AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[combat_boots]

A couple of years after that, I was present when a noted physician literally turned his back on someone rather than treat the person. I had never seen a doctor do that before. Ever.

[butterdezillion]

Congress passed a measure so that the Schiavo case would be looked at all over from the beginning - in fact and in law. And yet they wouldn’t even allow the testimony of the gal who was Michael Schiavo’s girlfriend - testimony that he kept saying that he had no idea what Terri would have wanted because she never said anything about it. They did no new finding of facts in the case. How in the world did they get away with that, when what Congress passed specifically said they were supposed to start afresh?

Another case where we all saw it happening and none of us could do a thing to stop it.

In so many different ways the political powers-that-be are just daring us to fight back.

Somebody said that Donofrio and Pidgeon have been fined for being “frivolous” because they pointed out that the original judge was party to blatant fraud. Good Lord, deliver us, when it is “frivolous” for somebody to point out fraud on the court. Can these judges find any more blatant way to piss on the rule of law and on the Constitution? When a JUDGE says the rule of law is “frivolous” the fat lady is singing and it’s time to turn out the lights on that system. It cannot survive; it is suicidal.

[Chesterbelloc]

To put this another way- if this was an actual scan, then it should be relatively easyt to reproduce the same way. SCAN IT AND TRY IT YOURSELF. I guarantte wou will never produce anything like this.

Would it matter which software you were using to do the scanning of a document?

[noinfringers2]

I’m very interested in seeing all the hoopala that will go on on the 4th of July. My belief is that there will be a lot of lip service to a holiday but little sincere feeling/understanding of the foundation of that day. I expect Obama and wife to play to the public celebration with platitudes and remind us how important Mohammed was to the founding of the USA.

[MHGinTN]

Years ago, when I put America, We Need To Tlak on line for free downloading via Freeper Calpernia's website, I actually got calls from a couple of physicians. One was calling from Kansas and berated me for even suggesting that the Hypocratic Oath was relevant in these modern times. The other went right to the edge of threatening me over my opposition to embryonic stem cell exploitation. He could see only the benefits possible from such exploitation of nascent human life. Interesting that the only ones emotionally vested enough to actually call we progressives wanting me to shut up or change my tune. The manuscript remains free for downloading and has been downloaded more than ten thousadn times as of the date I put it on my blogpage and could no longer count the downloads.

[butterdezillion]

The thing that most people didn’t notice was that the autopsy ruled that Terri was unable to swallow at the point of death BECAUSE OF NON-USE. Her injury never made her need the feeding tube. She needed the feeding tube at the end because her husband had ordered her to be medically neglected and/or abused all those years - because HE HAD DECIDED that if she couldn’t walk she would rather be dead.

She couldn’t feed herself at the end because he had insisted many years before that she not be allowed to feed herself.

The ruling that water is a “medicine” for a person who cannot physically walk to the sink to get a drink of water was the beginning of the end for physically disabled people. Her own family could not bring a wet cloth for her to suck on because that would have been the illegal dispensing of “medicine” .

And I remember reading that a poll was done using the real details of Terri’s situation but without using a name. And the vast majority of people supported the Schindlers in that scenario. But when they mentioned the name of Schiavo the numbers were reversed, which showed that the whole reason that there was public support for Michael Schiavo and the pro-death people was because THE MEDIA HAD LIED ABOUT THE FACTS OF THE CASE.

Geez, was that a foreshadowing of the current death of America because of media lies about Obama’s eligibility?

[MHGinTN]

I learned a lot about the Bush family during that heinous period. There is something desperately wrong with/when a man would commute the death sentence of a capital criminal yet would not step in to ‘pardon’ a brain injured woman being slowly, torurously murdered by a medical system which is being protected by a blind judge who saw only service to his political cronies and issued in reality an exceution warrant on an innocent, helpless woman. But if I live long enough, I am certain the democrat party and globalist will have that be the norm rather than an exception.

[butterdezillion]

There’s a phrase from a Christian song (”Adam, Adam, Where Are You” by Don Francisco) decades ago that REALLY reminds me of that situation and the eligibility situation:

“Rushing helter-skelter to destruction with their fingers in their ears”

I have a friend who is a really good person and normally very reasonable. But the Schiavo situation was too emotional for him because he had been in a situation where he had to talk himself into believing it was OK to let go and allow his wife to die of brain cancer. Because of the emotions involved for him he could never hear the true facts of the Schiavo case. He thought it really was about whether it is OK to allow somebody to die a natural death because you don’t do all the heroic measures to keep them alive.

And the same thing happens with the eligibility issue. At this point we’ve got a lot of evidence of foul play by SO MANY government agencies. And yet people are more brain-dead on this issue than Terri Schiavo ever was. They simply will not allow their minds to absorb the truth, regardless of how blatant it might be. They are “rushing helter-skelter to destruction with their fingers in their ears.”

Unfortunately for them, to destruction is exactly where they are headed, and it may not be long before even they will be forced to see that.

[Brown Deer]

to nonsense BC analysis from a quack...

lol, Yep, this dork's a real expert:
I'm working on a project that requires me to know the mapping of an image map.
The problem is: How do you get the image map from the httpd server?

This is the same idiot that said he analyzed youtube videos in 2007 and declared that bin Laden was dead in 2004!

"I was finally able to reach Neal Krawetz at the BlackHat conference to respond to the questions about the IntelCenter and As-Sahab logos (Krawetz doesn't have a cell phone on him so finding him at the conference took a while). He now says that the error levels on the IntelCenter and As-Sahab logos are different and that the IntelCenter logo was added after the As-Sahab logo. However, in a taped interview I conducted with him after his presentation, he said the logos were the same error levels and that this indicated they were added at the same time. Additionally, after I'd written the first blog entry about his presentation, I asked him to read it to make sure everything was correct. He did so while sitting next to me and said it was all correct. He apologizes now for the error and the confusion it caused," writes Wired blogger Kim Zetter.

[Kevmo]

Your comment #45 was removed.

[Kevmo]

Krawetz is calling you out again

[kjo]

I wrote about this to my Republican congressman two weeks ago...no response.

[little jeremiah]

It was the same info I re-posted but some little tool’s feelings were hurt so I re-posted minus the cruel and harsh cutting language.

[bluecat6]

True dat!

My favorite Chicago political saying...”vote early....and often.” From a true Chicagoan on election day.

Everyone - including the Repukes - are trying to hold on until 2012. But then Acorn will come out of hibernation and start its vote stealing in the critical states.

But the release of this POS LFBC provided a statement that may very well be correct - “we are untouchable!”

[Mr. K]

yes, it would

but if you were using the same software you should be able to produce something similar

I say SIMILAR because it will NEVER BE EXACT.

Whis is anther thing that is odd because there are some parts of Obama’s PDF which are pixel-by-pixel duplicates of each other.

ASTRONOMICALLY impossible odds of that happening by accident.

IT IS A FAKE~!

I would put my hand on the bible in court and swear to it, with my evidence of why. I have done computer imaging for a living and even had software I wrote certified at Fort Huachuka in Arizona for military image format specification alonge with others

[HighlyOpinionated]

He has always officially been Barack Obama.

I stand corrected that he changed his name from BARRY to Barack.

BUT his name has NOT "always" been Obama. There's PROOF that he went to school in Indonesia as Soetoro. And I want DNA proof that's he's even remotely related to Odinga in Kenya and his ILLEGAL Aunt here in the USofA.

HOW ABOUT DOING THIS TO RESOLVE THE SITUATION: Return America to its August 20th, 1959 borders so that Hawaii is no longer a state and Barack Hussein Obama can no longer claim to be a citizen.

[cynwoody]

HOW ABOUT DOING THIS TO RESOLVE THE SITUATION: Return America to its August 20th, 1959 borders so that Hawaii is no longer a state and Barack Hussein Obama can no longer claim to be a citizen.

Wouldn't affect his eligibility. Barry Goldwater was eligible in 1964, and he was born in 1909 in Phoenix, Territory of Arizona.

[john mirse]

What he doesn’t explain is why the name of hospital was changed ... there’s loads of info on the Internet about how he first listed one hospital and then another as his ‘official’ place of birth.

******

KAPIOLANI HOSPITAL: It has been about 4 WEEKS since Obama released his long form birth certificate back on April 27, 2011.

1.Amaziningly during those 4 weeks---and still counting---NOT a single word, sound, or anything has come from Kapiolani Hospital officials to verify that Kapiolani is indeed Obama's birth hospital as it is stated on Obama's long form birth certificate. It is as if hospital officials have suddenly gone into hiding for some unknown reason. Why is that?

2. And I bet another month and another month and so on will pass by and Kapiolani Hosptal officials and Obama still won't allow reporters to examine Obama's mother's hospital records. Why is that?

3. A DEADLY DAGGER THROUGH HEART OF BIRTHER NATION? Kapiolani Hospital officials know that they can drive a deadly dagger into the heart of birther nation if only President Obama would give Kapiolani officials permission to allow reporters to examine Obama's mother's hospital records.

4. But for some unknown reason, Obama won't give Kapiolani Hospital officials permission to release his deceased mother's records of Aug. 4, 1961---Obama's birth date---to reporters. Why is that?

5. My opinion is this: Kapiolani Officials will never release Obama's mother's records to reporters because there are no such records to release, that is, Obama's mother was NEVER a patient at Kapiolani Hospital on Aug. 4, 1961 as is stated on Obama's long form birth certificate.

6. So until Kapiiolani Hospital officials and President Obama allow reporters to examine Obama's mother's records of Aug. 4, 1961, I can only conclude that there are NO records for Obama's mother for Aug. 4, 1961.

7. I may eat my words later, but I say again that until reporters are allowed to examine Obama's mother's records for Aug, 4, 1961, I can only conclude that there are NO Kapiolani records for Obama's mother for Aug. 4, 1961, the day Obama claims as his birth date.

8. And the longer Kapiolani officials and President Obama play hardball when it comes to the release of President Obama's mother's records, the more VOTES President Obama will lose on election day Nov. 2012, because many VOTERS like me won't be able to understand how President Obama, on the one hand, can release his long form birth certificate to great fanfare at a White House press conference on April 27, 2011, but, on the other hand, he continues to play hardball when the public asks President Obama to take the next step and allow Kapiolani Hospital officials to release his deceased mother's records for Aug. 4, 1961, the day President Obama says is his birth date.

9. That is, VOTERS like me are starting to wonder about this: What is President Obams trying to hide that is in his deceased mother's Aug. 4, 1961 Kapiolani Hospital records; that is, what is in those records that is not already on President Obama's long form birth certificate, a certificate that President Obama released to the public with great fanfare at a White House press conference on April 27, 2011? Is it something that could damage and embarrass him politically? Very strange.

[Red Steel]

Krawetz is a leftist loon. He once tried to tie intelligence agencies under President Bush by saying that they doctored or faked Bin Laden’s publicly released videos implying that the vids were mutually beneficial for the terrorists and Bush.

[sometime lurker]

I suppose because I have worked for several bureaucracies, I have seen just how stupid and inept they can be. Non standard formats that vary from department to department, multiple violations of posted P&Ps, P&Ps so badly written that they must be violated just to get work done, etc.