AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[El Sordo]

Troublemaker.

[Tex-Con-Man]

Dr. Neal Krawetz gave Inspector Polarik a humiliating public spanking...it’s not surprising The “Love Doctor” Ron would throw a temper tantrum and blog about it.

[El Sordo]

IIRC, having not checked on this, the de-bossed seal reads in reverse.

The front side of an embossed document would be raised and read normally, but the back side would depressed and read in reverse.

I'd have to go and look at it again though.

[Kleon]

OK, according to his "Years of experience," Dr. Krawetz is 80+ years old!!!

*groan*

[Tex-Con-Man]

Troublemaker.

[butterdezillion]

I don’t know anything about computer stuff so I have no way of knowing whether to believe what this guy says about that or not. But the stuff I do know about, I see problems with what he said. If he’s not right on the stuff I know about, it doesn’t give me a lot of confidence on the stuff I have no way of knowing about.

[little jeremiah]

Check the link at my comment 45. He thinks all the MSM is biased against Democrats.

Ha Ha Ha Ha!

None so blind as he who does not want to see.

[little jeremiah]

Check out what I found out about the unbiased Dr. Professor Krawetz, document expert extraordinaire - comment 45.

[Texas Fossil]

The author claimed Hawaiian officials authenticated the original document.

..

For some reason, TF accused me of “blowing smoke”, even though all I did was correct a bad link.

The bad link you corrected was a link in 2008 that said that HI had authenticated his previous short form COLB. But what they really did was play Legal Weasel Word games. They did not authenticate the new forgery. That is the smoke.

[Texas Fossil]

Mark Niesse wrote an article saying that the only document the HDOH can reveal regarding Obama’s BC is the 1960-64 birth index. And lo and behold, I have just documented that the HDOH has manipulated their 1960-64 birth index (2 different versions of the exact same page) AND that it includes legally non-valid records (the birth names of adopted children, which are legally required to be SEALED, not available to the public).

Bingo, we have a winner! And late filing applications that were never approved.

[Tex-Con-Man]

I posted an article that was based on his actual area of expertise.

I suggest you read his 31 page PDF entitled “Digital Image Analysis and Forensics”, you might learn something relevant to the point.

http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf

His opinion of media bias is not within his claimed area of expertise, and therefore, wouldn't carry any more weight than James Cameron's opinion on global warming.

[Mr. K]

"Hawaii made an exception at the President's request and re-issued a new original"

WTF???? is this true????

If so then this who "fake" -vs- "REAL+ controversy is moot.

If they can just create one NOW and call it an 'original; then all bets are off. They can create anything Obama WANTS IT TO SAY.

And what the hell were THE WAIVERS he had to sign?????

Isn't there any JOURNBLISTS in the USA??

[curiosity]

Anyone will to predict what the history books will say about the birth place of Obama and his superposed documentation 10 years from now? Or even one year?

Hawaii. What's your prediction?

[Tex-Con-Man]

You are clearly within your right to claim the author was blowing smoke regarding the Hawaiian officials.

But you posted to me, and I quote, “You are blowing smoke.”

Since I never mentioned the Hawaiian officials, and simply corrected the non-working link, I'm still not sure how I could be blowing smoke.

[little jeremiah]

I must have upset the delicate sensibilities of someone with my derisive criticism. So this time I will merely post a link and a couple of quotes of the Famous Document Expert Extraordinaire Neal (oops, Dr!!!) Krawetz, and how he expertly determines that the MSM is heavliy biased - against Democrats. He does admit that some are not strictly anti-Democrat. But the fact that he finds so much anti-Dem bias in much of the MSM is pretty darn funny. And Google is equally pro-R as pro-D. Interesting.

http://www.hackerfactor.com/blog/index.php?/archives/404-Clear-and-Present-Danger.html

---

While USA Today has a few pro-Democrat statements, the vast majority of the headlines are swayed toward pro-Republican viewpoints. (I think I got everything; I’m sure someone will let me know if I missed anything.)

---

How about CNN?

Notice how, of the two statements that are not pro-Republican, both focus on anti-Republican and not pro-Democrat statements. There is not a single positive statement about Democrats on CNN. CNN uses slogans like “The Worldwide Leader in News” and “The Best Political Team on Television”. However, CNN is clearly even more biased than USA Today.

While the CSM [Christian Science Monitor] does have more pro-Republican headlines, they have a decent number of unbiased headlines and many pro-Democrat entries. This is very different and much more balanced than the one-sided slant offered by CNN and USA Today.

For clarity, I’m not trying to voice a political opinion here. I am only pointing out that the news, opinions, and views offered by CNN and USA Today are clearly one-sided and aimed toward a specific political agenda.

This same experiment can be done with the New York Times (stories slanted pro-Democrat), Washington Post (pro-Democrat), NPR, AP, and other news outlets. For example, the story about the stock market is covered in USA Today as “Fed aids investors, not savers?” and in CNN as “Stocks are waiting for the Fed”. However, the Washington Post reports it on the front page as “Fed’s moves aim to jump-start economy” — a much more positive spin.

Interestingly, I also looked at Google News. Google News harvests from a variety of media outlets. In my sample (I saved a PDF but couldn’t get Browsershots to create a PNG of it), I found no neutral headlines. However, there were nearly the same number of pro-Republican and pro-Democrat links.

This bias is clearly not coincidental. For example, News Corp. donated $1 million to the Repubican Governor’s Association.

[sometime lurker]

I have documented that the HDOH sent out 2 different documents that they said were copies of a single page from the 1960-64 birth index book in their office

Butter, looking these over, one looks like a direct copy, and the other is an electronic version. Might that have something to do with the header differences?

[Texas Fossil]

I was trying to say that since you defended the authors analysis on the tech side of the newly released COLB (long form) you were endorsing his article.

When I questioned the link relating to the HI Dept. of Health authenticating the COLB and you gave me the working link it was obvious that it did not do what the article said it did. It was not a statement concerning the authenticity of the new COLB. It was a statement concerning the “authentication” (NOT) of the previous forgery. At that time the HI Dept. of Health played the Legal Weasel Word game, and made it appear that they certified the COLB, but in reality if you examined their wording they did not.

No tech analyis can convince me that a document that was simply scanned and .pdfed will have 9 images in the document without being edited. We simply do not know what the HI Dept of Health gave to Obozo’s lawyers or what Zero’s Minions did to that document.

It is a forgery. Occam’s razor, the simplest explanation works. If it had been that easy, it would have been done long ago. The “Won” lies again.

[cynwoody]

The person might just as well have copied the document by hand onto a dinner napkin.

That would be a perfectly acceptable BC, as long as Dr Onaka sees fit to sign it, date it, and seal it, and thereby certify that its facts are a true representation of what Hawaii has on file.

[cynwoody]

THEREFORE, unless he can prove that his name was LEGALLY CHANGED to Obama, he’s going under a FALSE/ASSUMED name ... and that’s probably a FELONY.

Don't waste your time barking up that tree.

He has always officially been Barack Obama. However, sometime between Occidental and Columbia he went from being Barack just call me Barry to Barack.