Decode Your Barcode, Get Your Personal Info

Chris writes "The Swipe Toolkit is a collection of web-based tools that sheds light on personal data collection and usage practices in the United States. The tools demonstrate the value of personal information on the open market and enable people to access information encoded on a driver's license or stored in some of the many commercial data warehouses. Check out the Data Calculator, which shows how much your personal info is worth, and how the data brokers get it. It's all part of the Swipe Project, which will be on exhibition at UC-Irvine in March."

Comments

Moron

[DarkHelmet]

I saw this story as a subscriber before most everyone else did, so I go to the site and download all the software before the site ends up getting slashdotted.

I then download java, run the jar, scan my driver's license... doesn't work.

Then I rotate the image 180 and find out it doesn't work.

Then I go online and notice that California doesn't have a 2d barcode on the back of their licenses.

Which comes to the rule of the day, which is apparently applicable to myself:

You can be enough of a nerd to care about what's on your barcode, and still be a complete fucking moron

Re:Moron

[strobexii]

Then I go online and notice that California doesn't have a 2d barcode on the back of their licenses.

Hmm, my California license has a 2d barcode on the back. And suddenly I feel very uncomfortable.

Re:Moron

[AgentOJ]

Older California licenses have magnetic stripes on the back, rather than barcodes. In order to read those, you'll need a magstripe reader.

Re:Moron

[malachid69]

I download the java app, ran it.

My wife's license didn't work, but mine did. They are both Oregon licenses, but I noticed hers had the sticker on it (larger bar code and not as "clean"), whereas mine was fresh (from last renewal).

Mine contained my name, address, license#, birthdate, etc -- luckily no SS#.

Malachi

Re:Moron

[Ateryx]

...I go online and notice that California doesn't have a 2d barcode on the back of their licenses.

My experience was actually the exact opposite. I checked my id (new as of March 2003, so less than one year old), and saw no 2d barcode. Figured, what the hell, and decided to look to see what good 'ol Minnesota has for privacy (overall not too bad, only a few, separate mess ups.) I saw that Minnesota indeed does have a 2-d barcode, however it is nowhere on anyones licences that I checked made this year (I couldn't find anyone w/ a new licence as of this year). Either this site is 1)up to date, Minnesota started regulations as of the first of the year, or 2) has incorrect information.

Re:Moron

[Yottabyte84]

I picked up a reader (by ID Innovations) for $30 on ebay not to long ago

Writers will cost you at least $300 on ebay.

Wow! My CueCat will be useful again!

[Anonymous Coward]

Good thing I didn't throw it away.

Re:Wow! My CueCat will be useful again!

[afidel]

I used mine to keep track of my customers DLT tapes. Since we were up to a library of ~500 tapes and were changing them out at a rate of 25 every 10 days or so it really paid off. In fact I had my brother write a little VBA app on top of Access to keep track of their container and position. That way when the library needed new tapes I could take the reports from Veritas and pick out the tapes that were ready to be reused and know right where they were. Before doing this it took me about 3 hours a week to change out tapes, after organising things it was down under an hour.

It also came in usefull when we were pulling out over 400 PC's from a client site, recording all those asset tags by hand would have been a LOT more tedious than just stacking em and scanning. Picking in up was definitly the best $0 and 10 minutes of my life I ever spent =)

Re:Wow! My CueCat will be useful again!

[afidel]

Actually Cue:Cat's can decode most UPC style barcodes. If you run Win2k or XP you can use the keyboard filter driver from this site. Or for even more flexibility I like the Catnip program which allows you to alter the output including the barcode type and multiple delimiters, it can be found here among other places.

This is very important to me

[IchBinDasWalross]

Well, it would be, if I didn't live in my parent's attic and if I did actually have a driver's license.

An attic? Neat!

[Anonymous Coward]

I bet you get great radio reception and have a nice view. Lucky, I'm stuck down here in the basement.

Re:Hmm

[DarkHelmet]

RTFP :)

java -jar SwipeBarcode.jar

DMCA the freakers!

[mauthbaux]

so, where can I copyright my own personal info and sue the pants off of all these freakers passing around unauthorized copies?

Re:DMCA the freakers!

[LostCluster]

IANAL, but I'm a news writer at times...

And you can't copyright a fact. A copyright on a 9, 10, or 11 digit number just isn't going to stand, and neither is a copyright on an address. It is your address or number, it already appears on plenty of public records, and thereofore uncopyrightable documents. You can copyright an expression of a fact, so maybe a copyright of your address in your handwighting will stand... but you're not going to ever get copyright protection on your personal info, reporters can use your name all they want while talking about you, and the same goes for basic facts about you.

Old POS system

[KalvinB]

that's "Point of Sale"

When I worked at Peter Piper Pizza it was quickly learned you could exit the program handling orders to get to a prompt. You could then swipe any magnetic card through the CC reader in the keyboard to see what was on it. You just had to swipe it at the right speed to get everything.

Ben

Re:Old POS system

[LostCluster]

Most barcode readers / magnetic swipe readers work with drivers that simulate keystrokes... and that's why the point at which you're allowed to scan the card just happens to be same screen at which you can type the number in manually. The device just needs to be configured for what sequence of enters/tabs/etc. to enter after a scanned number.

For example, a credit card reader at a POS unit would be set to output the first 16 characters on the card, and then maybe [tab] to exit the entry box and [enter] to clear the "Are you sure? Y" prompt. Hook the same reader up to any free-text entry screen, and the number ends up in plain view.

Re:Old POS system

[senatorpjt]

Wow, that works a lot better than just reading the number off the front of the card!

Re:Old POS system

[MikeDawg]

I used to work for a POS Helpdesk for an *unnamed* gas station/c-store. We could always dig through the log files to read what sort of input was recorded from a cardswipe on a CC#. There are actually several (usually 2 readable) tracks on your average CC.

The data on the MS of your major CCs are usually <15-16 digits - ala your CC #>=<exp date>

not necessary

[Anonymous Coward]

i already have my personal data, thanks.

When will the knock off start

[manganese4]

So when will the first knock off site appear asking you for simialr information but actually keep an image of it on their server?

I'm not sure I care about this.

[musingmelpomene]

In my opinion, we're less than 100 years away from basically a total lack of "privacy." I'm not entirely sure this is a terrible thing, but it will certainly have interesting ramifications for society.

Once people know that essentially no one's a saint, we'll all be a lot better off without the sanctimonious holier-than-thou crap we get so much of today.

I am honest in all my dealings except the occasional shoplift from Barnes & Noble. I'd be fine with a lack of privacy, because everyone would be under equal scrutiny. The thing that bothers me is unequal privacy - which we're at right now.

Once everyone's life is part of a public record, we're all equally screwed and we can build our society around a new, more honest paradigm.

Re:I'm not sure I care about this.

[metroid composite]

A lot of privacy issues, videocameras in stores, monitoring what IPs have visited a certain site, et c. are already universal to everyone in the territory. I'm curious as to which privacies are unequally shared; most that I can think of depend purely on where you tread.

Re:I'm not sure I care about this.

[aralin]

Its idealists like you that are source of the problem. Get it in your head once and for good: "People are not equal! People will never be equal!"

Once you get this little bit, you might stop dreaming about people being all equally screwed since that will never happen.

And when you stop dreaming, you might start to adjust to a world where people are not equal and start to vote for politicians that are aware of the issue and start asking for laws that will protect the weak from the strong and for society that works for both. And stop get abused by people that try to ram this strange concept down your throat to make you feel good about yourself.

And when you put all this in context with the US Supreme Court decision that Corporations are for all the legal matters "people", you get closer to my point.

Re:I'm not sure I care about this.

[beakerMeep]

Yes but what if I don't want you to use my personal info to build your new society.

Why do people think that if nobody has any privacy that it naturally correlates with positive advancements toward open society? Wouldn't a lack of privacy be a boon to criminals and civilized society alike? Isn't this what we are seeing now with the rise of the internet?

I think the point is not whether or not privacy benefits society but whether or not an individual has a right to it. Personally, I like my privacy too a resonable extent because I don't like the idea that there are a bunch of people out there who compile profiles on me. Profiles that serve only a limited few purposes such as:

A) selling me products
B) stealing from me
C) arresting me
D) providing me medical treatment (see A)

While A and C could be good in some situations (ie I am a criminal or I got the right medical treatment because of a profile) I just don't see enough good in a total lack of privacy.

I think there will always be bad people in this world and if the data is out there and allowed to be shared it will be used for malice at some point but I think that's the key. As long as the data has strict sharing guidelines it can be beneficial. Without that, it does the individual AND HENCE the society very little good compared to the potential harm.

Re: I'm not sure I care about this.

[bezuwork's friend]

I'd be fine with a lack of privacy, because everyone would be under equal scrutiny.

You really think politicians and others of power would get treated the same way?

Would never happen, I think. The control of data collection would have to be in the hands of an entity (a) not under the control of the government, politicians, or police but (b) subject to regulation which the people, or at least attorney generals, can enforce.

It is the same problem with security cameras. Alot of /.ers say they are ok so long as everyone is treated equally. But, for everyone to be treated equally, wouldn't the people have to have equal access to the tapes?

I agree in principle with you that if everyone is treated equally, it should be ok. I do have a caveat, though (and this is something that alot of /.ers will probably have first hand experience with, as IT personnel). As more and more data is aggregated about people, it will be easier for those in power to abuse others. I've seen people at work get fired for viewing pornography when I know the bosses did it at work as well. The inequity in access to the company records in that case means the employee has a tough battle to fight such abuse. As privacy declines, these abuses will become easier. It is nothing new, just easier.

Re:I'm not sure I care about this.

[dont_think_twice]

I am honest in all my dealings except the occasional shoplift from Barnes & Noble.

Did you know that there are these places where you can get books without paying for them? They are called libraries. If you went there, you could consider yourself honest in all of your dealings, without an "except..."

Re:I'm not sure I care about this.

[Plugh]

Blockquoth aralin:

Get it in your head once and for good: "People are not equal! People will never be equal!"

You said it, buddy.

You would think, with so many millions of people who have survived through "enforced equality" (Communism, and its slightly-less-ugly bastard brother, Socialism), that people would get the lesson by now:

Any just society inherently entails inequality of outcomes

Sigh... it almost makes me want to join ESR and the rest of the Free Staters.

Re:I'm not sure I care about this.

[Planesdragon]

Why do people think that if nobody has any privacy that it naturally correlates with positive advancements toward open society? Wouldn't a lack of privacy be a boon to criminals and civilized society alike? Isn't this what we are seeing now with the rise of the internet?

Depends on how persuasive the lack of privacy is.

If it's essentially impossible to be private, then crime essentially vanishes. And, even better, if the "TIA" system works well enough, we'll see as the first change a massive drop in false accusations.

If privacy is still attainable by those who work at it, then crime will flourish under the system.

So, it should really be an "all or nothing" thing--that, as a most important safeguard, includes an automatic notification whenever someone wants to see your record.

Re:I'm not sure I care about this.

[photonX]

I think 100 years is *wildly* optimistic. The last 100 we went from literally a horse-and-buggy society straight into the Electronic Age, and from mainframes to handhelds in a quarter of that. I expect to see my every move tracked within the next 20, and DMV barcodes are tame next to face-recognition systems and rf tags.

I imagine that implantable chips have been discussed here before, probably ad nauseum, but it isn't much of a stretch to imagine that within a quarter century everyone under the age of 15 or 20 could be carrying one. In my country (USA) it will be called something like the Child and Infant Freedom and Protection Act, requiring implantation of ID tags in every newborn in the counry, and after that it's just a matter of time. After all, who's not all for protecting our children? And as long as they're already there, why not make it illegal to have them removed or deactivated--we have nothing to hide, do we?

If it's unpatriotic now to oppose the Patriot Act, how about a decade and a few more pre-emptive wars from now? We'll all be talking about the good old days when all we had to worry about were the barcodes on our drivers licenses.

Re:I'm not sure I care about this.

[kcbrown]

If privacy is still attainable by those who work at it, then crime will flourish under the system.

Privacy will always be attainable by some, because there will always be some who have more power than others. Power, especially when we're talking about government, directly translates to the ability to control information -- to be private.

The only way society could ever be what David Brin imagines it could be is if secrets, and the organizations (like the NSA and the CIA) that depend on them, don't exist. I guarantee that such a world will never come about, because the only people with the power to make it come about are the very people who don't want it. There will always be people with more privacy than others. Those people will, not coincidentally, have more power than others.

And so, the only acceptable alternative is a society in which certain privacies were jealously protected by that society. Without that you don't have a free society -- you have a police state. Which, not so coincidentally, is exactly the type of system we're headed towards (in fact, one could probably make a convincing argument that we're already there in everything but name).

Re:I'm not sure I care about this.

[atomicdragon]

I read that little comment and lost all respect for the guy and anything else he had to say.

Doesn't this demonstrate one of the needs for privacy? Whether he stole a book or not should not affect the validity of his point. Although some may need such information, such as an employer who could be putting themselves at risk, others have no real use for it.

I guess that just goes along with my answer to those that say "Only those with something to hide want privacy." Maybe I do have something to hide. It doesn't have to be something wrong, just something other people may misuses or have prejudice against, e.g. somebody's beliefs.

You can easily see...

[centralizati0n]

You can easily see that with a service such as MSN Hotmail, who already sells your personal info, your standard "I had best enter the correct info, or else bad things could happen" person can easily give them (as this project puts it) about $10 worth of personal info right in the sign-up boxes. MSN could then do a search through some of these free services and get even more money, as the information gains value if it is all stored in one location. We can then see how offering free email to the unwashed masses can be very profitable.

ALL YOUR INFO....

[segment]

Today, information is everything. Whether in insurance, government, banking, law enforcement, healthcare, the legal industry, or other fields, getting the information you need to know.now. quickly and easily is essential for smart decision making.

Accessing critical information is as easy as point-and-click. Using ChoicePoint Online's powerful search capabilities, you can easily search more than 14 billion records on individuals and businesses. Whoopdeedoo. Choicepoint and companies like them probably have more than you can spend your life trying to hide. Personally I blame it on utter laziness. Here's a day in the life of Avgjoe...

Avgjoe wakes up everyone morning and turns on the radio to hear the news while he gets ready for work. He uses XM satellite for news... (subscriber info sent)

As he gets into his car after getting ready he joyously turns on his car. "Welcome to OnStar" (userinfo sent). Driving over the Triboro bridge, Avjoe happily avoids crowds and goes through the EZPass lane. (info sent). Upon entering Manhattan he decides to fill up the tank at Mobil with his credit card. (info sent)

Driving down 1st avenue he eats a yellow light (snap snap go the cameras). Avgjoe is sent a ticket. "Hey I can fight this..."

Do the math if Avgjoe committed a serious crime he could be tracked to the minute if needed. If Avgjoe was Avgjoe do gooder who happened to be a politician who pissed off other politician, do gooder Avgjoe's information could also be abused.

You want what privacy or ease of use? Privacy? Dump your credit cards, and all other forms of digital clutter so you can complain less, unless you're just a whiner complaining while typing this with a what? UID... Ah yea a UID.

Re:ALL YOUR INFO....

[Total_Wimp]

You want what privacy or ease of use? Privacy? Dump your credit cards, and all other forms of digital clutter so you can complain less...

This would be a great solution if it didn't make you a second-class citizen. Want to fly? Must have ID. Want to rent a car? Must have credit card. Want to conduct business? Must have a phone.

To rent my apartment I had to go through a credit check. To eat for the same price as my neighbor I had to give my info to the grocery store.

It's not merely convenience. We're effectively being forced to do this to participate in society.

TW

Re:ALL YOUR INFO....

[BandwidthHog]

To eat for the same price as my neighbor I had to give my info to the grocery store.

I don't buy anything that's 'on sale' via their cards. Even if it's only a 10 cent difference. I go to their competitor for those items. If all stores in my town were holding boneless skinless chicken breasts hostage to the cards, well, I can eat hamburger (or steak) tonight.

Haven't checked the site lately, but nocards.org used to have a good FAQ on why you shouldn't just give bogus info to get one of those cards.

May or may not work

[jkitchel]

Some states encrypt the data before they put it in the barcode on the back of your license. It helps to prevent fake IDs. At least in Indiana, some of the liquor stores have scanners in them, through a deal with the state to read the back of the ID which has a PDF 417 2D barcode. That way when some 5'5", black hair, brown eyed underage person presnts the ID and the data on the back shows 6'1", blonde hair, blue eyes, they know it's a fake.

Re:May or may not work

[monkeydo]

Have you ever heard of public key cryptography? The decoder doesn't neccesarily have the ability to encrypt anything.

Re:This is a good idea

[mountiealpha]

The SWIPE Toolkit page has a link to a listing of the 39 states with barcode technology. It also lists those considering implementation of magnetic stripes and/or barcodes...

Might want to think about XM again......

[i_want_you_to_throw_]

He uses XM satellite for news... (subscriber info sent)

I can see where XM might be passing out mere subscriber info left and right (XM is partly owned by the Borg, Clear Channel)

Technologically I'm not sure how they know WHEN you tune in or what you listen to since it's a passive reception system.

If nobody ever bothers to RTFA...

[Audent]

...how do we slashdot the sites?

Re:If things like your address are worth money...

[LostCluster]

Your address alone is worthless. Unless they're specifically looking for you... a marketer doesn't need your address. If they've already got your name, then the address is free with the bargan. Your name and your address, associated with some random fact about you... you like golf, you TiVo "Friends" every week, you read Slashdot, you hate marketers, or you are 23 years old... starts to be come of value, particularly if presented in the form of a list of people who share the same attribute. That's where the direct marketer can come in, match that group up with a product that people who have that attribute would possibly buy, and send junk mail to that group. The more refined the profile, the better the ad is going to be targeted... and therefore the more sales that are likely to result per person bothered. Addresses alone are pretty worthless, but grouped together and with other information, that's where the value kicks in.

lobbying work

[JimBobJoe]

Here in Ohio I've actually got a few legislators entertaining the idea of introducing (or at the very least co-sponsoring) legislation to prohibit machine readibility on driver's licenses.

I've done it by convincing them that machine readability will cause more fraud. How?

The experience is that when a human has a machine that does scanning, the human will take a quick glance at the photo (or no glance at all) and then swipe/scan the card...and the card will say X and the human will believe it. Based just on that, remagnetizing the card or even an overlay sticker over the barcode can be very successful.

Indeed, the only thing separating the cheap plastic card from being an other cheap plastic card is the hologram and other visual/tactile elements that humans detect, but machines don't. If humans have to examine the card in depth before scanning it, then there is little reason to actually have the scanning machinery.

Which is cool...because the Ohio BMV does pay a touch extra for the plastic card blanks with magnetic stripes, so getting rid of the stripes saves a touch of money...at least enough to keep the conservatives listening.

And then I hit the privacy arguments...which I save for last.

These things take time incidentally...especially here in Ohio where legislators are deathly afraid of making a mistake, and the full year calendar means that they can take their damn time doing things.

But I was quite honored the other day...as I walked by one of the senior administrators of the BMV she stopped talking...she didn't want me to hear anything she was saying. Quite the compliment.

Machine readability is also discused on my New Jersey driver license privacy site, listed below.

Death to magnetic stripes

[DoraLives]

licenses have magnetic stripes on the back

Mine does too. So the first thing I did with it after I got it was to lay it on a steel table at work and take a whacking big speaker magnet and just go to town on that thing. I've had law enforcement question me about the lack of data on that stripe, but so far a doofus look and a shrug of the shoulders has seen me on my way. Your mileage will vary.

Re:Death to magnetic stripes

[Anonymous Coward]

I doubt it's legal to intentionally erase the magnetic stripe. Mine got too close to a hard drive's voice coil magnet. I love those magnets and ripe them out of any worthless hard disk. I should have been more careful.

Re:Death to magnetic stripes

[Anonymous Coward]

Johnny Law can't prove you scrambled the stripe.

Not unless you admit it in public.

Re:Death to magnetic stripes

[DoraLives]

You are an idiot.

It could happen.

your also a liar

'Fraid not. I done it, just like I says I done. The stripe is DEFINITELY no longer doing its job, or otherwise why would the police be asking me about that? Maybe it was the steel table, maybe it was I just got lucky, maybe it was no damned good from the beginning. I dunno. But it's broke now, that I do know.

And while you're at it, please brush up on your social skills, ok?

Re:Death to magnetic stripes

[sushi_steve]

Aww, I just looked on the back of my liscence and saw that it does have a barcode. I just ripped apart my new Harmon/Kardon speaker for nothing :(

Re:Death to magnetic stripes

[afidel]

No, you sir are the idiot. Speaker flux density for even mediocre magnets can be in the 10K Gauss range as seen here , and that's for ferrite magnets, rare-earth (mostly Neodymium) magnets can easily reach twice that. Sure simple ferrous magnets in cheap speakers are only around 1K Gauss but the OP might easily have had a magnet powerfull enough to wipe his card.

Re:Death to magnetic stripes

[subk]

Obviously noone but the OP here knows a damned thing about speakers and/or the types of magnets on them. Let's end this: a speaker magnet from the average 15" woofer will readily destroy a credit card (first hand experience) so why not a drivers license?

Really the best tool is a Bulk Eraser designed for standard audio cassette tapes. They are very cheap on ebay and only about 20 bucks new from a [real] A/V supply shop.

Re:Death to magnetic stripes

[Stonent1]

I doubt killing the stripe is going to cause a big deal anyway. All they have to do is run your license number (or SSN, which is the same in many states)

I think this info is more along the lines of offline data. So in the instance that their database is down, they can still get some general data on you. Also, those 2d barcodes... Anyone remember the old Macintosh magazines that had those in the back and you scanned them in for free programs?

Re:Death to magnetic stripes

[annisette]

When I bought my portable music recording system it was from an old timer in the business.

He told me about recycling reel to reel tapes with a demagnitizer (or any tape for that manner), I bought one about 2x the size of a hockey puck, never used it but he told me it was a loaded gun around tapes and to be careful or you could nick another tape moving it around to the one you wanted to erase.

Re:Death to magnetic stripes

[Ben Jackson]

It probably said much the same thing as the plain text, so all you've done is force the officer to pay attention to your license more carefully than he would have if he'd just swiped it. You already said you got questioned about it -- don't you think the officer also checked your records extra carefully when he was able to pull them up despite your trick?

If you're handing your license to an officer you're way beond anonymity. Your best hope at that point is to keep a low profile.

Re:Death to magnetic stripes

[Buck2]

Fact is, if they tried to pull that shit in real life, they'd probably get the shit beaten out of them. But since you can live anonymously behind a monitor, you're like a drunken asshole full of "courage".

You've obviously never been a drunken asshole full of courage. It's pretty different than random whining and pompous condescensions.

I think the physically present part helps to make everything a bit more real.

Re:But...

[LostCluster]

Yeah, but the definition of a compliation isn't going to cover facts about one person. The only compliations that are going to ever get protection are those about multiple people or multiple thing... think 2 or more database records in a table. If it can be properly expressed in one record, it's not going to make it.

Remember, it's the people who compile lists of data who are behind the effort to make sure copyright protection extends to what they do. They're not gonna be dumb enough to propose a law that puts themselves out of business. :)

Credit cards

[k4_pacific]

I work with Point-of-sale systems, so I know what is on a credit card. There are two tracks of data. The first contains the credit card number, name, expiration date and some checksum info. The second contains number and expiration date again, with more checksum. That is all. Also, the first digit of the account number indicates what kind of card it is:
3 - Amex
4 - Visa
5 - MasterCard
6 - Discover

Re:Credit cards

[Nashirak]

Actually the first digit doesnt always tell what kind of card it is. You can also work the checksum algorithm from simply the numbers (This is called the Luhn alogrithm). The way credit cards are usually handled is as follows:
(where the numbers are the first numbers of the credit card number)
Visa - 4
Mastercard - 51-55
Discover - 6011
Amex - 34

In fact credit card companies have a specific range of numbers to pull from, clubs have another range, and there a few other number ranges that are broken up... see:

http://www.merriampark.com/anatomycc.htm for a better indepth overview.

more like 10 yrs

[bobalu]

I think it's more like 10 yrs, but this is a very good point which I believe is overlooked by the pols. A truly independent data mining approach like the Total Information Awareness debacle of the less-noticed state-based "Matrix" program would catch all the associations between politicians and graft. Tthe GAO sued to get Dick Cheney to identify the parties in his energy task force, unsuccessfully. If that were public knowledge... in real time... hmmm. Maybe time to buy stock in the human courier business.

Mirror of the barcode reader file

[yknott]

Here is a mirror of the barcode reader file: http://www.waiknott.com/mirror/SwipeBarcode.jar

Here are the instructions: This SWIPE tool allows you to crack a 2D barcode. Ever noticed the barcode on the backside of your license? Ever wondered what information it stores or why it is even there? Use our online application or the stand-alone program and put an end to the mystery! It is your data, so shouldn't you have a look? Learn more about the 2D barcode and your driver's license.

WHAT YOU NEED TO BEGIN

1. Check to see if your driver's license has a 2D barcode. Currently 39 states use the 2D barcode to encode personal information on the backside of drivers' licenses. Look for a band of black and white squares in a random pattern.

This thing here is a 2D barcode.

2. Make a digital image of your driver's license barcode. You can either use a scanner or a digital camera to create this image. The image you create must be a color GIF file or a very high quality JPEG without compression artifacts. The image file size should be roughly 500k to 1.5MB and can not be larger than 2MB. The license image should be 1000-1500 pixels wide and make sure it is rightside up. For good results, this image must be in sharp focus with high contrast.

Based on recent use, our Toolkit participants are getting better results with scanned images than images taken with a digital camera. If you use a digital camera, be sure to point the camera directly at the barcode and the license is level in respect to the lens.

3. Decide if you want to use the online application or stand-alone program to decode your barcode. We have made two versions of our barcode decoder: an online version and a stand-alone program. They both will return the same results; the only difference is the stand-alone program allows you to decode locally on your hard drive. The online version is a little bit easier to use, but you will have to upload your barcode image to our server.

Note: We are not archiving any image files for future use. We will, however, keep track of the different kinds of information each state encodes on its drivers' licenses. This research will be made available to our SWIPE Toolkit visitors. No specific data or identifying information will ever be stored on our server.

Now it is time to decode! Please contact us if you have any problems or questions.

Use the "Fletch" Approach to disappear....

[i_want_you_to_throw_]

Always register for customer loyalty cards under phony names: Ted Nugent, Harry Truman, and John Cocktosen are favorites.

Need a fake SSN for your long distance service? (Really they don't need this) use 078-05-1120. It's an Eisenhower era specimen number that works 99% of the time.

Wired has a great story that these are pulled from. See it here

Re:Use the "Fletch" Approach to disappear....

[coolmacdude]

Need a fake SSN for your long distance service? (Really they don't need this) use 078-05-1120. It's an Eisenhower era specimen number that works 99% of the time.

LOL, not anymore.

Re:Use the "Fletch" Approach to disappear....

[MImeKillEr]

Just because the number the OP posted isn't accepted by the SSA, this doesn't mean that it won't work for Randall's or any other place with a 'loyalty' card. It's not like this is a credit card and requires an SSN that matches your personal info.

I'd take it one step further - start a group to swap owner loyalty cards to munge their marketing data up.

Copy of Standalone Reader

[theGreater]

gzipped jar here

I've always wanted to see if my school's MS only infrastructure could stand up to a good pounding...

-theGreater Slacker.

PS: They say to scan your license in so that it's between 1500 and 2500 pixels long, or between 1 and 2 MB in size. I don't have a scanner, though. Or a job.

NYS

[Quixote]

New York State uses a PDF417 barcode too at the back of the license.

I remember when it first started being used, and we happened to be working on a PDF417 decoding program.

We ran the license's barcode through our decoder, and found that the only "encryption" used in the barcode was to store the data in binary mode, instead of the text (alphanumeric) mode.

NYS also puts PDF417s on the car registration stickers.

I wonder what use are these, without a PGP (or similar) signature?

Oh, this can't be good...

[Call Me Black Cloud]

My barcode decodes to "THX-1138"...

I've done this

[PetoskeyGuy]

I was working on an application where the client wanted to be able to swipe a drivers license and get all the user data - name, address, height, weight, etc for quick data entry. We investigated and found that each state has different formats, and not all states put all that info on their cards in mag or bar code formats. We hoped to get all of this info quickly when people test drive a car.

We would have had to develop a different format for each state and in some cases resorted to scanning and OCR. In they end they decided they can type it in themselves rather then pay for development.

I did learn that serveral states were considering a standard format. Believe me that marketing companies are DROOLING over the day when every person has their Multi-Pass type card.

Very interesting to see the dollar amounts though. There should be a column for that on the 1040's. :)

BTW, to the person who mentioned a use for cue-cat - I have about 50 of them and they don't work that great. They are about 5 bucks on ebay, or free if you take the left overs from your local radio shacks.

Hey, you're lucky

[MikeXpop]

Mine decodes to "Buy more Ovaltine"

Military Records -- "Jackpot"

[akpoff]

I checked out the calculator and found that record values typically range from $0.50 to $10.00. Couple of bonus records:

• Education: $12.00

• Employment: $13.00

• Workers Comp: $18.00

• Bankruptcy: $26.50

Court records bring in some big dough:

• Lawsuits: $2.95

• Sex Offendors: $13.00

• Felonies: $16.00

But the biggest payoff comes for Military Records: $35.00.

When I got out of the military in the early 90s we were strongly encouraged to take our DD-214 (summary of military records) and submit them to the county clerk when we got back home so they'd become public record, that way if we ever lost it we could go look it up. I'm REAL GLAD(tm) I worked with Privacy Act information for my whole career and developed a healthy reluctance to hand out the juicy tidbits contained on my DD-214, e.g., SS#, DOB, education, and of course your whole military career.

Been Out For A While

[CritterNYC]

At some point, some time ago, there was a report about the bars in Boston scanning in the 2D codes on the back of licenses and then using it to send junk mail. The bars in New York City do the same thing. They won't let you in without "scanning" your license to be sure it isn't fake. They place it under a blacklight in a reader and it gets scanned. The club then has a record of every person, their address, description, birth date and drivers license that entered the club. On commercial licenses in some states, your Social Security Number is also encoded, so they'd have that, too.

Remember that, and think twice if the place you're about to enter really needs a complete copy of all the information on your driver's license. I've refused to provide it and taped over the back so noone can scan it quickly before I realize they're trying to. I haven't been refused access to anywhere yet.

Swipe this big bro....

[pair-a-noyd]

I took my DL and dropped it on the concrete, stood on it and twisted it on the concrete to render the bar code un-readable.

Then I took a LARGE degausser and nuked the mag-stripe into absolute oblivion.
And everytime I present my DL to any institution at their request/demand, I degauss it all over again, just to be sure in case they reprogrammed the mag-stripe.

When I go to the bank they have to use the phone and verify my license by reading the numbers over the phone since it is no longer machine readable.
Same thing when Mr. Busy Body policeman pulls me over to see if I have illegal farts in my pants or something. They tell me my license is "not working right" and that I need to have it replaced. I just tell them yeah, I dropped it and it got ran over in the driveway and that I am going to take care of it right away.. Yeah right.

Soo sorry, I don't play their game, I play the game my own way..

Re:But...

[gcaseye6677]

This new law will work exactly the same as the DMCA and importing/outsourcing laws, in that it can only be used to benefit the powerful corporations who bought the regulations and if the average person tries to use it to their advantage, they will be quickly stopped. Or they'll just end up hopelessly buried in legal fees.

Post links to online sources of personal data

[Anonymous Coward]

Let's have a thread here of nothing but links to places you can get personal data for free online. I'll start us off:

1. First name, last name and zip code to birthdate
2. First name, last name, city and state to phone number and address
3. Phone number to name, address, city, state and zip code

Used at Six-Flags theme park

[danwiz]

I was at Six-Flags theme park last summer and they scanned my Connecticut driver's license to determine if I was of legal age for a $4 cup of beer. They trusted the scanner and didn't even bother looking at the birthdate on the front. I now have concerns that my purchase info is in the company's database. If (or when?) this data is sold it could affect my health/life/auto insurance, privacy, etc.

Also, if I were stopped by the police on the way home this data could declare me guilty of DUI before proven innocent. Pretty bad since my girlfriend coaxed the beer away for herself before I could drink it.

I got my barcode on my leg

[MajorDick]

I got a barcode of my DOB and SSN tatooed on my leg, I needed a 'cover up" tat for scar and (Yes I did the unimaginable and had my Ex's name tatooed on me :) Anyhow about 8 years ago I wanted to get the mess on my leg covered up, I thought about all kinds of stuff but needed something fairly solid, Soooo, barcode it was , (my cuecat will even read it :)

Swipe Project needs Accurint

[Animats]

The Swipe Project should sign up for Accurint, so that when you put in your card, you get your whole dossier. That would show people how much is known about them.

Re:shoplifting

[cybermace5]

That depends. Shoplifting becomes a felony at certain levels. For example, in Georgia, the threshold is $300.00, or it's your fourth offense for ANY amount, or you took $100 from three different stores within 7 days. Once you hit felony shoplifting, the minimum sentence is 1 year. The max is ten years. Other states have different rules no doubt, but Georgia's came up first in Google.

Not really a thing to be playing around with. If they catch this guy on tape taking these things, and he racks up to the threshold before they catch and convict him, he's doing time. That'll ruin your life pretty well.

Re:Unamerican

[Plugh]

No, no, no... "All men are created equal" relates to Equality in the eyes of the Law.

What we're saying (and what Libertarians, Objectivists, Capitalists, and generally people of such bent have been saying for decades) is that people are NOT equal in terms of: intelligence, looks, motivation, parental fortune, geographical accident, etc.

Do yourself a favor, it will take only 5 minutes of your time. Carefully read the following blockquote and its link.(shamelessly copied from the Idea Channel)

The Declaration of Independence says, "all men are created equal." [Milton] Friedman explains that this did not mean all persons should or will have equal talents or income. Equal opportunity to better one's self, and the right to personally benefit from the gains realized, are consistent with freedom. Equality of results requires force.

New Career?

[GoodbyeBlueSky1]

Alright, I didn't see any posts on this and I know I was wondering:

I know it'd be damn near impossible to find someone who'd qualify for all of these, but nevertheless the total I came up with was $277.60 for the various types of info. And I'd imagine most of us could get at least $100 (SSN, Cell #, DOB, etc. all add up).

Now, I didn't see this on any of the sites but is this a one-time lifetime-rights-sold deal or maybe ... a monthly gig? Could I supplement my income at the expense of marketing scum?

Join the revolution

No digital sigantures?

[supersat]

I'm surprised these 2D barcodes don't have digital signatures encoded in them to verify the authenticity of the data. I think it'd cut down on the number of fake IDs used.

Many places are now using the 2D barcode to verify your age, but in many jurisdictions (such as Oregon), when you change your address, they issue you a plain STICKER with your new PDF417 barcode printed on it. Anyone with knowledge of the AAMVA standard could create their own barcode sticker, making them any age they want. This is precisely why digital signatures are needed.

When someone asks for your ID, they'd scan it into a device, which would use the issuing jurisdiction's public signature to verify the digital signature on the barcode. Assuming the data is authentic, it'd then display the encoded data on a display. The person checking your ID would compare the data on the display to that printed on the front of your ID. If both match, you can be fairly certain the ID is legit.

Of course, there'd probably have to be a law prohibiting places from storing your personal data without your explicit consent.

If you're curious about the exact data format of the barcodes and magstripes, check out the AAMVA DL/ID standard at http://www.aamva.org/Documents/stdAAMVADLIDStandrd 000630.pdf (2000 edition) or http://www.aamva.org/Documents/stdAAMVADLIDCardSpe cs_092003.pdf (2003 edition). Among other things, it also spells out recommended security measures.

Who is driving that cellphone ?

[andyr]

Folks,

I live in South Africa - one of many countries that use the GSM mobile standard. Here I have a pay-as-you-go SIM card, meaning that I am almost anonymous.

Going on a month business trip to Australia - I plan on doing the same thing - get a pay-as-you-go card, so I take my GSM phone over.

Go to the corner store - "Starter pack please".

"Sorry Sir, we need you to fill out all this information - Gov regulations, sorry."

Name, passport number, other phone numbers, drivers licence, DOB, blah blah.

I fill it all out.

"After they verify the information, your SIM card will be turned on"

Every single piece of info was wrong, yet my phone came on the next day.

Cheers, Andy!

What's so good about debit cards?

[TheLink]

Uh the very idea of using debit card should scare you more.

You're going around to various different entities of differing trustworthiness and paying them using your debit card - i.e. using YOUR MONEY. Anything goes wrong (double charges etc), it's YOUR MONEY that's involved and you're the one running around trying to fix things.

With a credit card you're paying those different entities the Card Issuer's money, NOT yours. When you look at your card statement, if anything is wrong (item didn't arrive, faulty, incorrect charges etc), you complain to the Card Issuer and refuse to pay the problem amount. You just sit easy whilst the Card Issuer settles it with the rest of the parties involved (Merchants, Banks, Cops etc). In many card cloning cases the Card Issuer contacts you before you notice the problems, and issues you a new card.

I really don't understand why so many people prefer using debit cards to credit cards. What are the advantages over credit cards? There are minimal if any privacy advantages. Worse security for the card holders.

The only advantage could be you can't get into debt as easily. But doh, only the stupid or unfortunate get into serious card debt.

Looks like you want attention

[TheLink]

And you'll get it. After a while some of the cops are going to know you by name AND face - "Yah that one with the broken card again". Plus the cops always have to pull your records from the online database for checks - so you might show up in a DB statistic/log somewhere. They can't just go - "Cards ok, looks like just another Joe, move along now".

If you want some semblance of anonymity, you hide in the herd. Or you go move somewhere else totally.

You don't hang around the herd looking and behaving different from everyone else, unless you want to be singled out on a regular basis. If the herd is chewing cud, you don't go around stomping unless you want to attract attention.

The NSA etc don't give a damn about the 80-90%. It's the unusual ones they watch.

The marketeers are interested in the 80%, but if you behave just like everyone else and hide the bits where you are different, you vanish into one of the Common categories.

Re:But...

[Absurd Being]

A family then forms a compilation.

Re:ALL YOUR INFO.... (No Tollroads at All)

[gizmonic]

It is not just EZPass you have to worry about. You have to avoid the toll roads altogether. I was watching one of those crime shows on TLC/Discovery and they were able to prove the suspect had used a toll road because they had the snapshots of his car/license plate from the toll booth. The catcher is, he used the manual lanes and paid the toll in cash. Those cameras don't just catch toll cheats, they "catch" everyone. I don't recall the state, but if one is doing it, then you have to assume they all are (if you're paranoid like me).