AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[sometime lurker]

I disagree. Rightly or wrongly, since the recent LF release, many voters no longer regard this as an issue. And the idea of a hospital pressuring a patient to authorize disclosure of Protected Health Information WILL scare people. “Why are they involved in this?” “If they pressure him to release that, what will they pressure me to release?”

Most people do not want their health information made public. It’s easy for people to start inventing scenarios when their privacy will be on the line.

[danamco]

make your case

Same as N-S and other FINOs!!!

[Natufian]

“And when he said that the HDOH had already confirmed the genuineness I wondered what he’s been smoking. The HDOH claims they sent 2 certified copies of a long-form BC. They refuse to say whether what they sent is what Obama posted.”

They confirmed it here:

On April 27, 2011 President Barack Obama posted a certified copy of his original Certificate of Live Birth.
http://hawaii.gov/health/vital-records/obama.html

[Beckwith]

The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Well, that settles that. The dhimmicrats in Hawaii would never lie, would they?

[Beckwith]

Barry Goldwater was eligible in 1964, and he was born in 1909 in Phoenix, Territory of Arizona

No. He wasn't eligible.

But your point is moot. Goldwater lost.

[butterdezillion]

They sent him a PDF? Is that what they are saying - that the PDF Obama posted is what they sent Obama? The “2 copies” were PDF files?

[Natufian]

They’re saying that he posted what they sent him and they describe it as a “certified copy of his original Certificate of Live Birth”.

[butterdezillion]

I repeat: Are they saying they sent him the PDF that he posted?

Show me the words where they claim that what he posted is specifically what they sent him. When WND asked them specifically whether what Obama posted was what they had sent him, the HDOH refused to answer the question. If that is what they are saying on their website then they would have no reason to refuse to say it to WND, or refuse to simply say that their website already says they confirmed that Obama posted what they sent him. Given their refusal to state it point-blank to WND, I would say that is NOT what their website is claiming, and that there is a reason their website is not specifically claiming that even though they are giving the APPEARANCE of having said it.

And that by itself tells us all we need to know about the HDOH. They’re preparing themselves to be able to argue over what the meaning of “is” is.

And besides all that, even if what he posted is what they sent him or an unmanipulated scan of what they sent him, it doesn’t meet the legal requirements of the HDOH’s own rules, AND it shows signs of forgery. So the only question at this point is whether the HDOH sent a forged BC, or whether Obama’s people manipulated what the HDOH sent them.

The chain of custody suggests the Obama people did something to do it - as does the crazy, layered PDF with LOTS of anomalies and the refusal to let anybody see the genuine copy - with the possible exception of Savannah Guthrie, who needs to be questioned because her story doesn’t match what was in the White House’s version of the gaggle report for that day. She was also the person who was attacking Donald Trump shortly before, because he was suggesting that Obama was hiding something.

And we should not forget (or fail to comprehend what it means) that the seal that shows on the FActcheck photos could not have been on the paper when it was photographed - which means that the Factcheck people absolutely lied when they said they saw and photographed a COLB with a seal on it. If they could lie so visibly and treasonously, then why couldn’t Savannah Guthrie do the same - especially when her story doesn’t match the White House story and her photo barely shows any sign of a seal at all, in contrast with the Factcheck photos which were supposedly taken of a seal embossed on the BACK?

[Natufian]

Hawaii say quite clearly that:

“On April 27, 2011 President Barack Obama posted a certified copy of his original Certificate of Live Birth.”

They then offer a link to the Whitehouse site showing the certificate.

If you can interpret that as anything other than a clear and unequivocal statement, I’d love to hear what you think it is that they’re saying.

[JoanVarga]

It states everything quite clearly. Now then, how much do you know about the “certification” process?

Certified means an official looked at it and is ready to stake their job and reputation on the line as to its veracity. Is their room for doubt of an official’s veracity?

The whole issue only raises the questions that any court case would: certified by whom; what is the process; who sees the original microfiche; who readies it for imprint onto safety paper; etc.

These are not illogical nor unwarranted questions if there is doubt. As far as we know, only one person is allowed to see the original as captured by the microfiche. Why should that be?

[Natufian]

I think you’ll find that any judicial process would simply take the Hawaii statement at face value. Exactly like judicial processes do all over the country, day in and and day out.

[JoanVarga]

Well, Obama has a “judicial process” in his DOJ that gives out assault rifles to Mexicans.

Face value is divided when it comes from two-faced politicians and their administrative satraps.

[Natufian]

Well, you could be screwed cause you’re wrong or it could be cause the system is ‘in’ on the conspiracy. I reckon it’s the former.

[butterdezillion]

They cited the White House site. According to that site, Obama posted a scan of his certified copy of his original birth certificate. When the HDOH was asked directly whether what Obama posted was what they had sent him, the HDOH refused to say.

IOW, they are pointing people to Obama’s claims. Obama claims that he posted a scan of his certified BC.

It’s a little bit like people saying that Janice Okubo confirmed that Obama posted his genuine COLB, even though the Politifact article closed with her saying that she could not say what the online image represents. The HDOH has steadfastly refused to say whether what was posted is genuine or not.

I can tell you right now - as I have already said - that what Obama posted, even in non-manipulated paper form, would not suffice as a legally-certified birth certificate if presented in court. It does not meet the requirements stated in the HDOH’s rules. And the HDOH would know that immediately, on sight.

[Natufian]

“They cited the White House site. According to that site, Obama posted a scan of his certified copy of his original birth certificate.”

Yep, and Hawaii confirmed that when they said that “On April 27, 2011 President Barack Obama posted a certified copy of his original Certificate of Live Birth.”

[butterdezillion]

We can go round and round about what that statement means, but the fact remains that when WND asked the HDOH to specifically confirm that what Obama posted online was what they had sent to him, they refused to do that. That’s all a person needs to know about what the HDOH has or hasn’t said.

It’s sort of like when Fukino gave her July 2009 statement and then Okubo said that they could not stray AT ALL from the language of the statement or say anything to clarify it. That, right there, should have set the place aflame with red flags. That tells the whole world that they are VERY CAREFULLY parsing the meaning of the word “is”.

These are the same people who told me they have no birth record for Virginia Sunahara, even though her name is listed in their birth index. I trust them as far as I can throw their entire office, and that doesn’t count the throwing up I do when I think of them.

These are also the same people who made a similar statement (something like “President Obama has posted his COLB...”) regarding the COLB supposedly photographed by Factcheck - even though I have shown that the seal on those photos COULD NOT have been on the page when it was photographed, which shows both Factcheck and the HDOH to be the deliberate liars they are.

Anthony Weiner resigned from the US House of Representatives after it was found he had made vague but libelous accusations of a crime (hacking of his Twitter account) in order to hide his personal lewdness. The HDOH has been vaguely libeling “birthers” by deliberately lying in OFFICIAL COMMUNICATIONS. That is documented.

If you’re still believing what they say at this point, then you are emotionally in far worse shape than any of the teeny-boppers Weiner showed his weiner to. Once they saw the lies they agreed that Weiner had seriously violated the public’s trust. You’re being taken for a ride; the evidence of the HDOH’s lies has been shown but unlike the teeny-boppers you are “standing by your man” as if the HDOH has any credibility after the lies and law-breaking they’ve been documented as doing.

I’m sorry, but I can’t help you. You’re not willing to be helped.

[Natufian]

Do you have the wording of the HDOH ‘refusal’ to confirm. Maybe they just refused to make any comments at all thinking, rightly IMO, that their statement was as clear and unambiguous as it needed to be.

If you think they’re carefully parsing their words, what other interpretation would you put on the following statement?

“On April 27, 2011 President Barack Obama posted a certified copy of his original Certificate of Live Birth.” (followed by a link to the WH page showing the image and PDF of the certificate).

[butterdezillion]

The word “yes” is a shorter answer than “no comment”. If they had time to say “no comment” then they could just as easily have said “yes”.

The only reason to not do so is if the statement they already made was NOT making that claim, so a “yes” would be more than they had ever said before.

As I have said repeatedly, I would interpret their statement to mean that they were citing Obama’s claim that he had posted his BC.

God knows that what Obama posted shows no sign of a seal and so could NOT have been a “certified copy”. I am a lowly, unsophisticated, computer-challenged mom and within 2 minutes I could post (and HAVE posted) a photo of a death certificate that shows a seal with great clarity. And it’s in a form that doesn’t allow text to be manipulated too. So any moron could have posted a genuinely-believable “birth certificate” online simply by snapping a pic and uploading it. No lawyers necessary, no fudging around, no waffling on whether or not somebody was able to see a photo, no one photo having faint smudges where a seal would be and another showing nothing at all.

It would be a piece of cake for both Abercrombie and the HDOH to confirm the legitimacy of what Obama posted to a news organization (which is supposed to be able to get a verification of birth claims anyway, but which the HDOH refuses to do). The fact that they won’t do it speaks loudly. (Both entities were asked, according to http://www.wnd.com/?pageId=313665 )

It would be a piece of cake for Obama to post photos of a genuine birth certificate so that there was no question about its genuineness. The fact that he won’t do that speaks volumes. The fact that he instead posted a PDF with text manipulation specifically enabled speaks even more loudly. Even the photocopies he gave to the media were made from a PRINT-OUT rather than from an original certified copy, as evidenced by the thin paper allowing print from the page below it to be picked up in the scan.

Factcheck could have done the same with the COLB. Instead, they CLAIMED they saw a real piece of paper with a real seal on it, but published a photo of a seal that could not have been on the paper when it was photographed because it does not distort the way it would have to distort if the seal was on a page actually photographed in that position. IOW, they lied - which is a serious violation of the Federal General False Statement Act, the crime of forgery, and misprision of felony. And the HDOH then claimed on their website that Obama had posted his COLB - which, if it is a claim that what Obama posted is genuine, is also a lie, a gross violation of the Federal General False Statement Act, and misprision of felony.

It seems clear to me that both Factcheck and the HDOH have committed blatant federal crimes. More blatant, proven, and concrete than anything Rod Blagojevich has done. But the people covering for Factcheck and the HDOH are more crooked than even the Chicago machine. Sad thing. Nobody within our government or media has an ounce of integrity or credibility at this point. They’re as dirty and bloody as the Chicago mafia, and anybody with their eyes open can see it.

It is a waste of time to talk to you. I’ve said this stuff over and over, and it makes no difference to you.

[Natufian]

But they didn’t say:

“On April 27, 2011 President Barack Obama claims to have posted a certified copy of his original Certificate of Live Birth.”

They said:

“On April 27, 2011 President Barack Obama posted a certified copy of his original Certificate of Live Birth.”

For someone who apparently fixates on the minutiae of whatever Onaka, Fukino or the HDOH says, you seem to be losing the need for precision in their words on this one.

Why? Probably because the clarity of the statement goes against what you want to see in the words.

[Natufian]

“God knows that what Obama posted shows no sign of a seal and so could NOT have been a “certified copy”.”

You not being able to discern a seal on the images you’ve looked at does not equate to a DEFINITIVE absence of a seal.

You haven’t touched it, so can’t make that claim. Savannah Guthrie has and she says it does have a seal. She even took a photo of it, here:

http://lockerz.com/s/96540937

BTW, it is certified. Hawaii has formally stated that “On April 27, 2011 President Barack Obama posted a certified copy of his original Certificate of Live Birth.”