FBI Probes Service Selling Tens of Millions of Drivers Licenses ⇥ krebsonsecurity.com
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images.
Mike Masnick, of Techdirt, reports the company in question is IDScan:
You cannot do age or identity verification safely. It always creates some sort of record and that set of records will always become a target. That’s what happened here. And it’s what will happen with any such systems.
Dan Gillmor on Bluesky:
If you support “age verification” online, you are supporting a system that GUARANTEES privacy meltdowns — endangering all of us — because the giant databases of scanned IDs are perpetually hacked by criminals who sell private data.
I am opposed to identity verification, but this argument is not particularly effective for me because there are incredibly low-risk solutions. In Canada, for example, we have an interbank service called Interac that offers an identity verification service. I am not naïve, but I would entirely trust this bank-based system to verify me on a regular basis. In fact, I already do — like many Canadians, I use my banking information to log into government websites. Maybe this relatively safe proxy for a centralized identification system is unique to Canada.
I imagine this argument lands fairly well for lots of people elsewhere, however. The rapid introduction of age verification laws has produced a market for these businesses, but handing your identifying information to some random third-party should terrify you, as it is exactly the behaviour any security expert warns against doing. You have no idea who is able to access that scan of your driver’s license or what they can do with it. And, as it turns out, neither do some of these companies, either.