘identity theft’. Theft crimes demand prevention and reduction strategies that are different to those of fraud. ‘Identity theft’ literature has a propensity to focus on crime control through personal guardianship – the consumer’s role in protecting their personal information.
Outside of a small circle of privacy advocacy groups, there is little research and literature on agency guardianship. Agency guardianship is about the role that governments and business must play in protecting vast amounts of personal information under their care and control. It is also about the issuing integrity of government MOI, and the level of diligence exercised in determining if means of identification are genuine, unaltered and in the hands of the person to whom they were issued.
Personal and agency guardianship do not address deception – an integral part of an identification-based crime.
There are two key elements to any identification-based crime – the technical mastery of forging the instruments and the human-centered mastery of deceit, such that suspicion is not aroused. Effective risk mitigation strategies ought to focus on the latter. The story – the biographical record behind a token, is far more valuable in rooting out deception than the token linearly supporting an identification document.
Means of identification are the instruments. The GAO study identifies that creating documents beyond the capacity of handlers to physically inspect for problems at a service counter is not a significant challenge. The physical detection of high-end forgeries is nearly impossible with the naked eye, particularly with the time constraints in our client-centric service delivery environment. The risk is compounded by a lack of experience and acumen among the junior, under skilled and under trained employees typically issuing and relying on MOI.
Anyone relying on means of identification must address three issues:
Any effective crime reduction strategy calls for creating more uncertainty for the perpetrator. Those skilled in rooting out deception trust their instincts first, then follow up on their hunches selectively with more thorough investigation. An astute interviewer will master the art of the open-ended question and then listen for deception in the structure of the document bearer’s language. The origin of this skill is in statement analysis.
Nothing is more of a gift to criminals than perfunctory, systematic MOI registration systems, staffed by disengaged employees. To reduce the risk exposures from identification-based crime, issuers and business users of MOI, must place more focus on, and improve ability in, their employees to root out deception. Technology will not aid in the case of a genuine identification document or token issued to, or temporarily in the hands of, the wrong person. Resolving identification-based crime is a human-centered challenge.
There is a general lack of enthusiasm and investment on the part of those issuing and relying on MOI to develop capacity in front-line staff to root out deception. Future risk mitigation strategies must be made more robust with empowerment strategies that place higher levels of trust and confidence in the intuition and judgment skills of document handlers screening applicants for services. They must have a conduit to quickly and quietly report suspicions un-be-known to the document bearer. Every time a criminal is turned away, he or she has been taught how to lie. They will share their experiences with others.
Consultants on mitigation strategies should design interventions into strategies that address mind-set and the business dilemma of balancing the natural tension between exercising higher levels of diligence, with the costs and the impact on delivery of client-centered services. Trusting intuition is not rocket science for police officers, nurses, lawyers, educators, entrepreneurs or anyone else who relies upon it in making on-the-spot, complex decisions. It requires a different way of thinking about the value placed in front-line service personnel.
Consulting and training support for these challenges should be practical, hands on, cost and risk mitigation effective. Valued, experienced people trained in the art of the open-ended question and listening for deception while handling MOI, develop a sixth sense when something in a person’s story, or the circumstances, just doesn’t fit into a recognizable pattern. This is the one element that a potential malfeasant cannot account for in their deception strategy. This is the most critical component in countering identification-based crime. It deserves the most attention, yet receives the least.