Sunday, 15 August 2010

The New Jackals: Identity Farmers

A generation ago, Frederick Forsyth's fictional assassin, The Jackal, showed the world how easy it was, in the sixties and seventies, to obtain passports and open bank accounts in the name of someone who had died in infancy. These days, it is unlikely that an identity obtained by the methods in that novel would stand scrutiny for very long, although it might still get someone through an airport on a one-way trip, or allow them to fleece a bank or supplier of a few thousand pounds.

Even in the nineteen sixties, when information technology was in its infancy, The Jackal's methods wouldn't have produced an identity that would stand up to any serious cross checking. If a person was vetted to work on a military installation, or even a County Court (in England, at any rate) it would soon be discovered that the birth certificate the identity was based on, matched a death certificate, somewhere, or that there was a gap or discontinuity in the person's documented history. Indeed, supplying equipment to carry out this kind of check used to help secure the computing businesses of both ICL and Ferranti, in the time before we heard of Microsoft.

The change that more advanced, and affordable, information technology has wrought on the false identity racket, is that false identities for many everyday criminal purposes need to be better crafted than those which the SOE created for agents infiltrating Nazi-occupied Europe. The modern criminal needs a false identity to match the standards of those produced by the GRU and KGB during the height of the cold war, but organised crime is big business and the number of such "legends" that a gang will consume is greater than that which the KGB was able to crank out, back in the day.

A cold war legend would probably be based on someone who either wasn't dead, or wasn't known to be dead by the country which issued their birth certificate. British subjects born outside the UK would be one favourite, UK-born globe-trotting adventurers another. If a US passport was required, things might be easier because two thirds of the American population never applies for one. Pick someone who is unlikely to travel abroad, but who now lives in a different State to where they were born, clone their identity, fill in the forms.

But it is becoming less and less possible to be sure that an ordinary US citizen won't suddenly apply for passport in their own name, which you may have quietly borrowed, and in the current security climate it is guaranteed that no-one will see this as an innocent mix up or other bureaucratic anomaly. Alarm bells will ring the moment the same individual appears to be in two places at once, and different national immigration computers talk to each other about this the whole time.

Another twist is required: the false identity must be a true identity, of someone who is not dead or whose death is a total secret (or utterly unnoticed) and that individual's life must be known in intimate detail by the gang exploiting their identity. The client using the identity must be assured that there is a very low risk that his alter-ego will do something untoward that reveals the theft, and he will need a guarantee that he will hear about it before the local police if this does happen or looks as if it might be about to happen. The client's use of the identity must also blend pretty seamlessly with the real person's use of their own persona.

None of this can be achieved merely with an unwitting owner of the real identity. They must be controlled and monitored, for a period of time before their identity is stolen, and for as long as it is being used, and probably for long enough thereafter for any trail to grow stone cold. Control is necessary, because whilst the criminals need the real person to be responsible for a normal level of traceable activity up to the point where the client starts to use their identity, the real person must then be stopped from travelling abroad, or applying for a mortgage, whilst their identity is in use.

When it was a case of the KGB needing a couple of dozen such identities, it was not impossible that the real people could be abducted, or murdered and their bodies disposed of without trace, but this would be fraught with difficulties, and cost, if done on the scale required by modern crime. Unless someone is homeless and living rough, it is actually quite difficult to "disappear" them without someone trying to report them as missing. But where people who are already homeless are concerned, it can be hell's own job establishing what their true identity is, before it can be stolen! And then it would be a challenge to create a suitable legend to explain their sudden rise from sleeping under Hammersmith Arches to a seat in business class.

However, if there is a market for false economies on an industrial scale, there is bound to be an industrial-scale solution, and it goes somewhat as follows:

Existing criminal networks are utilised: this process needs to be invisible if it can be, mistaken for something else if it is detected. It cannot be just any criminal network: it must be one that can be controlled with precision and authority. Drugs, or the harder side of the sex industry, means a dependence on ongoing supplies of dope or trafficked girls from international gangs. Internet banking fraud means a dependence on sources of "lists" of data. Any criminal network that's dependent on ongoing supplies from territory outside their control, can be controlled with some authority by whoever sources those supplies. In some countries, security and intelligence services may resort to the same basic methods as organised crime, in which case policemen and other officials will be found performing the same role as minor local gangsters. In the United States, expect to find both involved together.

People will be selected to have their identities used. This process is very much not to their benefit, it can be Hell on Earth, so there will always be an element of malice or revenge in the choices: it might work better if it were random, but it's always going to be malicious.

Those victims must first be studied: if the victim notices this at all, and most will not, it will resemble stalking by an unknown lunatic, or someone in petty authority, rather than a great conspiracy.

A proportion of the victims who are studied, will be selected for preparation: this basically consists of making it difficult for them to do anything that would spoil exploitation of their identity. Nearly all of the things they could do, which would create problems for someone else using their authority, require money. So, sabotage of career and finances are a prerequisite of anyone becoming a steer on the identity farm.

It is important that no-one really notices when the victim's difficulties become extreme. So their social circle needs to be whittled down as much as possible, and relatives driven off to a distance. But ties must not be broken so abruptly that anyone goes to the police, asking for a well-being check on the victim!

This has to be done with patience, and there will be dropouts and failures. Therefore, it has to be done to a large number of victims, that number constantly refreshed, in order to be economically viable. However, the more people who are being harassed and controlled, the fewer criminals or officials it takes per victim to keep all of this on the boil, and the more viable and profitable it becomes.

When the victim's identity is actively being exploited, the pressure on them must either be intense, or their life circumstances must make it all but impossible for them to do any of things which a normal person would do without thinking. One victim of this has likened the experience to the Robin Cook's novel (and Michael Crichton's film) "Coma" in which abductees and people supposedly having died during routine medical procedures, are stored, in a warehouse, in an induced coma, until such time as their organs are required for transplant. It is a telling simile.

Making a victim homeless, rather than starting with a homeless person from the off, is a good way of obtaining an exploitable identity long-term. But homeless people are apt to die, or suffer violence, and no-one can guarantee that their identity won't rise to official attention and clash with whatever scam is being worked by the alter ego.

The victim must go on living an ordinary life, but under paralysing pressure.

The most troubling question is this: what happens when their identity is no longer required, and when there's no ongoing income stream from a criminal client to pay for keeping them under paralysing pressure? Is that the point at which it might even be convenient for that identity to generate a death certificate? Because then, if a search for the criminal who'd exploited that identity did start, investigators would find all the loose ends tied in neat bundle at a graveside, somewhere.

Is there anything that can be done about it?

Well, the United States government requires travellers to that country, to complete a special clearance form on the internet at least 72 hours in advance. They are also going to charge $14 for doing this. But you can do it in advance, and you don't actually have to go to America if you get the clearance. Going through this tiresome procedure is bad enough, and paying $14 to do so sounds like madness. But it might just alert the American authorities to the fact that someone else was travelling on your identity, and if you're the one who cannot travel, and your alter-ego is the one living the life of Riley and breezing through US Immigration and Customs in your name, the bad things will be concentrated on them. And if you are approached by American officials, wherever you might be, that is your chance to say "I think my identity has been, not just stolen, but actively farmed, by criminals or an intelligence agency wanting covert entry to your fine country." They may not react very effectively the first time, but somewhere around the eighth or ninth times, the penny will drop.

Identity farming has another, even more sinister twist:
In the former Yugoslavia, when thousands of people went into mass graves amidst the chaos of civil war, it was normal practice to harvest identity documents from the victims. This wasn't just to stop the bodies being identified: the identities of people who are definitely dead, but whose deaths are undocumented by any lawful authority, have a considerable black market value. Given the connections between Serbian militias and Russian Organised Crime, and between Kosovan Freedom Fighters and Albanian Organised Crime, Medawar thinks that nearly all of the mass killings made a healthy profit. Yes, the UN and EU forensic scientists have identified a lot of the bodies, but it has taken ten years, and who knows what adventures the identities of the murdered had in that time?