Bruce Schneier on the Security of ID Checks

Bruce Schneier is a cryptographer and the founder & CTO of Counterpane Internet Security. I came to know about him from one his earlier books, Applied Cryptography (I had an interest in cryptography at the time and I still do). In any case, I respect his viewpoints on security and cryptography.

I recently found an article written by Schneier for the San Francisco Chronicle on the false sense of security that ID cards can provide. I’ve never particularly felt an extra sense of security from having my ID checked all the time (airports and elsewhere) and Schneier put into words some reasoning behind that:

First, verifying that someone has a photo ID is a completely useless security measure. All the Sept. 11 terrorists had photo IDs. Some of the IDs were real. Some were fake. Some were real IDs in fake names, bought from a crooked DMV employee in Virginia for $1,000 each. Fake driver's licenses for all 50 states, good enough to fool anyone who isn’t paying close attention, are available on the Internet. Or if you don’t want to buy IDs online, just ask any teenager where to get a fake ID.

Harder-to-forge IDs only help marginally, because the problem is not making sure the ID is valid. This is the second myth of ID checks: that identification combined with profiling can be an indicator of intention. […]

In short, checking IDs doesn’t help much since they could be forged. And, even if an ID is too difficult to forge, confirming an identity doesn't automatically stop crimes — even if IDs are checked against a list of known “bad guys”, the Bad Organizations could still recruit minions that aren’t yet on any Bad Lists. Schneier’s reasoning makes sense to me, but something tells me we won’t be doing away with ID checks at airports any time soon ;).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.