AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[CanaGuy]

Some comments on all this....

a. Many posters have complained that Obama has not shown his LFBC with the original seal and signatures, like the Nordyke BC's. Well, from what I can see, the Nordyke BC's are certified copies, dated 1966, or 5 years after they were born. What seal and signatures are supposed to be on an "original"? I haven't seen an "original" LFBC from Hawaii, circa 1961; has anyone else?

b. So much of the analysis of Zero's LFBC rests on the "layers" issue. However there doesn't appear to be much attention made to J.S.Applewhite's (AP) "handout" image which they claim is a xerox of the paper LFBC "waved" at the press conference.

Anyone care to shed some light on these?

[Tex-Con-Man]

Your links are about natural born citizen requirements for president.

The information I posted on this thread addressed the "BC is a fraud" conspiracy.

I draw a sizable distinction between the NBC discussion and the birth certificate conspiracy.

NBC is worthy of serious discussion. It will not, however, result in Obama's removal for a myriad of practical and political reasons. And since all sides, for the most part, agree that Obama has a Kenyan father, the validity of the BC isn't contributing to the advancement of that discussion.

I've said it before, serious NBCers need to convince people like the Heritage Foundation or Landmark Legal before it will make it's way to Congress. That's just the way our system works. (So far, neither are on board.)

Layers, kerning, smiling faces and software generated numbers are being used by unscrupulous people, ambivalent to the advancement of conservatism, solely for promoting books and generating webhits.

[Herbster]

I see nothing that appears to be suspicious. /S

[Herbster]

All my scans and PDF’s do this “all the time.”

/S

[bluecat6]

This had been discussed before, numerous times. Stop blaming Kapiolani - they are bound by HIPAA. Blame 0bama for not signing an authorization to disclose.

That is not correct. If the officials at Kapiolani KNOW that fraud has been committed the law does not mandate them be silent. If fact, if the fact is that Obama was not born there and Stanley Ann Dunham/Obama/Soetoro was never a patient then they have a fiduciary and legal responsibility to come forward and be open with the facts. Otherwise, they are part of the fraud. And they should go to jail for long time. Soon, many will if they do not get the record set straight. They really need to get on the record - and soon.

[sometime lurker]

If the officials at Kapiolani KNOW that fraud has been committed the law does not mandate them be silent. If fact, if the fact is that Obama was not born there and Stanley Ann Dunham/Obama/Soetoro was never a patient then they have a fiduciary and legal responsibility to come forward and be open with the facts.

I'm not a lawyer, but this doesn't sound right. It's certainly not mandated by HIPAA. What law applies? Why would there be a fiduciary duty at all? Any lawyers available to comment?

I think Kapiolani has no duty in this case, but I'm willing to be corrected by someone who is familiar with the law. If you are right that this duty exists, it implies that he was born there and that's why they haven't come forward to deny it.

[bluecat6]

Like you said you are not a lawyer. Or apparently a prosecutor.

Staying silent when you are manager or executive of an organization that has a duty to be accurate in its public reporting are complicit to fraud if they KNOWINGLY allow it to happen. Period. Same with the Department of Health. They can not hide behind privacy laws if they KNOW facts that are counter to those presented by public figures. They know it, their attorneys know it. They are all hoping the sands run out before 2012. But until then, every knock on their door at the office or at home could be the investigators who are on the ground in Hawaii coming to haul them in.

I wonder how close the hospital is to the Department of Health. The investigators in Hawaii could save some gas and make two stops on the trip. But they will need some extra handcuffs if they do that!

[sometime lurker]

Are you a lawyer? If so, where is the law that mandates a hospital correct false information put out by patients?

I somehow doubt this, as I can see too many cases where a hospital would have to release HIPAA protected information to counter patients’ false stories. (This celebrity says she went in for an appendectomy. Never mind that she came out with a new nose and bustline...)

As for the handcuffs, I doubt we will ever see that for Kapiolani.

[sometime lurker]

And why did you claim Kapiolani had a fiduciary responsibility? That makes no sense.

[john mirse]

NOT a single word, sound, or anything has come from Kapiolani Hospital officials to verify that Kapiolani is indeed Obama's birth hospital as it is stated on Obama's long form birth certificate. It is as if hospital officials have suddenly gone into hiding for some unknown reason. Why is that?

This had been discussed before, numerous times. Stop blaming Kapiolani - they are bound by HIPAA. Blame 0bama for not signing an authorization to disclose.

*******

1. I totally disagree with you. I still say that we need to put continuous pressure on Kapiolani Hospital officials so that they, in turn, will put pressure on President Obama to allow Kapiolani officials to release as soon as possible Obama's mother's records for Aug. 4, 1961, the date that Obama claims as his birthdate.

2. OBAMA:, HIPAA: I dont' t think that President Obama will ever allow Kapiolani officials to release his mother's Aug. 4, 1961 hospital records under HIPAA if we just concentrate on putting pressure only on him to release his mother's hospital records. He will continue to stonewall as long as he can.

(NOTE: HIPAA, Wikipedia: The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (P.L.104-191) [HIPAA] was enacted by the U.S. Congress in 1996. It was originally sponsored by Sen. Edward Kennedy (D-Mass.) and Sen. Nancy Kassebaum (R-Kan.).

3. However, in my opinion, if we continue to put pressure on KAPIOLANI officials from now until election day Nov. 2012, we might force Kapiolani to eventually plead with Obama to allow Kapiolani to release Obams's mother's hospital records, because Kapiolani officials might get tired of all the bad publicity it is getting because it won't release Obama's mother's records.

4. That is, Kapiolani officials---out of frustration---could contact Obama with a letter somenthing like the following if we continue to put pressure on Kapiolani officials and Obama throughout the 2012 presidential campaign:

"Mr. President:

"We want to respect your deceased mother's right to medical privacy, but we at Kapiolani hospital are deeply distressed when the public continually accuses us of hiding information about you, or when the public starts to believe that your mother was never a patient here because we won't release her hospital records to the public for Aug. 4, 1961.

"So it would help us a great deal and allow us to go on with our hospital work if you would simply allow us as soon as possible to release your mother's records for Aug. 4, 1961, the day you were born here.

"We understand that you may be waiting for the right moment to give us such permission so that you can embarrass your opponents during the 2012 presidential campaign as you did with the sudden release of your long form birth certificate on April 27, 2011, but, to be honest, we are so emotionally drained right now from this long form birth certificate controversy that we don't know how much longer we can hold on emotionally as we wait anxiously for you to tell us to release your mother's records.

"So Mr. President, we wish that you will give us your permission to release your mother's records as soon as possible, because you have already released your long form birth certificate on April 27, 2011.

That is, we see no reason for you to hide behind HIPAA to keep your deceased motther's records from the public because as you know, your mother's hospital records have basically the same information as your long form birth certificate, a certificate that you showed to the world on April 27, 2011. "

5. Again, I say that we keep the pressure on Obama and Kapiolani Hospital officials throughout the 2012 presidential campaign until Obama finally allows Kapiolani Hospital officials to release his mother's records .

6. However, if Kapiolani officials and Obama continue to play hardball during the 2012 presidential campaign and have not released his mother's records by election day Nov. 2012, then I say Obama will lose a lot of VOTES on that election day, because a lot of VOTERS on election day, in my opinion, will wonder why Obama never gave Kapiolani officials permission to release his mother's Aug. 4, 1961 hospital records, even though Obama had already released his detailed long form birth certificate to great fanfare way back on April 27, 2011.

[bluecat6]

Here is the deal.

If Kapiolani has NO RECORDS or their records are material conflict with PUBLICLY RELEASED information from other public officials then the managers, executives and board of directors (who are all accountable legally) are required to correct known incorrect information that they become AWARE OF IT. It is pretty safe to say they are aware of what was released by the White House.

To remain silent IF there was no birth at hospital or IF the information is materially incorrect in a legally meaningful way (different/no father listed) is easily an obstruction of justice charge. Assuming a prosecutor who is doing their job issues that that charge.

The board is responsible without a doubt as are the senior executives and legally managers fall into this category though I would expect line managers to not take the fall for this when it comes to fruition.

[Triple]

“While I can’t rule out that the person scanning the document meant no harm, it is obvious that the person had no conception of how to scan a legal document whose authenticiy was going to be questioned. The person might just as well have copied the document by hand onto a dinner napkin.” - WT

Excellent point.

Was it Tip O’Niel that said the are no coincidences in politics?

In order for this PDF to be on the up-and-up, the Executive Office of the President and the partner from Perkins Coe, that just personally flew to Hawaii to get 2 pieces of paper, had to hand over those papers to an intern level employee, and tell them to, “scan this, spruce it up a bit, and post the resulting PDF on the Whitehouse.gov website. Have it up by 12:00, because the president is speaking about it then.”

That is just not the way things work...

[sometime lurker]

First of all, Kapiolani can only accept 0bama’s release request for his mother’s records if he was either her executor or the designated medical representative. Otherwise, he can’t authorize the release of her records, but he could authorize the release of his own, which would come to the same thing.

Secondly, Kapiolani, or any hospital, has no business pressuring any patient to release their records. If you think Kapiolani is getting bad publicity for following the HIPAA law, just wait until you see the bad publicity they’d get if it came out they were pressuring patients to sign authorizations to disclose.

Pressure 0bama to authorize disclosure (although I don’t think it will get you very far.) Don’t make yourself look foolish by trying to get Kapiolani to break the law or to strongarm patients into disclosure.

[sometime lurker]

If Kapiolani has NO RECORDS or their records are material conflict with PUBLICLY RELEASED information from other public officials then the managers, executives and board of directors (who are all accountable legally) are required to correct known incorrect information that they become AWARE OF IT. It is pretty safe to say they are aware of what was released by the White House. To remain silent IF there was no birth at hospital or IF the information is materially incorrect in a legally meaningful way (different/no father listed) is easily an obstruction of justice charge.

Any lawyers out there? If bluecat6 is correct, anytime there is a published biography or history which has incorrect medical information (the patient didn't die of pneumonia, but of complications of alcoholism; the celebrity claims to be 29, but is in fact 36, etc.) hospitals would be required to correct the information and violate the HIPAA privacy rule. I have worked in and with hospitals since 1976, and I have never heard of this "duty to correct."

Bluecat6, since you haven't responded to my question by acknowledging you're a lawyer, may I assume you are not? In which case you are posting what you WISH was true. Maybe we can find an actual lawyer to respond.

[Kleon]

I do know that the only information physicians are required to disclose in Hawaii is the presence of a disease dangerous to the public health. They would never be called upon to disclose Ann Dunham's records, and they wouldn't do so voluntarily, because they have an ethical obligation to protect her privacy.

[Mr. K]

yeah.. right

you were doing imaging certifications in Arizona???

name one. tell me which room you did the testing. How was it set up? what was the name of the building? who was your CO?

[sometime lurker]

Thanks. It didn’t make sense that a hospital would be asked to violate HIPAA to correct a public record. And with “fiduciary responsibility” thrown in, I have a feeling the poster was substituting his wishes for the actual law.

[El Sordo]

“...the presence of a disease dangerous to the public health.”

Like Obama!

[Brown Deer]

I was there for 12 years. Didn’t have a CO.

[john mirse]

Secondly, Kapiolani, or any hospital, has no business pressuring any patient to release their records. If you think Kapiolani is getting bad publicity for following the HIPAA law, just wait until you see the bad publicity they’d get if it came out they were pressuring patients to sign authorizations to disclose.

*******

Maybe it is just me, but I believe that if President Obama finally allows Kapiolani officials to release his mother's hospital records, and President Obama admits that it was pressure from Kapiolani officials that was an important factor in his decision, I don't think that the majority of VOTERS would be the least bit angry that Kapiiolani officials put such pressure on President Obama.

In fact, I believe that most VOTERS would be very happy that President Obama finally allowed Kapiolani officials to release his mother's records for Aug. 4, 1961, no matter who talked President Obama into doing so.