Re: new ACLU Legislative Guidance

On Fri, Oct 11, 2024 at 4:36 PM Alan Karp <alanhkarp@gmail.com> wrote:
> Just to prove that I read the whole thing, I have a question about #9.

I'm chuckling at the notion that you need to prove anything to anyone. :P

> A “right to paper" talks about the widespread use of fakes.  The reported ages of the fraudsters makes me wonder what fraction of this use succeeds because the verifier simply doesn't care or actually benefits, such as at a club serving alcohol.  If enforcement of the law is lax, these venues benefit from the fraudulent use.

Yes, I do expect that there is some level of "looking the other way"
going on in certain market verticals, but not in the way you might
think. It's also true that enforcement waxes and wanes with politics.

I also expect that the statistic that you are looking for can't be
accurately measured. No retail operation in their right mind is going
to admit to looking the other way (if they do, and knowing some of the
owners at these stores, they have little incentive to look the other
way), and frankly, the clerks and bouncers at these places are given
clear instructions: if they admit someone that's underage, or
knowingly sell alcohol to a minor, they will be fired. So, there's a
bit of your suggestion that doesn't line up with the guidance and
fines. Law enforcement DO perform sting operations if they have
probable cause.

It is also true that the motivations of a club maximizing the number
of adults of drinking age look quite different from a marijuana
dispensary knowingly accepting a fake document. The former results in
a (depending on the jurisdiction) ~$2,500 per individual fine where-as
the latter shuts down the business. Additionally, the ramifications of
using a fake ID to board an airplane or open a line of credit are
quite different from entering a club and drinking. Like most problems
that seem simple on their surface, the realities are far more nuanced
and fascinating.

The real problem, IMHO, based on our experiences on ID checking in the
retail sector is that it is next to impossible to detect a fake ID
card through visual inspection these days. Fakes are trivial to
manufacture and purchase, expensive to verify, and thus enforcement
has become exceedingly difficult (and dangerous) in the average case.
Clerk: "I can't take this ID.", Customer: "What!? Why?! That's my
Driver's License!", Clerk: "It's a fake, it doesn't have the state
hologram in the top right.", Customer: "It's an old ID." ... and, at
this point, the clerk can't be sure if they're right or not...
especially if it's an ID from another state far away, which is usually
the case with fake IDs.

Also remember that there are additional burdens on our front-line
workers when performing enforcement for age verification; they are not
law enforcement officers, but are 20-something year olds making
minimum wage is the added danger of having a gun (in the US) or knife
pulled on them if they deny a sale due to rejecting a fake ID. Clerks
have been shot for denying sales:

Man who shot gas station clerk over denial of pack of cigarettes
convicted of murder
https://www.news-gazette.com/news/our_county/ford_county/man-who-shot-gas-station-clerk-over-denial-of-pack-of-cigarettes-convicted-of-murder/article_98dc1f4e-6252-55df-a15e-dc4eaf5be1c9.html

So, knowing that someone is using a fake ID is only part of the
problem, the other part of the problem is getting shot for catching a
fake ID. More on this below.

> What are the uses of such fakes that have actual victims?

High school kids in the US drive while intoxicated 2.4 million times a
month, auto accidents are the leading cause of death of teenagers, 25%
of those crashes involve an underage intoxicated driver. There are
many news stories that you can find by just googling some of the key
words in the previous sentence:

8 clerks arrested in crackdown on selling alcohol to minors following
death of Atascocita students
https://www.chron.com/neighborhood/atascocita/news/article/8-clerks-arrested-in-crackdown-on-selling-alcohol-13399764.php

Clerk arrested for selling alcohol to driver accused of killing family
on Halloween
https://lbpost.com/news/clerk-arrested-halloween-dui-awaida-navarro/

... and that's just the fatal injuries, the non-fatal ones, which are
more frequent, are equally disturbing.

> Are they widespread enough that such credentials will stop being accepted without something like VCB?

I don't see a future where they stop being accepted unless there is a
better alternative to switch to. We're in this situation because each
authority is doing what they're legally required to do, but the
systemic problem spans multiple authorities that need to act together,
but are not driven by the same incentives:

* The DMV's, and most notably their vendors, have not kept pace with
advances in document fraud. DMVs don't go out of business if their
identification cards are easy to duplicate. Verifiable Credential
Barcodes provide an open, patent and royalty-free way for them to keep
pace should they choose to adopt the technology.

* The organizations tasked with enforcing age verification, most
notably retail establishments selling age-gated product, have had no
economical affordable way of determining if a driver's license is
valid. Many state DMVs don't allow a retailer to check to see if a
driver's license is valid. The DMV's that do allow it, do it for a fee
that exceeds the profit on age-gated purchases. There is a correlation
between states that don't allow retailers to check and the number of
fake IDs being issued for those states. While "no phone home" is a
valid position to take (from a civil liberties perspective), the
consequence has been the inability for clerk's to use anything other
than their eyeballs to determine the validity of the license, which is
no longer a viable approach given how good fakes have become.

* The legislators don't have new viable technological solutions to
point to (though this is changing with Verifiable Credentials and
TruAge). Some of them are beholden to lobbying efforts and their
funding sources. Lowering the drinking age to 18 in the US is not
popular (anti-youth). Reducing age gated sales is not popular
(anti-business).

So, we have this situation where each authority is going: "We're doing
as much as we can."  because it's true from an authority vertical
perspective, but questionable from an ecosystem perspective. The
problem has not traditionally been approached in a holistic manner.

I do expect that there is a non-zero but unknown amount of willful
incompetence at play, but most of it is that it's just a far more
nuanced and complex problem than most people realize... driven largely
by the scale of the problem and the economics of the solutions. This
is why I often cringe at the "mDL/VCs are a solution to the 'proof of
age' problem". They're a part of the solution, sure, but the demos on
stage that we have seen over the years where someone just taps their
mDL to prove their age are just so misguided... all that does is just
shift the fraud to paper/physical credentials. The solution has to be
more holistic.

The "better option", at least from a detecting fraudulent documents
perspective, is what Verifiable Credential Barcodes can provide. IMHO,
here are the problems that need to be solved for the situation to
improve:

1. You need to be able to have some security feature that lets you
know that an issuer really issued the ID that you're looking at. A
paper verifiable credential with an issuer and digital signature can
achieve this and this is where Verifiable Credential Barcodes shine.

2. You need to have a mechanism that can detect ID cloning through
usage, but in a way that is privacy preserving. This is one of the
things the TruAge system provides.

3. You need to have a way that a clerk can deny a sale without having
a gun pulled on them. Being able to blame the automated kiosk for
requiring an ID, or not accepting an ID to complete the sale shifts
danger away from the clerks.

All of these things need to come together to make it possible to
address the problem, and if they are deployed, it'll be interesting to
see where the fraud shifts to next... social selling? online
order/delivery? Beer brewing kits? Powdered alcohol? You tighten one
security area up and the fraud will shift, usually quite quickly.

All that said, I expect the bigger driver of adoption of Verifiable
Credential Barcodes are going to be application to foundational
identity documents that combat things like financial crimes and
cross-border crimes.

-- manu

-- 
Manu Sporny - https://www.linkedin.com/in/manusporny/
Founder/CEO - Digital Bazaar, Inc.
https://www.digitalbazaar.com/

Received on Saturday, 12 October 2024 16:58:39 UTC