Fake ID generator spoofs politicians’ licenses to protest Online Safety Act

“This is satire”

A British coder has protested against the UK’s new online age verification rules with a fake ID generator.

The site is a response to Britain’s Online Safety Act, which now requires a whole range of websites operating in the UK to do more than simply ask “Are you 18 or over?” if they offer products, content and services that are considered risky for (or are legally prohibited to) children.

Services that enable user-to-user messaging such as comments and chat forums can apparently also fall foul of the law if they fail to stop underage users from joining their online community, on the grounds that those children could be contacted by, or exposed to posts from, unknown adults if they use the service.

The satirical Use Their ID site has been dubbed all over the media as an “AI-based” system, which is stretching things a bit, given that an old-school Python script directly using Cairo or Skia and the FreeType library would do the trick…

…but the creator’s point is not actually to help users bypass age detection checks.

To be clear, the fake licenses are quite obviously bogus, presumably to avoid legal complaints:

• They have only a passing resemblance to a real license.
• They have a driver ID number that very obviously doesn’t fit the given birthday, and is vanishingly unlikely to match any real ID in the system.
• They all use the same address, which roughly corresponds to the location of the Elizabeth Tower at the Houses of Parliament, where the world-famous clock and its Big Ben hour-bonging bell are located.
• They have a variable and apparently random selection of required data fields missing, perhaps due to the unreliability of the AI system used.

The fake IDs also have the words this is satire in the background where a real license would just have just have a swirly pattern.

Indeed, if there are any online systems that accept one of these satirical IDs, those systems are unfit for purpose, and should be considered at least as much of a cybersecurity risk as the cybersecurity problems that the Online Safety Act claims to solve.

Find your MP

The site asks for a UK postcode – an item that always appears on a genuine license, because you can’t get a UK license issued against an overseas address – and uses it to locate the visitor’s local MP, retrieve their official parliamentary mugshot, and work their name and photo into the parody document.

MP is short for Member of Parliament, the equivalent of a Congressperson in the US, elected to represent constituents in a specific geographic area. These constituencies are arranged so they have about 75,000 voters each.

Presumably, the idea is to remind visitors whom to write to if they want to comment on, or to complain about, the controversial Online Safety Act.

After all, MPs passed the Act in the first place, so it’s reasonable to expect them to act on constituents’ comments about that Act that are sent in good faith.

And there are several reasons to object to it, not least that the Act forces a wide range of sites to collect personally identifiable information (PII) online in order to “prove” that they have taken steps to “think of the children.”

But online ID checks are often done by outsourcing the process to cloud-based services, often based in other countries, which thereby get to collect huge quantities of personal information, and to process it in unspecified ways, including sharing it further to check it against other online identity verification services.

When safeguard becomes liability

Users of these identity checkers have to assume that the services will scrupulously and promptly delete the information when they’re done with it, though quite how long they may decide they need before they’ve “finished” their checks may be unclear, or even unspecified.

Critics note that by forcing many more sites to adopt age verification, even though they don’t represent any clear and present danger to children, or aren’t supplying already-restricted content such as pornography or online gambling, the amount of PII being steered offshore will greatly increase.

This ever-increasing PII collection could ultimately turn into a liability for huge numbers of people, rather than serving as a safeguard against a few who might be shielded from harm.

As the creator of the site puts it, “When the inevitable happens and the data is all leaked , I think it would be funny to see some MP’s IDs in there.”

What to do?

• Never use a fake ID for any genuine purpose, even as a well-intended protest, and even if the ID itself is clearly tagged this is satire. The legal system is supposed to be objective and consistent, and cannot be expected to take excuses such as “it felt harmless and humorous” into account.
• If you live in a country with online safety rules you disagree with, find out how to register your concerns legally and officially. If you live in the UK, you don’t need to generate fake IDs to locate your MP. You can find your MP’s details via your postcode at the official parliamentary website.
• Avoid handing over personal data unless you need to. If an online service asks for optional information that it doesn’t need by law or to provide its service, avoid entering it just because they ask for it. A data breach can’t expose data that wasn’t collected in the first place.
• If you run an online service that collects PII, make it easy for users to find out exactly what you need it for, how you use it, how long you keep it, and how they can get it deleted if they decide to unsubscribe from or leave your service. Don’t hide your data collection, retention and deletion practices inside lengthy, legalistic, eye-watering terms-and-conditions documents.

Clearly, there are some online services where you will need to provide large amounts of PII, such as when you renew a passport or apply for a visa.

Likewise, if you want to order a product and have it delivered to your house, you will have to hand over your real address.

For everything else, trying saying these words out loud before you hand over any personal data at all: If in doubt, don’t give it out.

Why not ask how SolCyber can help you do cybersecurity in the most human-friendly way? Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit your IT team, your colleagues, or your customers!

More About Duck

Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!