AFTER BIRTH - LFBC Digital Document Analysis

The Hacker Factor Blog ^ | Thursday, April 28. 2011 | Dr. Neal Krawetz

[Tex-Con-Man]

Preface

Before I begin, I need to point out two critical items for this evaluation. First, digital document analysis can detect manipulation, but it cannot determine whether the original subject is authentic. The authenticity can only be determined by the State of Hawaii, and they already said that it is authentic.

Second, we don't know the history of this PDF document released by the White House. Specifically, we don't know who scanned in the paper document and turned it into a PDF document.

Now, on to the analysis to determine whether there is anything funny with the PDF document released by the White House...

Contents

Let's start with the basics. The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

This document itself appears to be a photocopy of a document that was created on his birth. You can see the left edge bending and having an acceptable drift. It appears to have been scanned onto official thatched paper, and then it was rubber-stamped, signed, and dated with the current date. Again: nothing suspicious.

Moreover, this document contains all of the same information found on the previous form, released nearly three years ago. Neither Obama nor Hawaii have changed their story. Everything is consistent. There is nothing suspicious.

PDF Documents

The image itself was released as a PDF document. As image analysis goes, I hate PDF files. There is only one way to create a BMP (ignoring different versions). PNG and JPEG files have a little variability, but are mainly limited by the encoding library. But with PDF files, anything goes. Each image in a PDF is given an object ID. The image IDs can be stored as anything from vector graphics to bitmaps or embedded JPEGs. Moreover, images can be segmented or made in layers.

The concern about potential tampering comes from the fact that the PDF released by the White House uses a segmented image. The PDF itself contains 9 images: one color JPEG and 8 monochrome bitmaps. These images combine when the PDF document is rendered to display the full image.

The people who think that a segmented image equates to tampering clearly do not know how PDF documents work. The simplest segmentation happens when an alpha channel is used for image transparency. While many of the image formats stored in a PDF file support alpha channels, this isn't how they are usually rendered. Instead, the PDF usually contains two images: one is the image without an alpha channel, and the other is a bitmask containing the alpha channel.

Bitmasks can also be segmented in order to reduce space. For example, if most of the active masked pixels are contained in a 1454x1819 rectangle, but a small section is located outside that rectangle, then the data can be packed more efficiently by segmenting the mask. Although a larger mask could be used, it would really result it a bitmask with significantly more inactive pixels being stored.

An image mask can only store two colors. Usually this is "black" and "white". However, PDFs permit any two colors. It is not uncommon to have one mask store everything "black" on the page, and another store everything that is a specific "gray" color. And remember: by moving these specific, uniform colors into individual bitmasks, it reduces the variation seen in the color JPEG. Less variation means better compression, so the result is a more efficiently compressed document -- in theory. (I added "in theory" because sometimes the full color image would actually be a more efficient storage method. But that's what you get with heuristic encoding systems.)

The birth certificate PDF contains one image (a color JPEG) and eight bitmasks. The main image is PDF object ID 7 0 (ID #7, revision 0) and is 1652x1276. This image looks like the fully rendered image, but it is missing everything that is completely black (mostly black text). The largest bitmask is ID 9 0 and is 1454x1819. When the image is rendered, it is rotated 90-degrees (1819x1454) and masks out the text in the JPEG image. (The image definition actually says "/ImageMask true".) This masking adds the black to the image. (With a PDF mask, one color is ignored and the other identifies where the color should be placed. In this case, the color applied to the mask is black. But don't confuse the black in the mask with the black applied by the mask; one is a color and the other denotes the location to put the color.)



All of these bitmaps are combined in object ID 6 0 to form the full image:

6 0 obj
<< /ProcSet [ /PDF /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 26 0 R /Cs1 11 0 R >> /XObject << /Im7 20 0 R /Im8 22 0 R /Im9 24 0 R /Im2 9 0 R /Im4 14 0 R /Im1 7 0 R /Im6 18 0 R /Im3 12 0 R /Im5 16 0 R >> >>
endobj

This PDF code says that the main image consists of a color space defined by ID 26 0 ("26 0 R" is a reference to "26 0"; this is basically equivalent to a macro inclusion or function call) and ID 11 0. The color space is how the PDF rendering systems knows what color to apply to each mask. The object then includes a bunch of masks with the main image in layers.

Is this uncommon?

The big question is: why use a bitmask to add black to the image, instead of just rendering the image with black? The answer is: I hate PDF documents. There are an infinite number of ways to store an image in a PDF document, and the PDF encoding system used to create the PDF decided to use this method. This isn't even odd or abnormal. It is strictly dependent on the encoding system and encoding parameters. Even choices like "apply color profile", "optimize for printer", "use this paper size", and "export as PDF" vs "Save as PDF" can seriously tweak how the final PDF is generated; it usually isn't as simple as scaling or recoloring.

Another question that I expect to be asked: Why aren't all of the letters in the masks? The masks are only monochrome and act like a stencil. A single color is applied based on the masked regions. The fact that some letters are not in the masks shows that the images were scanned in and not everything dark is actually black. There is a significant amount of black, suggesting color correction or possibly OCR-based letter extraction during the scanning or conversion to PDF. I've seen this in other PDF documents, so this does not strike me as odd.

The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious.

Update 2011-04-30: Conspiracies

The latest round of conspiracies concerning this PDF file seem to repeat the same misinformation:

• False claim #1: The picture was made in layers so it is fake. As I explained above, the layers are masked elements created by the PDF encoder; it is not an indication of tampering. Moreover, the false claims repeatedly claim that the layers are images. This is incorrect: they are image masks, not images. (The difference is a stencil vs a picture created by using the stencil.) And they are masks that combine to form the image, not independent layers. Finally, if you look at the colored JPEG, you can see a white outline where all of the masks are applied -- so the lettering does exist in both the JPEG and masks. The PDF encoder did not take a blank document and add text to it; it took an existing image and separated it out. As I explained above: this was likely done for OCR processing or to improve the compression rate.
  
  
• False claim #2: The PDf was created with an Adobe tool. Some false claims say Photoshop, while others say Adobe Illustrator or some other Adobe program. The truth is seen in the PDF meta data (object IDs 36 0, 33 0, and 1 0): it was created using Apple Preview on a Mac OS X 10.6.7 system. The PDF encoder was "Mac OS X 10.6.7 Quartz PDFContext" (that's the back-end system library on a Mac). No Adobe front-end application was used to create this document. (You can also see this in the way the objects are ordered in the PDF document. Adobe generally writes the object IDs in numerical order. But whatever created this PDF document used prefix numbering and postfix writing to the file. This was not created by an Adobe product.) Statements by the conspirators about how the White House secretary did a poor job with photoshop are lying to you because this government-wage worker never used photoshop.

Finally, birthers make their boldest claims when they hide behind anonymity. Acclaimed image analysis expert "TechDude" was praised by birthers until he was outed as an anonymous fraud who was impersonating the credentials of a real forensics expert. "Polarik" was a huge anonymous expert until he was publicly exposed and shown to not have the credentials that he claimed. (To Ronald J. Polland aka Polarik: Running a dating web site is not the same as having image analysis experience, and why do you claim to work at a university when the university's faculty list does not include you? Perhaps this dating expert is just lonely... according to Facebook, "Ron has 1 friends".)

Already, anonymous experts are saying that the document is fake. Personally, I wouldn't put much stock in claims from any anonymous source. Some people have already started impersonations in order to give their theories more credibility. For example, Colonel Robert F. Cunningham reportedly sent out a heated email stating that he knows that the document is fake because of the layers in the PDF. The problem is, Colonel Cunningham died nearly 3 months ago. Either someone is impersonating the late Colonel for the credentials, or his ghost has email access. Either way, he does not strike me as an expert in digital document forensics.

Update 2011-05-03
Nathan Goulding has a great write-up for making the Quartz PDFContext library generate a PDF with masks -- just like those seen in this birth certificate. In his example, he is not doing anything fancy or special. He just selects one optimization setting.

[cynwoody]

WTF???? is this true????

If so then this who "fake" -vs- "REAL+ controversy is moot.

If they can just create one NOW and call it an 'original; then all bets are off. They can create anything Obama WANTS IT TO SAY.

Take a look at the paragraph you just quoted:

The document released yesterday contains a signature at the bottom because it is a re-release. As I understand it, most states only issue two "original" birth certificates: one goes to the parents, and one goes to the state. If the parents lose their original, then the state can issue a certificate but not another original. (The states won't give up their original, and the phrase "another original" defeats the purpose of "original".) However, Hawaii made an exception at the President's request and re-issued a new original. Make no mistake: this new document is an original, even if it was not created on the day he was born.

It contains two obvious errors, both of which are immaterial to the author's argument.

First, hospitals only issue one original, and it goes to the official agency that records births in the jurisdiction (the Hawaii Department of Health, in this case). Those funny pieces of paper with footprints that they hand out to parents are known as souvenir certificates. They are not official.

Second, Hawaii did not re-issue a new original. As, the author himself points out, the phrase another original defeats the purpose of original. What Hawaii did, at Zero's request, was to make an exception to their apparent current policy of not giving out certified copies of original long form birth certificates.

So, we are talking about a certified copy of an original. The birthers are claiming it's a false copy, based on crapload of pseudo document science, which the author convincingly refutes. And in any case, if it's a false copy, Hawaii still has the original!

[woofie]

I am not un biased or I wouldnt be on FR but as far as most birther stuff I think I can see both sides of the issue..... your point about this guy Krawetz is well taken .....I dont put him in an unbiased category....which makes me doubt the accuracy of this article.
I would love for someone to come up with a tech expert who all sides can agree is un biased

[El Sordo]

I'm a gonna hijack your thread and start a whole new conspiracy theory.

Check out the stamp from the COLB: http://factcheck.org/Images/image/birth_certificate_images/birth_certificate_9.jpg

Note the “A” at the beginning of Alvin T Onaka in this picture.

There is no smiley face.

Here the A is not smiling. Not smiling at all.

Instead the A is actually weeping. I calls it the “Weepy A”.

Obviously shedding tears for the forgery that someone was forced to manufacture. Probably at gunpoint. Probably also with the threat of having their family lowered into a vat of crocodile sharks swimming in acid.

So when Obama went back and told him “Make with a forged long form this time or back into the acid with them!” the forger figured that they were getting away with it so they changed from a sad face to a happy face.

[El Sordo]

Behold Obots!

The Weepy A:

[woofie]

Here is a serious(?) theory that I will put out there.
Obama has a BC from Hawaii ....but there is something on there he wants no one to see. He and his lawyers get the BC folks to sign off on whatever changes they make. (some of this probably has a lot to do with Obamas adoption.)

So the released doc is a combination of stuff it is doctored but the lawyers have all signed off on it making it legal

Once you get lawyers involved its cover your ass time all the time.

[deport]

Thanks.

I've got to the point I'm not really interested in this BC info that much much less the real details of the latest issued documents.

What interest me more is the data on the presented documents what is actually on file with the State of HI? If so I don't care if it's presented on scratch paper, memo graph paper, by computer, scan, photocopy, ink, pencil, charcoal or blood. If the data is legit then that is all that matters. We have two people in the state saying that the data provided is what is in or on file and have their careers and integrity on the line. Until we know that the data provided isn't what is in or on file with the State of HI then this is an exercise in futility as the form it is presented in isn't the most critical aspect, imo. Interesting anyway. Take care.

[Tex-Con-Man]

...and you call me a troublemaker...

[little jeremiah]

Karl Denninger explains clearly why it’s a forgery and he voted for Zero!

I don’t know where the thread on FR is but here’s a link to his site:

Scroll down and there’s a video of KD talking about it:

http://market-ticker.org/akcs-www?post=185119

Here’s his article:

http://market-ticker.org/akcs-www?post=186343&page=1

[little jeremiah]

He may have written more; seems that I’ve seen a longer piece of writing from him. If I see it I’ll try to remember to post a link here.

[El Sordo]

Dunno. I’ve wondered that myself.

It does seem possible.

I am skeptical though that whatever it might or might not be is related to eligibility.

[Eye of Unk]

I think baby Obama was registered in Hawaii (the empty line 23) but his Pink Slip says he was born in Mombasa.

If this was a betting wager in Vegas I would put money on it.

[Mr. K]

His professional opinion:

"The PDF released by the White House shows no sign of digital manipulation or alterations. I see nothing that appears to be suspicious. "

Mine: Bullshit.

He is wrong on every single point and this is a classic example of 'obfuscation'. He uses so many unrelated and convoulted 'explanations' the reader is left confused, unless he is another computer image evpert- like me.

NONE of his arguments make any sense, and he ignores the more damning points completely.

[Mr. K]

So... the Hacker Factor guy is a long-time anti-birther

[BuckeyeTexan]

That’s correct. And the one on Obama’s COLB is exactly the opposite. The text reading forward is depressed. The text reading backward is raised. All of the examples I’ve seen of Hawaiian short-forms have the text reading forward as raised and the text reading backward as depressed.

[Mr. K]

The ‘layers’ do not prove the document is fake, but the layers themselves are intersting.

The fact that they are there at all is odd (in the first place) and none of this convoulted “OCR” or pdf explanations can take that away.

There is NO REASON for this to have layers. If it was a scan of one page.

The layers themselves contain all the proof that it is a fake. They COULD NOT HAVE COME FROM ONE SCAN of an image.

The pixel alignment and color-vs- greyscale are the smoking guns.

To put this another way- if this was an actual scan, then it should be relatively easyt to reproduce the same way. SCAN IT AND TRY IT YOURSELF. I guarantte wou will never produce anything like this.

The forger blew it for Obaba by not reducing the layers to one image. If not for that, all of these things would have been speculation.

THIS DOCUMENT IS MANUFACTURED- not scanned

[Mr. K]

The ‘layers’ do not prove the document is fake, but the layers themselves are intersting.

The fact that they are there at all is odd (in the first place) and none of this convoulted “OCR” or pdf explanations can take that away.

There is NO REASON for this to have layers. If it was a scan of one page.

The layers themselves contain all the proof that it is a fake. They COULD NOT HAVE COME FROM ONE SCAN of an image.

The pixel alignment and color-vs- greyscale are the smoking guns.

To put this another way- if this was an actual scan, then it should be relatively easyt to reproduce the same way. SCAN IT AND TRY IT YOURSELF. I guarantte wou will never produce anything like this.

The forger blew it for Obaba by not reducing the layers to one image. If not for that, all of these things would have been speculation.

THIS DOCUMENT IS MANUFACTURED- not scanned

[BuckeyeTexan]

That’s basically where I am too.

[butterdezillion]

I asked for a copy from their 1960-64 birth index book, sent via e-mail if possible. The first time they sent an electronic scan of the page; the second time they said they could not send it electronically so they sent a photocopy of the page. Their photocopy is the one that had the 1960-64 date heading, even though neither the earlier scan to me nor the photo taken by “Researcher” (reported at Post & Email) had the heading.

They may have sent me an electronic printout rather than a copy of the page from their book as I asked for. That would be about par for them. But they still also sent me a photocopy from a 1960-64 birth index that is different than the 1960-64 birth index book they are showing the public at their office. So they may have THREE different versions.

The question is “Why?” And why do they include legally non-valid records in their list - especially when they also claim that having a name on their list actually means something in a legal sense? Seems to me that having a name on the list could mean that person has their name and birth claim written down on a kleenex somewhere. It means nothing.

So why did they alter their 1960-64 birth index so that it means nothing? I believe the public deserves an answer to that question. An answer backed up by the computer transaction logs, since the folks at the HDOH seem to lie as easily as they breathe.

[El Sordo]

Maybe I need to go look again, but to me it appeared to me to be the opposite of that.

That is the forward reading text is an outie and the reverse reading text is an innie.

The words “STATE” and “HAWAII” can fool the eye, as they are close to being palindromes, especially “HAWAII”.

But “DEPARTMENT” and “HEALTH” give a reference with the ‘DEPA’ and the ‘ALTH’ visible at the top of the photo.

[butterdezillion]

The people at the HDOH have already shown they have no integrity so nothing is on the line.

They have at least 2 different versions of their 1960-64 birth index, and their 1960-64 birth index documentably includes legally non-valid records which show the HDOH to be in violation of the law and in contempt of the court which sealed those non-valid records.

Those people already have so many years in jail if this ever gets legally investigated, that the only thing that could save their hides is for it to never get legally investigated. They will commit any crime to make sure that’s the case. They are the scariest criminals of all right now - the ones who have nothing to lose.

And THAT is what matters to me. Obama is a loser who only gets his power from the criminal government agencies who cover for him. And as long as we have the mafia in control of our government agencies they can put into place whoever they darn well please. They can hide their rules whenever they want. They can lie when convenient. They can refuse to report forgeries as if they can’t reveal content on a BC even though they do it EVERY DAY through their EVVE system.

If the government is gonna be lawless anyway, then why bother making laws? Why bother electing different people so that different laws will be made? If this nation has no rule of law we may as well forget the stupid facade and just say the truth: it’s the law of the jungle, folks. Those with power survive; those without power are enslaved.

That’s what is at stake here, and you better believe it matters.