Tag Archives: driver's license

Reasonable Minds Vehemently Disagree On Three Biometric Implementation Choices

(Part of the biometric product marketing expert series)

There are a LOT of biometric companies out there.

The Prism Project’s home page at https://www.the-prism-project.com/, illustrating the Biometric Digital Identity Prism as of March 2024. From Acuity Market Intelligence and FindBiometrics.

With over 100 firms in the biometric industry, their offerings are going to naturally differ—even if all the firms are TRYING to copy each other and offer “me too” solutions.

Will Ferrell and Chad Smith, or maybe vice versa. Fair use. From https://www.billboard.com/music/music-news/will-ferrell-chad-smith-red-hot-benefit-chili-peppers-6898348/, originally from NBC.

I’ve worked for over a dozen biometric firms as an employee or independent contractor, and I’ve analyzed over 80 biometric firms in competitive intelligence exercises, so I’m well aware of the vast implementation differences between the biometric offerings.

Some of the implementation differences provoke vehement disagreements between biometric firms regarding which choice is correct. Yes, we FIGHT.

MMA stands for Messy Multibiometric Authentication. Public Domain, https://commons.wikimedia.org/w/index.php?curid=607428

Let’s look at three (out of many) of these implementation differences and see how they affect YOUR company’s content marketing efforts—whether you’re engaging in identity blog post writing, or some other content marketing activity.

The three biometric implementation choices

Firms that develop biometric solutions make (or should make) the following choices when implementing their solutions.

  1. Presentation attack detection. Assuming the solution incorporates presentation attack detection (liveness detection), or a way of detecting whether the presented biometric is real or a spoof, the firm must decide whether to use active or passive liveness detection.
  2. Age assurance. When choosing age assurance solutions that determine whether a person is old enough to access a product or service, the firm must decide whether or not age estimation is acceptable.
  3. Biometric modality. Finally, the firm must choose which biometric modalities to support. While there are a number of modality wars involving all the biometric modalities, this post is going to limit itself to the question of whether or not voice biometrics are acceptable.

I will address each of these questions in turn, highlighting the pros and cons of each implementation choice. After that, we’ll see how this affects your firm’s content marketing.

Choice 1: Active or passive liveness detection?

From https://www.nist.gov/news-events/news/2023/09/whats-wrong-picture-nist-face-analysis-program-helps-find-answers

Back in June 2023 I defined what a “presentation attack” is.

(I)nstead of capturing a true biometric from a person, the biometric sensor is fooled into capturing a fake biometric: an artificial finger, a face with a mask on it, or a face on a video screen (rather than a face of a live person).

This tomfoolery is called a “presentation attack” (becuase you’re attacking security with a fake presentation).

Then I talked about standards and testing.

From https://www.iso.org/standard/79520.html.

But the standards folks have developed ISO/IEC 30107-3:2023, Information technology — Biometric presentation attack detection — Part 3: Testing and reporting.

And an organization called iBeta is one of the testing facilities authorized to test in accordance with the standard and to determine whether a biometric reader can detect the “liveness” of a biometric sample.

(Friends, I’m not going to get into passive liveness and active liveness. That’s best saved for another day.)

Well…that day is today.

By Rawpixel.com – https://pxhere.com/en/photo/1456377, CC0, https://commons.wikimedia.org/w/index.php?curid=79549317

A balanced assessment

Now I could cite a firm using active liveness detection to say why it’s great, or I could cite a firm using passive liveness detection to say why it’s great. But perhaps the most balanced assessment comes from facia, which offers both types of liveness detection. How does facia define the two types of liveness detection?

Active liveness detection, as the name suggests, requires some sort of activity from the user. If a system is unable to detect liveness, it will ask the user to perform some specific actions such as nodding, blinking or any other facial movement. This allows the system to detect natural movements and separate it from a system trying to mimic a human being….

Passive liveness detection operates discreetly in the background, requiring no explicit action from the user. The system’s artificial intelligence continuously analyses facial movements, depth, texture, and other biometric indicators to detect an individual’s liveness.

Pros and cons

Briefly, the pros and cons of the two methods are as follows:

  • While active liveness detection offers robust protection, requires clear consent, and acts as a deterrent, it is hard to use, complex, and slow.
  • Passive liveness detection offers an enhanced user experience via ease of use and speed and is easier to integrate with other solutions, but it incorporates privacy concerns (passive liveness detection can be implemented without the user’s knowledge) and may not be used in high-risk situations.

So in truth the choice is up to each firm. I’ve worked with firms that used both liveness detection methods, and while I’ve spent most of my time with passive implementations, the active ones can work also.

A perfect wishy-washy statement that will get BOTH sides angry at me. (Except perhaps for companies like facia that use both.)

Choice 2: Age estimation, or no age estimation?

Designed by Freepik.

There are a lot of applications for age assurance, or knowing how old a person is. These include smoking tobacco or marijuana, buying firearms, driving a car, drinking alcohol, gambling, viewing adult content, using social media, or buying garden implements.

If you need to know a person’s age, you can ask them. Because people never lie.

Well, maybe they do. There are two better age assurance methods:

  • Age verification, where you obtain a person’s government-issued identity document with a confirmed birthdate, confirm that the identity document truly belongs to the person, and then simply check the date of birth on the identity document and determine whether the person is old enough to access the product or service.
  • Age estimation, where you don’t use a government-issued identity document and instead examine the face and estimate the person’s age.

I changed my mind on age estimation

I’ve gone back and forth on this. As I previously mentioned, my employment history includes time with a firm produces driver’s licenses for the majority of U.S. states. And back when that firm was providing my paycheck, I was financially incentivized to champion age verification based upon the driver’s licenses that my company (or occasionally some inferior company) produced.

But as age assurance applications moved into other areas such as social media use, a problem occurred since 13 year olds usually don’t have government IDs. A few of them may have passports or other government IDs, but none of them have driver’s licenses.

By Adrian Pingstone – Transferred from en.wikipedia, Public Domain, https://commons.wikimedia.org/w/index.php?curid=112727.

Pros and cons

But does age estimation work? I’m not sure if ANYONE has posted a non-biased view, so I’ll try to do so myself.

  • The pros of age estimation include its applicability to all ages including young people, its protection of privacy since it requires no information about the individual identity, and its ease of use since you don’t have to dig for your physical driver’s license or your mobile driver’s license—your face is already there.
  • The huge con of age estimation is that it is by definition an estimate. If I show a bartender my driver’s license before buying a beer, they will know whether I am 20 years and 364 days old and ineligible to purchase alcohol, or whether I am 21 years and 0 days old and eligible. Estimates aren’t that precise.

How precise is age estimation? We’ll find out soon, once NIST releases the results of its Face Analysis Technology Evaluation (FATE) Age Estimation & Verification test. The release of results is expected in early May.

Choice 3: Is voice an acceptable biometric modality?

From Sandeep Kumar, A. Sony, Rahul Hooda, Yashpal Singh, in Journal of Advances and Scholarly Researches in Allied Education | Multidisciplinary Academic Research, “Multimodal Biometric Authentication System for Automatic Certificate Generation.”

Fingerprints, palm prints, faces, irises, and everything up to gait. (And behavioral biometrics.) There are a lot of biometric modalities out there, and one that has been around for years is the voice biometric.

I’ve discussed this topic before, and the partial title of the post (“We’ll Survive Voice Spoofing”) gives away how I feel about the matter, but I’ll present both sides of the issue.

White House photo by Kimberlee Hewitt – whitehouse.gov, President George W. Bush and comedian Steve Bridges, Public Domain, https://commons.wikimedia.org/w/index.php?curid=3052515

No one can deny that voice spoofing exists and is effective, but many of the examples cited by the popular press are cases in which a HUMAN (rather than an ALGORITHM) was fooled by a deepfake voice. But voice recognition software can also be fooled.

(Incidentally, there is a difference between voice recognition and speech recognition. Voice recognition attempts to determine who a person is. Speech recognition attempts to determine what a person says.)

Finally facing my Waterloo

Take a study from the University of Waterloo, summarized here, that proclaims: “Computer scientists at the University of Waterloo have discovered a method of attack that can successfully bypass voice authentication security systems with up to a 99% success rate after only six tries.”

If you re-read that sentence, you will notice that it includes the words “up to.” Those words are significant if you actually read the article.

In a recent test against Amazon Connect’s voice authentication system, they achieved a 10 per cent success rate in one four-second attack, with this rate rising to over 40 per cent in less than thirty seconds. With some of the less sophisticated voice authentication systems they targeted, they achieved a 99 per cent success rate after six attempts.

Other voice spoofing studies

Similar to Gender Shades, the University of Waterloo study does not appear to have tested hundreds of voice recognition algorithms. But there are other studies.

  • The 2021 NIST Speaker Recognition Evaluation (PDF here) tested results from 15 teams, but this test was not specific to spoofing.
  • A test that was specific to spoofing was the ASVspoof 2021 test with 54 team participants, but the ASVspoof 2021 results are only accessible in abstract form, with no detailed results.
  • Another test, this one with results, is the SASV2022 challenge, with 23 valid submissions. Here are the top 10 performers and their error rates.
From https://sasv-challenge.github.io/challenge_results/.

You’ll note that the top performers don’t have error rates anywhere near the University of Waterloo’s 99 percent.

So some firms will argue that voice recognition can be spoofed and thus cannot be trusted, while other firms will argue that the best voice recognition algorithms are rarely fooled.

What does this mean for your company?

Obviously, different firms are going to respond to the three questions above in different ways.

  • For example, a firm that offers face biometrics but not voice biometrics will convey how voice is not a secure modality due to the ease of spoofing. “Do you want to lose tens of millions of dollars?”
  • A firm that offers voice biometrics but not face biometrics will emphasize its spoof detection capabilities (and cast shade on face spoofing). “We tested our algorithm against that voice fake that was in the news, and we detected the voice as a deepfake!”

There is no universal truth here, and the message your firm conveys depends upon your firm’s unique characteristics.

And those characteristics can change.

  • Once when I was working for a client, this firm had made a particular choice with one of these three questions. Therefore, when I was writing for the client, I wrote in a way that argued the client’s position.
  • After I stopped working for this particular client, the client’s position changed and the firm adopted the opposite view of the question.
  • Therefore I had to message the client and say, “Hey, remember that piece I wrote for you that said this? Well, you’d better edit it, now that you’ve changed your mind on the question…”

Bear this in mind as you create your blog, white paper, case study, or other identity/biometric content, or have someone like the biometric content marketing expert Bredemarket work with you to create your content. There are people who sincerely hold the opposite belief of your firm…but your firm needs to argue that those people are, um, misinformed.

Drive content results with Bredemarket Identity Firm Services.

And as a postscript I’ll provide two videos that feature voices. The first is for those who detected my reference to the ABBA song “Waterloo.”

From https://www.youtube.com/watch?v=4XJBNJ2wq0Y.

The second features the late Steve Bridges as President George W. Bush at the White House Correspondents Dinner.

From https://www.youtube.com/watch?v=u5DpKjlgoP4.

Take Me to the (Login.gov IAL2) Pilot

From https://imgflip.com/memegenerator/Pepperidge-Farm-Remembers.

As further proof that I am celebrating, rather than hiding, my “seasoned” experience—and you know what the code word “seasoned” means—I am entitling this blog post “Take Me to the Pilot.”

Although I’m thinking about a different type of “pilot”—a pilot to establish that Login.gov can satisfy Identity Assurance Level 2 (IAL2).

From https://pages.nist.gov/800-63-3/sp800-63a.html#sec2.

A recap of Login.gov and IAL2-non compliance

I just mentioned IAL2 in a blog post on Wednesday, with this seemingly throwaway sentence.

So if you think you can use Login.gov to access a porn website, think again.

From https://bredemarket.com/2024/04/10/age-assurance-meets-identity-assurance-level-2/.

The link in that sentence directs the kind reader to a post I wrote in November 2023, detailing that fact that the GSA Inspector General criticized…the GSA…for implying that Login.gov was IAL2-compliant when it was not. The November post references a GSA-authored August blog post which reads in part (in bold):

Login.gov is on a path to providing an IAL2-compliant identity verification service to its customers in a responsible, equitable way.

From https://www.gsa.gov/blog/2023/08/18/reducing-fraud-and-increasing-access-drives-record-adoption-and-usage-of-logingov.

Because it obviously wouldn’t be good to do it in an irresponsible inequitable way.

But the GSA didn’t say how long that path would be. Would Login.gov be IAL2-compliant by the end of 2023? By mid 2024?

It turns out the answer is neither.

Eight months later we have…a pilot

You would think that achieving IAL2 compliance would be a top priority. After all, the longer that Login.gov doesn’t comply, the more government agencies that will flock to IAL2-compliant ID.me.

Enter Steve Craig of PEAK.IDV and the weekly news summaries that he posts on LinkedIn. Today’s summary includes the following item:

4/ GSA’s Login.gov Pilots Enhanced Identity Verification

Login.gov’s pilot will allow users to match a live selfie with the photo on a self-supplied form of photo ID, such as a driver’s license

Other interesting updates in the press release 👇

From https://www.linkedin.com/posts/stevenbcraig_digitalidentity-aml-compliance-activity-7184539504504930306-LVPF/.
From https://www.gsa.gov/about-us/newsroom/news-releases/general-services-administrations-logingov-pilot-04112024#.

And here’s what GSA’s April 11 press release says.

Specifically, over the next few months, Login.gov will:

Pilot facial matching technology consistent with the National Institute of Standards and Technology’s Digital Identity Guidelines (800-63-3) to achieve evidence-based remote identity verification at the IAL2 level….

Using proven facial matching technology, Login.gov’s pilot will allow users to match a live selfie with the photo on a self-supplied form of photo ID, such as a driver’s license. Login.gov will not allow these images to be used for any purpose other than verifying identity, an approach which reflects Login.gov’s longstanding commitment to ensuring the privacy of its users. This pilot is slated to start in May with a handful of existing agency-partners who have expressed interest, with the pilot expanding to additional partners over the summer. GSA will simultaneously seek an independent third party assessment (Kantara) of IAL2 compliance, which GSA expects will be completed later this year. 

From https://www.gsa.gov/about-us/newsroom/news-releases/general-services-administrations-logingov-pilot-04112024#.

In short, GSA’s April 11 press release about the Login.gov pilot says that it expects to complete IAL2 compliance later this year. So it’s going to take more than a year for the GSA to repair the gap that its Inspector General identified.

My seasoned response

Once I saw Steve’s update this morning, I felt it sufficiently important to share the news among Bredemarket’s various social channels.

With a picture.

B-side of Elton John “Your Song” single issued 1970.

For those of you who are not as “seasoned” as I am, the picture depicts the B-side of a 1970 vinyl 7″ single (not a compact disc) from Elton John, taken from the album that broke Elton in the United States. (Not literally; that would come a few years later.)

By the way, while the original orchestrated studio version is great, the November 1970 live version with just the Elton John – Dee Murray – Nigel Olsson trio is OUTSTANDING.

From https://www.youtube.com/watch?v=cC1ocO0pVgs.

Back to Bredemarket social media. If you go to my Instagram post on this topic, I was able to incorporate an audio snippet from “Take Me to the Pilot” (studio version) into the post. (You may have to go to the Instagram post to actually hear the audio.)

Not that the song has anything to do with identity verification using government ID documents paired with facial recognition. Or maybe it does; Elton John doesn’t know what the song means, and even lyricist Bernie Taupin doesn’t know what the song means.

So from now on I’m going to say that “Take Me to the Pilot” documents future efforts toward IAL2 compliance. Although frankly the lyrics sound like they describe a successful iris spoofing attempt.

Through a glass eye, your throne
Is the one danger zone

From https://genius.com/Elton-john-take-me-to-the-pilot-lyrics.

Postscript

For you young whippersnappers who don’t understand why the opening image mentioned “54 Years On,” this is a reference to another Elton John song.

And it’s no surprise that the live version is better.

From https://www.youtube.com/watch?v=rRngmF-AcFQ.

Now I’m going to listen to this all day. Cue the Instagram post (if Instagram has access to the 17-11-70/11-17-70 version).

Age Assurance Meets Identity Assurance (Level 2)

I’ve talked about age verification and age estimation here and elsewhere. And I’ve also talked about Identity Assurance Level 2. But I’ve never discussed both simultaneously until now.

I belatedly read this March 2024 article that describes Georgia’s proposed bill to regulate access to material deemed harmful to minors.

A minor in Georgia (named Jimmy Carter) in the 1920s, before computers allowed access to adult material. From National Park Service, https://www.nps.gov/jica/learn/historyculture/early-life.htm.

The Georgia bill explicitly mentions Identity Assurance Level 2.

Under the bill, the age verification methods would have to meet or exceed the National Institute of Standards and Technology’s Identity Assurance Level 2 standard.

So if you think you can use Login.gov to access a porn website, think again.

There’s also a mention of mobile driver’s licenses, albeit without a corresponding mention of the ISO/IEC 18013-5:2021.

Specifically mentioned in the bill text is “digitized identification cards,” described as “a data file available on a mobile device with connectivity to the internet that contains all of the data elements visible on the face and back of a driver’s license or identification card.”

So digital identity is becoming more important for online access, as long as certain standards are met.

What is B2B Writing?

Business-to-business (B2B) writing isn’t as complex as some people say it is. It may be hard, but it’s not complex.

Why do I care about what B2B writing is?

Neil Patel (or, more accurately, his Ubersuggest service) um, suggested that I say something about B2B writing.

From https://app.neilpatel.com/.

And then he (or it) suggested that I use generative artificial intelligence (AI) to write the piece.

From https://app.neilpatel.com/.

I had a feeling the result was going to suck, but I clicked the “Write For Me” button anyway.

From https://app.neilpatel.com/.

Um, thanks but no thanks. When the first sentence doesn’t even bother to define the acronym “B2B,” you know the content isn’t useful to explain the topic “what is B2B writing.”

And this, my friends, is why I never let generative AI write the first draft of a piece.

So, what IS B2B writing?

Before I explain what B2B writing is, maybe I’d better explain what “B2B” is. And two related acronyms.

  • B2B stands for business to business. Bredemarket, for example, is a business that sells to other businesses. In my case, marketing and writing services.
  • B2G stands for business to government. Kinda sorta like B2B, but government folks are a little different. For example, these folks mourned the death of Mike Causey. (I lived outside of Washington DC early in Causey’s career. He was a big deal.) A B2G company, for example, could sell driver’s license products and services to state motor vehicle agencies.
  • B2C stands for business to consumer. Many businesses create products and services that are intended for consumers and marketed directly to them, not to intermediate businesses. Promotion of a fast food sandwich is an example of a B2C marketing effort.

I included the “B2G” acronym because most of my years in identity and biometrics were devoted to local, state, federal, and international government sales. My B2G experience is much deeper than my B2B experience, and way deeper than my B2C expertise.

Let’s NOT make this complicated

I’m sure that Ubersuggest could spin out a whole bunch of long-winded paragraphs that explain the critical differences between the three marketing efforts above. But let’s keep it simple and limit ourselves to two truths and no lies.

TRUTH ONE: When you market B2B or B2G products or services, you have FEWER customers than when you market B2C products or services.

That’s pretty much it in terms of differences. I’ll give you an example.

  • If Bredemarket promoted its marketing and writing services to all of the identity verification companies, I would target less than 200 customers.
  • If IDEMIA or Thales or GET Group or CBN promoted their driver’s license products and services to all of the state, provincial, and territorial motor vehicle agencies in the United States and Canada, they would target less than 100 customers.
  • If McDonald’s resurrects and promotes its McRib sandwich, it would target hundreds of millions of customers in the United States alone.
From https://www.mcdonalds.com/us/en-us/product/mcrib.html.

The sheer scale of B2C marketing vs. B2B/B2G marketing is tremendous and affects how the company markets its products and services.

But one thing is similar among all three types of writing.

TRUTH TWO: B2B writing, B2G writing, and B2C writing are all addressed to PEOPLE.

Well, until we program the bots to read stuff for us.

This is something we often forget. We think that we are addressing a blog post or a proposal to an impersonal “company.” Um, who works in companies? People.

(Again, until we program the bots.)

Whether you’re marketing a business blog post writing service, a government software system, or a pseudo rib sandwich, you’re pitching it to a person. A person with problems and needs that you can potentially solve.

So solve their needs.

Don’t make it complex.

But what IS B2B writing?

Let’s return to the original question. Sorry, I got off on a bit of a tangent. (But at least I didn’t trail off into musings about “the dynamic and competitive world.”)

When I write something for a business:

  • I must focus on that business and not myself (customer focus). The business doesn’t want to hear my talk about myself. The business wants to hear what I can do for it.
  • I must acknowledge the business’ needs and explain the benefits of my solution to meet the business needs. A feature list without any benefits is just a list of cool things; you still have to explain how the cool things will benefit the business by solving its problem.
  • My writing must address one, or more, different types of people who are hungry for my solution to their problem. (This is what Ubersuggest and others call a “target audience,” because I guess Ubersuggest aims lasers at the assembled anonymous crowd.)
From https://www.hinklefuncenter.com/attractions/laser-tag/.

Again, this is hard, but not complex.

It’s possible to make this MUCH MORE complex and create a 96 step plan to author B2B content.

But why?

So now I’ve answered the question “What is B2B writing?”

Can Bredemarket write for your business? If so, contact me.

How to Vote Fraudulently in a Voter ID State

No, I shouldn’t be revealing this information, but if it helps to illustrate how weak so-called “voter ID” law enforcement is, so be it.

Voter ID States

The National Conference of State Legislatures (NCSL) has identified 36 states that presently have some type of “voter ID” requirement, in which the strictest states require a government-issued photo ID.

And this number is increasing. In June, Nebraska approved Legislative Bill 514 which implements voter ID requirements for Nebraska elections beginning in May 2024. Nebraska will be a “strict” voter ID state.

As the NCSL states:

Proponents argue increasing identification requirements can prevent in-person voter impersonation and increase public confidence in the election process. 

From https://www.ncsl.org/elections-and-campaigns/voter-id

The exact IDs that are required vary from state to state, but all states accept a state-issued driver’s license or other state ID (REAL ID or not) as an acceptable form of identification for voting.

Sounds great, right?

But there’s a problem.

Making and detecting fake IDs

    I hope you’re sitting down for this.

    People create fake driver’s licenses.

    This wouldn’t be mistaken for a real driver’s license. At least I hope not. But other fake driver’s licenses are more sophisticated. From https://www.etsy.com/listing/1511398513/editable-little-drivers-license

    These range from the novelty types of driver’s licenses pictured above to ones that are more sophisticated.

    From https://www.youtube.com/watch?v=pYciy7UL2Cc

    Of course, there are ways to detect fake driver’s licenses.

    Transportation Security Administration Checkpoint at John Glenn Columbus International Airport. By Michael Ball – Own work, CC0, https://commons.wikimedia.org/w/index.php?curid=77279000
    • When you present your ID to a Transportation Security Agency official, they place the ID in a specialized machine which, among other things, can detect forgeries.
    • And if you win money at a Las Vegas casino, they will check your ID also before paying out (as an underage friend of mine learned the hard way).

    How can YOU detect a fake ID? Well, you can buy a book such as the “I.D. Checking Guide” or similar reference and compare the presented ID to the examples in the book.

    There are more robust ways to detect a fake ID. Nametag has five suggestions:

    1. Check the hologram. You can do this without using any special tools, so it’s an easy way to spot a fake ID…unless the fraudster has placed a hologram on their document.
    2. Check for tampering. Sometimes this is obvious to the naked eye, sometimes not so obvious. For example, a fraudster may have clumsily pasted another photo on top of the real photo. But maybe the tampering isn’t so obvious.
    3. Inspect the microprint. You’ll need a magnifying glass for this, but if you know what to look for, you can spot fraudulent IDs…unless the fraudster also added the appropriate microprinting to their document.
    4. Look for ultraviolet (UV) features. You’ll need a UV light for this, but again this can reveal forgeries…unless the fraudster also incorporated UV features into their document.
    5. Use Nametag products. These (and similar products from other companies such as Regula) can check for fraud that the untrained eye cannot detect.

    These fraud detection techniques are great if you work for the TSA or a casino full-time and have the appropriate training and equipment to detect fake IDs.

    Enter the untrained, unequipped fraud guardians

    But what about precinct workers?

    They work one or maybe a few days a year, and it’s very doubtful that the elections authorities:

    • Train and test precinct workers in the detection of fraudulent IDs.
    • Provide precinct workers with reference materials, magnifiying glasses, ultraviolet lights, or automated hardware and software to detect fraudulent IDs.

    If the precinct workers don’t have the training, equipment, and software, Phineas T. Bailey could walk up to a local precinct, show a fake ID saying that he is Joe Real, and if Joe Real is registered to vote in that precinct, Phineas can go ahead and vote.

    From https://www.nist.gov/news-events/news/2023/09/whats-wrong-picture-nist-face-analysis-program-helps-find-answers

    Some security.

    But no one would ever vote with a fake ID…would they?

    “But John,” you say. “No one would ever create a fake ID and use it to vote.”

    Well, let’s look at this ID.

    John Wahl’s Regional Press Secretary identification. From https://www.al.com/news/2022/10/alabama-gop-chairman-made-the-photo-id-he-used-to-vote.html

    On at least two occasions, John Wahl presented the ID above when voting.

    When poll workers asked Alabama GOP Chairman John Wahl for his voter ID, he gave them a card they’d never seen before. He texted this picture of it to the Limestone County Probate judge, who then approved him to vote.

    From https://www.al.com/news/2022/10/alabama-gop-chairman-made-the-photo-id-he-used-to-vote.html

    However, it was subsequently discovered that Wahl made the ID himself.

    (Why? Because Wahl and other members of his family object to biometric identification for religious reasons. Rather than submitting to the standard biometric identification processes used to create driver’s licenses and other government forms of identification, Wahl simply had an unnamed third party create his own ID, with the knowledge of the State Auditor.)

    This incident ended up being a little embarrassing…because John Wahl happens to head the Alabama Republican Party (as of December 2023).

    So how do you fix it?

    If you’re going to insist that people present legitimate IDs for voting, then you need to enforce it, both for people who present IDs in person and for people who present IDs remotely. There are a number of companies that provide hardware and software to verify the legitimacy of driver’s licenses and other government-issued documents.

    Of course, that costs money. Depending upon the solution you choose, it could cost tens or hundreds of millions of dollars to protect the more than 230,000 polling places from identity fraud.

    And some argue that there’s no need to spend a lot of money on this, because voting fraud isn’t a real problem. Even the Heritage Foundation’s 2020 report of “1,285 proven cases of voter fraud” looks a little less dramatic when you consider that there were 161,420,000 registered voters in the United States in 2022. So even if there were, let’s say, 11,000 proven cases of voter fraud, that’s only 0.007% of the total electorate.

    But for now, if you want to vote fraudulently, vote away.

    The Imperfect Way to Enforce New York’s Child Data Protection Act

    It’s often good to use emotion in your marketing.

    For example, when biometric companies want to justify the use of their technology, they have found that it is very effective to position biometrics as a way to combat sex trafficking.

    Similarly, moves to rein in social media are positioned as a way to preserve mental health.

    By Marc NL at English Wikipedia – Transferred from en.wikipedia to Commons., Public Domain, https://commons.wikimedia.org/w/index.php?curid=2747237

    Now that’s a not-so-pretty picture, but it effectively speaks to emotions.

    “If poor vulnerable children are exposed to addictive, uncontrolled social media, YOUR child may end up in a straitjacket!”

    In New York state, four government officials have declared that the ONLY way to preserve the mental health of underage social media users is via two bills, one of which is the “New York Child Data Protection Act.”

    But there is a challenge to enforce ALL of the bill’s provisions…and only one way to solve it. An imperfect way—age estimation.

    This post only briefly addresses the alleged mental health issues of social media before plunging into one of the two proposed bills to solve the problem. It then examines a potentially unenforceable part of the bill and a possible solution.

    Does social media make children sick?

    Letitia “Tish” James is the 67th Attorney General for the state of New York. From https://ag.ny.gov/about/meet-letitia-james

    On October 11, a host of New York State government officials, led by New York State Attorney General Letitia James, jointly issued a release with the title “Attorney General James, Governor Hochul, Senator Gounardes, and Assemblymember Rozic Take Action to Protect Children Online.”

    Because they want to protect the poor vulnerable children.

    By Paolo Monti – Available in the BEIC digital library and uploaded in partnership with BEIC Foundation.The image comes from the Fondo Paolo Monti, owned by BEIC and located in the Civico Archivio Fotografico of Milan., CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=48057924

    And because the major U.S. social media companies are headquartered in California. But I digress.

    So why do they say that children need protection?

    Recent research has shown devastating mental health effects associated with children and young adults’ social media use, including increased rates of depression, anxiety, suicidal ideation, and self-harm. The advent of dangerous, viral ‘challenges’ being promoted through social media has further endangered children and young adults.

    From https://ag.ny.gov/child-online-safety

    Of course one can also argue that social media is harmful to adults, but the New Yorkers aren’t going to go that far.

    So they are just going to protect the poor vulnerable children.

    CC BY-SA 4.0.

    This post isn’t going to deeply analyze one of the two bills the quartet have championed, but I will briefly mention that bill now.

    • The “Stop Addictive Feeds Exploitation (SAFE) for Kids Act” (S7694/A8148) defines “addictive feeds” as those that are arranged by a social media platform’s algorithm to maximize the platform’s use.
    • Those of us who are flat-out elderly vaguely recall that this replaced the former “chronological feed” in which the most recent content appeared first, and you had to scroll down to see that really cool post from two days ago. New York wants the chronological feed to be the default for social media users under 18.
    • The bill also proposes to limit under 18 access to social media without parental consent, especially between midnight and 6:00 am.
    • And those who love Illinois BIPA will be pleased to know that the bill allows parents (and their lawyers) to sue for damages.

    Previous efforts to control underage use of social media have faced legal scrutinity, but since Attorney General James has sworn to uphold the U.S. Constitution, presumably she has thought about all this.

    Enough about SAFE for Kids. Let’s look at the other bill.

    The New York Child Data Protection Act

    The second bill, and the one that concerns me, is the “New York Child Data Protection Act” (S7695/A8149). Here is how the quartet describes how this bill will protect the poor vulnerable children.

    CC BY-SA 4.0.

    With few privacy protections in place for minors online, children are vulnerable to having their location and other personal data tracked and shared with third parties. To protect children’s privacy, the New York Child Data Protection Act will prohibit all online sites from collecting, using, sharing, or selling personal data of anyone under the age of 18 for the purposes of advertising, unless they receive informed consent or unless doing so is strictly necessary for the purpose of the website. For users under 13, this informed consent must come from a parent.

    From https://ag.ny.gov/child-online-safety

    And again, this bill provides a BIPA-like mechanism for parents or guardians (and their lawyers) to sue for damages.

    But let’s dig into the details. With apologies to the New York State Assembly, I’m going to dig into the Senate version of the bill (S7695). Bear in mind that this bill could be amended after I post this, and some of the portions that I cite could change.

    From https://www.nysenate.gov/legislation/bills/2023/S7695

    The “definitions” section of the bill includes the following:

    “MINOR” SHALL MEAN A NATURAL PERSON UNDER THE AGE OF EIGHTEEN.

    From https://www.nysenate.gov/legislation/bills/2023/S7695, § 899-EE, 2.

    This only applies to natural persons. So the bots are safe, regardless of age.

    Speaking of age, the age of 18 isn’t the only age referenced in the bill. Here’s a part of the “privacy protection by default” section:

    § 899-FF. PRIVACY PROTECTION BY DEFAULT.

    1. EXCEPT AS PROVIDED FOR IN SUBDIVISION SIX OF THIS SECTION AND SECTION EIGHT HUNDRED NINETY-NINE-JJ OF THIS ARTICLE, AN OPERATOR SHALL NOT PROCESS, OR ALLOW A THIRD PARTY TO PROCESS, THE PERSONAL DATA OF A COVERED USER COLLECTED THROUGH THE USE OF A WEBSITE, ONLINE SERVICE, ONLINE APPLICATION, MOBILE APPLICA- TION, OR CONNECTED DEVICE UNLESS AND TO THE EXTENT:

    (A) THE COVERED USER IS TWELVE YEARS OF AGE OR YOUNGER AND PROCESSING IS PERMITTED UNDER 15 U.S.C. § 6502 AND ITS IMPLEMENTING REGULATIONS; OR

    (B) THE COVERED USER IS THIRTEEN YEARS OF AGE OR OLDER AND PROCESSING IS STRICTLY NECESSARY FOR AN ACTIVITY SET FORTH IN SUBDIVISION TWO OF THIS SECTION, OR INFORMED CONSENT HAS BEEN OBTAINED AS SET FORTH IN SUBDIVISION THREE OF THIS SECTION.

    From https://www.nysenate.gov/legislation/bills/2023/S7695

    So a lot of this bill depends upon whether a person is over or under the age of eighteen, or over or under the age of thirteen.

    And that’s a problem.

    How old are you?

    The bill needs to know whether or not a person is 18 years old. And I don’t think the quartet will be satisfied with the way that alcohol websites determine whether someone is 21 years old.

    From https://www.budlight.com/

    This age verification method is…not that robust.

    Attorney General James and the others would presumably prefer that the social media companies verify ages with a government-issued ID such as a state driver’s license, a state identification card, or a national passport. This is how most entities verify ages when they have to satisfy legal requirements.

    For some people, even some minors, this is not that much of a problem. Anyone who wants to drive in New York State must have a driver’s license, and you have to be at least 16 years old to get a driver’s license. Admittedly some people in the city never bother to get a driver’s license, but at some point these people will probably get a state ID card.

    You don’t need a driver’s license to ride the New York City subway, but if the guitarist wants to open a bank account for his cash it would help him prove his financial identity. By David Shankbone – Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=2639495
    • However, there are going to be some 17 year olds who don’t have a driver’s license, government ID or passport.
    • And some 16 year olds.
    • And once you look at younger people—15 year olds, 14 year olds, 13 year olds, 12 year olds—the chances of them having a government-issued identification document are much less.

    What are these people supposed to do? Provide a birth certificate? And how will the social media companies know if the birth certificate is legitimate?

    Birth certificate of a B.H. Obama II. From https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/birth-certificate-long-form.pdf

    But there’s another way to determine ages—age estimation.

    How old are you, part 2

    As long-time readers of the Bredemarket blog know, I have struggled with the issue of age verification, especially for people who do not have driver’s licenses or other government identification. Age estimation in the absence of a government ID is still an inexact science, as even Yoti has stated.

    Our technology is accurate for 6 to 12 year olds, with a mean absolute error (MAE) of 1.3 years, and of 1.4 years for 13 to 17 year olds. These are the two age ranges regulators focus upon to ensure that under 13s and 18s do not have access to age restricted goods and services.

    From https://www.yoti.com/wp-content/uploads/Yoti-Age-Estimation-White-Paper-March-2023.pdf

    So if a minor does not have a government ID, and the social media firm has to use age estimation to determine a minor’s age for purposes of the New York Child Data Protection Act, the following two scenarios are possible:

    • An 11 year old may be incorrectly allowed to give informed consent for purposes of the Act.
    • A 14 year old may be incorrectly denied the ability to give informed consent for purposes of the Act.

    Is age estimation “good enough for government work”?

    LLM vs. LMM (Acronyms Are Fun)

    Document processing with GPT-4V. The model’s mistake is highlighted in red. From https://huyenchip.com/2023/10/10/multimodal.html?utm_source=tldrai

    I just ran across a use of “multimodal” that has nothing to do with fingers, faces, or irises. But it has everything to do with generative AI.

    Earlier this week, Chip Huyen published “Multimodality and Large Multimodal Models (LMMs)” at his website huyenchip.com. He starts as follows:

    For a long time, each ML (machine learning) model operated in one data mode – text (translation, language modeling), image (object detection, image classification), or audio (speech recognition).

    However, natural intelligence is not limited to just a single modality. Humans can read and write text. We can see images and watch videos. We listen to music to relax and watch out for strange noises to detect danger. Being able to work with multimodal data is essential for us or any AI to operate in the real world.

    From https://huyenchip.com/2023/10/10/multimodal.html?utm_source=tldrai

    As you can see from the title, Huyen uses an acronym “LMM” that is very similar to another generative AI acronym, “LLM” (large language model).

    So what’s the difference?

    Not all multimodal systems are LMMs. For example, text-to-image models like Midjourney, Stable Diffusion, and Dall-E are multimodal but don’t have a language model component.

    From https://huyenchip.com/2023/10/10/multimodal.html?utm_source=tldrai

    If you’re interested in delving into the topic, Huyen’s long three-part post covers the context for multimodality, the fundamentals of a multimodal system, and active research areas.

    You can find the post at https://huyenchip.com/2023/10/10/multimodal.html?utm_source=tldrai. And I guess you can figure out how I came across it.

    Android mobile driver’s licenses? It’s complicated.

    At least in the United States, the mobile driver’s license world is fragmented.

    Because driver’s license issuance in the U.S. is a state and not a federal responsibility, each state has to develop its own mobile driver’s license implementation. Subject to federal and international standards, of course.

    To date there have been two parties helping the states with this:

    • mDL vendors such as Envoc and IDEMIA, who work with the states to create mDLs.
    • Operating system vendors such as Apple and Google, who work with the states to incorporate mDLs in smartphone wallets.

    But because the Android ecosystem is more fragmented than the iOS ecosystem, we now have a third party that is involved in mDLs. In addition to mDL vendors and operating system vendors, we also have really large smartphone providers.

    From https://news.samsung.com/us/samsung-idemia-bring-mobile-drivers-licenses-samsung-wallet-arizona-iowa-first-states-rollout/

    Enter Samsung:

    Samsung Electronics America today announced it is bringing mobile driver’s licenses and state IDs to Samsung Wallet. Arizona and Iowa will be the first states to offer a mobile version of its driver’s license to their residents. The update expands the Samsung Wallet experience by adding a convenient and secure way to use state-issued IDs and driver’s licenses

    From https://news.samsung.com/us/samsung-idemia-bring-mobile-drivers-licenses-samsung-wallet-arizona-iowa-first-states-rollout/

    (For those who have seen prior references to Samsung in the Bredemarket blog, rest assured that this information is public and Samsung won’t get harmed if you feed it to ChatGPT or Bard or whoever.)

    In this particular case Samsung is working with IDEMIA (the mDL provider for Arizona and Iowa), but Samsung announced that it is working with other states and with the Transportation Security Administration (TSA).

    While there are underlying standards (most notably ISO/IEC 18013-5, previously discussed here) that govern the implementation of mobile driver’s licenses, there is still a dizzying array of options.

    From https://www.yourtango.com/201168184/facebook-relationship-status-what-does-its-complicated-mean

    On a personal note, I’m still working on validating my driver’s license for California’s pilot mDL program. It probably didn’t help that I renewed my physical driver’s license right in the middle of the mDL validation process.

    The Secret to Beating Half of All Fortune 500 Marketers and Growing Your Business

    (Updated blog post count 10/23/2023)

    Always take advantage of your competitors’ weaknesses.

    This post describes an easy way to take advantage of your competitors. If they’re not blogging, make sure your firm is blogging. And the post provides hard numbers that demonstrate why your firm should be blogging.

    Who uses blogging?

    According to an infographic using 2017 data, 50% of the top 200 Fortune 500 companies had a public corporate blog.

    Excerpt from the infographic at https://www.dailyinfographic.com/state-of-blogging-industry, cited by https://blog.hubspot.com/marketing/business-blogging-in-2015

    Which means that half of those companies don’t have a public corporate blog.

    The same infographic also revealed the following:

    • 86% of B2B companies are blogging. (Or, 14% are not.)
    • 68% of social media marketers use blogs in their social media strategy. (Or, 32% don’t.)
    • 45% of marketers saying blogging is the #1 most important piece of their content strategy.
    • Small businesses under 10 employees allocate 42% of their marketing budget to content marketing.

    So obviously some firms believe blogging is important, while others don’t.

    What difference does this make for your firm?

    What results do blogging companies receive?

    In my view, the figures above are way too low. 100% of all Fortune 500 companies, 100% of B2B companies should be blogging, and 100% of social media marketers should incorporate blogging.

    Why? Because blogging produces tangible results.

    Blogging produces awareness

    Blogging is an ideal way to promote awareness of your firm and its offerings. From the same infographic:

    • 77% of internet users read blogs.
    • Internet users in the US spend 3x more time on blogs than they do on email.
    • Companies who blog receive 97% more links to their websites.
    • 70% of consumers learn about a company through articles rather than ads.
    • The average company that blogs generates 55% more website visitors.

    Blogging produces leads

    Awareness is nice, but does awareness convert into leads?

    • Small businesses that blog get 126% more lead growth than those who don’t.
    • B2B marketers that use blogs get 67% more leads than those who do not.

    Blogging produces conversions

    From https://www.youtube.com/watch?v=B8EnslW6Uao

    Getting leads from blogging is nice, but show me the money! What about conversions?

    • Marketers who have prioritized blogging are 13x more likely to enjoy positive ROI.
    • 92% of companies who blog multiple times per day have acquired a customer from their blog.

    Take a look at those last two bullets related to conversion again. Blogging is correlated with positive ROI (I won’t claim causation, but anecdotally I believe it), and blogging helps firms acquire customers. So if your firm wants to make money, get blogging.

    What should YOUR company do?

    With numbers like this, shouldn’t all companies be blogging?

    But don’t share these facts with your competitors. Keep them to yourself so that you gain a competitive advantage over them.

    Now you just need to write those blog posts.

    How can I help?

    And if you need help with the actual writing, I, John E Bredehoft of Bredemarket, can help.

    From Sandeep Kumar, A. Sony, Rahul Hooda, Yashpal Singh, in Journal of Advances and Scholarly Researches in Allied Education | Multidisciplinary Academic Research, “Multimodal Biometric Authentication System for Automatic Certificate Generation.”
    By Unknown author – postcard, Public Domain, https://commons.wikimedia.org/w/index.php?curid=7691878

    In most cases, I can provide your blog post via my standard package, the Bredemarket 400 Short Writing Service. I offer other packages and options if you have special needs.

    Authorize Bredemarket, Ontario California’s content marketing expert, to help your firm produce words that return results.

    Bredemarket logo

    How Unusual Gambling Portals Drive the Need for Age Verification and Estimation

    Gambling is becoming acceptable in more and more places.

    When I was young, and even when I got older, the idea of locating a pro sports team in Las Vegas, Nevada was unthinkable. In the last few years, that has changed dramatically.

    The Roblox “Robux” gambing lawsuit

    Well, now that gambling for adults has become more and more acceptable (although adults in my home state of California still can’t gamble by phone), now attention is focusing on child gambling.

    Designed by Freepik.

    And no, the kids aren’t gambling U.S. currency, according to TechCrunch.

    In a new class action lawsuit filed in the Northern District of California this week, two parents accuse Roblox of illegally facilitating child gambling.

    While gambling is not allowed on the platform, which hosts millions of virtual games that cater to children and teens, the lawsuit points to third-party gambling sites that invite users to play blackjack, slots, roulette and other games of chance using Roblox’s in-game currency.

    From https://techcrunch.com/2023/08/18/roblox-children-gambling-class-action-lawsuit-robux/?_hsmi=271025889

    But the gambling sites’ terms of service prohibit underage gambling!

    I’m not going to concentrate on Roblox here, but on the other defendants—the ones who actually operate the sites that allegedly allow child gambling.

    The lawsuit specifically names RBXFlip, Bloxflip and RBLXWild as participants in “an illegal gambling operation that is preying on children nationwide.” 

    From https://techcrunch.com/2023/08/18/roblox-children-gambling-class-action-lawsuit-robux/?_hsmi=271025889

    But according to Bloxflip’s Terms of Service, it’s impossible that children can be using the site, because the Terms of Service prohibit this.

    By accessing Bloxflip or using the Services, you accept and agree to our website policies, including these Terms of Service, and you certify to us that (i) you are eighteen (18) years of age or older, and are at least the age of majority in your jurisdiction, (ii) you are not a resident of Washington, (iii) you have the legal capacity to enter into and agree to these Terms of Service, (iv) you are using the Services freely, voluntarily, willingly, and for your own personal enjoyment, and (v) you will only provide accurate and complete information to us and promptly update this information as necessary to maintain its accuracy and completeness.

    From https://bloxflip.com/terms
    From https://bloxflip.com/terms

    However, stating a minimum age in your TOS is even less effective than other common age verification methods, such as

    1. Asking your customer to check a box to say that they are over 18 years old.
    2. Asking your customer to type in their birthday.
    3. Requiring your customer to read a detailed description of IRA/401(k) funding strategies and the medical need for colonoscopies. (This would be more effective than the first two methods.)

    A better way to verify and estimate ages

    As more and more companies are realizing, however, there are other ways to measure customer ages, including a comparison of a live face with a government-issued identification card (driver’s license or passport), or the use of “age estimation” software to ensure that a 12 year old isn’t gambling. (And don’t forget that NIST will test age estimation software as part of its FATE testing.)

    Even when the kids aren’t gambling legal currency.