AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[butterdezillion]

It doesn’t matter to me what they said because they have already shown they are not credible. I’m giving them the benefit of the doubt by saying their statement isn’t a confirmation that Obama posted what they sent him, based on the fact that they aren’t willing to come right out and say that (which makes no sense if that is really what they were saying) and because what Obama posted does not even meet the legal requirements to be a certified birth certificate.

If I’m wrong and they are really saying that what Obama posted is what they sent, then they need to explain why they didn’t certify the BC according to their rules.

Just a couple of the many reasons not to believe anything they say:

Because they said the same thing about Obama’s COLB, and I have shown that it COULD NOT have been a certified copy.

And because they have documentably lied about official records. I have posted their response to me saying they have no birth record for Virginia Sunahara, as well as the birth index page which shows them as HAVING a birth record for her.

In short, these people are liars so they could well have been claiming that what Obama posted is what they sent. And their statement probably has about an equal likelihood of being true as being not true.

They are also lawless, as I’ve shown on my blog, and a source inside the HDOH has said that a forgery was placed in the HDOH’s records so it could be what they did send; if so, then they are the forgers instead of Obama. And there is probably as high a likelihood that they forged the BC as that Obama’s people forged it.

So they may or may not have said something that may or may not be true, and the BC they gave Obama may or may not have been what Obama posted, and what they sent him may or may not be a forgery, and anything they have that isn’t a forgery may or may not be accurate. And anything they sent him may or may not have followed the rules for legal certification, and regardless of whether they followed the rules or not, they may or may not call it a “certified copy”.

Welcome to the HDOH, where nothing means anything. It all depends on what the meaning of “is” is.

But I think if they were specifically claiming what you think they’re claiming, they wouldn actually come out and confirm that it’s what they are saying.

And if it’s what they sent Obama, then they need to explain why it is not half-handwritten as Fukino said it was.

Basically, what they said makes no difference, because they have lied and contradicted themselves and the law so often that everything that comes from their office is a sick, sick joke.

What difference does it make what either the HDOH or Factcheck have said, when they’ve already been documented as lying on critical issues?