How to Create the Perfect Fake Identity (Bruce Schneier)
wired.com
wired.com
Your proposal is that the photograph constitute identity. This isn't valid anymore. It wasn't even valid in the pre Photoshop days.
Delinquency history. People screw up. I'm a big fan of forgiveness. At the same time, the state has an interest in knowing whether this is the first time you've been convicted of a crime of the 20th.
Self-protection. Yes, identity (can) protect you from the state as much as it protects the state from you. Without identity, the government could (conceivably) steal you away in the night. With identity, that becomes harder as your relatives have documents proving your existence.
Those are just a few cases. To address your issues: your name must be on your passport because while your home country may perceive you as no threat, another country might perceive you as a risk. Usually that's simply an issue of politics, but let's say that it's 2008 and you're an upstanding citizen so you just grab yourself a shiny new passport; 2009 comes and you rob a dozen banks; it's in the state's interest to be able to differentiate between your passport and the passports of others at all times and not simply make the ok/not ok determination at issuance. With driver's licenses, an SSN requirement prevents someone who lost their license due to several counts of drunk driving from simply applying for a new one under a new name - drunk drivers can pass the exam, but they still aren't people I'd like on the road.
For better or worse, we're becoming a dossier society. On the better side, people who shouldn't be able to escape their past have a harder time (drunk drivers can't just go to the RMV and pass a test). On the worse side, people can't escape their past even when it's not that important - and I would say that a lot of people create a lot of anxiety over the fact that they have such a dossier following them around.
Interviews can help, but it's only partial. Let's pretend to work in HR. We have a position open for a senior programmer with a generous salary. We get 100 applicants. Well, we could interview all 100 of them, but that would certainly take a long time. If we don't have credentials that we trust on any of them, the interview must be quite extensive. Microsoft's interviews last an entire day. So, in order to hire someone from this group, it takes 100 days of work (whether that's 1 person working for 100 days or 10 people working for 10 days, it's a lot of work). And that's basically just lost productivity. With salaries of $50,000/yr, we've spent roughly $20,000 to hire one person.
Now, let's say that we require a BS in Computer Science and we trust identity in out society (no impersonations). Maybe we can weed out many of them who are simply kiddies using Joomla. Beyond that, we could even discriminate by institution. MIT to the top of the pile please! And so on. . .
Identity allows us to trust the information we receive from other sources. When your buddy vouches that you're fun to one of his friends, that friend knows your buddy and accepts that premise. They don't need to test you - they've accepted the credential that your mutual friend has provided. Likewise, a degree from MIT in Computer Science vouches for you as a major league nerd. While an HR department should still challenge you in an interview, it can allow them to weed out those who have no one to vouch for them and allows for somewhat more relaxed testing.
Heck, I get most of my work based off my portfolio. If others can claim to be me, they are able to use the sites I've built as vouching for them.
In the long run, people who are forging are found out. Eventually, that person with the bogus CS degree doesn't know what they should know and they're out. But in the short run, there's a ton of waste. They're drawing a salary as they work slower and produce crappier code. If we are trying to be efficient, we want to eliminate that waste.
And funny you should mention it - when I got hired to Microsoft nobody asked for my ID (until the day they needed to send the stuff to the tax-man which is long after the job offer was signed). I'm pretty sure nothing chnaged since. So you see, it works well enough.
I can see the point for your portfolio, but this seems like more of a business trademark issue than personal identity issue.
Oh, man, we've got enough indefinite imprisonment without charges going on as it is. Please don't encourage it.
Once upon a time, people's "data shadows" were very thin indeed. In The Fatal Shore, a truly awesome history book about Australia, they talked about policing in Georgian England. The identification of criminals relied primarily on verbal descriptions of their looks:
Official crime records and registers of criminals were primitive, and there would be no fingerprinting until 1885. Artists made sketches, for popular consumption, of famous offenders... but one could no more recognize a felon from such semi-devotional effigies than pick St. Paul from a crowd by consulting a Byzantine icon. Identification of wanted men had to be made from verbal descriptions in the police gazettes, circulated to mayors and magistrates after the early 1770s... Sketchy as they were, such descriptions did produce some arrests, mainly in villages where people noticed strangers. Some officers of the law had long memories. Henry Fielding's sightless half-brother John, a magistrate known in Bow Street as the "Blind Beak," was said to be able to identify 3000 different malefactors by their voices alone. But on the whole, it was easier for criminals to escape scot-free in the 1780s than it would ever be again.
This meant that, once you had caught a suspected criminal, there was no way to release them temporarily without them disappearing, quite possibly forever. So a lot of crimes were punishable by fines (which could be collected on the spot), or by immediate imprisonment (which is what you got if you couldn't pay the fine), or by death. You couldn't really put people on probation, or parole, or release them on bail.
The result, in practice, was that every person who stole a loaf of bread risked indefinite imprisonment or even death. It was so inhumane (and so expensive -- there weren't enough jails) that the English legal system leapt at the opportunity to solve the problem in a novel way: Transport criminals to the colonies, where they would never bother homelanders again even when they were freed. Until 1776 the favorite colonial destination was the American colonies, but after that the English had to invent the Australian penal colonies...
How did they know that he was correctly identifying them?
<rimshot />
In all seriousness, though: Once they'd caught their suspect and thrown them in Newgate Prison, the authorities could always summon people from the suspect's hometown to ID them more precisely. In theory. In practice, that would surely have been very expensive and slow, and I have no idea how diligent they really were about all that pesky "legal procedure" stuff, particularly if the prisoner didn't have the money to hire a lawyer. Back then they charged prisoners for everything: you had to pay room and board in prison, so if you hadn't managed to hang onto your money (which was probably pretty difficult when you were being arrested by freelance thief-takers...) and you didn't have local friends to look you up in prison and help pay your bills, you could be stuck in there for life, like Charley on the MTA.
How do yo correctly identify someone by sight?
Everyone who can talk (and I would guess grunt or otherwise shake the vocal cords) has a voice signature. The difference in some might be minute, even undetectable by most people, but the difference is still there.
People who have lost their sight tend to pick up more on the other senses (unless there's some damage there too). Consider braille. Can you distinguish the different dots?
Well, assuming our society is radical enough to discard identity, I think we can fix the prison system. The first step is to rethink what "crimes" are. Smoking marijuanna is not a crime. Selling it is not a crime. We should reserve prison for people that have proven they can't be in the "normal society" anymore. That basically means murders, rapists, "real criminals".
The next step is to make prisons centers for removal from society, not a place where we throw "undesirables" and let them rot (like the current system). We should give people in prison freedom to have a job, freedom to buy things, etc. We shouldn't force someone to live in a 16 square foot concrete box with 3 other people for 25 years. That's torture, not rehabilitation. (Other countries do a much better job than the US in this respect -- so this isn't just pie-in-the-sky. It could work.)
So anyway, I'm idealizing, not suggesting a policy. If someone is a danger to society, it doesn't benefit society to give them an identity document. Unless they are completely stupid, they are just going to fake the document to get what they want. (Example in real life: college students. It's illegal for them to buy alcohol, but they want it anyway. So they just get a fake ID. Problem solved. But why make them criminals for this? Why not just let them buy the beer legally?)
And -this- mentality is what's disastrous to security planning. I hope people actually inside NatSec / InfoSec take a long-term view of things.
That way, the shadow can never really be separated from the person (or at least the difficulty increases). BTW, I recommend watching the movie Gattaca for an interesting take on identity theft of the future, when people are engineered and DNA is checked everywhere you go.
Because the thing is that modern western society doesn't want a system of identity to be perfect, we just want it to be good enough.
The reason for this is quite simply a history lesson. Every single time the controllers of identity are able to do it really well, the rest of us get royally screwed.
And when it's twelve o'clock We climb the stair We never knock For nobody's there
Nice try though.
Because no one's ever used a fake photo ID to, say, get into a bar.
How do you fake your photograph though?