I'm not myself today, or, manufacturing a new you

Over at Wired, Bruce Schneier has an interesting piece that starts by musing how a foreign intelligence agency could have entered the United States in the 1980s, created a crop of phony, but perfectly documented identities, and now have a "crop" of mature, but manufactured, lives for agents to don like a suit of clothes.

So far, it sounds like the plot for an espionage novel.

But he then goes on to make the interesting point that such a tactic is possible because the records we leave in filing cabinets and databases have become more important than our physical selves as evidence of who we "really" are.

The point isn't to create another movie plot threat, but to point out the central role that data has taken on in our lives. Previously, I've said that we all have a data shadow that follows us around, and that more and more institutions interact with our data shadows instead of with us. We only intersect with our data shadows once in a while -- when we apply for a driver's license or passport, for example -- and those interactions are authenticated by older, less-secure interactions. The rest of the world assumes that our photo IDs glue us to our data shadows, ignoring the rather flimsy connection between us and our plastic cards. (And, no, REAL-ID won't help.)

I think he's right and, for good and ill, this is the major weakness of the security state into which our country is being transformed.

Proof of identity, once upon a time, meant that credible people could vouch for your name, credentials and character. Personal contacts were important, as were letters of introduction and letters of credit.

These days, though, an identity check means squinting at a bad photograph on a piece of plastic and, maybe, making sure the data on thet piece of plastic squares with an entry in a database. In a few years, the check will also include matching thumbrints, retina scans and other biometric data.

But the check is only as reliable as the information in the database. If files get corrupted or deleted, you can't prove who you are. Of equal importance, bogus data, once in the database, is holy writ -- fully acceptable as "proof" that you are who you say you are.

Manufacturing false ID has long been a lucrative business, for every use from buying beer underage to allowing illegal immigrants to seek employment. Modern technology has put effective forgery within easy reach. But most such efforts produce nothing more than cards unconnected to matching entries in databases. As such they're relatively easy to bust.

Better IDs are those that are actually issued by the state based on false information. When I was in college I ahem knew people who altered their birth certificates and then applied for non-driving proof-of-age IDs from the Department of Motor Vehicles. Once issued, these were solid gold, since they could survive the most thorough check.There was no risk to using them and no risk to accepting them since, as far as the government was concerned, they were real. The fact that they essentially manufactured new identities that didn't square with reality was irrelevant. A new reality was created.

Not surprisingly, some government employees have learned that they can make a nice income on the side by selling their access to identification databases and creating entries that back official IDs under bogus names.

As the United States moves increasingly toward tracking movement, employment status, tax compliance and the like with government databases like E-Verify, the money to be made by corrupting or manufacturing data entries is going to soar. Who you are in the system will increasingly matter much more than who you are in your skin.

The coming security state may be more annoying and intrusive than any that has gone before. But it offers no guarantees that the people you're talking to are who they say they are. And because of its near-total faith in whatever data is retrieved by a computer, it may actually offer small opportunities for those who can exploit the system's weaknesses to carve out greater freedom than the state ever intended.