Friday, August 7, 2015

In-depth analysis: new NYS ID card security features

Every once in a while I'm hit with an obsession that I can't shake off. Last time it was criticality accidents; now it's ID cards. The following statement from the DMV website is the culprit:
The new design, which contains more than 30 security features, places them among the most secure of their kind in the country.
30? Bullshit. Maybe if you count things twice. So like any self-respecting hacker, I decided to put that claim to the test. This post is the result of a few dozen hours' worth of experiments on my ID. I used microscopes, UV lamps, lasers, even improvised a coaxial light machine, and all I've got to say is...

I didn't bother highlighting the obvious ones.

I stand corrected.

I found 10 very subtle features that few seem to know about (on many of them I couldn't find any info online!). Coupled with all the easy ones, it's plausible that there are more than 30 of them.

All my findings are based on an under 21 ID with a heavy topping of educated guesses. My over 21 is on its way from the DMV (with correct name and gender too!) but I won't cover it because it's probably analogous and I already spent way too much time on this.

Obvious features

There are two types of security features: generic, which are identical for all IDs in a batch, and variable, which are unique to each ID. Here are the well-known ones:
  • Generic: microprint galore front and back, aligned UV with miniprint, matte area on back, rainbow coloring, fine lines, anti-copy lines (cause moirĂ© patterns) on the Statue and diagonal bands, vertical format for under 21
  • Variable: raised ID number and DOB, raised signature, laser-embossed photo with microprint underneath, secondary photo with transparent window and microprinted swirly text, DOB shadow in corner, 1D and 2D barcodes on back
All the personalized items seem to be created with a single laser-embossing machine (DMV says it's engraved, but that's misleading because the text is actually raised; see Bubbling effect below). However, this is not much of an issue because the ID is made of polycarbonate.

The card consists of an opaque printed layer (substrate) sandwiched between two transparent ones, thinner on the front. The entire assembly is fused using pressure at high temperature, making it a monolithic block. There is no lamination to peel at corners or get destroyed during bending, and trying to alter the text will ruin the ID (unlike the old version).

Polycarbonate is also the reason why dropping the ID on a hard surface produces a metallic ringing sound just like dropping a CD (it's the same material). Many replicas fail the sound test because the equipment necessary to fuse the polycarbonate is expensive, so they tend to substitute it with other materials such as teslin.

What it doesn't have

During my research I tried several things that didn't work. In no particular order, I couldn't find any:
  • Optically variable ink (shows different colors at different angles)
  • Thermochromatic effects (changes color when hot or cold)
  • Holograms
  • Coaxial light images (though I did discover something else; see Coaxial retrorelief)
  • Intentional printing errors or typos (apart from a missing line on a p in deputy) (Update: see H.)
  • Index of refraction discrepancy from expected value (test was inconclusive)
I did make some breakthroughs however, which were the most fun and rewarding part of it all.

Advanced security features

For precise locations, refer to the first image. Also, take all of this with a grain of salt. Undocumented or unofficial features can be changed at any time.

A. Vertical tracking laser

Most raster laser printing machines print left-right top-bottom (or haphazardly) by default, but in this ID card the text is printed top-bottom, then left-right. This causes unique artifacts on raised digits such as those on the DOB. It also makes the vertical bars (Is, Hs, Es etc.) on the variable data font very slim.

To identify whether an ID is fake or not, look for:
  • Vertical artifacting on raised numbers suggests real
  • Thick vertical bars in Is, Ls, and other letters suggests fake
Particularly investigate "ID", "Class", "Expires", "Height", and "Issued" with the naked eye, and the raised digits with a magnifying glass.

B. Horizontal and vector tracking laser

Not all data is printed top-to-bottom (vertical tracking). Both photos, as well as the signature, are printed left-right (horizontal tracking). The "ID" outline is printed as a vector element, i.e. the laser tracks the outline instead of doing pixel-based printing (Correction: "ID" seems to be a generic element printed before the laser engraving phase).

To identify whether an ID is fake or not, look for:
  • Horizontal tracking on the ID photo or signature is inconclusive, but vertical tracking suggests fake
  • Pixelization in the "ID" graphic suggests fake
Look around the chin, eyes, and nostrils. Investigate horizontal lines in the signature. Look at the diagonal lines in "ID".

C. Bleeding (runoff) effect

The laser embossing material seems to somehow adhere to the fine printed lines, resulting in "ink" runoff along those lines (the areas on top the swirly pattern bulge a bit; it's very subtle). This is almost impossible to see with the naked eye.

To identify whether an ID is fake or not, look for:
  • Neat runoff along the swirly lines suggests real
  • Bleeding outside the swirly lines suggests fake
  • No runoff is inconclusive
Particularly look around the signature and raised text.

D. Bubbling effect

As I mentioned earlier, the features seem laser embossed, not engraved. All variable data text (including headings), as well as the Commissioner's signature, are slightly raised. This can lead to a tiny amount of bubbles trapped right next to the text after the fusion process.

Also note the missing bar on the p in Deputy. I'm not sure whether that's intentional or not. Don't count on it.

To identify whether an ID is fake or not, look for:
  • No bubbling is inconclusive
  • Tiny amount of bubbling only visible when angled properly suggests real
  • Excessive bubbling visible at any angle suggests fake
Look anywhere there's dark but not tactile text. Particularly investigate the Deputy's signature, name and address fields, and organ donor icon. Look at the text from different angles; it's most visible when a bright light reflects off it.

E. Thin lines and pattern break

The two faded waves along the top are made with different techniques: the bottom one features thinner lines, whereas the top one features dotted lines. It's least visible towards the edges of the ID, and the "thin" pattern might in some places exhibit dotted lines and vice-versa.

To identify whether an ID is fake or not, look for:
  • Solid lines at top and dotted lines at bottom suggest fake
  • Solid lines at bottom and dotted lines at top suggest real
  • If ambiguous, test is inconclusive
Particularly look at the lines above and below the first T in State.

F. Smiley face in sun

Maybe not a smiley face, but the sun at the center of the state seal has eyes, a nose, and a mouth, just like in the real one. It's hard to spot because it is white on yellow and there are distracting elements around. If you have good vision and a bright light, you might be able to spot it with the naked eye.

To identify whether an ID is fake or not, look for:
  • No face in the middle of the sun suggests fake

G. Watermark beneath main photo

There is a state seal surrounded by a hexagonal array of stars beneath the large photo. This is extremely hard to spot, and nigh-impossible with the naked eye. With a bright light, look for any "textured" appearance in the background. Use a microscope if possible.

To identify whether an ID is fake or not, look for:
  • Positive proof that the watermark is missing suggests fake
  • Too well-defined watermark suggests fake
Especially look above the head, on the cheeks, and on the forehead.

H. Faint UV markings

Under a UV light, you find a full-front array of flowers, swirly patterns, and "New York State" microprint. However, there seem to be a number of missing flowers. They are not missing, but extremely faint, and whitish in hue instead of blue. They are hard to capture on camera, but should be visible without magnification. (Update: it seems that they are visible under a different wavelength than my UV light has, and they are a different color, most likely green).

To identify whether an ID is fake or not, look for:
  • Too well-defined "missing" flowers suggests fake
  • Complete absence of anything in that spot suggests fake
Look in the following areas: center-right and top-left for flowers, top-right for swirly lines, and the "Y" in "NYC" inside the state outline.

I. Embedded microthreads

Instead of having the swirly lines printed, a real ID has them embedded as actual threads. Some of them are fluorescent which makes them easy to spot, and gives an appearance of thick dots on the edge of the ID when viewed under ultraviolet light.

To identify whether an ID is fake or not, look for:
  • Appearance of embedded threads suggests real
  • No sideways-visible UV-reactive dots suggests fake
Especially look on the long sides of the ID, in the lower half.

J. Coaxial retrorelief

This requires some explanation. During the ID creation process, the embossing causes text to be raised. We've seen this in Bubbling effect. This happens on the back as well as the front; as a result, wherever there's a black bar in the barcode, the opaque substrate is ever so slightly thicker. During the fusion process, because the transparent panel on the front is thinner than the one on the back, the barcode "punches through" and causes an embossed effect on the front. This is invisible under all conditions except when coaxially illuminated. I think this effect is inherent to the ID making process and the use of fused polycarbonate, so it probably won't go away any time soon.

To identify whether an ID is fake or not, look for:
  • Bumpy barcode on the front under coaxial illumination suggests real
  • Lack of bumpiness suggests fake or changed manufacturing
Look in the areas on the front side directly opposite the barcodes.

H. Update: intentional printing error

This is pretty self-explanatory. Look for the reversed N in "NEWYORKSTATE" to the bottom-right of the Statue.

To identify whether an ID is fake or not, look for:
  • Reversed N to the bottom-right of the Statue indicates real or fake with a good template
  • No reversed N suggests fake.


I was wrong. The new NYS ID card appears to be very secure, and the claim of "more than 30 security features" does not seem far-fetched. Some features, such as the embedded microthreads, seem almost impossible to replicate. As in any type of weak-link situation, however, this enhanced security is diminished by the fact that criminals can forge a less-secure ID from a different state, or create a "good-enough" version that appears real under anything but close scrutiny.

On a final note, some of the things that I uncovered don't look intentional at all. I wonder if the DMV knows about them.