AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[Tex-Con-Man]

There is more at the link, but I've included most of the information directly related to the LFBC.

About Dr. Neal Krawetz...

His basic Bio:
http://www.hackerfactor.com/about.php

His Books, Articles and White Papers:
http://www.hackerfactor.com/publications.php

[BuckeyeTexan]

Ping

[woofie]

Thats not what I heard

[BuckeyeTexan]

I think everyone is clear on my opinion of MissTickly, right? There’s no love lost between us.

Okay. I recently read an article on her blog about the seal on Obama’s short-form COLB as photographed by FactCheck.org. She has a valid point. That seal is debossed not embossed. In other words, it’s completely the opposite of what it should be. WTF? Hawaii uses an embossed seal which creates raised text and images, as evidenced by every other seal we’ve seen and by the law in Hawaii. The seal on his COLB has lowered text and images. She is not mistaken.

Check it out. Let me know if I’m missing something.

[BuckeyeTexan]

FYI to my post #4

[Eye of Unk]

Anyone will to predict what the history books will say about the birth place of Obama and his superposed documentation 10 years from now?

Or even one year?

Lies and deceit cannot be maintained forever, they can repetitiously drone over and over hoping to find fertile minds to grow upon.

Nothing lasts forever, the truth will overcome, the lies will be revealed.

[Texas Fossil]

and they already said that it is authentic.

Why does your link not work?

[BuckeyeTexan]

Ping. This explains the technical reasons for the white text and much more.

[William Tell]

From the article: "The PDF released by the White House shows no sign of digital manipulation or alterations."

What a laughable claim. There may have been no "intentional manipulation" but the trade-offs that resulted in the released PDF are extreme digital manipulations. Typewriters don't create crisp-edged characters of a single color, nor do ink pens.

While I can't rule out that the person scanning the document meant no harm, it is obvious that the person had no conception of how to scan a legal document whose authenticiy was going to be questioned. The person might just as well have copied the document by hand onto a dinner napkin.

[HighlyOpinionated]

What he doesn’t explain is why the name of hospital was changed ... there’s loads of info on the Internet about how he first listed one hospital and then another as his ‘official’ place of birth.

ALSO, I think maybe Obama WAS born in Hawai’i ... BUT not under the name “Barack Hussein Muhammad Obama. I propose that his birth name is Barry Dunham. His ADOPTIVE name [so he could attend school in Indonesia, a requirement that he be Indonesian is also verifiable] is Barry Soetoro.

EVERYONE is looking for the wrong name on a birth certificate and that’s why it cannot be ‘found.’ It’s not lost or misplaced. It’s listed under Soetoro or Dunham and NOT under Obama.

In one of his books, Obama ADMITS to changing his name to the more ‘exotic’ “Obama” because ‘the girls dug it.’

THEREFORE, unless he can prove that his name was LEGALLY CHANGED to Obama, he’s going under a FALSE/ASSUMED name ... and that’s probably a FELONY.

And in the USofA, we don’t want a FELON in the White House. Of course, in Islam, the more felonious, the better.

Would someone in Hawai’i do a bit of Dunham/Soetoro research, please?

[Tex-Con-Man]

I copied the HTML from the source.

This link should work.

http://www.hackerfactor.com/blog/index.php?/archives/235-Bad-Science-How-Not-To-Do-Image-Analysis-Part-II.html

[Elendur]

first, i’m NOT a techie. but i absolutely agree with Tex-Con-Man, that the “layers” and Adobe stuff doesn’t prove anything. In fact, i agree with 99% of the above.

But, until the LFBC came out, i believed Obama was born in Hawaii. I am convinced the document is a fraud, for many reasons not addressed above.

Longbow, Steel Wolf, and even Jeff Winston (all of whom, i respect greatly, even if i disagree with them), have at least acknowledged and addressed these many other, much stronger anomolies. maybe they are correct, about the signatures of different resolutions/ pixel sizes, the words that curve next to words that don’t, etc.
but i foolishly still believe they are clear evidence of fraud.
the stuff above about layers, implying that is all that is wrong, is simply misleading at best.

and the 1 thing i disagree with above, is:
“Finally, birthers make their boldest claims when they hide behind anonymity.”
this is simply not true.
i have read court affidavits, by graphics experts, that
are certainly not anonymous. And other experts, that have posted on the internet, that are not anonymous. (one lady especially impressed me, with her experience.)

...the “expert” that was on Fox immediately after the LFBC was released, was a Canadian trade school graduate, with a previous history of Obama advocacy.

but again, i agree the “layers” prove nothing. but there are MANY more things that strongly suggest the LFBC is a fraud. ESPECIALLY in context. “anti-birthers” knock one or 2 items out, and claim victory. ignoring the clear evidence of coverup and fraud, that Satindoll has documented for years.
...missing page 11 of divorce papers, missing early years of SAD’s passport files, the Obama Sr papers that shows that his AGE on the LFBC is incorrect for 1961, and much more, should raise honest questions from ANY honest American, and make us MORE curious.

...so why is he posting this article about “layers”, that no one cares about now on either side, and making the provable false claim, that there are no experts willing to state their name, when many have done so, including in sworn affidavits under penalty of perjury?

[magna carta]

I am not very capable or lucid on such technical minutiae but in my mind I thought the market-ticker guy and the curvature of letters was the most credible criticism. It became obvious that the layering arguments were not rock solid. Also the stamp-seal stuff is pretty intriguing.

[BuckeyeTexan]

The name change assertion is incorrect. He went by Barry Obama. In his book, he describes when and why he decided to use Barack. The name change wasn’t from Soetoro to Obama. It was from Barry to Barack.

http://www.newsweek.com/2008/03/22/when-barry-became-barack.html

[spookie]

African is not a valid category of race especially during the 1960s. Race categories in Hawaiian classification manual dtd 2006 did not include African either. Thus it had to have been edited well after 1961.

[woofie]

The document released yesterday contains a signature at the bottom because it is a re-release.

This was written in the first days after the release.It doesn't seem very comprehensive.

[Elendur]

... there’s loads of info on the Internet about how he first listed one hospital and then another as his ‘official’ place of birth.
= = =
excellent point! i was recently re-reading an old fluff campaign interview, with OBAMA AND HIS SISTER, that quoted the other hospital as his birthplace.
WHY did Obama and his sister, give the OTHER hospital name to the reporter?
Why can’t Texas Con Man, agree Obama has been lying and covering up, and help us FIND the truth, instead of shooting down old items that don’t matter?

and i absolutely agree with you, about his legal name is Soetoro, and he never legally changed it back to Obama. I have NO doubt, that Obama was legally adopted. His Indonesian school registration, the missing divoce page, missing SAD passport documents, and much mre, all support that.
that deception alone, results in criminal fraud by Obama.
and would at least hurt his reelection in 2012, if more people knew the facts.

(and, his Connecticut SSN IS fraudulent. and also relates to the above. the pieces SUPPORT each other. But anti-birthers won’t look at the forest, because they are too busy cutting down trees. A CT SSN is impossible, since he never lived there!!!

[Tex-Con-Man]

There are, in fact, quite a few birther/freepers who claim that the “layers” are proof the document has been forged.

This simply offers an explanation of how a scan turns into a PDF.

But believers believe.

[BuckeyeTexan]

That’s incorrect. See my home page for details. (You can verify the sample BC on ancestry.com.)

[Elendur]

There are, in fact, quite a few birther/freepers who claim that the “layers” are proof the document has been forged.
This simply offers an explanation of how a scan turns into a PDF.
/// thank you Sir. again, i agree with 99% of what you wrote. and some people believe that “face” is evidence. i don’t. i think the face is simply a graphics artifact, an optical illusion, like the face on the moon.
...and, removing false claims, is important. there only needs to be ONE single clear item, to prove the document is a fraud. which is why i ignore things that are ambiguous like layers, or not clear, like the smiley face.
and we know there are Obama trolls here. (and i am NOT saying you are one!) but some of the people pushing already debunked items, i think are trolls passing misinformation, in an attempt to muddy the waters.
...i thank you, for helping to remove items, that don’t prove anything.