THE COMPANY SAYS IT SCANS 21 MILLION LICENSES A MONTH AT 20,000 COUNTERS — IT HAS CONFIRMED NOTHING ABOUT THE BREACH — THE MACHINE IS THE STORY, NOT THE LEAK
A dark web service called Nexus is selling driver's license scans. 153 million of them, from the United States and Canada, plus 10 million ID cards, 3 million travel documents and 579,000 medical cards. Not the numbers off the front. The front and the back, the infrared scan, the ultraviolet scan, the photograph, and a timestamp of the moment it was taken. Brian Krebs went looking for licenses belonging to people he knows and found nine of them. The timestamps lined up with days those people had rented a car. The FBI's New Orleans office has opened a case.
The operators say the images came out of IDScan.net. Hold that loosely, because the company has not confirmed it: “We are working urgently to validate that information and determine whether any unauthorized access occurred.” Krebs writes that the definitive source is still unestablished. Half of X spent this morning naming them anyway.
Here is the number that matters more than the breach, and it is the company's own, from its own marketing, not a hacker's boast. IDScan runs 21 million verifications a month across more than 20,000 locations. Hertz. FedEx. Target. Dispensaries.
Twenty-one million a month. That is not an accident rate. That is a production rate.
Say this particular story collapses tomorrow and nothing was ever taken. The machine still runs at 21 million scans a month. It ran at that rate last month. It will run at that rate next month. Every one of those images is sitting somewhere with a timestamp on it, and a face and a date of birth cannot be changed the way you change a password.
Now set it beside what happened to money this week. On Monday two men sued Tether in New York over $42.4 million it froze on an informal request from a Homeland Security agent. No warrant that day. The warrant arrived 112 days later.
One system copies your face twenty-one million times a month. The other can stop your money on a request and file the paperwork four months on. It is the same arrangement in two different rooms: prove who you are to a company you have never heard of, then trust it forever.
Bitcoin does not fix your driver's license, and anybody telling you it does is selling something. What it is, is the one thing you can hold where nobody scans anything and nobody has a switch. Fundamentalist.
The operators say the images came out of IDScan.net. Hold that loosely, because the company has not confirmed it: “We are working urgently to validate that information and determine whether any unauthorized access occurred.” Krebs writes that the definitive source is still unestablished. Half of X spent this morning naming them anyway.
Here is the number that matters more than the breach, and it is the company's own, from its own marketing, not a hacker's boast. IDScan runs 21 million verifications a month across more than 20,000 locations. Hertz. FedEx. Target. Dispensaries.
Twenty-one million a month. That is not an accident rate. That is a production rate.
Say this particular story collapses tomorrow and nothing was ever taken. The machine still runs at 21 million scans a month. It ran at that rate last month. It will run at that rate next month. Every one of those images is sitting somewhere with a timestamp on it, and a face and a date of birth cannot be changed the way you change a password.
Now set it beside what happened to money this week. On Monday two men sued Tether in New York over $42.4 million it froze on an informal request from a Homeland Security agent. No warrant that day. The warrant arrived 112 days later.
One system copies your face twenty-one million times a month. The other can stop your money on a request and file the paperwork four months on. It is the same arrangement in two different rooms: prove who you are to a company you have never heard of, then trust it forever.
Bitcoin does not fix your driver's license, and anybody telling you it does is selling something. What it is, is the one thing you can hold where nobody scans anything and nobody has a switch. Fundamentalist.
KREBSONSECURITY · Tue Sep 1 · + CYBERNEWS Wed Sep 2 for IDScan's own scale and its statement · FBI New Orleans · source of the data NOT confirmed · + BITCOIN.COM Wed Sep 3 on the reaction wave, incl. Zach Edwards of Infoblox: “There's never been a breach of driver's licenses at this scale'” — reaction only, no new facts